臺灣博碩士論文加值系統

摘要
在本論文中，我們提出了應用安全電子交易於校園網路電子成績檔案傳送的方法。透過如此安全機制，使得系所、課務組、註冊組及老師皆能安全且方便地傳送課程表及成績單。
為什麼要以安全電子交易協定為基礎呢?簡單地說,因為它是可以進行三方認證,具公正效果且安全性高。
在這方法中，首先系所、課務組、註冊組及老師送訊息前必須先向認證中心註冊來完成身份確認並取得電子證書。然後在學期開始以前，系所送課程表給課務組，課務組先回送給系所課程表證明書，等課務組作業完成之後再送給系所課程時間表、教室編排表、點名簿及授課證明，當系所收到這些電子檔案資料後交給老師。在學期末時，老師送成績單給註冊組，註冊組先回送給老師成績單證明書，之後向課務組請求授權，等授權完成後才確認此份成績單的有效性。
在一般協定中，我們常應用以下的方法來保證資料的私密性、完整性及確認身份。
1.應用訊息加密來保證私密性。
2.應用數位簽署來保證完整性及認證性。
3.應用電子證書來強化認證性。
我們研究的主要結果如下：（1）確保成績單的機密性及隨伴成績單的授課證明之機密性（2）認證中心機制，具公正效果且安全性較高（3）可驗證使用者的合法性（4）確保傳送資料的正確性（5）確保安全系統設計和安全性（6）使用明確的協定與訊息格式，以提供不同軟硬體間互相運作能力。
我們相信本論文的研究結果，對於在如下所述的未來研究領域上將有所助益：（1）擴展校園網路的其他重要資料傳送（2） 使用端點對端點的互相認證以提昇整體效能（3）以電腦系統簡化協定及改善運作速度。。

Abstract
In this thesis, we propose a scheme that applies SET to electronic score files transmission via campus networks. By way of such secure protocols, the electronic lesson table files and electronic score files can be transmitted among the departments, curriculum section, registrar’s section and teachers securely and conveniently.
Why do we design the secure electronic score files transmission via campus networks based on SET? To be brief, because it can proceed authentication of three ends and high security.
In the scheme, at first, the departments, curriculum section, registrar’s section and teachers must register with a CA before they send messages to achieve identity authentication. Then, before the term beginning, the department sends electronic lesson table files to the curriculum section, and the curriculum section sends the references of electronic lesson table files to the department right now via a secure network. After the curriculum section finishes the corresponding processes, it sends the electronic school timetables, classroom tables, roll books, giving lessons proofs to the departments. When the departments receive the files, it sends to the corresponding teachers.
At the end of term, the teacher sends his electronic score files to the registrar’s section, the registrar’s section sends the reference of electronic score files to the teacher right now via a secure network. Then the registrar’s section requests authorization to the curriculum section to assure that the electronic score files is valid.
In the proposed protocols, we apply the following means to ensure confidentiality, integrity of data and authentication of identity.
1.Confidentiality is ensured by the use of
message encryption.
2.Integrity and authentication are ensured by the
use of digital signatures.
3.Authentication is further strengthened by the
use of certificates.
The main results of our study are as follows. (1) It ensures the confidentiality of the electronic score files with electronic giving lessons proof files. (2) The CA possesses just effect and high security. (3) It provides the legitimacy of user’s authentication. (4) It ensures the integrity of all transmitted data. (5) It ensures that the design of mechanisms is secure. (6) The usage of precise protocols and message formats to provide interoperability among software and hardware.
It is believed that the results of our study in this thesis will be much helpful and feasible for the future research as follows.
（1）Expand our results to other important data
transmission via campus networks.
（2）Use the end to end authentication discretely
to promote the overall performance.
（3）Study the possibility to build our results
in a computer system to the effectiveness.

Contents
Abstract…………………………………….………..…I
List of figures……………………………….….. III
List of Tables……………………………………....Ⅴ
Chapter 1. Introduction
1.1 Introduction……………………………………...1
1.2 Main Results…………………………...……..…3
1.3 Organization of The Thesis…………………...6
Chapter 2. Background and Review of SET
2.1 Analyses of Business Requirements…………..7
2.2 Basic Concepts of Cryptography………….….10
2.3 Review of SET……………………………….....28
2.4 The reasons of applying SET to Electronic Score
Files Transmission via Campus Networks…..52
Chapter 3. A Scheme of Appling SET to Electronic Score Files Transmission via
Campus Networks
3.1 Registration Protocols…………………………56
3.2 Secure Electronic Score Files Transmission
Protocols…………………………………….....64
Chapter 4. Conclusions and Future Research…..81
References……………………………………………..82

References〔1〕Mastercard and Visa, Secure Electronic Transaction（SET） Specification Book1：Business Description, Version1.0, May 31, 1997.〔2〕Mastercard and Visa, Secure Electronic Transaction（SET） Specification Book2：Programmer’s Guide, Version1.0, May 31, 1997.〔3〕Mastercard and Visa, Secure Electronic Transaction（SET） Specification Book3：Formal Protocol Definition, Version1.0, May 31, 1997.〔4〕William Stallings, Cryptography and Network Security, Principles and Practice, Second Edition, pp.461, 1999, Alan Apt.〔5〕Shaohua Tang and Weihua Ma, “The Design of HTTP-based Cardholder Registration Software for SET”, Proceedings of the IEEE SET, pp.756- 758, 2000.〔6〕Shaohua Tang and Gang Wei, “Directed User Authentication Schemes”, Proceedings of the 1999 International Workshop on Cryptographic Techniques and E-commerce, Manuel Blum and C H Lee, Eds. Hong Kong, Hong Kong：City University of Hong Kong Press, pp.99-104, 1999.〔7〕Vijay Ahuja, “Building Trust in Electronic Commerce”, Proceedings of the IEEE Electronic Commerce, pp.61-63, 2000.〔8〕MasterCard and Visa, Secure electronic Transaction（SET） Specification Book1：Business Description, Version1.0, pp.6-9, May 31, 1997.〔9〕William Stallings, Cryptography and Network Security, Principles and Practice, Second Edition, pp.462, 1999, Alan Apt.〔10〕William Stallings, Cryptography and Network Security, Principles and Practice, Second Edition, pp.240-244, 1999, Alan Apt.〔11〕賴溪松, 韓亮, 張真誠, 近代密碼學及其應用, 松崗電腦圖書資料股份有限公 司, pp.6-10, 1999.　〔12〕張真誠, 林祝興, 江季翰, 電子商務安全, 松崗電腦圖書資料股份有限公 司,pp4-2~4-5, 2000.〔13〕Thomas O. Wells,“Electronic and Digital Signatures：In Search of a Standard”, Proceedings of the IEEE Electronic Commerce, pp.24-30, 2000.〔14〕中華電信股份有限公司數據通信分公司, GCA簡介, 2001.〔15〕張耀仁, 劉永信, 電子商務系統, 高立圖書有限公司, 2000.〔16〕Shiyong Lu, Scott A. Smolka,“Model Checking the Secure Electronic Transaction（SET）Protocol”, Proceedings of the IEEE SET, 2000.〔17〕Capt James M. Hayes,“Secure In-Band Update of Trusted Certificates”, Proceedings of the Office of INFOSEC Research and Technology, 2000.〔18〕MARVIN A. SIRBU,“Credits and debits on the Internet”, Proceedings of the IEEE Electronic Payments, pp.23-29, 1997.〔19〕賴溪松, 資訊安全通訊, 中華民國資訊安全學會, Vol.7, No.3, June 2001.〔20〕Dominique Bolignano, GIE Dyade, “Towards the Formal Verification of Electronic Commerce Protocols”, Proceedings of the IEEE Electronic Commerce, pp.133-146, 1997.　　〔21〕Heiko Schuldt, Andrei Popovici, Hans-Jorg Schek,“Automatic Generation of Reliable E-Commerce Payment Process”, Proceedings of the IEEE Electronic Commerce, pp.434-441, 2000.〔22〕Radia Perlman, “An Overview of PKI Trust Models”, Proceedings of the IEEE PKI, pp.38-43, 1999.〔23〕M.PaPa, O.Bremer, J.Hale, S.Shenoi, “Formal Analysis of E-Commerce Protocols”, Proceedings of the IEEE Electronic Commerce, pp.19-28, 2001.〔24〕Scott D. Stoller, “A Bound on Attacks on Payment Protocols”, Proceedings of the IEEE SET, pp.61-70, 2001.〔25〕林祝興, 電子商務安全本土化教材大綱編撰成果報告, 教育部顧問室, pp.65- 73, 1999.〔26〕Simson Garfinkel, Euguene H. Spafford, “Cryptography and the Web”, http：//www.w3j.com/7/s3.crypt.wrap.html, 2000.〔27〕Dieter Gollmann, “E-commerce security”, Computing & Control Engineering Journal, pp.115-118, June, 2000.〔28〕Bruce Schneier, “Applied Cryptography”, Second Edition, John Wiley & Sons, Inc, pp.429-459, 1996.〔29〕楊吳泉, 現代密碼學入門與程式設計, 全華科技圖書股份有限公司, 1997.〔30〕張真誠, 電腦密碼學與資訊安全, 松崗電腦圖書資料股份有限公司, 1999.〔31〕William Stallings, Cryptography and Network Security, Principles and Practice, Second Edition, pp.467-472, 1999, Alan Apt.