臺灣博碩士論文加值系統

　　由1995年J.E. Wilkes提出行動通訊系統私密性之需求（通訊資訊之私密性、語音之私密性、資料之私密性、使用者位置之私密性、使用者識別身份之私密性、通訊模式之私密性以及金融傳輸之私密性）至今已將近十年，行動通訊系統也由2G、2.5G發展到3G，但是行動通訊系統在私密性保護方面卻仍然不足，尤其是使用者位置之私密性、使用者識別身份之私密性以及通訊模式之私密性。

　　為了解決這個問題，本研究提出了 "行動通訊系統匿名通訊協定" 以及 "可追蹤的行動通訊系統匿名通訊協定" 。主要運用盲簽章以及公平的盲簽章機制來提供連線的匿名性質，這兩個協定可以和目前主要的行動通訊系統結合，利用其匿名性質來增強行動通訊系統之安全性，特別是使用者位置之私密性、使用者識別身份之私密性以及通訊模式之私密性。

　　除此之外，上述兩個協定還可以用在其它基於行動通訊系統且需要私密性質之應用中。以行動付款系統為例子， "行動通訊系統匿名通訊協定" 可以應用在帳戶制行動付款系統，利用其匿名性質來增強帳戶制行動付款系統之私密性，特別是使用者識別身份之私密性以及交易和付款資訊之私密性，以防止系統內部人員輕易獲取行動付款系統用戶個人之交易以及付款資訊。

It has been nearly ten years, since J.E. Wilkes proposed Privacy Requirements for Mobile Communication System (Privacy of Call Setup Information, Privacy of Speech, Privacy of Data, Privacy of User Location, Privacy of User ID, Privacy of Calling Patterns, and Financial Transactions) in 1995. The Mobile Communication System also advanced from 2G, 2.5G to 3G. However, the Mobile Communication System is still insufficient the privacy protection of, especially the Privacy of User Location, the Privacy of User ID, and the Privacy of Calling Patterns.

In this thesis, the “Anonymous Communication Protocol for Mobile Communication System” and “Traceable Anonymous Communication Protocol for Mobile Communication System” are proposed to solve this problem. The mechanism of Blind Signature and the Fair Blind Signature are used to provide the anonymity of the communication sessions, respectably. These two protocols embedded into current Mobile Communication Systems to enhance the privacy protection, especially the Privacy of User Location, the Privacy of User ID, and the Privacy of Calling Patterns.

In addition, the above two protocols can be used in other applications, which are based on Mobile Communication System and require stronger privacy protection. Take Mobile Payments System for example, the “Anonymous Communication Protocol for Mobile Communication System” can be used in an Account-based Mobile Payment System to enhance the privacy protection, especially the Privacy of User ID, the Privacy of Transaction and the Privacy of Financial Transaction. The internal personnel of the Mobile Communication System are prevented from easily obtaining its clients’ personal information and financial transaction information.

誌謝 ..................................................... I
摘要 .................................................... II
Abstract ................................................ IV
圖目錄 ................................................ VIII

1. 緒論 .................................................. 1
1.1. 行動通訊需求之發展 ............................... 1
1.2. 行動通訊之私密性要求 ............................. 1
1.3. 研究動機 ......................................... 2
1.4. 研究貢獻 ......................................... 3
1.5. 本論文之架構 ..................................... 4
2. 行動通訊系統 .......................................... 5
2.1. 蜂巢式行動通訊系統 ............................... 5
2.2. GSM行動通訊系統 .................................. 6
2.3. EIA/TIA IS-95行動通訊系統 ........................ 8
2.4. WCDMA行動通訊系統 ............................... 10
2.5. 行動通訊系統之比較 .............................. 12
3. 行動通訊系統之私密性 ................................. 14
3.1. 行動通訊系統之私密性需求 ........................ 14
3.2. GSM行動通訊系統之私密性保護機制 ................. 16
3.2.1. GSM行動通訊系統之認證機制 ................ 16
3.2.2. GSM行動通訊系統之加解密機制 .............. 17
3.3. EIA/TIA IS-95行動通訊系統之私密性保護機制 ....... 18
3.3.1. EIA/TIA IS-95行動通訊系統之認證機制 ...... 18
3.3.2. EIA/TIA IS-95行動通訊系統之加解密機制 .... 20
3.4. WCDMA行動通訊系統之私密性保護機制 ............... 21
3.4.1. WCDMA行動通訊系統之認證機制 .............. 21
3.4.2. WCDMA行動通訊系統之加解密機制 ............ 23
3.5. 行動通訊系統私密性保護機制之分析 ................ 23
3.6. 行動通訊系統私密性保護機制之改善 ................ 24
4. 密碼學工具 ........................................... 26
4.1. 盲簽章 .......................................... 26
4.2. Diffie-Hellman金鑰交換協定 ...................... 27
4.3. 多重簽章 ........................................ 28
4.4. 公平的盲簽章 .................................... 30
5. 行動通訊系統匿名通訊協定 ............................. 32
5.1. 取得匿名憑證階段 ................................ 32
5.2. 設定通訊資訊階段 ................................ 34
5.3. 分析與討論 ...................................... 36
5.3.1. 私密性分析 ............................... 36
5.3.2. 匿名性討論 ............................... 37
5.3.3. 帳務問題討論 ............................. 38
6. 可追蹤的行動通訊系統匿名通訊協定 ..................... 39
6.1. 基於多重簽章之公平的盲簽章 ...................... 39
6.2. 取得匿名憑證階段 ................................ 42
6.3. 設定通訊資訊階段 ................................ 45
6.4. 分析與討論 ...................................... 47
6.4.1. 私密性分析 ............................... 47
6.4.2. 匿名性討論 ............................... 49
6.4.3. 帳務問題討論 ............................. 49
7. 行動通訊系統匿名通訊協定之應用 ....................... 51
7.1. 行動付款系統 .................................... 52
7.2. 行動商務安全性之要求 ............................ 53
7.3. 具行動商務安全性之行動付款系統 .................. 54
7.4. 行動通訊系統匿名通訊協定嵌入帳戶制行動付款系統 .. 55
7.4.1. 取得匿名憑證階段 ......................... 55
7.4.2. 設定資訊階段 ............................. 57
7.5. 分析 ............................................ 59
7.6. 討論 ............................................ 60
8. 結論 ................................................. 61

參考文獻 ................................................ 63

[AAZM2004] Wael Adi, Ali Al-Qayedi, Abdulkarim Al Zarooni, and Ali Mabrouk, "Secured Multi-Identity Mobile Infrastructure and Offline Mobile-Assisted Micro-Payment Application", IEEE Wireless Communications and Networking Conference, 2004, pp.879-882.
[AMSW97] Bob Askwith, Madjid Merabti, Qi Shi, and Keith Whiteley, "Achieving User Privacy in Mobile Networks", Proceedings of the 13th Annual Computer Security Applications Conference, pp.108, December 08-12, 1997.
[Boy89] Colin Boyd, "Digital Multisignatures", Cryptography and Coding, 1989.
[Cha82] David Chaum, "Blind Signatures for Untraceable Payments", Proceedings of Crypto, Plenum Press, 1982.
[CK2003] Su-Gil Choi and Kwang-Jo Kim, "Authentication and Payment Protocol Preserving Location Privacy in Mobile IP", IEEE Global Communications Conference, San Francisco, USA, 2003.
[DZ2003] Yuan-Jun Dai and Li-He Zhang, "A Security Payment Scheme of Mobile-eCommerce", International Conference on Communication Technology, China, 2003.
[DH76] Whitfield Diffie and Martin E. Hellman, "New directions in cryptography", Information Theory, IEEE Transactions on, Volume: 22, Issue: 6, Nov 1976 Pages: 644 – 654.
[EP2003] Geoffrey Elliott and Nigel Phillips, "Mobile Commerce and Wireless Computing System", 2003, Addison-Wesley, USA.
[FJP96] Hannes Federrath, Anja Jerichow, and Andreas Pfitzmann, "MIXes in Mobile Communication Systems: Location Management with Privacy", Proc. Workshop on Information Hiding, Cambridge (UK), Univ. of Cambridge, Isaac Newton Institute, 30. 5. -1. 6. 96.
[Gin2002] S Gindraux, "From 2G to 3G: a guide to mobile security", 3G Mobile Communication Technologies, 2002. Third International Conference on (Conf. Publ. No. 489) , 8-10 May 2002 Pages: 308 – 311.
[HHMK99] Lawrence Harte, Morris Hoenig, Daniel McLaughlin, and Roman Kikta, "CDMA IS-95 for Cellular and PCS Technology Applications and Resource Guide", McGraw-Hill, USA, 1999.
[KALNN98] Heikki Kaaranen, Ari Ahtiainen, Lauri Laitinen, Siamak Naghian, and Valtteri Niemi, "UMTS Networks Architecture, Mobility and Services", John Wiley & Sons Ltd., USA, 1998.
[KOK98] Jungjoon Kim, Mina Oh, and Taegun Kim, "Security requirements of next generation wireless communications", Communication Technology Proceedings 1998, ICCT '98, 1998 International Conference on, 22-24 Oct. 1998 Pages:6 pp. vol.1.
[LHY99] Chii-Hwa Lee, Min-Shiang Hwang, and Wei-Pang Yang, "Enhanced privacy and authentication for the global system for mobile communications", Wireless Network pp. 231 - 243, 1999.
[LKK2001] Byung-Rae Lee, Tai-Yun Kim, and Sang-Seung Kang, "Ticket based Authentication and Payment Protocol for Mobile Telecommunications Systems", Pacific Rim International Symposium on Dependable Computing, Seoul, Korea, 2001.
[MP2002] Merritt Maxin and David Pollino, "Wireless Security", McGraw-Hill, INC., 2002.
[Min2003] Robert P. Minch, "Privacy issues in location-aware mobile devices", System Sciences 2004, Proceedings of the 37th Annual Hawaii International Conference on, 5-8 Jan. 2004 Pages: 127 – 136.
[PHE2002] Sang Yun Park, Moon Seog Han, and Young Ik Eom, "An Efficient Authentication Protocol Supporting Privacy in Mobile Computing Environments", IEEE 5th International Conference on High Speed Networks and Multimedia Communications (HSNMC2002), Cheju Island, Jul. 3-5 2002, pp. 332-337.
[RS2000] Gopal Racherla and Debashis Saha, "Security and privacy issues in wireless and mobile computing", Personal Wireless Communications, 2000 IEEE International Conference on , 17-20 Dec. 2000 Pages:509 – 513.
[RWO95] Siegmund M. Redl, Matthias K. Weber, and Malcolm W. Oliphant, "An Introduction to GSM", Artech House Inc., 1995.
[RWO98] Siegmund M. Redl, Matthias K. Weber, and Malcolm W. Oliphant, "GSM and Personal Communications Handbook", Artech House Inc., 1998.
[Rhe98] Man Young Rhee, "CDMA Cellular Mobile Communications and Network Security", Prentice Hall, USA, 1998.
[SM94] Didier Samfat and Refik Molva, "A method providing identity privacy to mobile users during authentication", Mobile Computing Systems and Applications 1994, Proceedings, Workshop on, 8-9 Dec. 1994 Pages: 196 – 199.
[SK2002] S. Schwiderski-Grosche and H. Knospe, "Secure mobile commerce", Electronics and Communication Engineering Journal, 2002, vol.14, pp.228-238.
[SPC95] Markus Stadler, Jean-Marc Piveteau, and Jan Camenisch, "Fair Blind Signatures", Advances in Cryptology EUROCRYPT '95, vol. 921 of Lecture Notes in Computer Science, pp. 209-219, 1995.
[VM97] Vijay Varadharajan and Yi Mu, "Preserving privacy in mobile communications: a hybrid method", Personal Wireless Communications, 1997 IEEE International Conference on, 17-19 Dec. 1997 Pages: 532 – 536.
[Var2002] Upkar Varshney, "Mobile Payments", Computer, 2002, vol.35, pp.120-121.
[Wil95] Joseph E. Wilkes, "Privacy and Authentication Needs of PCS", IEEE Personal Communications, Vol. 2, No. 4, August 1995, pp. 11-15.
[ZC2003] Xiao-Lin Zheng and Deren Chen, "Study of Mobile Payments System", IEEE International Conference on E-Commerce, 2003, pp.24-27.