臺灣博碩士論文加值系統

隨著網路技術的進步，數位內容的散佈變得越來越容易。
內容散佈系統 (content distribution system) 允許原創作者將數位內容上傳至內容散佈者所提供的平台上，而內容散佈者會負責散佈這些數位內容。事實上，原創作者可能會想要販售他們所創作的數位內容，因此需要散佈者的協助來販售商品。舉例來說，一個音樂工作室可以將他們所創作的音樂上傳至iTunes，消費者可以從iTunes 所提供的平台購買音樂。音樂工作室
可以賺取版權費而內容散佈者可賺取散佈費。

然而，目前在內容散佈系統下的付費協定，其交易過程都需要一個可信任的仲裁者(broker)的介入，意即現在多數的付費協定為線上的協定(on-line protocol)。由於可信任的仲裁者頻繁的介入，系統的效率會降低，而且仲裁者的計算能力亦可能成為系統的瓶頸。有鑒於此，本研究提出兩個適用於內容散佈系統的離線付費協定。

第一個付費協定強調交易時的公平性。在交易的過程中，由於沒有仲裁者的介入，消費者可能會擔心在給予電子金錢後，沒有辦法收到相對應的數位內容。同樣的，散佈者(商家)亦會擔心在給予數位內容後，消費者不會給予電子金錢。本研究將並存簽章(concurrent signature)與代理轉密法(Proxy re-encryption)結合並做適當的修改，達成公平的密文/簽章交換
之協定。

本研究所提出的第二個協定為強調效率的小額付費協定。當數位內容的價格相當低廉的時候，內容散佈者所面對的交易量可能非常的龐大，因此付費系統的效率是需要被考量的。本研究將聚集簽章(aggregatesignature)與變色龍雜湊(chameleon hash)與PayWord 結合並做適當的修改，達成一個有效率的小額付費協定。

With the widespread use of the internet, there are more and more e-commerce systems being developed. Digital contents such as audio, video, or articles can be distributed easily, and many digital contents now can be sold on the internet.

Content distribution system (CDS) is a system where the original authors can upload their contents onto a distributor and the distributor will spread the contents.
In fact, some authors may wish to sell their contents, so they may ask the distributor to help them sell their works. For example, a music studio can upload their music
onto iTunes and customers can buy music from iTunes. The original author can earn royalty fees and the distributor can earn distribution fees.

Most existing payment protocols in CDS need the on-line involvement of a trusted broker. Due to the frequent involvement of the trusted broker, it will reduce the
efficiency of the system, and the computational capability of the broker may become the bottleneck of the system.
In our works, we present two off-line payment protocols
in CDS. The first proposed payment protocol will focuse on the fairness issues. A customer (buyer) may not trust the distributor that the distributor will honestly give him the content after he signed a valid signature as a check. On the other hand, the distributor may not trust the customer either. We proposed a payment protocol with fair ciphertext/signature exchange procedure, which garantees that both parties either recieves or not revieve the intended things. We combine the proxy re-encryption scheme and concurrent signature into a fair ciphertext/signature
exchange procedure.
The second proposed payment protocol is a micropayment protocol that will focuse on the efficiency issues. When the price of the content is extremely low, the distributor may deal with a lot of transactions at the same time. The computational cost of bank and distributor should be low enough such that the system can work correctly. We use aggregate signature, chameleon hash, and payword to construct a micropayment protocol in which the verification of signatures is delayed and in batch. Although the verification of signatures is delayed, the second proposed protocol contains a dispute handling procedure, which guarantees that even if the disputes happen, the broker can still handle it.

1 Introduction. . . . . . . . . . . . . . . . . . . . . 1
1.1 Background and Motivation . . . . . . . . . . . . 1
1.2 Overview of the Thesis . . . . . . . . . . . . . 2

2 Content Distribution System . . . . . . . . . . . . . 6
2.1 Introduction to Content Distribution System . . . 6
2.2 A Typical Model of CDS with a Payment Protocol . . 7
2.3 Drawbacks of Existing Payment Protocol in CDS . . .9
2.4 The Requirements of Our Payment Protocol in CDS . 10
2.4.1 Basic Requirements . . . . . . . . . . . . . 10
2.4.2 Additional Requirements . . . . . . . . . . . 11

3 Preliminary . . . . . . . . . . . . . . . . . . . . . 14
3.1 Bilinear Map . . . .. . . . . . . . . . . . . . . 14
3.2 Proxy Re-encryption . . . . . . . . . . . . . . . 15
3.3 Concurrent Signatures . . . . . . . . . . . . . . 16
3.4 PayWord . . . . . . . . . . . . . . . . . . . . . 18
3.5 Aggregate Signature . . . . . . . . . . . . . . . 19
3.6 Chameleon Hash . . . . . . . . . . . . . . . . . 21

4 A Fair Payment Protocol for CDS . . . . . . . . . . . 23
4.1 Overview of the Protocol . . . . . . . . . . . . 23
4.1.1 Requirements . . . . . . . . . . . . . . . . 24
4.2 Protocol Description . . . . . . . . . . . . . . 25
4.2.1 Setup Phase . . . . . . . . . . . . . . . . . 25
4.2.2 Transaction Phase . . . . . . . . . . . . . . 26
4.2.3 Redeem Phase . . . . . . . . . . . . . . . . 27
4.3 Analysis of the Protocol . . . . . . . . . . . . 27

5 An Efficient Payment Protocol for CDS . . . . . . . 31
5.1 Overview of the Protocol . . . . . . . . . . . . 31
5.1.1 Requirements . . . . . . . . . . . . . . . . 32
5.2 Protocol Description . . . . . . . . . . . . . 33
5.2.1 Setup Phase . . . . . . . . . . . . . . . . . 33
5.2.2 Transaction Phase . . . . . . . . . . . . . . 34
5.2.3 Redeem Phase . . . . . . . . . . . . . . . . 35
5.2.4 Dispute handling procedure . . . . . . . . . 37
5.3 Analysis of the Protocol . . . . . . . . . . . . 38

6 Conclusion . . . . . . . . . . . . . . . . . . . . . 43

[1] G. Ateniese, K. Fu, M. Green, and S. Hohenberger. “Improved proxy reencryption schemes with applications to secure distributed storage”. ISOC NDSS’ 2005, pp. 29–43, 2005.
[2] S. Brands, “Untraceable off-line cash in wallet with observers,” CRYPTO’ 1993, LNCS, Vol. 773, pp. 302–318, 1993.
[3] M. Bellare, J.A. Garay, R. Hauser, A. Herzberg, H. Krawczyk, M. Steiner, G. Tsudik, and M. Waidner, “iKP: a family of secure electronic payment protocols”,
Conference on USENIX Workshop on Electronic Commerce’ 1995, Vol.1, pp. 7–7, 1995.
[4] C. Boyd and E. Foo, “Off-line fair payment protocols using convertible signatures”,
ASIACRYPT’ 1998, LNCS, Vol. 1514, pp. 271-285, 1998.
[5] D. Boneh, C. Gentry, B. Lynn, and H. Shacham, “Aggregate and verifiably encrypted signatures from bilinear maps,” EUROCRYPT’ 2003, LNCS, Vol. 2656, pp. 416–432, 2003.
[6] P.S.K.M Barreto, B. Lynn, M.Scott,“Efficient implementation of pairing-based cryptosystems,” Journal of Cryptology, Vol. 17, Num. 4, pp. 321–334, 2004.
[7] B. Cox, J.D. Tygar, and M. Sirbu, “NetBill security and transaction protocol”, Conference on USENIX Workshop on Electronic Commerce’ 1995, Vol. 1, pp.6–6, 1995.
[8] D. Chaum , E. V. Heyst, “Group signature,” EUROCRYPT’ 1991, LNCS, Vol.
547, pp. 257–265, 1991.
[9] D. Chaum and T. Pederson. “Transferred cash grows in size,” EUROCRYPT’1992, LNCS, Vol. 658, pp. 390–407, 1993.
[10] L. Chen, C. Kudla, and K.G. Paterson, “Concurrent signatures”. EUROCRYPT’2004, LNCS, Vol. 3027, pp. 287–305, 2004.
[11] D. Catalano , G. Ruffo, and R. Schifanella, “P2P market place based on aggregate Signatures,” Parallel and Distributed Processing and Applications’ 2005, LNCS, Vol. 3759, pp. 54–63, 2005.
[12] M. K. Franklin and D. Malkhi, “Auditable metering with lightweight security”, Journal of Computer Security, Vol. 6 , Num. 4, pp. 237–255, 1998.
[13] G. Frey, M. Muller, and H. Ruck. “The Tate pairing and the discrete logarithm applied to elliptic curve cryptosystems”, IEEE Transactions on Information
Theory’ 1999, Vol. 45, pp. 1717–1718, 1999.
[14] A. L. Ferrara, M. Green , S. Hohenberger, “Practical short signature batch verification”, CT-RSA’ 2009, LNCS, Vol. 5473, pp. 309–324, 2009.
[15] C. Gentry, Z. Ramzan,“Identity-based aggregate and verifiably encrypted signatures from Bilinear Pairing,” Computational Science and Its Applications’2005, LNCS, Vol. 3483, pp. 1046–1054, 2005.
[16] S. Glassmann, M. Manasse, M. Abadi, P. Gauthier, and P. Sobalvarro, “The millicent protocol for inexpensive electronic commerce,” International World Wide Web Conference’ 1995, pp. 603–618, 1995.
[17] H. Krawczyk and T. Rabin, “Chameleon hashing and signatures”, ISOC NDSS’2000, pp. 143–154, 2000.
[18] Q. Liu, R. Safavi-Naini, and N.P. Sheppard, “Digital rights management for content distribution”, Australasian Information Security Workshop Conference on ACSW Frontiers’ 2003, Vol. 21, pp. 49–58, 2003.
[19] Y. C. Liu, “An optimistic fair peer-to-peer payment system,” ICMSE’ 2007, pp. 228–233, 2007.
[20] S. Miyazaki and K. Sakurai, “A more efficient untraceable ecash system with partially blind signatures based on the discrete logarithm problem,” Financial
Cryptography’ 1998, LNCS, Vol. 1465, pp. 1167–1198, 1998.
[21] S. Micali and R.L. Rivest, “Micropayments revisited,” CT-RSA’ 2002, LNCS, Vol. 2271, pp. 171–203, 2002.
[22] V. Miller. “The Weil pairing, and its efficient calculation”. Journal of Cryptology, Vol. 17, Num. 4, pp. 235–261, 2004.
[23] M. Naor and B. Pinkas, “Secure and efficient metering”, EUROCRYPT’ 1998, LNCS, Vol.1403, pp. 576–590, 1998.
[24] C. Popescu, “An off-line electronic cash system with revokable anonymity,”IEEE Mediterranean Electrotechnical Conference’ 2004, Vol. 2, 2004.
[25] R. L. Rivest and A. Shamir, “Payword and micromint-two simple micropayment schemes”, Security Protocols’ 1997, LNCS Vol. 1189, pp. 69–87, 1997.
[26] R.L. Rivest, “Electronic lottery tickets as micropayments,” Financial Cryptography’
1997, LNCS, Vol. 1318, pp. 307–314, 1997.
[27] M. Sirbu and J.D. Tygar. “NetBill: An internet commerce system optimized for network delivered services”, IEEE Personal Communications, pp. 6–11, 1995.
[28] J. Stern and S. Vaudenay, “SVP: A flexible micropayment scheme,” Financial Cryptography’ 1997, LNCS, Vol. 1318, pp. 161–171, 1997.
[29] N. van Someren, A. Odlyzko, R. Rivest, T. Jones, D. Goldie-Scot, “Does anyone really need micropayments?,” Financial Cryptography’ 2003, LNCS, Vol. 2742, pp. 69–76, 2003.
[30] K. Wei, Y.F. Chen, A. J. Smith, and B. Vo, “WhoPay: A scalable and anonymous payment system for peer-to-peer environments,” IEEE International Conference on Distributed Computing Systems’ 2006, pp. 13–22, 2006.
[31] B. Yang and H. Garcia-Molina, “PPay: Micropayments for peer-to-peer systems,”ACM Conference on Computer and Communications Security’ 2003, pp. 300–310, 2003.
[32] S.M. Yen, C.N. Chen, H.C. Lin, J.M. Wu, and C.T. Lin, “Improved probabilistic micropayment scheme,”International Workshop on Information Security
Applications’ 2002, Journal of Computers, Vol. 18, pp. 175–186, 2008.
[33] J. Zou, T. Si, L. Huang, and Y. Dai, “A new micro-payment protocol based on P2P networks,” IEEE International Conference on E-Business Engineering’
2005, pp. 449–455, 2005.
[34] MasterCard and VISA Corporations, Secure Electronic Transaction (SET) Specification – Book3: Formal protocol definition version 1.0, May 1997, http://www.setco.org
[35] iTunes, http://www.apple.com/itunes/
[36] Steam, http://store.steampowered.com/
[37] Youtube, http://www.youtube.com/