臺灣博碩士論文加值系統

隨著手持行動裝置，例如筆記型電腦、智慧型手機等，使用已越來越普遍，透過手持行動裝置進行購物消費的行為的使用者也逐漸變多。有別於傳統的實體付款模式(如現金、信用卡等)，使用手持裝置進行購物消費需要達到快速付款及確保付款的安全性。由於一般手持行動裝置記憶空間與運算能力有限，因此安全設計上需要注重輕量的特性，另外，付款過程中其隱私需要保護，避免將資料洩漏給惡意的攻擊者。
本論文利用基於授權之認證以及群簽章的技術提出兩種關於具匿名漫遊付款系統。在2010年Youn 及 Lim學者提出基於授權的認證機制，並提供不可連結性以保護使用者的位置隱私，然而，Youn 及 Lim學者所提出的方法無法抵禦阻斷服務(DoS, Denial of Service ) 攻擊。本論文提出一個漫遊付款系統，其結合PayWord和基於授權的認證方法。我們提出的協定能夠抵擋在認證階段阻斷服務攻擊的問題，並且利用雜湊函數鏈的技術有效降低運算成本。
第二個匿名漫遊付款系統之設計藉由整合PayWord和群簽章(Group Signature) 使之具備低通訊量之優勢。此方法來自Yang 等學者以及 He 等學者所提出的隱私保護的匿名認證機制所啟發。此外，我們提出的系統已經提供快速漫遊認證的方式來執行輕量運算的付款並且能支援多商家的運作架構。

As the mobile devices, such as notebooks and smart phones are used everywhere, more and more consumers shop on-line by using them. Unlike the traditional payment methods (e.g., cash, credit cards, etc.), performing payment by the mobile device needs being fast and ensuring of safety. Due to the limitation in the memory and computational ability, the security design for the mobile device must focus on the lightweight property. Moreover, the payment privacy needs to be preserved to avoid leaking information to the malicious entities.
This thesis brings up two kinds anonymous roaming payment systems by using delegation-based authentication and group signatures. In 2010, Youn and Lim proposed a delegation-based authentication to provide a nice property of unlinkability to fully protect user’s location privacy. Nevertheless, Youn and Lim’s protocol cannot defeat the Denial of Service (DoS) attack. We proposed a roaming payment system for mobile environment combing the concepts of PayWord and delegation-based authentication. The proposed protocol can solve the DoS attack in authentication stage, and effectively reduce the computational cost by using hash chains for payments.
The second approach for the anonymous roaming payment system is designed through the integration of the PayWord scheme and group signature scheme to have an advantage in low cost communications. It is inspired by Yang et al.’s and He et al.’s privacy-preserving roaming authentication protocols. Further, the fast authentication in roaming has been provided in our proposed system to perform lightweight payments and support multiple vendor architecture.

中文摘要.................................................i
ABSTRACT................................................ii
致謝....................................................iv
CONTENTS................................................vi
LIST OF FIGURES.........................................viii
LIST OF TABLES..........................................ix
Chapter 1. Introduction.................................1
1.1 Overview............................................1
1.2 Motivation..........................................2
1.3 Security Issues for Roaming Payment Schemes.........3
1.4 Organization of This Thesis.........................4
Chapter 2. Related Works................................6
2.1 Roaming Authentication..............................6
2.1.1 Review of Previous Roaming Authentication Schemes.7
2.1.2 Review of Roaming Authentication Constructed by Delegation-Based Authentication Schemes.................9
2.1.3 Review of Roaming Authentication Constructed by Group Signatures..............................................12
2.2 Roaming Payment Protocols...........................14
2.2.1 Micropayment Tools................................15
2.2.1.1 One-way Hash Chain..............................15
2.2.1.2 Unbalanced One-Way Binary Tree..................16
Chapter 3. Efficient Delegation-Based Roaming Payment Protocol Against Denial of Service Attacks..............18
3.1 Overview of System Design...........................18
3.2 System Construction Details.........................19
3.2.1 Initial Phase.....................................19
3.2.2 Registration Phase................................20
3.2.3 Authentication Phase..............................21
3.2.4 Roaming Payment Phase.............................24
3.3 Security Analysis and Discussions...................25
Chapter 4. Anonymous Roaming Payment System with Low Communication Cost by Using Group Signature.............28
4.1 Overview of System Design...........................29
4.2 System Construction Details.........................29
4.2.1 Authentication Phase..............................29
4.2.2 Roaming Payment Phase.............................31
4.3 Security Analysis and Discussions...................33
Chapter 5. Conclusions and Future Work..................36
References..............................................37

[1]S. Brands, “Untraceable Off-Line Cash in Wallet with Observers,” Conference on Advances in Cryptology- CRYPTO '93, vol. 773 , pp.302 – 318, 1994.

[2]D. Chaum and E. van Heyst, “Group Signatures,” Advances in Cryptology EUROCRYPT ’91, Lecture Notes in Computer Science, pp. 257 – 265, 1991.

[3]C. C. Chang, C. Y. Lee, and Y. C. Chiu, “Enhanced Authentication Scheme with Anonymity for Roaming Service in Global Mobility Networks,” Computer Communications, vol. 32, no. 4, pp. 611 – 618, Mar. 2009.

[4]Z. Eslami and M. Talebi, “A New Untraceable Off-line Electronic Cash System,” Electronic Commerce Research and Applications, vol. 10, no. 1, pp. 59 – 66, Jan.–Feb. 2011.

[5]D. He, J. Bu, S. Chan, C. Chen, and M. Yin, “Privacy-Preserving Universal Authentication Protocol for Wireless Communications,” IEEE Transactions on Wireless Communications, vol. 10, no. 2, pp. 431 – 436, Feb. 2011.

[6]Z. Huang and K. F. Chen, “Electronic Payment in Mobile Environment,” in Proceedings of the 13th International Workshop on Database and Expert Systems Applications, France, pp. 413 – 417, 2002.

[7]K. F. Hwang and C.C. Chang, “A Self-Encryption Mechanism for Authentication of Roaming and Teleconference Services” IEEE Transactions on Wireless Communications, vol. 2, no. 2, pp. 400 – 407, Mar. 2003.

[8]D. He, S. Chan, C. Chen, J. Bu, and R. Fan, “Design and Validation of an Efficient Authentication Scheme with Anonymity for Roaming Service in Global Mobility Networks,” Wireless Personal Communications, vol. 61, no. 2, pp. 465 – 476, 2011.

[9]D. He, M. Ma, Y. Zhang, C. Chen, and J. Bu, “A Strong User Authentication Scheme with Smart Cards for Wireless Communications,” Computer Communications, vol. 34, no. 3, pp. 367 – 374, Mar. 2011.

[10]R. J. Hwang, S. H. Shiau, and D. F. Jan, “A New Mobile Payment Scheme for Roaming Services,” Electronic Commerce Research and Applications, vol. 6, no. 2, pp. 184 – 191, 2007.

[11]J. T. Isaac, J. S. Camara, S. Zeadally, and J. T. Marquez, “A Secure Vehicle-to-Roadside Communication Payment Protocol in Vehicular Ad Hoc Networks,” Computer Communications, vol. 31, no. 10, pp. 2478 – 2484, Jun. 2008.

[12]Y. Jiang and C. Lin, “Mutual Authentication and Key Exchange Protocols for Roaming Services in Wireless Mobile Networks,” IEEE Transaction on Wireless Communications, vol. 5, no. 9, pp. 2569 – 2577, Sept. 2006.

[13]L. Lamport, “Password Authentication with Insecure Communication,” Communications of The ACM, vol. 24, no. 11, pp. 770 – 772, Nov. 1981.

[14]P. Lin, H. Y. Chen, Y. Fang, J. Y. Jeng, and F. S. Lu, “A Secure Mobile Electronic Payment Architecture Platform for Wireless Mobile Networks,” IEEE Transaction on Wireless Communications, vol. 7, no. 7, pp. 2705 – 2713, Jul. 2008.

[15]T. F. Lee, S. H. Chang, T. Hwang, and S. K. Chong, “Enhanced Delegation-Based Authentication Protocol for PCSs,” IEEE Transactions on Wireless Communications, vol. 8, no. 5, pp. 2166 – 2171, May 2009.

[16]W. B. Lee and C. K. Yeh, “A New Delegation-Based Authentication Protocol for Use in Portable Communication Systems,” IEEE Transactions on Wireless Communications, vol. 4, no. 1, pp. 57 – 64, Jan. 2005.

[17]H. Mun, K. Han, Y. S. Lee, C. Y. Yeun, and H. H. Choi, “Enhanced Secure Anonymous Authentication Scheme for Roaming Service in Global Mobility Networks,” Mathematical and Computer Modelling, vol. 55, no. 1 – 2, pp. 214 – 222, Jan. 2012.

[18]T. Nakanishi and N. Funabiki, “Verifier-Local Revocation Group Signature Schemes with Backward Unlinkability from Bilinear maps,” in Proceediings ASIACRYPT’05, Lecture Notes In Computer Science, vol. 3788, pp. 533 – 548, 2005.

[19]R. L. Rivest and A. Shamir, “Payword and Micromint: Two Simple Micropayment Schemes,” in Proceedings International Workshop on Security Protocols, Lecture Notes In Computer Science, vol. 1189, pp. 69 – 87, 1997.

[20]S. Yen, L. Ho, and C. Huang, “Internet Micropayment Based on Unbalanced One-Way Binary Tree,” in Proceedings of International Workshop on Cryptographic Techniques and E-Commerce,CrypTEC’99, Hong Kong, pp. 155 – 162, Jul. 1999.

[21]G. Yang, Q. Huang, D. S. Wong, and X. Deng, “Universal Authentication Protocols for Anonymous Wireless Communications,” IEEE Transactions on Wireless Communications, vol. 9, no. 1, pp. 168 – 174, Jan. 2010.

[22]T. Y. Youn and J. Lim, “Improved Delegation-Based Authentication Protocol for Secure Roaming Service with Unlinkability,” IEEE Communications Letters, vol. 14, no. 9, pp. 791 – 793, Sept. 2010.

[23]G. Yang, D. S. Wong, and X. Deng, “Anonymous and Authenticated Key Exchange for Roaming Networks,” IEEE Transactions on Wireless Communications, vol. 6, no. 9, pp. 3461 – 3472, 2007.