無線環境的認證方法及其在電子商務應用之研究

The Study of Authentication Schemes in Wireless Environment and their Applications to E-Commerce

張仕昌(Shih-Chang Chang)

指導教授 ： 張真誠

國立中正大學/工學院/資訊工程學系/博士(2013年)

摘要

隨著網路迅速的發展，有許多生活上的特殊應用出現，像是無線環境應用及電子商務應用。但衍生了一些安全上的問題，例如如何在公開訊息的環境下去保護個人機密與隱私，就是一個重要的問題。而認證方法就是一種公認既有效又安全的解決方案。不過我們發現現有的認證方法，並不完全適用於無線環境及電子商務上。因此，我們研究著重在發展新的適用於無線環境應用與電子商務應用認證方法。
在認證方法方面，我們提出了一種基於生物資訊並使用智慧卡的認證方法。在傳統的密碼系統上，必須要利用通行碼才能達到認證的目的。而高科技的發展，生物資訊是一種極難被偽造的特徵碼，我們利用其特性結合智慧卡提出一種新的認證方法。所提出的方法不需要用到同步機制，就可以抵擋重送攻擊。
接著，我們結合認證方法與無線環境，提出了兩個新協定。在第一個協定中，我們基於在無線感知環境，每個感測器無法進行複雜的運算，但利用感測器來收集訊息時，必須要是合法的使用者，才能進行工作。所以我們針對安全性與效能為主要考量，提出兩者兼備的新協定。在第二個協定中，我們基於橢圓密碼系統發展一個適合在無線通訊的新協定。我們的協定除了可達到高安全性的標準也可以用比較少的運算來完成通訊認證。
而在電子商務上，我們利用認證方法為基礎，提出了一個新的電子支票機制及兩個企業數位權利管理機制。電子支票在電子商務中是一個重要的議題，但是在傳統的方法上，如何決定面額大小是一直在討論的問題。在前人的方法中，都必須要事先決定，這對使用者是非常沒有彈性的。因此，我們提出一個可以讓使用者自行輸入面額電子支票機制。
數位權利管理是一種保護數位產品的機制，而企業數位權利管理是針對企業中的數位資料進行保護。在此研究中，我們提出一個基於赫序函數及互斥或的新機制，來達到高安全性及高效率性。另外，我們設計一個金鑰分發系統適用於企業數位管理。

關鍵字

橢圓曲線密碼系統 ； RSA 密碼系統 ； 電子支票 ； 赫序函數 ； 無線網路 ； 密碼學 ； 智慧卡 ； 互相認證 ； 匿名性 ； 企業數位權利管理 ； 秘密分享

並列摘要

With the rapid development of the Internet, people propose more and more applications in daily life, such as wireless communication and e-commerce. After that, the network security becomes a popular research to protect the personal right and privacy in everywhere. Thus, how to prevent the secure over the communication on Internet form being eavesdropped, forged, or cheated becomes main challenges of designing the mechanisms. In this study, we focus on authentication schemes on wireless environment and applications to e-commerce.
Engineers have proposed many password authentication schemes for remote login systems in past decades. In recent years, the biometrics technology has allowed us to develop a novel method of user authentication using a smart card. In addition, many authentication schemes need a system of synchronized clocks to withstand replay attacks and achieve mutual authentication.
Then, we focus on enhancing the security and efficiency for wireless sensor networks based on the authentication scheme. Therefore, we design a novel user authentication protocol that can perform to withstand the well-known attacks and achieve better efficient than other related works.
After that, we propose a secure and efficient mutual authentication and key agreement protocol based on ECC for wireless communications. Besides, evaluations of our proposed protocol show that our protocol can withstand various known types of attacks, and also satisfies essential functionality requirements. Additionally, efficiency analyses show that our protocol is simple and cost-efficient.
In e-commerce, we use the authentication scheme in wireless environment to develop three protocols. The details are shown as follows.
Electronic check (e-check) is an important component of electronic commerce. Till now, engineers have provided many improvements to enhance the security and functionality of the e-check system. The face value of a check and the identification of a payee, however, have to be determined previously in these improved versions. This results in the inflexibility of the system. In this study, we propose a novel e-check mechanism which allows a payer attaching the face value and the information of a payee to an e-check when dealing with a transaction.
Digital Rights Management (DRM) is a term for access control technologies that are used by hardware manufacturers, publishers, copyright holders, and individuals to limit the use of digital content and devices. Enterprise digital rights management (E-DRM) is the application of DRM technology to prevent illegal users from accessing the confidential data of an enterprise. In this study, we propose an improved secure and efficient E-DRM mechanism based on a one-way hash function and exclusive-or. In addition, we design a group key distribution system for E-DRM based on the concept of a secret-sharing mechanism and the generalized Aryabhata remainder theorem (GART).

並列關鍵字

RSA cryptosystem ； e-check ； hash function ； wireless network ； cryptography ； smart card ； mutual authentication ； anonymity ； elliptic curve cryptosystem ； Enterprise DRM ； secret sharing

參考文獻

[15] Hwang, M.S. and Liu, C.Y. “Authenticated encryption schemes: current status and key issues,” International Journal of Network Security, Vol. 1, No. 2, pp. 61-73, 2005.

[16] Kim, M. and Koc, C.K. “A simple attack on a recently introduced hash-based strong-password authentication scheme,” International Journal of Network Security, Vol. 1, No. 2, pp. 70-80, 2005.

[18] Li, C.T. and Chu, Y.P. “Cryptanalysis of threshold password authentication against guessing attacks in ad hoc networks,” International Journal of Network Security, Vol. 8, No. 2, pp, 166-168, 2009.

[58] Xu, J., Zhu, W.T. and Feng, D.G. “An efficient mutual authentication and key agreement protocol preserving user anonymity in mobile networks,” Computer Communications, Vol. 34, No. 3, pp. 319-325, 2011.

[1] Lamport, L. “Password authentication with insecure communication,” Communications of ACM, Vol. 24, pp. 770-772, 1981.