[[alternative]]可撤銷匿名之小額電子付款方法

碩士[[abstract]]隨著小額商品與服務的交易的興起，小額付款法因而被提出來。因為商品與服務其價值相當地微薄，因此小額付款法的主要考量是低計算量與低通訊量。在過去提出的小額付款方法中，因成本因素而沒有提供消費者匿名功能。然而匿名功能是保護消費者的個人交易資訊隱私的必要功能。Lin與Tsou分別在2004與2005提出他們的匿名小額付款方法；然而他們的方法所提供的匿名功能各有其缺失。Lin的方法不提供匿名撤銷的功能，無法得知(惡意)消費者的真實身份，因此無法解決交易糾紛。Tsou的方法採用假名來保護消費者的真實身份，然而其假名固定不變，消費者的身份可能經由其消費習慣而被推測出。此外，Tsou的方法一旦撤銷消費者的匿名，消費者必須重新向銀行註冊，此點對消費者甚為不便。另外，Lin與Tsou的方法皆採用先付款方式。先付款方式比後付款方式較容易建立匿名功能。然而，後付款的方式對消費者較為便利，消費者可先購買商品，日後再付出貨款。 本論文提出兩個匿名小額付款方法。第一個方法為先付款，第二個方法為後付款。兩個方法所使用的匿名方式，皆基於隨機地更換智慧卡的公開金鑰觀念，因此攻擊者無法經由追蹤交易行為而推測出消費者的真實身份。我們的方法皆提供匿名撤銷的功能，一旦發生交易糾紛，存在一公正第三者來撤銷消費者的匿名。我們的匿名撤銷皆不會嚴重影響消費者的匿名性，消費者只需更換智慧卡的公開金鑰，即可再次獲得匿名功能。此外，第二個小額付款方法為後付款方式，相信可吸引更多消費者。[[abstract]]Micropayment schemes are proposed for purchasing goods/services with small value. For the small value of goods/services, the low computation and communication cost is the major consideration of micropayment schemes. For the low computational and communicational cost, the earlier proposed micropayment schemes do not take the customer’s anonymity into the consideration. However, the anonymity is an essential function for the privacy of customers’ payment. Lin and Tsou proposed their anonymous micropayment schemes in 2004 and 2005, respectively. However, there are some problems in their schemes. Lin’s scheme does not provide the revoking function of customers’ anonymity. Without revoking (malicious) customers’ anonymity, the disputes among customers, merchants, and banks cannot be settled down. Tsou’s scheme uses the pseudonyms to protect customers’ identities. Using the fixed customer’s pseudonym in Tsou’s scheme, the adversaries can infer customers’ identities by tracing customers’ payments. Besides, after revoking customer’s anonymity in Tsou’s scheme, the customer has to register a new bank account. This is inconvenient for customers. Both Lin’s and Tsou’s schemes are prepaid schemes that are easier to provide anonymity than the postpaid schemes. For customers, postpaid schemes are more convenient than prepaid schemes, since customers can obtain goods/services first and pay the money later. In this thesis, two anonymous micropayment schemes are proposed. One is prepaid and the other is postpaid. Both schemes are based on the concept of randomly changing the smart card’s public keys. Therefore, the adversaries cannot trace the customer’s payments to find the customer’s identity. Both our schemes provide the function of revoking the customer’s anonymity, the disputes are sure to be resolved. Besides, the anonymity revocations in both schemes do not affect the customer’s anonymity. Customers can obtain their anonymity again by only updating their smart cards’ public keys. The second scheme is the postpaid scheme which will be more popular than the prepaid schemes.[[tableofcontents]]Table of Content Chapter 1 Introduction.................................P. 1 Chapter 2 Related Works................................P. 4 2.1 PayWord Scheme..................................P. 4 2.2 Blind Signature Schemes.........................P. 5 Chapter 3 Our Prepaid Micropayment Scheme..............P. 8 3.1 Model of Our Prepaid Micropayment Scheme........P. 8 3.2 Cryptographic Primitives and Notations..........P. 12 3.3 Our Basic Scheme................................P. 13 3.3.1 The Setup Phase.............................P. 14 3.3.2 The Registration Phase......................P. 14 3.3.3 The Key Updating and Commitment Phase.......P. 14 3.3.4 The Payment Phase...........................P. 17 3.3.5 The Deposit Phase...........................P. 18 3.3.6 The Anonymity Revoking Phase................P. 19 3.4 Our Advanced Scheme.............................P. 20 3.4.1 The Key Updating and Commitment Phase.......P. 20 3.4.2 The Payment Phase...........................P. 21 3.4.3 The Deposit Phase...........................P. 21 3.5 Security Analyses...............................P. 23 3.5.1 Double Spending Prevention..................P. 23 3.5.2 Unforgeability..............................P. 23 3.5.3 Anonymity...................................P. 24 3.6 Comparisons and Discussions.....................P. 25 3.6.1 Comparisons of Security Requirements........P. 25 3.6.2 Comparisons of Computational Performance....P. 27 Chapter 4 Our Postpaid Micropayment Scheme............P. 30 4.1 Model of Our Postpaid Micropayment Scheme.......P. 30 4.2 Cryptographic Primitives and Notations..........P. 33 4.3 Our Postpaid Micropayment Scheme................P. 35 4.3.1 The Setup Phase.............................P. 35 4.3.2 The Registration Phase......................P. 35 4.3.3 The Key Updating Phase......................P. 36 4.3.4 The Commitment Phase........................P. 37 4.3.5 The Payment Phase...........................P. 39 4.3.6 The Deposit Phase...........................P. 40 4.3.7 The Anonymity Revoking Phase................P. 42 4.4 Security Analyses...............................P. 43 4.4.1 Double Spending Prevention..................P. 43 4.4.2 Unforgeability..............................P. 43 4.4.3 Anonymity...................................P. 44 4.5 Comparisons and Discussions.....................P. 45 4.5.1 Comparisons of Security Requirements........P. 45 4.5.2 Comparisons of Computational Performance....P. 46 Chapter 5 Conclusions.................................P. 50 References............................................P. 51 List of Tables Table 1 Comparisons of security requirements among various anonymous micropayment schemes. ...………….....…………………………… P. 26 Table 2 Computational Performance of Anonymous Micropayment Schemes....…………....………….....…………………...………….. P. 28 Table 3 Security requirements comparisons among various anonymous micropayment schemes....………….....………….....…………..….. P. 46 Table 4 Computational Performance of anonymous micropayment schemes....…………....………….....…………………....………….. P. 49 List of Figures Fig 1 Okamoto-Schnorr Blind Signature Scheme ...……………………. P. 5 Fig 2 Model of Our Prepaid Micropayment Scheme…………………… P. 9 Fig 3 Model of Our Postpaid Micropayment Scheme………………….. P. 31[[note]]學號: 693192220, 學年度: 9