SSEP安全电子支付模型研究

上海交通大学硕士学位论文SSEP安全电子支付模型研究姓名：邵浩然申请学位级别：硕士专业：计算机系统结构指导教师：马范援200401014SSEP2090SSLSETSETSSLSETSSLSSEPSSEPSSLSETSSEPSSEPSSEPSSEPSSLSETDSA5SSEPSECUREELECTRONICSPAYMENTMODELRESEARCHAbstractSincelastdecade,networktransactionaswellasE-commercehavebecomemoreandmorepervasivearoundtheworldwiththedevelopmentofcomputernetworktechnology.Whilefacilitatingpeople’sdailylifeandprovidingpeoplewithmanycommercialopportunities,therearestillsomechallengesofwhichthesecurityandpracticabilityproblemsarethemostremarkableones.SecureelectronicspaymenthasbeenthecoreprocessofE-commerce.Currently,therearesomeinternationalspecificationsonsecureelectronicspayment.Amongthem,theSSLandSETarethemostpopularones.However,therearesomeproblemswithSSLandSET.ThroughcomparisonbetweenSETandSSL,thisthesisproposesasecureandefficientelectronicspaymentmodelSSEPthattriestocombinemodernencryptiontechnologyandclassicalelectronicspaymentprocess.SSEPisbasedonthesecuresocketlayeranddigital()technology.Itprovidesfundamentalnetworkcommunicationsecuritythroughsecuresocketlayer,andensuresthetransactionsecuritybasedontheintegrationoffine-tunedtransactionprocessanddigital()technology.Thewholetransactionprocesscanbecarriedoutthroughbrowser,whichhasgoodpracticabilityaswellashighsecurity.6Firstly,thefundamentalprinciplesofsecureencryptionisintroduced.WegiveacomprehensivesurveyofSSLandSETmodels,andanalysistheiradvantagesanddisadvantages.Then,thisthesespresentsthepaymentprocessofSSEPanditsmessageflows,thedefinitionofmessagespecificationandmessageprocessingmoduleinSSEP.ThesecurityofSSEPisanalyzedindetail,aswellasitsprivacy.Finally,wedescribetheimplementationofSSEPmodel.KEYWORD:electronicpayment,SSL,SET,DSA2200418311commoditymoneyfiatmoney30ATMPOS(EDI)SSL2SETSSLSSLSETSETSET9675442SSLSETInternet428SSLSET322.1SSL2.1.1SSLSecuritySocketLayerSSL[3,23,25,26,27](Netscape)WebNetscapeIESSL123SSL()ServerClientSSL(TCPTCP)HTTPFTPTELNET1SSLX.509RSARc4-128Rc-128DESDESIDESSSLIS0SSLll4lllSSL2-1SSLFigure2-1SSLArchitectureGraph2.1.2SSLSSL(TCP)SSLSSLSSLDES/TELNETFTPHTTPSSLSSLRefRSARC4RC2IDEADESTCP/IPInternet5SSLSSLSSLSSL23()13276731638310SSLSSLMAC(MessageAuthenticationCode)MACMACCIPHER-CHOICEMD2MD5MAC16MACMACHash[]MACMAC32SSLSSLSSL2.1.3SSLSSL()216Client-helloCSChallenge-datacipher-specsServer-helloCSConnetion-idserver-certificatecipher-specsClient-master-keyCScipher-kindclear-master-keyserver-public-keyclient-finishCSConnection-idclient-write-keyserver-verifyCSChallenge-dataserver-write-keyserver-finishCSSession-idserver-write-key2-1SSLTable2-1SSLMessageStreamnClient-hellonServer-hellonclient-master-key40()master-keymaster-keyclient-write-key(server-read-key)client-read-key(server-write-key)client-write-keyserver-read-keyserver-write-keyclient-read-keynclient-finishclient-write-keyconnection-idnserver-verifyserver-write-keynserver-finishserver-write-keyHELLOHELLOSERVER-HELLO7CLIENT-MASTER-KEYSERVER-VERIFYREQUEST-CERTIFICATESERVER-FINISH2.1.4SSL1SSL(hash)SSL(RSA)2WEBUBLURL()DNSSSL3.08SSL3.03DESTCPTCPTCPACKSSLSSLWEBUBLTELNETSSL3.02.22.2.1()1)2)3)9Schneier[2,14,24,28]1)2)3)4)5)2.2.21988DiffeeNPGMxGx=M(mod)PNaNbMCdMdC(modN)ceCMMeC(modN)dxyx=y2(modN)19761)RSA[1],RonRivestAdiShamirLeonardAdleman102)EIGamall,TEIGamal1985Rabin3)Schnorr,ClausSchnorr4)ESIGN,DavidChaumRSA2.2.31TAKaBKbTAB1)AKaBT2)TKaA3)TAAKbB4)BKbBTA2DiffeeHellman[13]1)A2)AB3)BAAATAA311ABl00BABBABBAAB4A1)2)3)4)51)ASa(m)2)ABBEb(Sa(m))3)BDb(Eb(Sa(m)))Sa(m)4)BAVa(Sa(m))m6(SET)BobA1iceA1iceA1iceA1iceBobA1ice12A1iceBobBob2.3(Hash)[10,11,12]2.3.1h1hM2h1283hMh(M)Hashllxz=h(x),y=Sigk(z)lxy=Sigk(z)z=h(x)xyxlHash[15,16,17]13HashHashHashHashRabinHashMerkleHashN-HashMD4MD5SHA-12.3.2HashHashHashHashM1M2h(M1)=h(M2)HashM1M2(M2!=M1),h(M1)=h(M2)HashHashHashHashHash1Hash2HashHash3HashHashHashHashHashHashHashHashHashMHashHash14KMACMACDESMACMACMHash(MDC)Hash(SHS)MDCHashMMDCMDCOSIHash2.3.3HashHashHash[20,21,22]1)HashDavies-PriceHashCCITTJuenemanHashDamgardHashDamgardHashSchnorrFFTHashHash2)DESHashHashHashRabinHashWinternitzHashQuisquater-GiraultHashMerkleHashN-Hash3)HashHash(SHA)MD4MD5MD2RIPE-MDHAVAL1533.1SET199519966IBMMasterCardInternationalVisaInternationalMicrosoftNetscapeGTEVerisignSAICTerisaSETSecureElectronicTransation[4,5]3.1.1SETSETSETDESRSASETDESRSASETSETSETSETSETInternetSET16SETSETInternet173.1.2SET31SET[8,9]311SETFigure3-1BusinessFlowofSETSET1WEBwalletSET2SET3456SETCA123456183-2SETFigure3-2SETPaymentMessageFlow1PInitReq2PInitReqPInitResPInitRes3OI(PI)PInitResAuthReqPResAuthResCapResPInitReqPReqShopBankCustomer19PIPIOIPIOIPIOIPIPIPIPIOIPReq4PIAuthReqAuthReqAuthReq(PI)5PIOIPIAuthResAuthRes(KI)KIAuthRes6AuthResKI7InqReq208InqRes9CapReqOICapReqK3K3CapReq10K3K3(CapRes)CapResCapResK4K4CapResK4K4CapResCapResSETPGP1Alice()SHA-12AliceRSA3AliceAliceDES4Bob()RSA56Bob7Alice218Alice97SHA-110(8)(9)DESRSASHA-1SET3.2SSLSETSSLSSL3-3SSLFigure3-3SimpleBusinessFlowChatofSSL1AB2BAC3ASSLCCB12534224B5A1)2)SSL3)4)5)6)HTTPS7)8)9)233.3SSLSETSSLSETInternetSSLSSLSSLSSLSETSETSETSETSSLRSARSA31SETSSLSETSSLSET15803-1SETSSLTable3-1comparisonwithSETandSSL3.3.1SSLSETWebIENetsc