文献类型：期刊文献

中文题名：一种分析电子商务安全协议的新逻辑

英文题名：New Logic of Analyzing Electronic Commerce Security Protocols

作者：陈莉[1]

第一作者：陈莉

机构：[1]河南财经学院计算中心

第一机构：河南财经政法大学

年份：2010

卷号：37

期号：10

起止页码：110-115

中文期刊名：计算机科学

外文期刊名：Computer Science

收录：CSTPCD;;北大核心:【北大核心2008】；CSCD:【CSCD2011_2012】；

基金：国家高技术研究发展计划(863计划)(2007AA01Z471);国家自然科学基金项目(60473021);河南省重点科技攻关项目(072102210029);河南省科技攻关项目(0624260017)资助

语种：中文

中文关键词：逻辑分析方法;安全属性;密钥保密性;原子性;混合密码原语;逻辑构件

外文关键词：Logic analysis method; Security property; Secrey of key; Atomicity; Hybrid cryptography-based primitives; Logic sentences

摘要：针对典型电子商务安全协议逻辑分析方法存在的问题,如安全属性分析存在局限性、缺乏形式化语义、对混合密码原语的处理能力不强等,提出了一种新的逻辑分析方法。新逻辑能够分析电子商务安全协议的认证性、密钥保密性、非否认性、可追究性、公平性及原子性。以匿名电子现金支付协议ISI作为分析实例,证明了新逻辑方法的有效性。分析找出了该协议的安全漏洞和缺陷:不满足商家的非否认性、密钥保密性、可追究性、公平性以及原子性,客户面临商家恶意欺骗的潜在威胁。
The paper researched the typical logic analysis methods of electronic commerce security protocols and pointed out their limitations in analyzing security properties.Most of them are lack of formal semantics and ability of analyzing hybrid cryptography-based primitives.In response on the above-mentioned problems,the paper proposed a new logic analysis method,which can analyze most of the known security properties of the electronic commerce protocols,such as authentication,secrecy of key,non-repudiation,accountability,fairness and atomicity.The validation of the new logic was verified by analyzing the anonymous e-cash payment protocol ISI.The analysis reveals the security vulnerabilities and flaws of the protocol,which cannot satisfy non-repudiation of merchants,secrey of key,accountability,fairness and atomicity,moreover,the customers face malicious cheat of the merchants.