一种分析电子商务安全协议的新逻辑

New Logic of Analyzing Electronic Commerce Security Protocols

针对典型电子商务安全协议逻辑分析方法存在的问题,如安全属性分析存在局限性、缺乏形式化语义、对混合密码原语的处理能力不强等,提出了一种新的逻辑分析方法。新逻辑能够分析电子商务安全协议的认证性、密钥保密性、非否认性、可追究性、公平性及原子性。以匿名电子现金支付协议ISI作为分析实例,证明了新逻辑方法的有效性。分析找出了该协议的安全漏洞和缺陷:不满足商家的非否认性、密钥保密性、可追究性、公平性以及原子性,客户面临商家恶意欺骗的潜在威胁。

The paper researched the typical logic analysis methods of electronic commerce security protocols and pointed out their limitations in analyzing security properties.Most of them are lack of formal semantics and ability of analyzing hybrid cryptography-based primitives.In response on the above-mentioned problems,the paper proposed a new logic analysis method,which can analyze most of the known security properties of the electronic commerce protocols,such as authentication,secrecy of key,non-repudiation,accountability,fairness and atomicity.The validation of the new logic was verified by analyzing the anonymous e-cash payment protocol ISI.The analysis reveals the security vulnerabilities and flaws of the protocol,which cannot satisfy non-repudiation of merchants,secrey of key,accountability,fairness and atomicity,moreover,the customers face malicious cheat of the merchants.