论文标题:基于XML的SET支付系统的研究与实现
The Research of the Bounds on the Deviation between Curves and the Corresponding Control Polygons
论文作者 周锋波
论文导师 韩芳溪,论文学位 硕士,论文专业 计算机应用技术
论文单位 山东大学,点击次数 75,论文页数 50页File Size2198k
2005-04-05论文网 http://www.lw23.com/lunwen_145848742/ 电子商务;安全协议;SET;XML
E-commerce; Secure Protocol; SET; XML
随着计算机的普及、计算机网络的高速发展和人们对高速快捷的商业行为的需求,在全世界的范围内电子商务得到了较大的发展,电子商务逐渐渗透到商业的各个方面,一些传统的商业行为正在逐渐被电子商务所冲击。在电子商务获得较大发展的同时,电子商务过程中的交易安全问题也变得越来越突出。使用安全性比较高的支付协议是解决这个问题的一个有效手段,其中SET协议是人们现在研究的热点。 本文主要内容是提出了将XML安全技术应用于SET协议的设计构思和实现方法,并在此基础上提出了对SET协议的一些改进方法。SET协议中涉及大量的数据,并对这些数据有严格的要求,数据套封(Message Wrapper)具有严格的格式,因此它的处理非常繁琐,灵活性非常差,限制了它的普及。XML技术是一种灵活的数据处理技术,它具有结构化、可扩展性等特点,非常适合处理复杂的、不规则的数据,将XML技术引入SET协议,提高了SET协议的处理灵活性和可扩展性。 SET协议具有很高的安全性,但是它付出的代价是算法开销大,通过引入安全等级制度,也就是制定不同的安全等级,可以根据用户的需要选择安全强度,这样可以最大限度的达到两者的平衡。这里存在的最大难度就是算法和密钥协商问题,通过使用XML的签名和加密技术,这个问题可以得到很好的解决。 虽然SET协议具有很高的安全性,但是在具体的交易中还是存在一定的安全风险。在持卡人产生购买请求之前确定的订单信息,没有得到商家的认证承诺,这样一旦商家进行更改,将会对持卡人产生不安全因素。通过修改SET的交易流成,在持卡人购买初始化阶段要求商家对产生订单信息进行认证,提高了SET协议的安全性,减少了持卡人的风险。 重要信息的处理问题是SET协议考虑较少的问题,通过引入对重要数据的第三方保存,可以使SET具有更高的安全性,而且更适合法律对电子商务的介入,使电子商务中对重要数据取证难的问题得到解决。 本文首先对现行的SET协议进行分析,着重说明了SET协议的工作流程和使用的主要安全技术,重点介绍了与密码学有关的技术,通过对协议的分析找到SET协议中存在的不足和不完善的地方。然后,本文分析了XML安全技术的基本结构和处理流程,详细的说明了XML加密和签名的方案,分析了XML加密的优势。最后,将XML技术应用于SET协议,给出了持卡人端和商家端之间交换信息的具体实现方法,详细说明了消息结构和主要的功能模块以及处理流程,并对系统从安全、效率等方面了作了分析。
Along with popularity of computer and high-speed development in computer network and increasing demand on quick and convenient business, e-commerce is improved tremendously in the world. E-commerce is gradually pervading to the full extent, and is impacting drastically some kinds of traditional commerce. Meanwhile, security of bargain is emerging in multitude in the course of e-commerce. It is very effective to solve the problem by using payment protocol with high security. As one of payment protocol with high security, SET protocol is a hot research topic now.The paper put forward a design concept and its realization for applying XML security technology to SET protocol, in which the advantages of XML compensate the shortage existing in SET protocol. A large amount numbers are involved in SET protocol, which should be strictly formatted, that is, Message Wrapper having rigidly format. So this is a complex and less flexible job, which limits SET protocol widely spreading. XML technology is a flexible data processing technology, which has some attracting features such as structured and extensible and suits to process complex and anomalous data. Absorbing XML technology enhances the processing flexibility and extensible capacity of SET protocol.Although SET protocol possesses very high security, it pays a lot of cost in algorithmic spending. Through introducing security ranking system (in other words, setting down different security rank, so that users can chose security intensity in the light of their demand) both sides are balanced the furthest. The most difficult still existing is the conferring between algorithms and encrypt. This puzzle is settled down perfectly by using XML signature and encrypt technology.Some security risks still lie in concrete transactions though SET protocol possesses pretty high security. Confirmed order information, before cardholders present buy demands, does not gain merchants authentication promise. So once merchants change something, cardholders will encounter security risks. Security of SET protocol is improved and cardholders" risks are decreased by adding merchants" authentication to order information during cardholders buy initial stage.Important information processing is less considered in SET protocol. Through introducing in third-party storage of important data, SET possesses higher security and more suits for law intervening e-commerce so that the hard problem of collecting evidence about important data in e-commerce is settled down.In this paper, firstly actual SET protocol is analyzed. In the section the emphasis is put on explaining the workflow and key security technology of SET protocol, which is mainly concerned about encryption. According to analyzing SET protocol we canfind its weakness. Then the paper focuses on analyzing basic structure and deal flow of XML security technology, especially on explaining the scheme of XML encryption and signature in detail, and analyzing the advantages of XML encryption. In the end, this paper introduces XML technology into SET protocol and puts forward the improvement scheme on SET protocol. As a result, deal flow of SET protocol is optimized and its security, flexibility and implement were improved. The paper presents specific implement method for exchanging information between customer and business, also interprets the information structure and primary function modules. Furthermore, the author analyzes security and efficiency of the system.
|
