Electronic Commerce Protocols Research Articles

Analysis and Optimization of Delegation-based Sequenced Packet Exchange (SPX) Protocol: A Kailar Logic Approach

Accountability within electronic commerce protocols has tremendous significance, especially those that require answerability for the actions taken by participants. In this study, the authors evaluate the delegation of accountability based on the Sequenced Packet Exchange (SPX) protocol. The study emphasizes the concept of provability as a benchmark to formalize accountability. Moreover, this paper proposed a new framework that enables principals to delegate individual rights to other principals and how the delegator's accountability is handed over or retained, which provides the crucial functionality of tracing how accountability is distributed among principals within a system. The study provides a novel solution to accountability challenges and analysis of protocols, such as introducing novel conditions for distributing essential credentials among the grantor and the grantee and analyzing delegation-based protocols. The approach adopted will help prevent potential compromises of the integrity of online transactions. By extension, it will also serve as a best practice solution for settling legal disputes among principals.

Fairness analysis of e-commerce protocols based on strand spaces

Strand space logic is a formal method for analysing the security protocol. The electronic commerce protocols are of more complex structures, for example, branch structures, or a protocol is composite of multiple sub-protocols, so the analysis of electronic commerce protocols is far more complex than the analysis of authentication protocols. Fairness is a very important feature in e-commerce protocol. But traditional belief logic is not suitable for this. In this paper, we analyse the strand and bundle of ISI payment protocol and then prove its unfairness. We also present a strand node path method to analyse ASW protocol, which consists of multiple sub-protocols with branch structure, and the strand space analysis shows that this protocol is fair.

Modeling and Analysis of Electronic Commerce Protocols Using Colored Petri Nets

Electronic commerce protocols are the basis of security in electronic commerce. Therefore, it is essential to ensure these protocols correctly. With the ideas of ZQ logic and the security protocols analysis method using Colored Petri Nets, a new method synthesizing ZQ logic and Colored Petri Nets is presented to analyze electronic commerce protocols. The new method is suitable for analyzing both accountability and fairness. However, it needs not to establish a dispute settlement model. Moreover, the ISI protocol is chosen to illustrate how an electronic commerce protocol is analyzed using the new method. An insecure state of the ISI protocol is found. Thus, the ISI protocol does not achieve accountability and fairness. The result is the same as the one in [10] where ZQ logic is used. These are stunning confirmations of the validity of the new method for analyzing electronic commerce protocols.

PROOF SCORE APPROACH TO ANALYSIS OF ELECTRONIC COMMERCE PROTOCOLS

Proof scores are documents of comprehensible plans to prove theorems. The proof score approach to systems analysis is a method in which proof scores are used to verify that systems enjoy properties (or analyze systems). In this paper, we describe a way to analyze electronic commerce protocols with the proof score approach, which has been developed and refined through several case studies conducted.

Probabilistic model checking for the quantification of DoS security threats

Secure authentication features of communication and electronic commerce protocols involve computationally expensive and memory intensive cryptographic operations that have the potential to be turned into denial-of-service (DoS) exploits. Recent proposals attempt to improve DoS resistance by implementing a trade-off between the resources required for the potential victim(s) with the resources used by a prospective attacker. Such improvements have been proposed for the Internet Key Exchange (IKE), the Just Fast Keying (JFK) key agreement protocol and the Secure Sockets Layer (SSL/TLS) protocol. In present article, we introduce probabilistic model checking as an efficient tool-assisted approach for systematically quantifying DoS security threats. We model a security protocol with a fixed network topology using probabilistic specifications for the protocol participants. We attach into the protocol model, a probabilistic attacker model which performs DoS related actions with assigned cost values. The costs for the protocol participants and the attacker reflect the level of some resource expenditure (memory, processing capacity or communication bandwidth) for the associated actions. From the developed model we obtain a Discrete Time Markov Chain (DTMC) via property preserving discrete-time semantics. The DTMC model is verified using the PRISM model checker that produces probabilistic estimates for the analyzed DoS threat. In this way, it is possible to evaluate the level of resource expenditure for the attacker, beyond which the likelihood of widespread attack is reduced and subsequently to compare alternative design considerations for optimal resistance to the analyzed DoS threat. Our approach is validated through the analysis of the Host Identity Protocol (HIP). The HIP base-exchange is seen as a cryptographic key-exchange protocol with special features related to DoS protection. We analyze a serious DoS threat, for which we provide probabilistic estimates, as well as results for the associated attacker and participants' costs.

A Toolkit for Generating and Displaying Proof Scores in the OTS/CafeOBJ Method

The OTS/CafeOBJ method can be used to model, specify and verify distributed systems. Specifications are written in equations, which are regarded as rewrite rules and used to verify specifications. The usefulness of the method is demonstrated by applying the method to nontrivial problems such as electronic commerce protocols and railroad signaling systems. In this paper we describe a toolkit called Buffet, which assists verification in the method. Given predicates used to split cases and lemmas, Buffet automatically generates proofs (called proof scores) and checks the proof scores using the CafeOBJ system. Buffet also has facilities to display proof scores generated and verification results on a web browser.

A Formal Method for Analyzing Electronic Commerce Protocols

A formal method which can be used to analyze security properties such as accountability and fairness in electronic commerce protocols is presented. Compared with the previous work, the main contributions are the following. Firstly, a formal definition is given to the possession set of each protocol participant, and the initial possession set depends only on the environment. Secondly, the set of initial state assumptions is divided into three categories: basic assumptions, trust assumptions, and protocol comprehension assumptions, in order to avoid analysis errors caused by informal initial state assumptions. Thirdly, the set of trust assumptions is articulated by formal specification at a lower level of granularity, exposing the essence of the protocol. Fourthly, establishing an axiom system makes the new approach more rigorous and expressive.

Model checking electronic commerce security protocols based on CTL

We present a model based on Computational Temporal Logic (CTL) methods for verifying security requirements of electronic commerce protocols. The model describes formally the authentication, confidentiality integrity, non-repudiation, denial of service and access control of the electronic commerce protocols. We illustrate as case study a variant of the Lu-Smolka protocol proposed by Lu-Smolka. Moreover, we have discovered two attacks that allow a dishonest user to purchase a good debiting the amount to another user. And also, we compared our work with relative research works and found that the formal way of this paper is more general to specify security protocols for E-Commerce.

Accountability analysis of electronic commerce protocols by finite automaton model

The accountability of electronic commerce protocols is an important aspect to insures security of electronic transaction. This paper proposes to use Finite Automaton (FA) model as a new kind of framework to analyze the transaction protocols in the application of electronic commerce.

A new logic for electronic commerce protocols

The primary objective of this paper is to present the definition of a new dynamic, linear and modal logic for security protocols. The logic is compact, expressive and formal. It allows the specification of classical security properties (authentication, secrecy and integrity) and also electronic commerce properties (non-repudiation, anonymity, good atomicity, money atomicity, certified delivery, etc.). The logic constructs are interpreted over a trace-based model. Traces reflect valid protocol executions in the presence of a malicious smart intruder. The logic is endowed with a tableau-based proof system that leads to a modular denotational semantics and local model checking.

Towards a methodology for formal design and analysis of agent interaction protocols

Various extensions of UML have been developed to meet the challenges of designing modern software systems, such as agent-based electronic commerce applications. Recent advances in model checking technology have led it to be introduced into the development of approaches and tools to check the correctness of electronic commerce protocols. This paper focuses on the research of a method that connects an extension of AUML to model checker-SPIN/Promela for the specification and verification of agent interaction protocols (AIP) in electronic commerce. The method presented here allows us to combine the benefits of visual specification with the power of some static analysis and model checking. Some algorithms and rules are developed to permit all visual modeling constructs translated mechanically into some Promela models of AIP, as supported by the model checker-SPIN. Moreover, a process is illustrated to guide the specification and verification of AIP. The method is demonstrated thoroughly using the e-commerce protocol-NetBill as an example.

Using Abstract Interpretation for the Safe Verification of Security Protocols

In this paper we extend the results proposed in [5] so as to provide an approach for finding and using a safe abstraction for the verification of general security properties. Similar abstractions based on abstract interpretation techniques have been developed for the verification of temporal properties expressed using various branching-time temporal logics (eg. [10,8,15,9,13,14,19]). Here we transpose some of the results of [8,14,19] to the verification of security properties. We also automate the construction of the abstract model and the translation of security properties into abstract ones for a large class of practical situations. As opposed to other uses of abstraction which typically guarantee the preservation of a whole logic or of a whole class of properties, here a specific abstraction function is selected for each given property and is thus only to guarantee the property at hand. The requirements are consequently much less demanding and the model reduction can be much more important. The proposed approach is currently being applied for the verification of large electronic commerce protocols.

Properties of secure transaction protocols

Communication protocols are the computational basis for distributed electronic commerce systems, and thus the properties of these protocols define the forms of commerce possible in electronic systems. Existing protocols used for electronic commerce focus primarily on security properties, including message integrity, privacy and non-repudiation, and on basic transaction properties, usually just atomicity; their structural properties are limited to supporting two-party transactions with fixed semantics. We believe that the properties provided by these protocols limit their use to simple forms of commerce. In this paper we define the properties we believe are necessary for electronic commerce protocols. These include the security properties of existing protocols, and extend the transactional properties to include isolation and causality. Causality is a new property for transactions. It allows the order of the messages in a completed transaction to be independently verified, and thus inferences can be made about causal relationship between messages. We also extend the structural properties to support scalability, layering and separation of roles. Scalable protocols allow several parties to join each transaction. Protocol layering enables arbitrary transaction semantics and greater system modularity. Separation of roles provides independent adjudication of disputes between transaction participants and allows the use of varied exchange media. We term a protocol with the above properties a secure transaction protocol. Lastly, we present a protocol that provides these properties. We believe that this protocol can be used to support more complex and extended forms of electronic commerce than existing protocols.

Accountability in electronic commerce protocols

In most commercial and legal transactions, the ability to hold individuals or organizations accountable for transactions is important. Hence, electronic protocols that implement commercial transactions must be designed to provide adequate accountability assurances for transacting parties. A framework is proposed for the analysis of communication protocols that require accountability, such as those for electronic commerce. This framework can be used to analyze protocol designs to detect accountability (or lack thereof). Arguments are presented to show that a heretofore unexplored property "provability" is pertinent to examining the potential use of communication protocols in the context of litigation, and in the context of audit. A set of postulates which are applicable to the analysis of proofs in general and the proofs of accountability in particular, are proposed. The proposed approach is more natural for the analysis of accountability than the existing belief logics (e.g., M. Burrows et al., 1990) that have been used in the past for the analysis of key distribution protocols. Some recently proposed protocols for electronic commerce and public key delegation are analyzed to illustrate the use of the new analysis framework in detecting (and suggesting remedies for eliminating) their lack of accountability, and in detecting and eliminating redundancies.