【作者】 张向军；

【导师】 陈克非；

【作者基本信息】 上海交通大学 ， 计算机应用技术， 2009， 博士

【摘要】 电子支付模式作为传统支付方式的电子表示形式,具有纸币交易不具备的特点,它维护方便,便于携带,不易遗失,更能适应未来商务活动要求。目前进行的全球性EMV[1]迁移工作,是个人电子支付领域的一次全面技术升级,能否抓住这一契机,对于改变我国在此领域的落后状况,全面提升技术水平具有重要意义。但是,由于我国的应用环境同EMV规范的定义有差异,因而具有一定实施障碍。对于国内在此领域出现的新应用、新需求,如对电子钱包、离线支付、小额支付、internet支付应用和P2P支付应用等,EMV规范的考虑不够充分,限制了它在国内的推广和作用发挥。本文针对个人消费电子支付技术新的发展趋势进行了讨论和研究,为解决以上问题提出了建设性意见。本文较系统地总结并分析了个人电子支付领域的现状和发展趋势,结合作者在所参与的EMV和电子支付项目中获得的经验和成果,指出了现有技术中存在的不足。并提出了一个集成化电子支付系统作为改进方案。本文提出的集成化系统是基于EMV规范和PBOC2.0规范构建的,利用金融卡的CPU计算能力和COS中复合应用接口的支持,引入电子货币机制,取长补短,有机融合了两种电子支付技术的优点。此系统在保留金融卡技术原有优点的同时,能够方便的实现真正的离线交易,摆脱了硬件设施不足这一瓶颈的制约。也可以引入匿名机制加强隐私保护,更好的支持网络P2P交易,有力的推动个人电子消费应用的普及。在此集成化电子支付系统中,本文根据EMV规范的安全机制和设计理念,提出了可用安全的概念,从而为这一难以建模的综合系统提供了一个可用的安全性的判定准则。通过细致分析,为系统引入了包括小额支付、匿名支付、可撤销匿名性支付、提供公平性判断的支付方案等应用选择。结合在同领域项目中得到的设计成果,本文给出了实用的硬件和软件构架开发方案。通过引入独立读卡器模块,扩充PBOC2.0规范中电子钱包应用的接口指令,利用IC卡防篡改硬件和EMV规范的安全流程,在不影响原EMV支付模块运行效率和安全性的前提下,提供符合要求的安全、公平的支付协议族。此协议族较好地支持上面提到的各种应用,扩充了EMV金融卡的功能和性能。此协议族实现了电子货币系统在IC卡上的移植,扩充了PBOC卡应用。在保持离线支付能力的同时,提供了匿名性控制机制,实现了匿名电子货币的列表长度控制机制和找零功能,并通过微调原有规范规定的交易记录机制,巧妙地建立了一个公平性判别协议,保证此集成系统具有良好的可用性和丰富的功能。通过上述一系列工作,本文对现有规范和支付技术进行了补充,弥补了原有EMV规范中的一些不足,提升了此类应用在我国的适用性。既能利用金融卡的普及性将电子货币应用引入用户视野,也能够利用EMV规范的严整性来规范电子货币技术的开发,为电子货币的实用化提供一个新的契机。本文对所提出的集成化电子支付模型进行了较全面的分析和总结,对用户关心的一些诸如安全性、可靠性、响应速度、易用性等性能进行了测试分析,并对其中存在的问题给出了参考意见,最后对此模型研究的今后工作进行了分析和展望。更多还原

【Abstract】 As the electronic form of paper currency, electronic payment technique has the advantages, such as easy to maintain, convenient to carry, preventable to be stolen, and be fit for the most up-to-date payment applications. The in-performing EMV[1] reformation is a global technique development in personal electronic payment field. It’s of great importance for China to catch this chance, and change the underdevelop status in this field. However, some situations in our country aren’t fit for the EMV specification. Morover, some newest applications, such as the payment actions on internet and the P2P exchanging techniques, doesn’t take into account in EMV specification. In order to cope with these problems, we are about to discuss and investigate new technique of the electronic payment system within personal exchanging field in this paper.This paper analyzes the status and developing trend of electronic payment technique. Using the experiement achieved in the electronic payment projects, we point out the shortages of current systems. In order to solve these shortages, we propose an integrated electronic payment architecture, which is based on PBOC 2.0 specification. It integrates the electronic cash mechanism in it by utilizing the computing ability of the CPU in financial card and the support of CAPP purchase application embedded in the COS. This development can make up for the shortages of financial card and electronic cash. While maintaining the advantages of financial card, this new system can realize off-line payment and erase the restriction of deficient infrastructure. It also enables anonymous mechanism, and network P2P exchange. It can also promote the popularization of personal commercial applications. In this payment system, according to the security mechanism and idea used in EMVspecification, we introduce a concept of usable security. This can supply a usable security criterion for building the integrated payment system. We carefully involve some applications in our architecture by delicate analysis. They are micro-payment, anonymous payment, revocable anonymous payment, and the payment application supporting fairness judgment. By utilizing the techniques achieved in other projects, this paper supplies the software and hardware establishing scheme. By using a tamper-resistance module in IC card, the secure scheme of EMV reference, and the assistant electronia purse system, we can build a payment protocol family that can implement the applications mentioned before without affecting the performance of the EMV modular in efficiency and security. Thus, we can improve and extend the function and performance of the EMV card.This protocol family realizes the application of electronic cash in IC card. While maintaining the off-line payment characteristic, it can supply an anonymous control mechanism, implement the coin list scale control and divisibility of anonymous system, and promot a fair exchanging guarantee protocol by adding some simple modification in payment records. These design insure the usability and practicability of the integrated systemTo sum up, we build a integrate payment system, adjust the application of EP illustrated in PBOC2.0 specification, cover its shortages, and improve the performance of EMV financial card. Its advantage also lies in the function to introduce electronic cash into users’minds to help popularizing this technique. Moreover, it can help to change the isolation status of existing systems, via the standardization of EMV specification. In the end, we analyze and discuss this integrated system, investigate the issues that user concerns, such as, security, reliability, speed and convenience. Some advices for latent problems and some prospects for the future development are also given.更多还原