TeAM YYePG Digitally signed by TeAM YYePG DN: cn=TeAM YYePG, c=US, o=TeAM YYePG, ou=TeAM YYePG, email=yyepg@msn.com Reason: I attest to the accuracy and integrity of this document Date: 2005.02.23 04:49:12 +08'00' Advances in Security and Payment Methods for Mobile Commerce Wen-Chen Hu University of North Dakota, USA Chung-wei Lee Auburn University, USA Weidong Kou Chinese State Key Lab of Integrated Service Networks, China IDEA GROUP PUBLISHING Hershey • London • Melbourne • Singapore Acquisitions Editor: Senior Managing Editor: Managing Editor: Development Editor: Copy Editor: Typesetter: Cover Design: Printed at: Mehdi Khosrow-Pour Jan Travers Amanda Appicello Michele Rossi Ingrid Widitz Jennifer Wetzel Lisa Tosheff Yurchak Printing Inc Published in the United States of America by Idea Group Publishing (an imprint of Idea Group Inc.) 701 E Chocolate Avenue, Suite 200 Hershey PA 17033 Tel: 717-533-8845 Fax: 717-533-8661 E-mail: cust@idea-group.com Web site: http://www.idea-group.com and in the United Kingdom by Idea Group Publishing (an imprint of Idea Group Inc.) Henrietta Street Covent Garden London WC2E 8LU Tel: 44 20 7240 0856 Fax: 44 20 7379 3313 Web site: http://www.eurospan.co.uk Copyright © 2005 by Idea Group Inc All rights reserved No part of this book may be reproduced in any form or by any means, electronic or mechanical, including photocopying, without written permission from the publisher Library of Congress Cataloging-in-Publication Data Advances in security and payment methods for mobile commerce / Wen Chen Hu, Chung-Wei Lee and Weidong Kou, editors p cm Includes bibliographical references and index ISBN 1-59140-345-6 (h/c) ISBN 1-59140-346-4 (s/c) ISBN 1-59140-347-2 (eisbn) Mobile commerce Security measures Business enterprises Computer networks Security measures I Hu, Wen Chen, 1960- II Lee, Chung-Wei, 1965- III Kou, Weidong HF5548.34.A37 2004 658.4'78 dc22 2004016285 British Cataloguing in Publication Data A Cataloguing in Publication record for this book is available from the British Library All work contributed to this book is new, previously-unpublished material The views expressed in this book are those of the authors, but not necessarily of the publisher Advances in Security and Payment Methods for Mobile Commerce Table of Contents Preface vi Section I: Fundamentals of Mobile Commerce Security and Payment Methods Chapter I Mobile Commerce Security and Payment Methods .1 Chung-wei Lee, Auburn University, USA Weidong Kou, Chinese State Key Lab of Integrated Service Networks, China Wen-Chen Hu, University of North Dakota, USA Chapter II Reputation and Trust 19 Li Xiong, Georgia Institute of Technology, USA Ling Liu, Georgia Institute of Technology, USA Chapter III Intrusion Detection and Vulnerability Analysis of Mobile Commerce Platform 36 Changhua Zhu, Xidian University, China Changxing Pei, Xidian University, China Chapter IV A Secure Authentication Infrastructure for Mobile Users 56 Gregor v Bochmann, University of Ottawa, Canada Eric Zhen Zhang, University of Ottawa, Canada Section II: Mobile Commerce Security Chapter V Policy-Based Access Control for Context-Aware Services over the Wireless Internet 81 Paolo Bellavista, University of Bologna, Italy Antonio Corradi, University of Bologna, Italy Cesare Stefanelli, University of Ferrara, Italy Chapter VI A Comprehensive XML Based Approach to Trust Negotiations 109 Elisa Bertino, Purdue University, USA Elena Ferrari, Università degli Studi dell’Insubria, Italy Anna Cinzia Squicciarini, Università degli Studi di Milano, Italy Chapter VII Security Issues and Possible Countermeasures for a Mobile Agent Based M-Commerce Application 140 Jyh-haw Yeh, Boise State University, USA Wen-Chen Hu, University of North Dakota, USA Chung-wei Lee, Auburn University, USA Chapter VIII Secure Multicast for Mobile Commerce Applications: Issues and Challenges 164 Mohamed Eltoweissy, Virginia Tech, USA Sushil Jajodia, George Mason University, USA Ravi Mukkamala, Old Dominion University, USA Section III: Mobile Commerce Payment Methods Chapter IX M-Payment Solutions and M-Commerce Fraud Management 192 Seema Nambiar, Virginia Tech, USA Chang-Tien Lu, Virginia Tech, USA Chapter X Multi-Party Micro-Payment for Mobile Commerce 214 Jianming Zhu, Xidian University, China Jianfeng Ma, Xidian University, China Chapter XI SeMoPS: A Global Secure Mobile Payment Service 236 Stamatis Karnouskos, Fraunhofer Institute FOKUS, Germany András Vilmos, SafePay Systems Ltd., Hungary Antonis Ramfos, Instrasoft International, Greece Balázs Csik, ProfiTrade 90 Ltd., Hungary Petra Hoepner, Fraunhofer Institute FOKUS, Germany Section IV: Ad Hoc Mobile Commerce Security and Payment Methods Chapter XII Remote Digital Signing for Mobile Commerce 263 Oguz Kaan Onbilger, University of Florida, USA Randy Chow, University of Florida, USA Richard Newman, University of Florida, USA Chapter XIII A Mobile Coalition Key-Evolving Digital Signature Scheme for Wireless/Mobile Networks 285 Quanxing Zhang, Auburn University, USA Chwan-Hwa “John” Wu, Auburn University, USA J David Irwin, Auburn University, USA Chapter XIV Smart Card Based Protocol for Secure and Controlled Access of Mobile Host in IPv6 Compatible Foreign Network 312 R K Ghosh, Indian Institute of Technology, Kanpur, India Abhinav Arora, Indian Institute of Technology, Guwahati, India Gautam Barua, Indian Institute of Technology, Guwahati, India About the Authors 338 Index 347 vi Preface Introduction With the introduction of the World Wide Web, electronic commerce has revolutionized traditional commerce and boosted sales and exchanges of merchandise and information Recently, the emergence of wireless and mobile networks has made possible the admission of electronic commerce to a new application and research subject: mobile commerce, which is defined as the exchange or buying and selling of commodities, services, or information on the Internet through the use of mobile handheld devices In just a few years, mobile commerce has emerged from nowhere to become the hottest new trend in business transactions In fact, the growth of mobile handheld devices has been more rapid than the growth in any previous technology Yet, one of the biggest impediments to the growth of mobile commerce has been a lack of consistency in security and payment methods and an absence of consensus on technology standards Various wired or electronic commerce security and payment methods have been modified and applied to mobile commerce, but experience shows that simply adapting those solutions to mobile commerce is not feasible Different methods and approaches must be taken to enforce mobile commerce security and secure payment methods Many novel security and payment technologies, therefore, have been proposed and applied to mobile commerce and they are highly diverse and broad in application This book attempts to provide a comprehensive study of mobile commerce security and payment methods and address the complex challenges facing the mobile commerce industry This book contains high-quality research, and industrial and practical articles in the areas of mobile commerce security and payment methods from both academics and industrialists It includes research and development results of lasting significance in the theory, design, implementation, analysis, and application of mobile commerce security and payment methods It could be used for a textbook of an advanced computer science (or related disciplines) course and would be a highly useful reference book for IT professionals vii Organization The issues related to mobile commerce security and payment methods are wide and varied, and this book has benefited from contributions by authors with a range of backgrounds To help readers better understand this book, it is divided into four major sections and a brief overview of each chapter is given below Section I This section describes the fundamentals of mobile commerce security and payment methods and includes four chapters on the general concepts, reputation and trust, intrusion detection, and a secure authentication infrastructure Chapter I, Mobile Commerce Security and Payment Methods, is by Chung-wei Lee, Weidong Kou, and Wen-Chen Hu This chapter provides a comprehensive overview of mobile commerce security and payment methods A secure mobile commerce system must have the following properties: (i) confidentiality, (ii) authentication, (iii) integrity, (iv) authorization, (v) availability, and (vi) non-repudiation It discusses the security issues related to the following three network infrastructures: (i) wireless local area networks, (ii) wireless wide area networks, and (iii) WAP Among the many themes of mobile commerce security, mobile payment methods are probably the most important A typical mobile payment process includes: (i) registration, (ii) payment submission, (iii) authentication and authorization by a content provider, and (iv) confirmation This chapter also describes a set of standards for mobile payments Chapter II, Reputation and Trust, is authored by Li Xiong and Ling Liu The authors introduce reputation systems as a means of facilitating trust and minimizing risks in mcommerce and e-commerce in general They presents PeerTrust, an adaptive and dynamic reputation based trust model that helps participants or peers to evaluate the trustworthiness of each other based on the community feedback about participants’ past behavior Chapter III, Intrusion Detection and Vulnerability Analysis of Mobile Commerce Platform, is authored by Changhua Zhu and Changxing Pei Intrusion detection and vulnerability analysis play the same important roles in wireless infrastructure as in wired infrastructure This chapter first gives the methods and technologies of intrusion detection and vulnerability analysis It then gives the security issues in various wireless networking technologies, analyzes the vulnerability of the enabling technologies for the mobile commerce platform, and proposes a distributed wireless intrusion detection & vulnerability analysis (WID&VA) system that can help to address the identified security issues Chapter IV, A Secure Authentication Infrastructure for Mobile Users, is authored by Gregor v Bochmann and Eric Zhen Zhang This chapter first explains the requirements for an authentication infrastructure for electronic commerce, identifying the partners involved in e-commerce transactions and the trust relationships required An improved authentication protocol, which provides trust relationships for mobile e-commerce users, is then presented Its analysis and comparison with other proposed authentication protocols indicate that it is a good candidate for use in the context of mobile e-commerce viii Section II This section discusses issues related to mobile commerce security and includes four chapters on policy-based access control, XML-based trust negotiations, mobile agents, and secure multicast Chapter V, Policy-Based Access Control for Context-Aware Services over the Wireless Internet, is authored by Paolo Bellavista, Antonio Corradi, and Cesare Stefanelli The spreading wireless accessibility to the Internet stimulates the provisioning of mobile commercial services to a wide set of heterogeneous and limited client terminals This requires novel programming methodologies to support and simplify the development of innovative service classes In these novel services, results and offered quality levels should depend on both client location and locally available resources (context) Within this perspective, this chapter motivates the need for novel access control solutions to flexibly control the resource access of mobile clients depending on the currently applicable context In particular, it discusses and exemplifies how innovative middlewares for access control should support the determination of the client context on the basis of high-level declarative directives (profiles and policies) and distributed online monitoring Chapter VI, A Comprehensive XML Based Approach to Trust Negotiations, is authored by Elisa Bertino, Elena Ferrari, and Anna Cinzia Squicciarini Trust negotiation is a promising approach for establishing trust in open systems like the Internet, where sensitive interactions may often occur between entities at first contact, with no prior knowledge of each other This chapter presents Trust-X, a comprehensive XML-based XML framework for trust negotiations, specifically conceived for a peer-to-peer environment It also discusses the applicability of trust negotiation principles to mobile commerce, and introduces a variety of possible approaches to extend and improve Trust-X in order to fully support mobile commerce transactions and payments Chapter VII, Security Issues and Possible Countermeasures for a Mobile Agent Based M-Commerce Application, is authored by Jyh-haw Yeh, Wen-Chen Hu, and Chung-wei Lee With the advent of wireless and mobile networks, the Internet is rapidly evolving from a set of connected stationary machines to include mobile handheld devices This creates new opportunities for customers to conduct business from any location at any time However, the electronic commerce technologies currently used cannot be applied directly since most were developed based on fixed, wired networks As a result, a new research area, mobile commerce, is now being developed to supplement existing electronic commerce capabilities This chapter discusses the security issues related to this new field, along with possible countermeasures, and introduces a mobile agent based solution for mobile commerce Chapter VIII, Secure Multicast for Mobile Commerce Applications: Issues and Challenges, is authored by Mohamed Eltoweissy, Sushil Jajodia, and Ravi Mukkamala This chapter identifies system parameters and subsequent security requirements for secure multicast in m-commerce Attacks on m-commerce environments may undermine satisfying these security requirements, resulting, at most times, in major losses A set of common attacks and the core services needed to mitigate these attacks are discussed first It then provides efficient solutions for secure multicast in m-commerce Among ix these services, authentication and key management play a major role Given the varying requirements of m-commerce applications and the large number of current key management schemes, it also provides a set of performance metrics to aid m-commerce system designers in the evaluation and selection of key management schemes Section III Section III covers the issues related to mobile commerce payment methods and includes three chapters on the subjects of mobile payment introduction and overview, micro-payments, and a mobile payment service SeMoPS, respectively Chapter IX, M-Payment Solutions and M-Commerce Fraud Management, is by Seema Nambiar and Chang-Tien Lu The shift from physical to virtual payments has brought enormous benefits to consumers and merchants For consumers it means ease of use For mobile operators, mobile payment presents a unique opportunity to consolidate their central role in the m-commerce value chain Financial organizations view mobile payment and mobile banking as a way of providing added convenience to their customers along with an opportunity to reduce their operating costs This chapter starts by giving a general introduction to m-payment by providing an overview of the m-payment value chain, life cycle and characteristics The second section reviews competing mobile payment solutions that are found in the marketplace Different types of mobile frauds in the m-commerce environment and solutions to prevent such frauds are discussed in the last section Chapter X, Multi-Party Micro-Payment for Mobile Commerce, is authored by Jianming Zhu and Jianfeng Ma This chapter introduces a new micro-payment scheme that is able to apply to multi-party for mobile commerce, which allows a mobile user to pay every party involved in providing services The micro-payment, which refers to lowvalue financial transactions ranging from several cents to a few dollars, is an important technique in m-commerce Their scheme is based on the hash function and without any additional communication and expensive public key cryptography in order to achieve good efficiency and low transaction costs In the scheme, the mobile user releases an ongoing stream of low-valued micro-payment tokens into the network in exchange for the requested services Chapter XI, SeMoPS: A Global Secure Mobile Payment Service, is authored by Stamatis Karnouskos, András Vilmos, Antonis Ramfos, Balázs Csik, and Petra Hoepner Many experts consider that efficient and effective mobile payment solutions will empower existing e- and m-commerce efforts and unleash the true potential of mobile business Recently, different mobile payment approaches appear to the market addressing particular needs, but up to now no global mobile payment solution exists SEMOPS is a secure mobile payment service with an innovative technology and business concept that aims to fully address the challenges the mobile payment domain poses and become a global mobile payment service They present a detailed description of the approach, its implementation, and features that diversify it from other systems They also discuss on its business model and try to predict its future impact x Section IV The issues related to mobile commerce security and payment methods are wide and disparate This section consists of three chapters on digital signatures and smart cards Chapter XII, Remote Digital Signing for Mobile Commerce, is authored by Oguz Kaan Onbilger, Randy Chow, and Richard Newman Mobile agents (MAs) are a promising technology, which directly address physical limitations of mobile devices such as limited battery life, intermittent and low-bandwidth connections, with their capability of providing disconnected operation This chapter addresses the problem of digital contract signing with MAs, which is an important part of any mobile commerce activity and one special challenging case of computing with secrets remotely in public The authors use a multi-agent model together with simple secret splitting schemes for signing with shares of a secret key carried by MAs, cooperating to accomplish a trading task Chapter XIII, A Mobile Coalition Key-Evolving Digital Signature Scheme for Wireless/Mobile Networks, is authored by Quanxing Zhang, Chwan-Hwa “John” Wu, and J David Irwin A scheme is proposed in this chapter to apply a secure digital signature scheme in a mobile-IP environment and treats the three entities in a dynamic path as either foreign agents (FA), home agents (HA) or mobile agents (MA), such that a coalition is formed containing each of the individual agents Each agent has a pair of keys: one private and one public The private key is evolving with time, and the public key is signed by a certification authority (CA) All the private keys of the three agents in the coalition are needed to sign a signature Furthermore, all the messages are signed and verified The signature is verified against a public key, computed as the product of the public keys of all three agents, and readily generated when a new dynamic path is formed Chapter XIV, Smart Card Based Protocol for Secure and Controlled Access of Mobile Host in IPv6 Compatible Foreign Network, is authored by R.K Ghosh, Abhinav Arora, and Gautam Barua This chapter presents a proposal to combine the advantages of IPSec and smart cards in order to design a new protocol for secure bi-directional access of mobile hosts in an IPv6 foreign network using smart cards The protocol, called mobile authentication protocol (MAP), builds a security association needed for IPsec An access router in a foreign network contacts an AAA (authentication, authorization and accounting) server in order to authenticate and authorize a mobile host that approaches the router to access services The access router then acts as a gateway for all subsequent service requirements of the mobile host 338 About the Authors About the Authors Wen-Chen Hu received a BE in computer science from Tamkang University, Taiwan (1984), an ME in electronic and information engineering from the National Central University, Taiwan (1986), an MS in computer science from the University of Iowa, Iowa City (1993), and a PhD in computer and information science and engineering from the University of Florida, Gainesville (1998) He is currently an assistant professor in the Department of Computer Science, University of North Dakota (USA) His current research interests are in the World Wide Web research and applications including information retrieval, especially electronic and mobile commerce, search engines, data mining, and databases Chung-wei Lee received a BS in electrical engineering from the National Tsing-Hua University, Taiwan (1987), an MS in computer science and information engineering from the National Taiwan University, Taiwan (1994), and a PhD in computer and information science and engineering from the University of Florida, Gainesville (2001) He is currently an assistant professor in the Department of Computer Science and Software Engineering, Auburn University, and a faculty of Auburn’s Center for Innovations in Mobile, Pervasive, and Agile Computing Technologies (IMPACT) He is interested in mobile/ wireless networks, mobile commerce, multimedia streaming, IP routing and quality of service (QoS), and network security Weidong Kou is dean of the School of Computer Science and Engineering, and distinguished professor of Xidian University, as well as director of the Chinese State Key Laboratory of Integrated Service Networks Professor Kou also serves as honorary/ adjunct/guest professor in more than a dozen universities, including the University of Maryland (USA) and the University of Hong Kong Professor Kou has more than 12 years Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited About the Authors 339 of industrial experience in IBM, AT&T, and Siemens in North America He received various invention achievement and technical excellence awards from IBM, AT&T and Siemens He was associate director of the E-Business Technology Institute at the University of Hong Kong Professor Kou is founding chair of the International Symposium on Electronic Commerce (ISEC) He is a chairman of the IEEE International Conference on Dynamic E-Commerce Technology to be held in Beijing in September 2004 Professor Kou has authored/edited seven books in the areas of e-commerce, security, and multimedia technologies, and published more than 60 papers in journals/conferences He has also authored nine US/Canadian issued and pending patents Professor Kou is a senior member of IEEE and was elected as a member of New York Academy of Sciences in 1992 * * * Abhinav Arora graduated from IIT Guwahati, India, and joined Samsung India in 2003 Currently, he is pursuing graduate studies at the Seoul National University (Korea) under a sponsorship from Samsung Gautam Barua graduated from IIT Bombay, India He earned his PhD from the University of California, Santa Barbara (USA) He was on the faculty with the Department of Computer Science and Engineering at IIT Kanpur (1982-1995) He has been a member of the faculty at IIT Guwahati, India Currently, he is director of the Institute His areas of interest are operating systems and networks Paolo Bellavista is a research associate of computer engineering at the University of Bologna His research activities span from mobile agent-based middleware solutions and pervasive/ubiquitous computing to systems/service management, location/contextaware services, and adaptive multimedia He received a PhD in computer science engineering from the University of Bologna He is member of the IEEE, the ACM, and the Italian Association for Computing To contact: pbellavista@deis.unibo.it Elisa Bertino is a professor of computer sciences and research director of CERIAS at Purdue University (USA) Her research interests are in the areas of security, privacy, database systems, multimedia systems and object-oriented technology She is a fellow member of ACM and a fellow member of IEEE She received the IEEE Computer Society Technical Achievement Award in 2002 Gregor v Bochmann has been a professor at the School of Information Technology and Engineering at the University of Ottawa (Canada) since January 1998, after working 25 years at the University of Montreal He is a fellow of the IEEE and ACM and a member of the Royal Society of Canada He did research on programming languages, compiler design, communication protocols, and software engineering and published many papers Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited 340 About the Authors in these areas He was also actively involved in the standardization of formal description techniques for communication protocols and services His present work is aimed at methodologies for the design, implementation and testing of communication protocols and distributed systems Ongoing projects include quality of service management for distributed multimedia applications and optical networks Randy Chow earned his PhD in computer and information science from the University Of Massachusetts (1977) He has been on the faculty in the Computer and Information Science and Engineering Department at the University of Florida since 1981, where he is currently a professor His research areas include distributed systems, computer networks and computer security Dr Chow has published more than 75 technical papers and is the author of a graduate level textbook on distributed operating systems and algorithms Antonio Corradi is a full professor of computer engineering at the University of Bologna His research interests include distributed systems, object systems, mobile agent platforms, network management, and distributed and parallel architectures He received an MS in electrical engineering from Cornell University He is a member of the IEEE, the ACM, and the Italian Association for Computing To contact: acorradi@deis.unibo.it Balázs Csik is leading the mobile specification, design and development of the SEMOPS payment system He earned his master’s degree in information technology at the University of Technology at Budapest (1999) Currently he works at ProfiTrade 90 Ltd., but also acts as a PhD student and assistant researcher at University of Technology at Budapest He is a member of the McLeod Institute of Simulation Sciences He specializes in electronic/mobile transaction handling, payment systems, mobile technologies and simulation He published several papers related to simulation of economic systems and virtual transaction handling In the past he was leading several big electronic payment projects in the field of SET and 3-D secure Mohamed Eltoweissy is a visiting professor and associate professor of computer science at Virginia Tech and James Madison University (USA), respectively He founded the Commonwealth Information Security Center in Virginia His research interests include information security, wireless sensor and ad hoc networks, and group computing and communications He has published more than 60 technical papers in the refereed journals, books, and conference proceedings For more information, visit: www.cs.jmu.edu/users/ eltowemy Elena Ferrari is professor of database systems at the University of Insubria at Como, Italy She has also been on the faculty in the Department of Computer Science of the University of Milano, Italy (1998 to March 2001) She received a PhD in computer science from the University of Milano (1997) Elena Ferrari has been a visiting researcher at George Mason University in Fairfax, Virginia, and at Rutgers University in Newark, New Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited About the Authors 341 Jersey Her main research interests include database and Web security, and temporal and multimedia databases In those areas, Professor Ferrari has published several papers in all major refereed journals, and in proceedings of international conferences and symposia She is in the editorial board of the VLDB Journal and the International Journal of Information Technology (IJIT) Professor Ferrari has served as program chair of the Ninth ACM Symposium on Access Control Models and Technologies (SACMAT’04), COMPSAC’02 Workshop on Web Security and Semantic Web, the first ECOOP Workshop on XML and Object Technology, and the first ECOOP Workshop on Objectoriented Databases Dr Ferrari was also general chair of the Eighth ACM Symposium on Access Control Models and Technologies (SACMAT’03) and the Software Demonstration Chair of the 10 th International Conference on Extending Database Technologies (EDBT’04) She has also served as program committee member for several international conferences Dr Ferrari is a member of ACM and the IEEE Computer Society R K Ghosh graduated with a Master in Science from Ravenshaw College, Cuttack, India He earned his PhD from the Indian Institute of Technology, Kharagpur, India Currently, he is on the faculty of computer science and engineering at IIT Kanpur, India He had been also on the faculty of computer science and engineering at IIT Guwahati, India (20022003) His areas of interests are mobile computing and mobile ad hoc networks Petra Hoepner is a senior scientist and R&D project leader for security at Fraunhofer Institute FOKUS In this function she is concerned with project management, coordination and technological development, specifically in the domain of security and egovernment solutions in national and international projects Her research interests include security in distributed processing environments and service architectures, identity management, as well as security for e-government, telecommunication and electronic commerce applications and services Prior to coming to FhI FOKUS, Ms Hoepner worked as a system specialist at Nixdorf Microprocessor Engineering GmbH (1981-1990) She received her Diploma in Computer Science from Technical University of Berlin (1980) J David Irwin was born in Minneapolis, Minnesota, in 1939 He received a BEE from Auburn University, Auburn, Alabama (1961), and an MS and PhD from the University of Tennessee, Knoxville (1962 and 1967, respectively) In 1967, he joined Bell Telephone Laboratories, Inc., Holmdel, New Jersey, as a member of the technical staff and was made a supervisor in 1968 He joined Auburn University in 1969 as an assistant professor of electrical engineering He was made an associate professor in 1972, associate professor and head of the department in 1973, and professor and head in 1976 From 1982-1984, he was professor and head of EE and CS In 1993, he was named Earle C Williams Eminent Scholar and head Sushil Jajodia is BDM international professor of information technology and director of the Center for Secure Information Systems at the George Mason University in Fairfax, Virginia His research interests include information security, temporal databases, and Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited 342 About the Authors replicated databases He has authored four books, edited 19 books, and published more than 250 technical papers in the refereed journals and conference proceedings For more information, visit: http://csis.gmu.edu/faculty/jajodia.html Stamatis Karnouskos holds a Diploma (summa cum laude) in computer engineering and informatics from the University of Patras in Greece He is currently a senior scientist and R&D project manager at Fraunhofer Institute FOKUS He is involved in several industrial and European Union projects related to mobile payments, mobile commerce, software agents, active networks, security and mobility His contributions include project management and coordination as well as technical research and development in the aforementioned domains His research aims at making future networks and their services more open, secure and flexible He has authored more than 25 technical papers in international books, journals and conferences, has acted as guest editor at the IEEE T-SMC Journal, and participates as member of the technical program committee and reviewer in several international conferences and workshops Ling Liu is an associate professor in the College of Computing at Georgia Tech (USA) Her research involves both experimental and theoretical study of distributed data intensive systems, including distributed middleware systems, advanced Internet systems and Internet data management Her current research interests range from performance, scalability, reliability, to security and privacy of Internet services, mobile and wireless computing systems, and pervasive computing applications Dr Liu has published more than 100 articles in international journals and international conferences Her research group has produced a number of open source software systems, of which the most popular ones are WebCQ and XWRAPElite She is currently a member of ACM SIGMOD executive committee, editor-in-chief of ACM SIGMOD Record, and on the editorial board of three international journals, and served as a vice PC chair or PC co-chair of several international conferences, including IEEE International Conference on Data Engineering (ICDE 2004), and IEEE International Conference on Web Services Her current research is partially funded by government grants from NSF, DARPA, DoE and industry grants from IBM and HP Chang-Tien (C.T.) Lu received a BS in computer science and engineering from the Tatung Institute of Technology, Taipei, Taiwan (1991), an MS in computer science from the Georgia Institute of Technology, Atlanta, Georgia (1996), and a PhD in computer science from the University of Minnesota, Minneapolis (2001) He is currently an assistant professor in the Department of Computer Science at Virginia Polytechnic Institute and State University (USA) His research interests include spatial database, data mining, data warehousing, and geographic information systems Jianfeng Ma received a BS in mathematics from Shaaxi Normal University (Xi’an) (1985) and obtained an ME and PhD in computer software and communications engineering from Xidian University (Xi’an) (1988 and 1995, respectively) Since 1995, he has been with Xidian University as a lecturer, associate professor and professor He is also a supervisor Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited About the Authors 343 of PhD students in “Cryptography” and “Computers with Their Applications” at the university From 1999-2001, he was with Nanyang Technological University of Singapore as a research fellow He is an IEEE member and a senior member of Chinese Institute of Electronics (CIE) His research interests include information security, coding theory and network management Ravi Mukkamala received a PhD from the University of Iowa (1987) and an MBA from Old Dominion University (1993) Since 1987, he has been with the Department of Computer Science at Old Dominion University, Norfolk, Virginia (USA), where he is currently a professor His research interests include distributed systems, data security, performance analysis, and PKI His research has been sponsored by NRL, DARPA, NASA, and CISC For more information, visit: www.cs.odu.edu/~mukka Seema Nambiar received a BS in computer science from the University of Bangalore, India, and spent a year and a half working as software engineer in Wipro Technologies (NYSE: WIT) for their Lucent division Since the fall of 2001 she has been a master student of the Department of Computer Science at Virginia Polytechnic and State University Richard E Newman is an assistant professor of Computer & Information Science & Engineering at the University of Florida (USA) He received a BA in mathematics from New College in Sarasota, Florida (1981) and his MS in computer science from the University of Rochester in Rochester, New York (1983), where he completed his PhD in computer science (1986) After graduation, he joined the faculty at the University of Florida He has taught operating systems, distributed operating systems, computer networks, computer and network security, algorithms, formal languages and computation theory, and computational complexity His research is primarily in distributed systems, computer networking and security, including industry- and governmentsponsored projects on these topics that have brought in over $3 million and led to over 60 technical publications Oguz Kaan Onbilger received a BS from the Computer Science and Engineering Department at Hacettepe University, Turkey (1990) He received an MS in computer engineering from the Middle East Technical University, Turkey (1995) He is currently a PhD candidate in the Computer and Information Science and Engineering Department at the University of Florida Between and during the academic programs he completed, he worked in the industry several years before he joined the doctorate program at the University of Florida His research interests are computer networks and security, mobile code systems, and Internet/distributed computing Changxing Pei received a BS in wireless communication from Xidian University, Xi’an, China (1970) He is a professor with the School of Telecommunications Engineering, Xidian University, where he teaches and conducts research in wireless communications, data networks, Internet, and interference cancellation Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited 344 About the Authors Antonis Ramfos joined Intrasoft International in 1997 and is currently R&D section manager His main responsibilities include R&D strategy formulation, conception and management of R&D projects, (both externally- and internally-funded), innovation transfer to commercial solutions of the company and finally the promotion and commercial exploitation R&D results His current research interests include knowledge and content management technologies; e-business and e-government systems; and ecommerce and m-commerce systems Dr Ramfos has several publications in journals, conferences and books He holds a BSc in mathematics from the University of Sussex, UK (1983), an MSc in computing and statistics from the University of Wales, College of Cardiff, UK (1985), and a PhD in the area of distributed heterogeneous databases from the University of Wales, College of Cardiff (1991) Anna Cinzia Squicciarini is a PhD student at the University of Milan, Italy She received a degree in computer science from the University of Milan with full marks (July 2002) During Autumn 2003, Anna Cinzia was a visiting researcher at Swedish Institute of Computer Science, Stockholm During Spring 2004, she also was a research scholar at Colorado State University, Fort Collins (CO) (USA) Her main research interests include trust negotiations, privacy, models and mechanisms for privilege and contract management in virtual organizations and, recently, Web services access control models Cesare Stefanelli is an associate professor of computer engineering at the University of Ferrara His research interests include distributed and mobile computing, mobile code, middleware supports for adaptive services, network and systems management, and security infrastructures He received a PhD in computer science from the University of Bologna He is a member of the IEEE and the Italian Association for Computing To contact: cstefanelli@ing.unife.it András Vilmos is the project manager of SEMOPS and managing director of SafePay Systems Ltd He has held different leading positions at major companies, as being chief controller of the national carrier, and CFO of the national grid A few years ago, Mr Vilmos launched his own company active in financial consulting Being interested in telecommunication and Internet business, Mr Vilmos was working on payment related research and eventually developed the concept that forms the bases of the SEMOPS project Mr Vilmos has a number of patents pending related to online payments Chwan-Hwa “John” Wu received a BS from the National Chiao Tung University, Taiwan, Republic of China (1980), and a PhD from the Polytechnic University, New York (1987) In 1987, he joined the faculty of Auburn University, Alabama, and is currently a professor of electrical & computer engineering Dr Wu is the author and co-author of over 150 scientific and technical publications Li Xiong is a PhD candidate in the College of Computing at Georgia Institute of Technology (USA) Her research interests are in Internet data management, electronic Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited About the Authors 345 commerce, distributed computing and Internet security She has published articles in international journal and conferences including IEEE Transactions of Knowledge and Data Engineering and IEEE Conference on Electronic Commerce Previously, she received her BS and MS in computer science from the University of Science and Technology in China and Johns Hopkins University, respectively She also had several years of industry experience working as a software engineer with companies, including Internet security systems Jyh-haw Yeh received a BA in applied mathematics and an MS and PhD in computer science (1988, 1993, 1999) from the National Chung-Hsing University (Taiwan), Cleveland State University, and University of Florida, respectively Currently, he is an assistant professor in the Department of Computer Science at Boise State University, Idaho (USA) His research interests are in the areas of computer security, e-commerce, and interconnected networks He is a member of the IEEE Computer Society and the Association of Computing Machinery Eric Zhen Zhang is a master’s student in the computer science program at the School of Information Technology and Engineering at the University of Ottawa, after working years in telecommunication industry He did research on wireless network, quality of service, multimedia and information security His present work is aimed at security support for mobile user access services in ubiquitous environment Quanxing Zhang was born in 1962 in Shanxi province, P.R.China He attended Northwestern Polytechnic University, Xi’an, China (1978), and graduated with Bachelor of Science in electrical engineering (July 1982) He worked in Baocheng General Electronics Corp, Shaanxi, China, as a technologist until September 1985, when he enrolled in graduate school of the same university He graduated in April 1988 with Master of Science in Electrical Engineering and was working for the same corporation as a design engineer until he came to enroll in Auburn University He graduated from Auburn University with a PhD in 2003 Changhua Zhu received a BS in electromagnetic field theory and microwave technology (1995) and his MS in telecommunications and information system (2001), all from Xidian University, Xi’an, China He was a microwave engineer at Institute of Electromechanical Information Technology, Xi’an, China (1995-1998) Now he is pursuing a PhD at Xidian University His research interests include measurement, modeling and performance analysis of IP networks Jianming Zhu received a BS in mathematics from Huaibei Coal & Normal College, Huaibei, Anhui, China (1985), and obtained his ME in computers and their applications from Taiyuan University of Technology, Taiyuan, Shanxi, China (1998) Since 1989, he has been with Shanxi Finance & Taxes College (Taiyuan) as a lecturer and associate professor Currently, he is pursuing a PhD in computers with their applications at Xidian Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited 346 About the Authors University, Xi’an, Shaanxi, China His research interests include information security, cryptography and e-commerce Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited Index 347 Index A access control 170 access rights 60 address filtering 319 anomaly detection 40 anonymity 61, 144 asymmetric key systems authentication 1, 60, 174, 325 authentication authority 59 authentication authorization accounting (AAA) 316 authentication infrastructure 58 authentication methods 61 authenticity 144, 170 authorization 1, 325 B bandwidth 169, 224 biometric information 63 Bluetooth C certificate 115 certificate exchange 121 certification authority (CA) 285 client 111 collaborative investigation team 166 common mode failure 287 community context 25 compliance checker 119 confidentiality 1, 144, 170, 171 content download 12 content on device 12 context awareness 22 context manager (CM) 90 context-aware access control 85 context-aware service provisioning 84 convenience 205, 237 credential 115 credential authorities (CAs) 112 credential language 115 credential types 115 credit reference 59 cryptographic algorithm 325 cryptography 173 customer module 243 cycle-stealing 172 D data confidentiality data integrity Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited 348 Index data integrity 245 data sets 116 declaration 115 decryption 37 denial-of-service (DoS) 172 digital cash 150 digital credentials 110 digital signature 219 digital signature scheme 290 digital signing key security 286 digital wallet 195 disabling of service 172 disclosure policies 112 disclosure policies language 117 dishonest feedback 22 DoS attack 21 E eavesdropping 46, 171 El Gamal public key cryptosystem 271 electronic commerce (e-commerce) 2, 19, 57, 58, 110, 141, 264 electronic payment systems 217 embedded operating system 243 encrypted information 244 enhanced messaging services (EMS) 11 entity authentication 245 extensible authentication protocol (EAP) 141 H handheld device 142 hash chain 219 hash collisions 221 hash sequences 221 home agents (HA) 285 home directory 67 home location registry (HLR) 168 home-base key 292 host-based vulnerability scanner 42 I impersonation 46 in-band method 14 in-band purchase 247 integrity 1, 144, 170 Internet 141, 165, 214 Internet payment 251 Internet service provider (ISP) 58 interoperability 15, 170 intrusion detection 36, 39 intrusion detection system 41 iPIN 199 IPV6 319 J Jalda 203 Java micro edition 243 Java card 315 F K feedback system 26 flooding attack 46 foreign agents (FA) 285 fraud 219 fraud management systems 205 frequency hopping 173 Kerberos 65 key management 175 key splitting 271 KTH airlines 113 G latency 169 limited-liability keys 278 local security association 321 location awareness 22 low security guarantee 317 global secure mobile payment service 236 GSM security 10 L Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited Index 349 M m-commerce fraud management 192 m-Pay 201, 238 m-payment 193 m-payment lifecycle 194 m-payment solution 192 m-payment value chain 193 malicious SMS messages 20 man-in-the-middle 46, 171 master agent 269 MCKE 292 memory card 315 merchant module 244 message authentication code (MAC) 223 metadata manager (MM) 93 micro-payment scheme 214 micro-payment system 215 microprocessor card 315 middleware proxies 87 millicent scheme 223 misuse detection 39 mobile agent (MA) 88, 263, 285 mobile agent technology 142 mobile auction 165 mobile authentication protocol 323 mobile commerce (m-commerce) 19, 57, 111, 140, 141, 164, 192, 214, 263 mobile commerce platform 36 mobile commerce security mobile communication system 224 mobile content 246 mobile cryptography 267 mobile hose 312 mobile network fraud 206 mobile network operator (MNO) 238 mobile networking 286 mobile payment 1, 236 mobile payment solutions 238 mobile payment systems 197 mobile phone fraud 205 mobile stock trading 97 mobile-IP network attack 289 mobile-OP protocol 288 multi-agent model 268 multi-party micro-payment 216 multicast routing 175 multilevel security 170 multimedia messaging services (MMS) 11 multiple cryptography 270 multisignatures 270 N negotiation tree 123 NetPay scheme 222 network access provider 59 network hijack 45 network infrastructure network layer security 319 network-based scanner (NIDS) 41 network-based vulnerability system 42 Nokia 203 non-repudiation 144 O online business model 143 online e-business 149 operating systems (OS) 242 out-of-band model 14 P P2P payment 248 Paybox 198 payment credentials 60 payment instruction 143 payment lifecycle 15 PayWord evaluation 222 PayWord scheme 222 PIN 241 PKI 241 point of sale 12 point of sale (POS) payment 249 policy language 113 portable middleware facilities 94 privacy 61, 171 private key 245, 292 private key-evolving scheme 291 private keys refresh algorithm 299 private keys update algorithm 298 Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited 350 Index proactive schemes 287 proximity payment 14 public key certificates 278 public key infrastructure (PKI) 63 public key system public keys 62 public-key cryptosystem 263 purchase order 143 R R-term 117 radio access network (RAN) random Oracle model 303 refresh 293 reliability 169 remote digital signing 263, 276 reputation data dissemination 22 reputation system 19 resource description framework (RDF) 93 S scanning tools 42 secure authentication infrastructure 56 secure electronic transaction (SET) 145 secure mobile commerce 167 secure sockets layer (SSL) 65 secure trust data transmission 23 security 110, 140, 205, 244, 288, 324 security assertion markup language (SAML) 66 security associations 324 security attack 171 security requirements 60 SeMoPS 236 service provider 59, 82 session hijacking 172 shared secret 62 signature generation 271 signer key 292 signing algorithm 300 SIM card 66 SIM toolkit (STK) 242 smart card 66, 195, 312 sniffing 45 spoofing 45 symmetric key systems system state characterization 43 T third parties 59 threshold cryptography 270 traffic analysis 171 transaction context 25 transaction specific risks 20 tree manager 119 trust 19 trust model 23 trust negotiation 109 trust parameters 23 trust relationships 57 trust sequence 121 trust-X 109, 119 trust-X negotiations 120 trust-X policies 117 trusted third party (TTP) 245 U UMTS security 10 unauthorized access 45 user 59 user authentication 13, 57 user registration protocol 321 V verifiable signatures 61 verifying algorithm 300 virus attack 21 Vodafone 200 vulnerability analysis 36, 42 vulnerability index evaluation 43 vulnerability metrics 43 W Wi-Fi security WICoCo 83 wireless application protocol (WAP) 37, 196 Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited Index 351 wireless coverage area 168 wireless identity module (WIM) 37, 196 wireless Internet 81 wireless local area networks (WLAN) wireless networking 286 wireless security issues 167 X X-profile 116, 121 Copyright © 2005, Idea Group Inc Copying or distributing in print or electronic forms without written permission of Idea Group Inc is prohibited NEW RELEASE Mobile Commerce Applications Nansi Shi, University of South Australia, Australia Mobile Commerce Applications addresses and explores the critical architectural issues in constructing m-commerce applications and in applying mobile technologies in different areas, including methodologies, enabling technologies, models, paradigms, architectures, standards and innovations This book discusses many unique characters and issues on applying mobile computing for various business purposes, and provide theoretical and practical guidelines on how to cope with these issues and develop reliable and secure mobile commerce applications It also introduces the best practices in security mechanisms, knowledge management, message services and Quality of Service (QoS), and some business areas that are very appropriate in applying mobile computing technologies to increase competitive advantage Finally, this book offers an interesting mix of in-depth views on challenges and trends in mobile commerce for further research ISBN 1-59140-182-8 (h/c) • US$79.95 • ISBN 1-59140-293-X (s/c) • US$64.95 • 358 pages • Copyright © 2004 “The crucial challenge or success factor to modern organizations is whether they are able to provide enough useful M-commerce applications that consumers can access and willing to use However, constructing mobile applications has some inherent complexities and architectural issues as M-commerce embraces many emerging technologies.” Nansi Shi University of South Australia, Australia Its Easy to Order! Order online at www.idea-group.com or call 717/533-8845 x10 Mon-Fri 8:30 am-5:00 pm (est) or fax 24 hours a day 717/533-8661 Idea Group Publishing Hershey • London • Melbourne • Singapore An excellent addition to your library ... public key is signed by a certification authority (CA) All the private keys of the three agents in the coalition are needed to sign a signature Furthermore, all the messages are signed and verified... mechanisms provided by WLANs and cellular networks, the wireless application protocol (WAP) is designed to work with all wireless networks The most important technology applied by WAP is probably... can be used by hackers, and this provides necessary clues for intrusion Intruders can penetrate into the WLAN anywhere by using high sensitivity antennas Subscribers might be deceived by unauthorized