# Dynamic Symmetric Key Mobile Commerce Scheme Based on Self-Verified Mechanism

Authors: Jiachen Yang; Longsheng Xu; Qinggang Meng; Shudong He
Journal: Mathematical Problems in Engineering
 (2014)

---

## Abstract

In terms of the security and efficiency of mobile e-commerce, the authors summarized the advantages and disadvantages of several related schemes, especially the self-verified mobile payment scheme based on the elliptic curve cryptosystem (ECC) and then proposed a new type of dynamic symmetric key mobile commerce scheme based on self-verified mechanism. The authors analyzed the basic algorithm based on self-verified mechanisms and detailed the complete transaction process of the proposed scheme. The authors analyzed the payment scheme based on the security and high efficiency index. The analysis shows that the proposed scheme not only meets the high efficiency of mobile electronic payment premise, but also takes the security into account. The user confirmation mechanism at the end of the proposed scheme further strengthens the security of the proposed scheme. In brief, the proposed scheme is more efficient and practical than most of the existing schemes.


---

## Body

## 1. Introduction

With the rapid development of mobile communication technology, more and more electronic trading has been introduced to the wireless network environment [1]. The wireless mobile network in the electronic trading model not only provides numerous merchants with a new way of promoting the sale of products and increases the profit, but also greatly enriches the network shopping environment of the consumers [1]. Mobile electronic commerce has achieved rapid development, since the mobile users and merchants traded anywhere and anytime [2]. However, compared with fixed networks, there are some factors that have restricted the development of mobile commerce, such as lower bandwidth, longer delay time, unstable connection, limited storage space, and restricted computing power [1]. In order to reduce the risk of these problems, the priority of all kinds of mobile payment schemes is the security and efficiency of the solution.Recently, with the development of mobile commerce based on the characteristics of the mobile network, some researchers have successively put forward certificate-based public key cryptosystem scheme (CBCS) [3], ID-based cryptography scheme (IDBCS) [1, 4, 5], and self-verified digital signature scheme (SVDSS) [2, 6, 7]. CBCS is similar to the scheme based on the Secure Electronic Transaction protocol, in which user’s authentication requires the certificate preserved in the certificate authority (CA). When the node certificate is updated or canceled, each node directory needs to be updated synchronously. The requirements of this sort of certificate management for calculation, storage, and communication of the system are relatively high. In order to avoid the certificate management burden, IDBCS used key escrow (KE) features and key distribution center (KDC) unified manage public/private key pair of all trading entity, which can generate a symmetric key, and then improve the efficiency of system. However, once the KDC public/private key leaks, the system will lose the security barrier. In addition, with the increase of the number of users, the KDC needs to maintain a set of large user authentication tables, resulting in increasing the burden of the system [1]. SVDSS is more efficient and secure than CBCS and IDBCS. On the one hand, its authentication mechanism does not need to rely on complex certificate management, which reduces the amount of calculation and traffic and improves the execution efficiency; on the other hand, it does not set public/private key to KDC. Thus SVDSS has extensive application prospect in the field of mobile e-commerce.The core work of SVDSS is generating the authentication key and digital signature which verifies the identity of transaction entity. At present, the mainstream generative mechanism of SVDSS is based on ECC. Compared with the public key cryptosystem (PKC), ECC uses smaller key length to meet the same level of security and has very low computational burden [7–9]. The specific performance comparison can be seen in Table 1. Therefore, the electronic payment scheme based on ECC is more effective than that based on PKC.Table 1
Comparison of performance of RSA and ECC.
Break time/MIPS
RSA key length/bit
ECC key length/bit
RSA/ECC key length ratio
104
512
106
5 : 1
108
768
132
6 : 1
1012
1 024
160
7 : 1
1020
2 048
210
10 : 1
1078
21 000
600
35 : 1The symmetric key encryption system has a simple encryption processing, encryption speed, shorter key, and so forth [9]. The authors summarize the theory and experience of predecessors and propose a new type of dynamic symmetric key mobile commerce scheme based on self-verified mechanism in this paper. This proposed scheme meets the requirements of both security and high efficiency because of the application of ECC. Based on the self-verified signature concept, each transaction entity holds the verification key and the digital signature for a later user authentication [2, 10]. The symmetric keys held by two entities are generated dynamically by the verification key and the digital signature. This contributes to security and efficient information interaction. A special key management mechanism is not necessary to reduce the cost of key management. In this way, the network operator only needs to provide users with a secure network and does not need to maintain redundancy authentication table. Therefore, the electronic payment scheme can not only meet the requirements of the large-scale mobile users, but also execute secure and efficient information interaction with generated symmetric key between the two entities after successful authentication. The environment of the electronic payment scheme is very suitable for large-scale mobile user environments, because the network operator does not need to maintain redundancy authentication table. In addition, the proposed scheme supports user anonymity mechanism and confidentiality, and it can prevent impersonation attack effectively. With our efforts, the system safeguards the rights and interests of users and ensures security. This scheme adopts ECC. Compared with other mechanisms such as the PKC and pairing function encryption mechanism, ECC obviously improves the operating efficiency of the system [11, 12]. To sum up, the proposed scheme is effective and practical in mobile commerce.This paper is structured as follows. In Section2, the authors summarize the main idea of the self-verified mechanism and basic steps. In Section 3, the paper presents detailed process of the proposed scheme. In Section 4, the authors analyze operational efficiency and security. Finally, conclusions are made in Section 5.


## 2. The Principle of Self-Verified Mechanism

Yang and Chang [2] proposed an authentication mechanism which is divided into three phases: the initialization phase, the registration phase, and the authentication phase.


### 2.1. The Initialization Phase

In this phase, the serverS initializes the system parameters over an elliptic curve domain through the following steps. In order to facilitate subsequent statements, important parameters and explanations are listed in Table 2.Table 2
The parameter self-authentication scheme.
Parameter
Explanation
F
q
Finite fieldF
q over a large odd prime q
E
q
(
a
,
b
)
Elliptic curve equation with the ordern over F
q
Q
Public point overE
q
(
a
,
b
)
H
(
⋅
)
The one-way hash function
*
The point multiplication overE
q
(
a
,
b
)
V
X
A verification key that is generated byO for the entity X
(
E
X
,
S
X
)
The self-verified signature that is generated byO for the entity X
ID
X
The unique identity of trading entityX


#### 2.1.1. Elliptic Curve Equation

S chooses a finite field F
q over a large odd prime q and generates an elliptic curve equation E
q
a
,
b:
(1)
y
2
=
x
3
+
a
x
+
b
mod
⁡
q
,
where parameters satisfy the following conditions:
(2)
a
,
b
∈
F
q
,
q
>
3
,
4
a
3
+
27
b
2
≠
0
mod
⁡
q
.S selects a public point Q over E
q
a
,
b and a public one-way hash function H
(
·
), where Q is the finite point over E
q
a
,
b.


#### 2.1.2. Generating Public Key

S chooses its private key d
S
∈
Z
q to compute its public key by
(3)
U
S
=
d
S
*
Q
.


### 2.2. The Registration Phase

Assume that userA wants to log in the server S. Prior to the logging, A must register to S.


#### 2.2.1. Generating Verification Key and Self-Verified Signature

Firstly,A sends a registration request to S. S generates A
′s verification key by
(4)
V
A
=
H
(
I
D
A
∥
w
A
)
,
where w
A
∈
Z
q
* and I
D
A is A
’s identity. S computes W
A by
(5)
W
A
=
w
A
*
Q
=
(
x
,
y
)
,
where x and y denote the x-coordinate and y-coordinate of W
A, respectively. To generate the self-verified signature (
E
A
,
S
A
), S computes
(6)
E
A
=
H
x
∥
I
D
A
mod
⁡
n
,
S
A
=
w
A
-
d
·
E
A
mod
⁡
n
.


#### 2.2.2. Confirming the Legitimacy of Information

S sends {
V
A
,
(
E
A
,
S
A
)
} to A via a secure channel. A verifies the legitimacy of the message by computing
(7)
W
A
′
=
S
A
*
Q
+
E
A
*
U
S
=
x
′
,
y
′
,
E
A
′
=
H
(
x
′
∥
I
D
A
)
.
Then, A checks if E
A
′ is equal to E
A. If they are equal, then A confirms that {
V
A
,
(
E
A
,
S
A
)
} is really generated by O.


### 2.3. The Authentication Phase

In this phase,A wants to log in S; S can verify the user’s legality [9].


#### 2.3.1. Obtaining Data Set

A uses H
(
·
) to compute
(8)
C
=
H
I
D
A
∥
V
A
∥
TS
,
where TS is the timestamp; A sends data set (I
D
A
,
C
,
E
A
,
S
A) to S.


#### 2.3.2. Identity Authentication

After receiving (I
D
A
,
C
,
E
A
,
S
A), S computes
(9)
w
A
′
=
S
A
-
d
S
*
E
A
mod
⁡
n
,
V
A
′
=
H
I
D
A
∥
w
A
′
,
C
′
=
H
I
D
A
∥
V
A
′
∥
TS
.
S checks if C
′ is equal to C that is sent from A. If they are equal, then S can authenticate that A is a legal user.


## 2.1. The Initialization Phase

In this phase, the serverS initializes the system parameters over an elliptic curve domain through the following steps. In order to facilitate subsequent statements, important parameters and explanations are listed in Table 2.Table 2
The parameter self-authentication scheme.
Parameter
Explanation
F
q
Finite fieldF
q over a large odd prime q
E
q
(
a
,
b
)
Elliptic curve equation with the ordern over F
q
Q
Public point overE
q
(
a
,
b
)
H
(
⋅
)
The one-way hash function
*
The point multiplication overE
q
(
a
,
b
)
V
X
A verification key that is generated byO for the entity X
(
E
X
,
S
X
)
The self-verified signature that is generated byO for the entity X
ID
X
The unique identity of trading entityX


### 2.1.1. Elliptic Curve Equation

S chooses a finite field F
q over a large odd prime q and generates an elliptic curve equation E
q
a
,
b:
(1)
y
2
=
x
3
+
a
x
+
b
mod
⁡
q
,
where parameters satisfy the following conditions:
(2)
a
,
b
∈
F
q
,
q
>
3
,
4
a
3
+
27
b
2
≠
0
mod
⁡
q
.S selects a public point Q over E
q
a
,
b and a public one-way hash function H
(
·
), where Q is the finite point over E
q
a
,
b.


### 2.1.2. Generating Public Key

S chooses its private key d
S
∈
Z
q to compute its public key by
(3)
U
S
=
d
S
*
Q
.


## 2.1.1. Elliptic Curve Equation

S chooses a finite field F
q over a large odd prime q and generates an elliptic curve equation E
q
a
,
b:
(1)
y
2
=
x
3
+
a
x
+
b
mod
⁡
q
,
where parameters satisfy the following conditions:
(2)
a
,
b
∈
F
q
,
q
>
3
,
4
a
3
+
27
b
2
≠
0
mod
⁡
q
.S selects a public point Q over E
q
a
,
b and a public one-way hash function H
(
·
), where Q is the finite point over E
q
a
,
b.


## 2.1.2. Generating Public Key

S chooses its private key d
S
∈
Z
q to compute its public key by
(3)
U
S
=
d
S
*
Q
.


## 2.2. The Registration Phase

Assume that userA wants to log in the server S. Prior to the logging, A must register to S.


### 2.2.1. Generating Verification Key and Self-Verified Signature

Firstly,A sends a registration request to S. S generates A
′s verification key by
(4)
V
A
=
H
(
I
D
A
∥
w
A
)
,
where w
A
∈
Z
q
* and I
D
A is A
’s identity. S computes W
A by
(5)
W
A
=
w
A
*
Q
=
(
x
,
y
)
,
where x and y denote the x-coordinate and y-coordinate of W
A, respectively. To generate the self-verified signature (
E
A
,
S
A
), S computes
(6)
E
A
=
H
x
∥
I
D
A
mod
⁡
n
,
S
A
=
w
A
-
d
·
E
A
mod
⁡
n
.


### 2.2.2. Confirming the Legitimacy of Information

S sends {
V
A
,
(
E
A
,
S
A
)
} to A via a secure channel. A verifies the legitimacy of the message by computing
(7)
W
A
′
=
S
A
*
Q
+
E
A
*
U
S
=
x
′
,
y
′
,
E
A
′
=
H
(
x
′
∥
I
D
A
)
.
Then, A checks if E
A
′ is equal to E
A. If they are equal, then A confirms that {
V
A
,
(
E
A
,
S
A
)
} is really generated by O.


## 2.2.1. Generating Verification Key and Self-Verified Signature

Firstly,A sends a registration request to S. S generates A
′s verification key by
(4)
V
A
=
H
(
I
D
A
∥
w
A
)
,
where w
A
∈
Z
q
* and I
D
A is A
’s identity. S computes W
A by
(5)
W
A
=
w
A
*
Q
=
(
x
,
y
)
,
where x and y denote the x-coordinate and y-coordinate of W
A, respectively. To generate the self-verified signature (
E
A
,
S
A
), S computes
(6)
E
A
=
H
x
∥
I
D
A
mod
⁡
n
,
S
A
=
w
A
-
d
·
E
A
mod
⁡
n
.


## 2.2.2. Confirming the Legitimacy of Information

S sends {
V
A
,
(
E
A
,
S
A
)
} to A via a secure channel. A verifies the legitimacy of the message by computing
(7)
W
A
′
=
S
A
*
Q
+
E
A
*
U
S
=
x
′
,
y
′
,
E
A
′
=
H
(
x
′
∥
I
D
A
)
.
Then, A checks if E
A
′ is equal to E
A. If they are equal, then A confirms that {
V
A
,
(
E
A
,
S
A
)
} is really generated by O.


## 2.3. The Authentication Phase

In this phase,A wants to log in S; S can verify the user’s legality [9].


### 2.3.1. Obtaining Data Set

A uses H
(
·
) to compute
(8)
C
=
H
I
D
A
∥
V
A
∥
TS
,
where TS is the timestamp; A sends data set (I
D
A
,
C
,
E
A
,
S
A) to S.


### 2.3.2. Identity Authentication

After receiving (I
D
A
,
C
,
E
A
,
S
A), S computes
(9)
w
A
′
=
S
A
-
d
S
*
E
A
mod
⁡
n
,
V
A
′
=
H
I
D
A
∥
w
A
′
,
C
′
=
H
I
D
A
∥
V
A
′
∥
TS
.
S checks if C
′ is equal to C that is sent from A. If they are equal, then S can authenticate that A is a legal user.


## 2.3.1. Obtaining Data Set

A uses H
(
·
) to compute
(8)
C
=
H
I
D
A
∥
V
A
∥
TS
,
where TS is the timestamp; A sends data set (I
D
A
,
C
,
E
A
,
S
A) to S.


## 2.3.2. Identity Authentication

After receiving (I
D
A
,
C
,
E
A
,
S
A), S computes
(9)
w
A
′
=
S
A
-
d
S
*
E
A
mod
⁡
n
,
V
A
′
=
H
I
D
A
∥
w
A
′
,
C
′
=
H
I
D
A
∥
V
A
′
∥
TS
.
S checks if C
′ is equal to C that is sent from A. If they are equal, then S can authenticate that A is a legal user.


## 3. Proposed Scheme

There are three transaction entities in the proposed e-payment scheme: the provider of electronic goodsP, the mobile user U, and the network operator O that is a collection of financial institutions. O provides the wireless network bearer services to P and U, such as 3G services. Before being involved in trading officially, P and U must register to O and obtain the exclusive account. Only in this way can O provide service for user’s transaction. The trading model of the proposed scheme is shown in Figure 1.Figure 1
Trading model.The proposed electronic trading scheme is divided into four phases: the registration phase, the withdrawing phase, the paying phase, and the depositing phase. During the registration phase,P and U need to register to O for obtaining their verification keys and self-verified signatures. The function of withdrawing phase is that U not only obtains an electronic identification of account balance but also completes the identity authentication with P. In the paying phase, U and P perform authentication with each other; then U will obtain the electronic goods from P. During the depositing phase, U agrees on this transaction and then P redeems the price from the account of U.


### 3.1. The Registration Phase

Before the depositing phase,P and U need to register to O for obtaining their verification keys and self-verified signatures. The steps of this phase are demonstrated as follows.


#### 3.1.1. Generating{
V
U
,
(
E
U
,
S
U
)
}

U sends a registration request to O, and O generates the verification key V
U and the self-verified signature (
E
U
,
S
U
). Through the secure way, O sends authentication information {
V
U
,
(
E
U
,
S
U
)
} to U. Then U stores {
V
U
,
(
E
U
,
S
U
)
} into its mobile device for subsequent authentications.


#### 3.1.2. Generating{
V
P
,
(
E
P
,
S
P
)
}

In a similar way,P gets the authentication information {
V
P
,
(
E
P
,
S
P
)
} from O and stores it into its mobile device.


#### 3.1.3. Storing Authentication Information

O stores the registration information of U and P to its database. The information provides the foundation of authentication, generating keys, information transfer, and payment in later transaction.


### 3.2. The Withdrawing Phase

According to the registration information in the registration phase,U obtains an electronic identification of account balance that the maximum value is V
N. In the subsequent transactions, the value of electronic goods bought by U from P will not exceed V
N. In this phase, U and P not only complete the identity authentication but also generate a pair of symmetric key between themselves, and the symmetric key will be applied during user confirmation mechanism in the depositing phase. The steps of this phase are shown as follows and the specific flow chart is shown in Figure 2.Figure 2
Flow chat of withdrawing phase.Step
1.
U makes use of {
V
U
,
(
E
U
,
S
U
)
} to compute
(10)
C
U
O
=
h
I
D
U
∥
I
D
P
∥
V
U
∥
TS
,
where TS is the timestamp and U sends I
D
U, I
D
P, (
E
U
,
S
U
), TS, and C
A
O to O.Step
2. In order to verify the legitimacy of U, O uses its private key d
O to compute
(11)
w
U
′
=
S
U
-
d
O
*
E
U
mod
⁡
n
,
V
U
′
=
H
I
D
U
∥
w
U
′
.
Then, O checks validity of TS. If TS is valid, O computes
(12)
C
U
O
′
=
h
I
D
U
∥
I
D
P
∥
V
U
′
∥
TS
.
O confirms that U is legal and above withdrawing information is really sent from U when C
U
O
′ equals C
U
O. Otherwise, O rejects the transaction.Step
3.
O generates an electronic identification of account balance that the maximum value is V
N. In the subsequent transactions, the value of electronic goods bought by U from P will not exceed V
N. Meanwhile, O generates a serial number SN of V
N.Step
4.
O makes use of w
U
′, I
D
O, I
D
U to generate the symmetric key
(13)
K
s
O
_
U
=
H
(
w
U
′
∥
I
D
O
∥
I
D
U
)
.
Based on ECC, O generates the digital signature Sig
(
V
N
∥
SN
∥
I
D
P
) and computes
(14)
C
O
U
=
E
V
U
′
K
s
O
_
U
,
V
N
,
SN
,
V
U
′
,
Sig
V
N
∥
SN
∥
I
D
P
,
and then it sends C
O
U to U and stores (
V
N
,
SN
) in the local database and deducts the cost of V
N from mobile user’s account.Step
5.
U uses symmetric key to decrypt C
O
U for K
s
O
_
U, V
N, SN, V
U
′, Sig
V
N
∥
SN
∥
I
D
P.Then whether the equationV
U
′
=
V
U is established is checked. If it is established, U confirms that C
O
U is really sent by O, stores (
V
N
,
SN
) into the users’ database, and obtains symmetric key K
s
O
_
U.


### 3.3. The Paying Phase

In this phase,U sends good information GI to P; then U and P perform authentication with each other. After the authentication is legalized, U will obtain the electronic goods encrypted by the symmetric key K
s
P
_
U generated between the two entities. The steps of this phase are shown as follows and the specific flow chart is shown in Figure 3.Figure 3
Flow chart of paying phase.Step
1.1.
U browses P’s online shop and generates the good information G
I
1 that contains the descriptions and the prices defined by P
1 of the electronic goods. Meanwhile, U arbitrarily selects an integer r
U
∈
Z
q and obtains the value k
x by
(15)
R
U
=
r
U
*
Q
,
K
U
=
r
U
*
U
P
=
k
x
,
k
y
.
U generates the dynamic symmetric key K
s
P
_
U between P and U by
(16)
K
s
P
_
U
=
H
r
U
∥
I
D
P
∥
I
D
U
,
where I
D
P and I
D
U is the unique identification of P and U. U encrypts the payment message with the key k
x
(17)
PI
=
E
k
x
G
I
1
,
K
s
P
_
U
,
V
N
,
SN
,
Sig
V
N
∥
SN
∥
I
D
P
.Step
1.2. After receiving the encrypted payment message PI, P obtains k
x
′ by
(18)
K
U
′
=
d
P
*
R
U
=
k
x
′
,
k
y
′
.
P decrypts PI and obtains payment message DI by
(19)
DI
=
D
k
x
′
{
PI
}
=
G
I
1
,
K
s
P
_
U
,
V
N
,
SN
,
Sig
V
N
∥
SN
∥
I
D
P
.
P verifies the legitimacy of digital signature with computing Ver
(
Sig
(
V
N
∥
SN
∥
I
D
P
)
). If the signature is legal, P can confirm PI is really sent by U. Therefore, P confirms that (
K
s
P
_
U
,
V
N
,
SN
) is legal and obtains the dynamic symmetric key K
s
P
_
U.Step
1.3.
P obtains the good information GI and then determines whether inequality P
1
≤
V
N was established. If V
N is greater than or equal to P
1, P stores (
G
I
1
,
I
D
U
,
V
N
,
SN
) in the database and sends E
K
s
P
_
U
(
E
G
1
) to U, where E
G
1 is the electronic goods. Then U obtains the E
G
1 encrypted by K
s
P
_
U. Otherwise, U rejects the transaction.If user wants to execute subsequent transactions, the proposed scheme can make full use of symmetric keyK
s
P
_
U, which is generated in the previous process. In the J
th transaction, both entities apply hash function H
K
(
·
), symmetric key K
s
P
_
U, and good information G
I
J to complete the transaction. The steps of this phase are shown as follows.Step
J.1.
U browses P’s online shop and generates the J
th good information G
I
J. In the meantime U updates symmetric key K
s
P
_
U
J
=
H
K
J
(
K
s
P
_
U
), where H
K
J
(
·
) represents performing the hash operation J times.Step
J.2.
U uses K
s
P
_
U
J to compute the payment message by
(20)
P
I
J
=
E
K
s
P
_
U
J
G
I
J
,
I
D
U
,
V
N
,
SN
,
where G
I
J contains the price information P
J and sends P
I
J to P. P updates the symmetric key K
s
P
_
U
J and obtains the payment message by
(21)
DI
=
D
K
s
P
_
U
J
P
I
J
=
G
I
J
,
I
D
U
,
V
N
,
SN
.Step
J.3. After receiving DI, P judges the condition
(22)
I
=
P
1
+
P
2
+
⋯
+
P
J
≤
V
N
.
If the inequality is not established, P rejects the transaction. If the inequality is established, P stores (
G
1
+
G
2
+
⋯
+
G
J
,
I
D
U
,
V
N
,
SN
) into the database and sends E
K
s
P
_
U
J
(
E
G
J
) to U. Finally, U obtains electronic goods E
G
J encrypted by K
s
P
_
U
J.


### 3.4. The Depositing Phase

After the paying phase,P obtains I
=
P
1
+
P
2
+
⋯
+
P
J from U and wants to redeem them from O in this phase. The steps of this phase are shown as follows and the specific flow chart is shown in Figure 4.Figure 4
Flow chart of depositing phase.Step
1.
P makes use of V
P to generate
(23)
E
P
P
_
O
=
E
V
P
I
D
P
,
I
D
U
,
SN
,
V
P
,
GI
.
Then it sends E
P
P
_
O, I
D
P, (
E
P
,
S
P
) to O, where is the collection of G
I
1
,
G
I
2
,
…
,
G
I
J.Step
2. In order to verify P, O uses private key d
O to generate V
P
′ and compute EP
⁡
P
_
O
′ by
(24)
w
p
′
=
S
p
-
d
O
·
E
p
mod
⁡
n
,
V
p
′
=
H
I
D
P
∥
w
p
′
,
E
P
P
_
O
′
=
E
V
P
′
(
I
D
P
,
I
D
U
,
SN
,
V
P
′
,
GI
)
.
O checks if the equation E
P
P
_
O
′
=
E
P
P
_
O holds. If the equation holds, then O confirms that P is legal.Step
3.
O uses K
s
O
_
U to compute
(25)
E
P
O
_
U
=
E
K
s
O
_
U
(
I
D
P
,
I
D
U
,
GI
,
SN
)
and sends E
P
O
_
U to U. U makes use of K
s
O
_
U and obtains I
D
P, I
D
U, GI, SN. If U agrees on this transaction and replies confirmation information to O, then O completes the deposit. Otherwise, O rejects this transaction.


## 3.1. The Registration Phase

Before the depositing phase,P and U need to register to O for obtaining their verification keys and self-verified signatures. The steps of this phase are demonstrated as follows.


### 3.1.1. Generating{
V
U
,
(
E
U
,
S
U
)
}

U sends a registration request to O, and O generates the verification key V
U and the self-verified signature (
E
U
,
S
U
). Through the secure way, O sends authentication information {
V
U
,
(
E
U
,
S
U
)
} to U. Then U stores {
V
U
,
(
E
U
,
S
U
)
} into its mobile device for subsequent authentications.


### 3.1.2. Generating{
V
P
,
(
E
P
,
S
P
)
}

In a similar way,P gets the authentication information {
V
P
,
(
E
P
,
S
P
)
} from O and stores it into its mobile device.


### 3.1.3. Storing Authentication Information

O stores the registration information of U and P to its database. The information provides the foundation of authentication, generating keys, information transfer, and payment in later transaction.


## 3.1.1. Generating{
V
U
,
(
E
U
,
S
U
)
}

U sends a registration request to O, and O generates the verification key V
U and the self-verified signature (
E
U
,
S
U
). Through the secure way, O sends authentication information {
V
U
,
(
E
U
,
S
U
)
} to U. Then U stores {
V
U
,
(
E
U
,
S
U
)
} into its mobile device for subsequent authentications.


## 3.1.2. Generating{
V
P
,
(
E
P
,
S
P
)
}

In a similar way,P gets the authentication information {
V
P
,
(
E
P
,
S
P
)
} from O and stores it into its mobile device.


## 3.1.3. Storing Authentication Information

O stores the registration information of U and P to its database. The information provides the foundation of authentication, generating keys, information transfer, and payment in later transaction.


## 3.2. The Withdrawing Phase

According to the registration information in the registration phase,U obtains an electronic identification of account balance that the maximum value is V
N. In the subsequent transactions, the value of electronic goods bought by U from P will not exceed V
N. In this phase, U and P not only complete the identity authentication but also generate a pair of symmetric key between themselves, and the symmetric key will be applied during user confirmation mechanism in the depositing phase. The steps of this phase are shown as follows and the specific flow chart is shown in Figure 2.Figure 2
Flow chat of withdrawing phase.Step
1.
U makes use of {
V
U
,
(
E
U
,
S
U
)
} to compute
(10)
C
U
O
=
h
I
D
U
∥
I
D
P
∥
V
U
∥
TS
,
where TS is the timestamp and U sends I
D
U, I
D
P, (
E
U
,
S
U
), TS, and C
A
O to O.Step
2. In order to verify the legitimacy of U, O uses its private key d
O to compute
(11)
w
U
′
=
S
U
-
d
O
*
E
U
mod
⁡
n
,
V
U
′
=
H
I
D
U
∥
w
U
′
.
Then, O checks validity of TS. If TS is valid, O computes
(12)
C
U
O
′
=
h
I
D
U
∥
I
D
P
∥
V
U
′
∥
TS
.
O confirms that U is legal and above withdrawing information is really sent from U when C
U
O
′ equals C
U
O. Otherwise, O rejects the transaction.Step
3.
O generates an electronic identification of account balance that the maximum value is V
N. In the subsequent transactions, the value of electronic goods bought by U from P will not exceed V
N. Meanwhile, O generates a serial number SN of V
N.Step
4.
O makes use of w
U
′, I
D
O, I
D
U to generate the symmetric key
(13)
K
s
O
_
U
=
H
(
w
U
′
∥
I
D
O
∥
I
D
U
)
.
Based on ECC, O generates the digital signature Sig
(
V
N
∥
SN
∥
I
D
P
) and computes
(14)
C
O
U
=
E
V
U
′
K
s
O
_
U
,
V
N
,
SN
,
V
U
′
,
Sig
V
N
∥
SN
∥
I
D
P
,
and then it sends C
O
U to U and stores (
V
N
,
SN
) in the local database and deducts the cost of V
N from mobile user’s account.Step
5.
U uses symmetric key to decrypt C
O
U for K
s
O
_
U, V
N, SN, V
U
′, Sig
V
N
∥
SN
∥
I
D
P.Then whether the equationV
U
′
=
V
U is established is checked. If it is established, U confirms that C
O
U is really sent by O, stores (
V
N
,
SN
) into the users’ database, and obtains symmetric key K
s
O
_
U.


## 3.3. The Paying Phase

In this phase,U sends good information GI to P; then U and P perform authentication with each other. After the authentication is legalized, U will obtain the electronic goods encrypted by the symmetric key K
s
P
_
U generated between the two entities. The steps of this phase are shown as follows and the specific flow chart is shown in Figure 3.Figure 3
Flow chart of paying phase.Step
1.1.
U browses P’s online shop and generates the good information G
I
1 that contains the descriptions and the prices defined by P
1 of the electronic goods. Meanwhile, U arbitrarily selects an integer r
U
∈
Z
q and obtains the value k
x by
(15)
R
U
=
r
U
*
Q
,
K
U
=
r
U
*
U
P
=
k
x
,
k
y
.
U generates the dynamic symmetric key K
s
P
_
U between P and U by
(16)
K
s
P
_
U
=
H
r
U
∥
I
D
P
∥
I
D
U
,
where I
D
P and I
D
U is the unique identification of P and U. U encrypts the payment message with the key k
x
(17)
PI
=
E
k
x
G
I
1
,
K
s
P
_
U
,
V
N
,
SN
,
Sig
V
N
∥
SN
∥
I
D
P
.Step
1.2. After receiving the encrypted payment message PI, P obtains k
x
′ by
(18)
K
U
′
=
d
P
*
R
U
=
k
x
′
,
k
y
′
.
P decrypts PI and obtains payment message DI by
(19)
DI
=
D
k
x
′
{
PI
}
=
G
I
1
,
K
s
P
_
U
,
V
N
,
SN
,
Sig
V
N
∥
SN
∥
I
D
P
.
P verifies the legitimacy of digital signature with computing Ver
(
Sig
(
V
N
∥
SN
∥
I
D
P
)
). If the signature is legal, P can confirm PI is really sent by U. Therefore, P confirms that (
K
s
P
_
U
,
V
N
,
SN
) is legal and obtains the dynamic symmetric key K
s
P
_
U.Step
1.3.
P obtains the good information GI and then determines whether inequality P
1
≤
V
N was established. If V
N is greater than or equal to P
1, P stores (
G
I
1
,
I
D
U
,
V
N
,
SN
) in the database and sends E
K
s
P
_
U
(
E
G
1
) to U, where E
G
1 is the electronic goods. Then U obtains the E
G
1 encrypted by K
s
P
_
U. Otherwise, U rejects the transaction.If user wants to execute subsequent transactions, the proposed scheme can make full use of symmetric keyK
s
P
_
U, which is generated in the previous process. In the J
th transaction, both entities apply hash function H
K
(
·
), symmetric key K
s
P
_
U, and good information G
I
J to complete the transaction. The steps of this phase are shown as follows.Step
J.1.
U browses P’s online shop and generates the J
th good information G
I
J. In the meantime U updates symmetric key K
s
P
_
U
J
=
H
K
J
(
K
s
P
_
U
), where H
K
J
(
·
) represents performing the hash operation J times.Step
J.2.
U uses K
s
P
_
U
J to compute the payment message by
(20)
P
I
J
=
E
K
s
P
_
U
J
G
I
J
,
I
D
U
,
V
N
,
SN
,
where G
I
J contains the price information P
J and sends P
I
J to P. P updates the symmetric key K
s
P
_
U
J and obtains the payment message by
(21)
DI
=
D
K
s
P
_
U
J
P
I
J
=
G
I
J
,
I
D
U
,
V
N
,
SN
.Step
J.3. After receiving DI, P judges the condition
(22)
I
=
P
1
+
P
2
+
⋯
+
P
J
≤
V
N
.
If the inequality is not established, P rejects the transaction. If the inequality is established, P stores (
G
1
+
G
2
+
⋯
+
G
J
,
I
D
U
,
V
N
,
SN
) into the database and sends E
K
s
P
_
U
J
(
E
G
J
) to U. Finally, U obtains electronic goods E
G
J encrypted by K
s
P
_
U
J.


## 3.4. The Depositing Phase

After the paying phase,P obtains I
=
P
1
+
P
2
+
⋯
+
P
J from U and wants to redeem them from O in this phase. The steps of this phase are shown as follows and the specific flow chart is shown in Figure 4.Figure 4
Flow chart of depositing phase.Step
1.
P makes use of V
P to generate
(23)
E
P
P
_
O
=
E
V
P
I
D
P
,
I
D
U
,
SN
,
V
P
,
GI
.
Then it sends E
P
P
_
O, I
D
P, (
E
P
,
S
P
) to O, where is the collection of G
I
1
,
G
I
2
,
…
,
G
I
J.Step
2. In order to verify P, O uses private key d
O to generate V
P
′ and compute EP
⁡
P
_
O
′ by
(24)
w
p
′
=
S
p
-
d
O
·
E
p
mod
⁡
n
,
V
p
′
=
H
I
D
P
∥
w
p
′
,
E
P
P
_
O
′
=
E
V
P
′
(
I
D
P
,
I
D
U
,
SN
,
V
P
′
,
GI
)
.
O checks if the equation E
P
P
_
O
′
=
E
P
P
_
O holds. If the equation holds, then O confirms that P is legal.Step
3.
O uses K
s
O
_
U to compute
(25)
E
P
O
_
U
=
E
K
s
O
_
U
(
I
D
P
,
I
D
U
,
GI
,
SN
)
and sends E
P
O
_
U to U. U makes use of K
s
O
_
U and obtains I
D
P, I
D
U, GI, SN. If U agrees on this transaction and replies confirmation information to O, then O completes the deposit. Otherwise, O rejects this transaction.


## 4. The Performance and the Security Analyses

This scheme will be compared to the related schemes in terms of performance and security analysis in order to identify the characteristics and advantages of proposed scheme. Compared with previous trading models [1, 2], the proposed scheme further compresses the computation costs, and the dynamic symmetric key introduced improves the dynamic efficiency of the system. Considering the complexity and integration of current system, the proposed scheme adds the user confirmation mechanism which can maximize the protection of the rights of the user.


### 4.1. The Performance Analysis

Compared with authentication mechanism of CBCS and IDBCS, the efficiency SVDSS authentication is higher. The reason is that this scheme adopts the self-verified signature mechanism to implement authentication between transactions entities, eliminate the need for frequent transfer certificate and verification, and save communication cost. In the specific verification process, the proposed scheme adopts the mechanism based on ECC. Compared with the public key cryptosystem (PKC) [6], ECC uses smaller key length to meet the same level of security and bear very low computational burden [7]. After trading entity verifies that each side is legal object, it achieves symmetric encryption/decryption using the symmetric key. In the concrete scheme, it further improves the system efficiency from the following two aspects.


#### 4.1.1. Payment Efficiency

In the previous mobile commerce, hash function was used to generate electronic money instead of cash.T
H denotes the execution time for executing the hash function for token generation and verification. As for T
H denotes 0.006 ms on 15 a Pentium IV 3.0 GHz with 2 GB. In the literature [1], in order to generate and verify N tokens, the total number of hash operation performed is 3 N in the entire transaction process (including the generating, using, and redeeming of electronic token). In the literature [2], when U obtains the tokens from O, U did not use hash function but did get the tokens directly. So the total number of hash operation performed is 2 N. According to literature [1, 2], the total execution time for token generation and verification is 3
N
T
H and 2
N
T
H. Usually, the number N is from 50 to 50,000. The total execution time of token generation and verification is illustrated in Figure 5, where the literature [1, 2] introduces the Lin et al.’s scheme and Yang and chang’s scheme, respectively. In the proposed scheme, U does not use hash function to generate the electronic tokens; the user directly obtains V
N from O. The total price of the goods purchased keeps accumulating in P, as long as the price does not exceed V
N. Therefore, compared with literature [1, 2], payment efficiency of proposed scheme has been greatly improved.Figure 5
The analysis of payment efficiency.


#### 4.1.2. Message Encryption and Decryption

Recently, in order to improve the efficiency of mobile commerce, symmetric key mechanisms have been applied actively. However, due to the difficulties of key management of symmetric key, the concrete scheme of mobile commerce is based on asymmetric keys, to generate a symmetric key between trading entity. According to literature [1], the system generates symmetric key between entities, but the public/private key that can generate symmetric key exists in the KDC. Once the KDC information leakage occurs, the security of the whole system will be under threat. And the generated symmetric keys in subsequent transactions are not continuously updated, which will result in the insecurity of the system. In the literature [2], both the symmetric keys are generated by executing three times point multiplication over E
q
a
,
b during each paying phase. In the paying phase, assume U and P execute J times payment, the total execution time for generating the symmetric keys is 3J
T
ECC.T
ECC denotes the time of the multiplication on an elliptic curve E
q
a
,
b. In this paper, the scheme generates the first pair symmetric key in the first process during the paying phase. In the subsequent transaction, only the hash function is used to update the symmetric key K
s
P
_
U
J
=
H
K
J
(
K
s
P
_
U
). The total execution time for generating the symmetric keys is 3
T
ECC
+
(
J
-
1
)
*
2
*
T
H. In fact, T
ECC is much larger than T
H. This will further reduce the computing cost of the system and improve the execution efficiency. As is shown in Figure 6, the computational cost of generating symmetric key in the proposed scheme is higher than that in the literature [2].Figure 6
The analysis of generating symmetric key.


### 4.2. The Security Analysis

The authors analyze the security of proposed scheme as follows.


#### 4.2.1. Prevent Impersonation Attack

Assume that an attacker makes an attempt to modify the response information returned toO [13–15]. Obviously, the attacker needs to forge a set of data, including V
U, (
E
u
,
S
u
). After receiving the forged information, O will naturally enter into the verification mode by computing (11) and (12).IfC
U
_
O is not equal to C
U
_
O
′, O discovers the user is illegal and then rejects the transaction. The same authentication mechanism also occurs between O user and P. The proposed scheme makes full use of this authentication mechanism to prevent impersonation attack.


#### 4.2.2. User Anonymity

In electronic payment schemes, the vender (service provider) does not need to know the user’s real identity to protect the user’s privacy [16, 17]. Provider obtains the payment information (17).It does not contain identity information about user; service providers’ judgment of the source information is based on the validity ofSig
(
V
N
∥
SN
∥
I
D
P
)
. Subsequent transactions are based on (
K
s
P
_
U
,
V
N
,
SN
); as long as the total price of the purchased goods does not exceed V
N, the entire transaction can continue proceeding. P redeems the I
=
P
1
+
P
2
+
⋯
+
P
J from O based on SN in the depositing phase. In the process of the whole system, vender has no access to the user’s identity information.


#### 4.2.3. Confidentiality

Through the analysis of the concrete transaction process, information of the transaction between entities is held by pairwise symmetric key to encrypt/decrypt. Concrete example is as follows.Equations (17) and (19) achieve the secure transfer of information between U and P.Equations (20) and (21) achieve the secure transfer of information between U and O. However, compared to the asymmetric keys, symmetric keys are easy to crack [18, 19]. Thus during the transaction phase, the symmetric key between the user and the service provider is continuously updated, which can also prevent the Man-in-the-Middle attack.


#### 4.2.4. User Confirmation Mechanism

In fact, the operation of a whole system is not isolated, and the attack also exists. In order to improve the system security and protect the lawful rights and interests of customers, the proposed scheme particularly introduces this mechanism. First of all, symmetric key is generated betweenU and O in the withdrawing phase. In the depositing phase, O obtains I
D
P, I
D
U, SN, and GI and computes (25).After receivingE
P
O
_
U from O, U can decrypt it and generate a feedback (agree on or reject the transaction). Finally, according to the user’s feedback information, O completes/terminates the depositing process.


## 4.1. The Performance Analysis

Compared with authentication mechanism of CBCS and IDBCS, the efficiency SVDSS authentication is higher. The reason is that this scheme adopts the self-verified signature mechanism to implement authentication between transactions entities, eliminate the need for frequent transfer certificate and verification, and save communication cost. In the specific verification process, the proposed scheme adopts the mechanism based on ECC. Compared with the public key cryptosystem (PKC) [6], ECC uses smaller key length to meet the same level of security and bear very low computational burden [7]. After trading entity verifies that each side is legal object, it achieves symmetric encryption/decryption using the symmetric key. In the concrete scheme, it further improves the system efficiency from the following two aspects.


### 4.1.1. Payment Efficiency

In the previous mobile commerce, hash function was used to generate electronic money instead of cash.T
H denotes the execution time for executing the hash function for token generation and verification. As for T
H denotes 0.006 ms on 15 a Pentium IV 3.0 GHz with 2 GB. In the literature [1], in order to generate and verify N tokens, the total number of hash operation performed is 3 N in the entire transaction process (including the generating, using, and redeeming of electronic token). In the literature [2], when U obtains the tokens from O, U did not use hash function but did get the tokens directly. So the total number of hash operation performed is 2 N. According to literature [1, 2], the total execution time for token generation and verification is 3
N
T
H and 2
N
T
H. Usually, the number N is from 50 to 50,000. The total execution time of token generation and verification is illustrated in Figure 5, where the literature [1, 2] introduces the Lin et al.’s scheme and Yang and chang’s scheme, respectively. In the proposed scheme, U does not use hash function to generate the electronic tokens; the user directly obtains V
N from O. The total price of the goods purchased keeps accumulating in P, as long as the price does not exceed V
N. Therefore, compared with literature [1, 2], payment efficiency of proposed scheme has been greatly improved.Figure 5
The analysis of payment efficiency.


### 4.1.2. Message Encryption and Decryption

Recently, in order to improve the efficiency of mobile commerce, symmetric key mechanisms have been applied actively. However, due to the difficulties of key management of symmetric key, the concrete scheme of mobile commerce is based on asymmetric keys, to generate a symmetric key between trading entity. According to literature [1], the system generates symmetric key between entities, but the public/private key that can generate symmetric key exists in the KDC. Once the KDC information leakage occurs, the security of the whole system will be under threat. And the generated symmetric keys in subsequent transactions are not continuously updated, which will result in the insecurity of the system. In the literature [2], both the symmetric keys are generated by executing three times point multiplication over E
q
a
,
b during each paying phase. In the paying phase, assume U and P execute J times payment, the total execution time for generating the symmetric keys is 3J
T
ECC.T
ECC denotes the time of the multiplication on an elliptic curve E
q
a
,
b. In this paper, the scheme generates the first pair symmetric key in the first process during the paying phase. In the subsequent transaction, only the hash function is used to update the symmetric key K
s
P
_
U
J
=
H
K
J
(
K
s
P
_
U
). The total execution time for generating the symmetric keys is 3
T
ECC
+
(
J
-
1
)
*
2
*
T
H. In fact, T
ECC is much larger than T
H. This will further reduce the computing cost of the system and improve the execution efficiency. As is shown in Figure 6, the computational cost of generating symmetric key in the proposed scheme is higher than that in the literature [2].Figure 6
The analysis of generating symmetric key.


## 4.1.1. Payment Efficiency

In the previous mobile commerce, hash function was used to generate electronic money instead of cash.T
H denotes the execution time for executing the hash function for token generation and verification. As for T
H denotes 0.006 ms on 15 a Pentium IV 3.0 GHz with 2 GB. In the literature [1], in order to generate and verify N tokens, the total number of hash operation performed is 3 N in the entire transaction process (including the generating, using, and redeeming of electronic token). In the literature [2], when U obtains the tokens from O, U did not use hash function but did get the tokens directly. So the total number of hash operation performed is 2 N. According to literature [1, 2], the total execution time for token generation and verification is 3
N
T
H and 2
N
T
H. Usually, the number N is from 50 to 50,000. The total execution time of token generation and verification is illustrated in Figure 5, where the literature [1, 2] introduces the Lin et al.’s scheme and Yang and chang’s scheme, respectively. In the proposed scheme, U does not use hash function to generate the electronic tokens; the user directly obtains V
N from O. The total price of the goods purchased keeps accumulating in P, as long as the price does not exceed V
N. Therefore, compared with literature [1, 2], payment efficiency of proposed scheme has been greatly improved.Figure 5
The analysis of payment efficiency.


## 4.1.2. Message Encryption and Decryption

Recently, in order to improve the efficiency of mobile commerce, symmetric key mechanisms have been applied actively. However, due to the difficulties of key management of symmetric key, the concrete scheme of mobile commerce is based on asymmetric keys, to generate a symmetric key between trading entity. According to literature [1], the system generates symmetric key between entities, but the public/private key that can generate symmetric key exists in the KDC. Once the KDC information leakage occurs, the security of the whole system will be under threat. And the generated symmetric keys in subsequent transactions are not continuously updated, which will result in the insecurity of the system. In the literature [2], both the symmetric keys are generated by executing three times point multiplication over E
q
a
,
b during each paying phase. In the paying phase, assume U and P execute J times payment, the total execution time for generating the symmetric keys is 3J
T
ECC.T
ECC denotes the time of the multiplication on an elliptic curve E
q
a
,
b. In this paper, the scheme generates the first pair symmetric key in the first process during the paying phase. In the subsequent transaction, only the hash function is used to update the symmetric key K
s
P
_
U
J
=
H
K
J
(
K
s
P
_
U
). The total execution time for generating the symmetric keys is 3
T
ECC
+
(
J
-
1
)
*
2
*
T
H. In fact, T
ECC is much larger than T
H. This will further reduce the computing cost of the system and improve the execution efficiency. As is shown in Figure 6, the computational cost of generating symmetric key in the proposed scheme is higher than that in the literature [2].Figure 6
The analysis of generating symmetric key.


## 4.2. The Security Analysis

The authors analyze the security of proposed scheme as follows.


### 4.2.1. Prevent Impersonation Attack

Assume that an attacker makes an attempt to modify the response information returned toO [13–15]. Obviously, the attacker needs to forge a set of data, including V
U, (
E
u
,
S
u
). After receiving the forged information, O will naturally enter into the verification mode by computing (11) and (12).IfC
U
_
O is not equal to C
U
_
O
′, O discovers the user is illegal and then rejects the transaction. The same authentication mechanism also occurs between O user and P. The proposed scheme makes full use of this authentication mechanism to prevent impersonation attack.


### 4.2.2. User Anonymity

In electronic payment schemes, the vender (service provider) does not need to know the user’s real identity to protect the user’s privacy [16, 17]. Provider obtains the payment information (17).It does not contain identity information about user; service providers’ judgment of the source information is based on the validity ofSig
(
V
N
∥
SN
∥
I
D
P
)
. Subsequent transactions are based on (
K
s
P
_
U
,
V
N
,
SN
); as long as the total price of the purchased goods does not exceed V
N, the entire transaction can continue proceeding. P redeems the I
=
P
1
+
P
2
+
⋯
+
P
J from O based on SN in the depositing phase. In the process of the whole system, vender has no access to the user’s identity information.


### 4.2.3. Confidentiality

Through the analysis of the concrete transaction process, information of the transaction between entities is held by pairwise symmetric key to encrypt/decrypt. Concrete example is as follows.Equations (17) and (19) achieve the secure transfer of information between U and P.Equations (20) and (21) achieve the secure transfer of information between U and O. However, compared to the asymmetric keys, symmetric keys are easy to crack [18, 19]. Thus during the transaction phase, the symmetric key between the user and the service provider is continuously updated, which can also prevent the Man-in-the-Middle attack.


### 4.2.4. User Confirmation Mechanism

In fact, the operation of a whole system is not isolated, and the attack also exists. In order to improve the system security and protect the lawful rights and interests of customers, the proposed scheme particularly introduces this mechanism. First of all, symmetric key is generated betweenU and O in the withdrawing phase. In the depositing phase, O obtains I
D
P, I
D
U, SN, and GI and computes (25).After receivingE
P
O
_
U from O, U can decrypt it and generate a feedback (agree on or reject the transaction). Finally, according to the user’s feedback information, O completes/terminates the depositing process.


## 4.2.1. Prevent Impersonation Attack

Assume that an attacker makes an attempt to modify the response information returned toO [13–15]. Obviously, the attacker needs to forge a set of data, including V
U, (
E
u
,
S
u
). After receiving the forged information, O will naturally enter into the verification mode by computing (11) and (12).IfC
U
_
O is not equal to C
U
_
O
′, O discovers the user is illegal and then rejects the transaction. The same authentication mechanism also occurs between O user and P. The proposed scheme makes full use of this authentication mechanism to prevent impersonation attack.


## 4.2.2. User Anonymity

In electronic payment schemes, the vender (service provider) does not need to know the user’s real identity to protect the user’s privacy [16, 17]. Provider obtains the payment information (17).It does not contain identity information about user; service providers’ judgment of the source information is based on the validity ofSig
(
V
N
∥
SN
∥
I
D
P
)
. Subsequent transactions are based on (
K
s
P
_
U
,
V
N
,
SN
); as long as the total price of the purchased goods does not exceed V
N, the entire transaction can continue proceeding. P redeems the I
=
P
1
+
P
2
+
⋯
+
P
J from O based on SN in the depositing phase. In the process of the whole system, vender has no access to the user’s identity information.


## 4.2.3. Confidentiality

Through the analysis of the concrete transaction process, information of the transaction between entities is held by pairwise symmetric key to encrypt/decrypt. Concrete example is as follows.Equations (17) and (19) achieve the secure transfer of information between U and P.Equations (20) and (21) achieve the secure transfer of information between U and O. However, compared to the asymmetric keys, symmetric keys are easy to crack [18, 19]. Thus during the transaction phase, the symmetric key between the user and the service provider is continuously updated, which can also prevent the Man-in-the-Middle attack.


## 4.2.4. User Confirmation Mechanism

In fact, the operation of a whole system is not isolated, and the attack also exists. In order to improve the system security and protect the lawful rights and interests of customers, the proposed scheme particularly introduces this mechanism. First of all, symmetric key is generated betweenU and O in the withdrawing phase. In the depositing phase, O obtains I
D
P, I
D
U, SN, and GI and computes (25).After receivingE
P
O
_
U from O, U can decrypt it and generate a feedback (agree on or reject the transaction). Finally, according to the user’s feedback information, O completes/terminates the depositing process.


## 5. Conclusions

This scheme is based on the self-verified mechanism, the application of ECC, key agreement mechanism, prepayment mechanism, and other technologies to guarantee security and high efficiency of this proposed scheme. The proposed scheme does not need certificate management, which avoids the burden of network node storage certificate in CBCS and the communication overhead due to transferring certificate at the same time. The use of the self-verified mechanism avoids the defects of key escrow of IDBCS and no longer requires KDC to maintain a set of large user authentication tables, which can greatly reduce the system burden. The proposed scheme also takes advantage of updated symmetric key and user confirmation mechanism to guarantee the security. In a word, this scheme possesses the advantages of the current trading system which ensures the real time and user anonymity and further improves efficiency and security of system.



---

*Source: 103136-2014-12-28.xml*