Table Of ContentSpringerBriefs in Computer Science
Cătălin Bîrjoveanu · Mirela Bîrjoveanu
Secure
Multi-Party
E-Commerce
Protocols
SpringerBriefs in Computer Science
SeriesEditors
StanZdonik,BrownUniversity,Providence,RI,USA
ShashiShekhar,UniversityofMinnesota,Minneapolis,MN,USA
XindongWu,UniversityofVermont,Burlington,VT,USA
LakhmiC.Jain,UniversityofSouthAustralia,Adelaide,SA,Australia
DavidPadua,UniversityofIllinoisUrbana-Champaign,Urbana,IL,USA
XueminShermanShen,UniversityofWaterloo,Waterloo,ON,Canada
BorkoFurht,FloridaAtlanticUniversity,BocaRaton,FL,USA
V.S.Subrahmanian,UniversityofMaryland,CollegePark,MD,USA
MartialHebert,CarnegieMellonUniversity,Pittsburgh,PA,USA
KatsushiIkeuchi,UniversityofTokyo,Tokyo,Japan
BrunoSiciliano,UniversitàdiNapoliFedericoII,Napoli,Italy
SushilJajodia,GeorgeMasonUniversity,Fairfax,VA,USA
NewtonLee,InstituteforEducation,ResearchandScholarships,LosAngeles,CA,
USA
SpringerBriefs present concise summaries of cutting-edge research and practical
applicationsacrossawidespectrumoffields.Featuringcompactvolumesof50to
125pages,theseriescoversarangeofcontentfromprofessionaltoacademic.
Typicaltopicsmightinclude:
(cid:129) Atimelyreportofstate-of-theartanalyticaltechniques
(cid:129) A bridge between new research results, as published in journal articles, and a
contextualliteraturereview
(cid:129) Asnapshotofahotoremergingtopic
(cid:129) Anin-depthcasestudyorclinicalexample
(cid:129) A presentationofcoreconceptsthatstudentsmustunderstandinordertomake
independentcontributions
Briefsallowauthorstopresenttheirideasandreaderstoabsorbthemwithminimal
time investment. Briefs will be published as part of Springer’s eBook collection,
withmillionsofusersworldwide.Inaddition,Briefswillbeavailableforindividual
print and electronic purchase. Briefs are characterized by fast, global electronic
dissemination, standard publishing contracts, easy-to-use manuscript preparation
and formatting guidelines, and expedited production schedules. We aim for pub-
lication 8–12 weeks after acceptance. Both solicited and unsolicited manuscripts
areconsideredforpublicationinthisseries.
**Indexing:ThisseriesisindexedinScopus,Ei-Compendex,andzbMATH**
Ca˘ta˘lin V. Bîrjoveanu (cid:129) Mirela Bîrjoveanu
Secure
Multi-Party
E-Commerce
Protocols
Ca˘ta˘linV.Bîrjoveanu MirelaBîrjoveanu
DepartmentofComputerScience VitescoTechnologies
AlexandruIoanCuzaUniversity Iasi,Romania
Iasi,Romania
ISSN2191-5768 ISSN2191-5776 (electronic)
SpringerBriefsinComputerScience
ISBN978-3-030-99350-4 ISBN978-3-030-99351-1 (eBook)
https://doi.org/10.1007/978-3-030-99351-1
©TheAuthor(s),underexclusivelicensetoSpringerNatureSwitzerlandAG2022
Thisworkissubjecttocopyright.AllrightsaresolelyandexclusivelylicensedbythePublisher,whether
thewhole orpart ofthematerial isconcerned, specifically therights oftranslation, reprinting, reuse
ofillustrations, recitation, broadcasting, reproductiononmicrofilmsorinanyotherphysicalway,and
transmissionorinformationstorageandretrieval,electronicadaptation,computersoftware,orbysimilar
ordissimilarmethodologynowknownorhereafterdeveloped.
Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublication
doesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevant
protectivelawsandregulationsandthereforefreeforgeneraluse.
Thepublisher,theauthorsandtheeditorsaresafetoassumethattheadviceandinformationinthisbook
arebelievedtobetrueandaccurateatthedateofpublication.Neitherthepublishernortheauthorsor
theeditorsgiveawarranty,expressedorimplied,withrespecttothematerialcontainedhereinorforany
errorsoromissionsthatmayhavebeenmade.Thepublisherremainsneutralwithregardtojurisdictional
claimsinpublishedmapsandinstitutionalaffiliations.
ThisSpringerimprintispublishedbytheregisteredcompanySpringerNatureSwitzerlandAG
Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland
To ourchildren,
DianaAndreeaand Ca˘linPaul
Preface
Therapid,widespreaddevelopmentofthedigitalworld(Internet,communications,
software,smartdevices)ismakingtraditionalcommerceobsoleteandreplacedbye-
commerce,whichisbecominganormalcyofeverydaylife.E-commerceispresent
when you want to do online shopping, pay a bill, pay taxes, or access a certain
resourcefroma digitallibrary.Theusageon a largescale of e-commerceleadsto
new business models that require multiple parties to be involved.The widespread
use of e-commerce in various ranges of applications opens up security breaches
whose exploitation leads to major damage to all parties involved: customers,
merchants,and e-commerceplatforms.Thus, e-commerceprotocolsmust provide
protectionagainstexternalattacksaswellasfrominternalattacksinitiatedbyone
oftheparticipantsintheonlinetransaction.Fairnessisoneofthekeyrequirements
thate-commerceprotocolsmustguarantee.Acustomerwhopaysthemerchantfor
aproductwantstobesurethathewillreceivethepaidproductfromthemerchant.
Ontheotherhand,themerchantwhosuppliestheproducttothecustomerwantsto
beassuredthathewillreceivethecorrespondingpaymentfromthecustomer.When
multiplepartiesareinvolved,guaranteeingfairnessismuchharder.
The main goal of this book is to develop secure multi-party e-commerce
protocols which is a challenging issue because the extension from two-party
to multi-party is a difficult task. The hardship of designing secure multi-party
e-commerceprotocolsresidesinmultipleparticipants(customer,merchants,inter-
mediaries, providers), the bundle nature of the goods purchased by the customer,
andinthefactthatsomeessentialsecurityrequirementsfromtwo-partye-commerce
scenariosarenotpreservedinmulti-partye-commercescenarios.Inordertoreflect
the multiple possibilities in which the customer can place an order for online
shopping,weconsidercomplextransactionsascombinationsofaggregate,optional,
andpartialtransactions.Optionaltransactionsallowthecustomertoprovidemany
preferences regarding physical products he wants to buy, aggregate transactions
allowthecustomertobuyanentirepackofproducts,andpartialtransactionsallow
the customer to acquire only a part of a pack. Another topic coveredin this book
is the chained transaction in which the customer buys a physical product from a
providerusingmanyintermediaries.
vii
viii Preface
The first step in designingsecure multi-partye-commerceprotocolsis to adapt
the definition of desired security requirements from two-party to multi-party.
Some security requirements can be extended straightforward, but for fairness,
effectiveness,andtimeliness,weneedtopayspecialattention.Themaingoalofthe
bookis to providemulti-partye-commerceprotocolsthatguarantee(amongother
securityproperties)strongfairnessincomplextransactions,chainedtransaction,and
theircombination,respectively.
The customer’sprivacyin complextransactionsis anothersubjectaddressedin
this book. Maintaining privacy of the customer brings new challenges: ensuring
privacyforthecustomerinpaymentandinphysicalproductsdelivery.
A chapter of this book is dedicated to formal verification of multi-party e-
commerceprotocolsusingAVISPA.Thisisanelaboratetaskduetothecomplexity
ofthesetypesofprotocols.
This bookis mainly targeted at researchersand practitioners,particularlyfrom
the e-commerce security field and generally from the information security field.
Further,itcanbeusedassupportforuniversitycoursesinthesefields.Webelieve
that this book can be interesting for specialists in e-commerce who will find a
starting point regarding secure e-commerce protocols involving multiple parties.
Thisbookcanalsobeusedbypersonswhohaveageneralinterestine-commerce
protocolsbecause it offersstate of the art andreview for two-partyand for multi-
partyfairexchangeprotocols.
Ias¸i,România Ca˘ta˘linV.Bîrjoveanu
February16,2022 MirelaBîrjoveanu
Contents
1 Introduction .................................................................. 1
1.1 E-CommerceTypesandFeatures ...................................... 1
1.2 SecurityThreatsinE-Commerce....................................... 3
1.3 E-CommerceSecurityRequirementsandProtocols................... 4
1.4 ChallengesandPurposesoftheBook.................................. 9
1.5 BookStructure .......................................................... 11
References..................................................................... 12
2 Two-PartyE-CommerceProtocols......................................... 15
2.1 State-of-the-ArtAnalysis............................................... 15
2.2 SubtransactionProtocol................................................. 23
2.2.1 ExchangeSub-protocol......................................... 24
2.2.2 ResolutionSub-protocol........................................ 26
2.3 Protocol with Physical Product Delivery Providing
Customer’sPrivacy...................................................... 27
2.3.1 SPaymentSub-protocol ........................................ 32
2.3.2 SDeliverySub-protocol......................................... 34
2.3.3 ResolutionSub-protocols....................................... 35
2.3.4 SecurityAnalysis............................................... 37
2.4 ComparativeAnalysis................................................... 39
References..................................................................... 40
3 Multi-partyE-CommerceProtocolsforComplexTransactions........ 43
3.1 State-of-the-ArtAnalysis............................................... 43
3.2 B2BandB2CUseCases ............................................... 47
3.3 SecurityRequirements.................................................. 48
3.4 ComplexTransactionProtocol ......................................... 49
3.4.1 AggregateAbortSub-protocol.................................. 54
3.5 ComplexTransactionProtocolProvidingCustomer’sPrivacy ....... 57
3.5.1 CTPCPSecurityDiscussion.................................... 59
ix
x Contents
3.6 ComparativeAnalysis................................................... 61
References..................................................................... 62
4 E-CommerceProtocolsforMulti-chainedComplexTransactions..... 65
4.1 State-of-the-ArtAnalysis............................................... 65
4.2 ApplicationsB2C/B2B ................................................. 68
4.3 SecurityRequirements.................................................. 69
4.4 ChainedTransactionProtocol.......................................... 70
4.4.1 Resolution1Sub-protocol...................................... 75
4.4.2 Resolution2Sub-protocol...................................... 77
4.5 Multi-chainedComplexTransactionsProtocol........................ 78
4.5.1 AggregateChainsAbortSub-protocol.......................... 79
References..................................................................... 80
5 Formal Verification of Multi-party Fair Exchange
E-CommerceProtocols...................................................... 81
5.1 AVISPATool............................................................ 81
5.1.1 High-LevelProtocolSpecificationLanguage ................. 82
5.1.2 VerificationResultsUsingAVISPA............................ 90
5.2 VerificationofComplexTransactionProtocols........................ 94
References..................................................................... 105
6 Conclusions................................................................... 107
