Hsiang m-kupon protokolünün güvenlik analizi

Abstract

To show that the protocol is secure by the result of the security analysis obtained with the developed simulation and formal security analysis tool Scyther  Examination of the protocol against known attacks by using man in the middle and eavesdropping  Providing data security to seller and customer while shopping Although there are a large number of applications developed for users and their numbers increase day by day, the security analyzes of the applications do not progress in parallel with this increase. In the studies, the security analysis is never mentioned or is only described as superficial. For instance, a novel issue used on mobile devices: m-coupon which is a special coupon and used to give special discount to the customers. One of the important things that mobile coupon usage needs to be widespread is ensuring of user security. (a) Hsiang's m-coupon protocol (b) Analysis result of the protocol with the Scyther tool Figure A. Security analysis of Hsiang's m-coupon protocol Purpose: M-coupon scheme can't be secured just using only known cryptographic algorithms. Although cryptographic algorithms are an essential part of the protocol, security cannot be guaranteed by using cryptographic algorithms alone. Additionally security analysis of the protocol which is the essential part of the process must be done thoroughly. The fact that there is not enough work in this area and that there is often no explanation for the method by which security analyzes are claimed to be safe were the source of inspiration for this study. As a subject, the safety analysis of NFC-based m-coupons, which are considered to be widely used in the near future, has been selected. Theory and Methods: Hsiang's NFC based m-coupon scheme has been analyzed by using Game Theory and automated security protocol validation tool Scyther. In the simulation, a communication is established between the coupon provider, the customer and the cashier, and the packages are sent. By listening the established communication, the attacker established multiple cash-in attack, replay attack, impersonation attack, unauthorized coupon copying/generation, invalidation of the coupon attack and secret disclosure attack, then examined whether he can unpack the packages he obtained or can manipulate the system. Results: At the issuing phase of Hsiang's m-coupon protocol some vulnerabilities have been found with the simulation and Scyther security analysis tool which is used to verify security protocols. Conclusion: By using the vulnerabilities, some attacks have been illustrated to the scheme and then solutions are offered to these vulnerabilities.