Improving WTLS Security for WAP Based Mobile e-Commerce

摘要

In recent years, WAP has been gaining increasing popularity as a platform for mobile e-commerce; its security has thus become an important issue. In this paper, we focus primarily on improving WTLS, a sub-protocol of WAP, to achieve enhanced WAP security. We propose using an Anonymous Client Authentication (ACA) scheme, which can be applied in general to most Public Key Infrastructure based mobile e-commerce applications, to be incorporated into WTLS to provide client anonymity in WAP. Further, in order to support the desired security feature forward secrecy, and to resist various attacks which could hardly be coped with by the original WTLS, we exploit Elliptic Curve Cryptography (ECC) for session key establishment. The proposed protocol has been shown able to outperform not only the original WTLS protocol, but also the published improved WTLS protocols in terms of computation cost and communication bandwidth. Besides, the proposed ACA scheme can also be exploited in other internet and wireless network based platforms.