Abstract

With the advent of an increasing number of multicast services such as audio/video streaming, news broadcast and software distribution, accounting for the resources consumed by subscribers becomes essential. However, multicast environments are inherently more susceptible to attacks because there is as yet no proper foundation for securing multicast networks. However, any e-commerce operational environment requires support for the security properties such as authentication, authorization, data confidentiality, and non-repudiation. As secured multicast services gain popularity in the Internet, at one point there would be a significant response from the service providers to support e-commerce through multicast networks. In this thesis, a Multicast Security Protection Profile (MSPP) has been presented to identify and secure the operating environment of multicast sessions. Although e-commerce protocols such as SSL, TLS, and SET protocols offer some forms of security in e-transactions, they cannot be directly extended to provide security for e-commerce sessions in the multicast (point-to-multipoint) environment. Therefore, we have designed an architectural framework, called the Secure E-Commerce Transactions for Multicast Services (SETMS), to secure e-commerce sessions for multicast environments. The SETMS framework provides authentication of host through the HIP protocol, authorization of subscriber and his e-payments through a variant of the 2KP protocol, a procedure to account for the subscriber's resource consumption, and support for non-repudiation of principal parties through PKI. The SETMS framework has been evaluated using the Common Criteria based MSPP security specification and formally validated using the AVISPA tool