解析及建立電子商務中價值移轉週期的證據責任鏈

Chain of Evidence in a Cycle of Value Transfers for Electronic Commerce

10.6382/JIM.200301.0109

黃景彰(Jing-Jang Hwang)；邵敏華(Min-Hua Shao)；吳壽山(Sou-Shan Wu)

證據責任鏈 ； 價值移轉週期 ； 不可否認服務 ； 電子商務 ； Chain of Evidence ； Value Transfers Cycle ； Non-repudiation Services ； Electronic Commerce

資訊管理學報

9卷2期（2003 / 01 / 01）

109 - 128

繁體中文

只要是商業交易，爭議的發生就無法避免。在實體商業世界中，商業行為的爭議解決機制已經存在；同樣地，在網路數位化社會中，電子化商務的有效運作，也必須依賴合適的制度來規範，稱為「不可否認服務(non-repudiation service)」，定義在國際標準組織(IS○)與國際電工協會(IEC)所制定的標準文件中[10, 11, 12, 13]。無論採取何種途徑解決，「證據」是這些服務能否有效發揮的關鍵所在；目前在相關的國際標準文件或學術文獻中，是以單一件證據為處理對象，主要是用於證明單一事件或動作曾經發生的資訊，然而單一事件的資訊大多是局部的事實陳述，無法清楚勾勒出一事件發生的因果關係，因為商業交易是由連續的活動所組成；連續的商業事件可以形成一個「價值移轉週期(value transfer cycle)」。以「價值移轉週期」作為解析的基礎，本文提出了電子商務環境中的「證據責任鏈」，加入更週延的證據概念，補強相關標準文件在證據處理上的不足。其次，我們以一個典型的線上信用卡付款系統－Secure Electronic Transaction (SET)為例，說明本文所提出的模式與概念在SET系統中如何運用，這個部份特別是證據責任鏈之產生及使用，並沒有被SET的原創者納入在其規範文件中[20]。本文的目的是為電子化交易環境提供一個更完善的證據處理機制，這是任何爭議解決機制的首要工作。我們希望本篇研究能為數位化的商業交易環境中的不可否認服務工作，提供一些學理上的支援。

Disputes are inevitable in business. Disputes in the real world have varied ways to resolve; in the virtual world there are a few types of non-repudiation service as defined in the ISO/IEC standards [10, 11, 12, 13]. Whatever actions are taken, evidence is the key to the successful conduct of these services. These above standards and some papers only define the concept of using a single piece of evidence that cannot describe the relation between cause and effect completely. In business, no activity is atomic and so evidence does not exist as an atomic piece but exists in a form of relevant pieces of evidence. In other words, we must consider a series of activities as formed a cycle of value transfers. Therefore, we introduce the chain-of-evidence concept to electronic commerce as a base for the refinement of the pertinent international standards. The chain of evidence can be analyzed and derived from the cyclic model of value .transfers. Moreover, we have conducted a case study on Secure Electronic Transaction (SET), a typical system designed for on-line credit card payment. In this case, we present the chain of evidence associated with the value transfer cycle that may not have been defined in the original SET specifications. The purpose of this paper provides a better evidence management mechanism that is the first step of whichever disputes settling way. As a result, we expect this research contribute to a theoretical support for disputes resolution in the practical world.

1. 黃景彰 Hwang, Jing-Jang、沈曉芸 Shen, Hsiao-Yun(2001)。電子商業交易的爭議解決機制。資訊管理學報 Journal of Information Management，8(2)
   連結：
2. (1996).Applied Crytography.United States of America:John Wiley ＆ Sons, Inc..
3. (2000).Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet.Academic Press.
4. (1989).Oxford Advanced Learner's Dictionary.Oxford University Press.
5. (1999).Handbook of Information Security Management.Boca Raton, Fla.:Auerbach.
6. Abad Peiro, J. L.,Asokan, N.,Steiner, M.,Waidner, M.(1998).Designing a Generic Payment Service.IBM Systems Journal,37(1)
7. Ainsworth, K.(2000).Non-repudiation - Simple to understand, Difficult to implement.
8. Asokan, N.,Herreweghen, E. V.,Steiner, M.(1998).Third USENIX Workshop on Electronic Commerce.Boston, Mass:
9. Asokan, N.,Schunter, M.,Waidner, M.(1996).Optimistic Protocols for Multi-Party Fair exchange.IBM Research.
10. Committee on Consumer Policy, Directorate for Science, Technology and Industry, Organization for Eco(2001).Inventory of Consumer Protection Laws, Policies and Practices Applied to Electronic Commerce.
11. Gartner, F.,Pagnia, H.,Vogt, H.(1999).Proceeding of the 18th IEEE Symposium on Reliable Distributed Systems.
12. Herreweghen, E. V.(1999).Using Digital Signatures as Electronic of Authorizations in Evidence Credit-Card Payments.IBM Research.
13. International Organization for Standardization/ International Electrotechnical Commission(1997).Information Technology - Open Systems Interconnection - Security frameworks for open system: Non-repudiation framework.
14. International Organization for Standardization/ International Electrotechnical Commission(1997).Information Technology - Security Techniques - Non-repudiation Part 2: Mechanisms using symmetric techniques.
15. International Organization for Standardization/ International Electrotechnical Commission(1997).Information Technology - Security Techniques - Non-repudiation Part 1: General.
16. International Organization for Standardization/ International Electrotechnical Commission(1997).Information Technology - Security Techniques - Non-repudiation Part 3: Mechanisms using asymmetric techniques.
17. Knaster, A. S.(1988).OCEANS'88 Proceedings of a Partnership of Marine Interests.
18. Pfitzmann, B.,Waidner, M.(1996).Properties of Payment Systems: General Definition Sketch and Classification.IBM Research.
19. Tygar, T. D.(1998).Atomicity in Electronic Commerce.Mixed Media,April/ May
20. Zhou, Jianying,Gollmann, D.(1997).Evidence and non-repudiation.Journal of Network and Computer Applications,20(3)
21. 黃景彰 Hwang, Jing-Jang(2001)。資訊安全電子商務之基礎。臺北市:華泰文化。

1. 張琬喻,涂良育(2004).台灣企業宣告從事電子商務對股東財富的影響.臺灣管理學刊,4(2),161-185.