京都大学 / 0048 / 新制・課程博士 / 博士(生命科学) / 甲第22608号 / 生博第441号 / 新制||生||58(附属図書館) / 京都大学大学院生命科学研究科高次生命科学専攻 / (主査)教授 朝長 啓造, 教授 野田 岳志, 教授 千坂 修 / 学位規則第4条第1項該当 / Doctor of Philosophy in Life Sciences / Kyoto University / DFAM

「流動性」、「安全性」、「獲利性」三目標間之如何適度組合與運用，使銀行之經 營管理成為一門特殊藝術，本文之研究內容，即由一個體商業銀行經營時所面臨的這 三個目標間之消長關係談起，剖析一銀行在面臨存款提取之波動性與滿足客戶信用需 求之必要性－－所謂「存款流動性」與「放款流動性」之雙面壓力下，一銀行之流動 性調整行為。全文共分五章，約五萬餘字，逐次分由資金來源面與運用面探討影響流 動性需求的因素，維持流動性之優先順序，流動性資金之項目與性質、流動性狀況之 衡量、銀行流動性之調整行為模型等，並以樣本資料分析台灣之商業銀行流動性管理 ：在綜合存款與放款之雙重流動性需求之流量觀念下，分析一銀行應持有多少流動性 (How much liquidity to hold)以何種方式持有(in what forms to hold) 、長期流 動性需求之估計、未來存放款總額之估計等有關四項問題，最後並提出若干結論與建 議。

本論文提出了一個免憑證加密系統的方案，並且將此方案實作出來，使得此方案更具實用性。此方案主要架構為免憑證加密系統，利用此系統的特性消除傳統公開金鑰密碼系統中需要公開金鑰憑證認證的麻煩，也不會產生基於身分認證加密系統的私鑰託管問題，有效的結合了兩項系統的優點，並且提高了這兩種系統的安全性及方便性。本論文的協定中，在基於身分認證加密系統的公鑰部分還加入了階級以及時間戳記的概念，用以限制接收方取得部份私鑰的能力，並且也將接收方的部分公鑰加入其中，來增加部份私鑰的安全性。另外此協定也加入了提早解密金鑰的部分，可讓傳送方在傳出密文後更改解密時間，而不需要重新使用新的公鑰加密資訊，便可提早讓接收方取得相對應的明文資訊。 / In this paper, we propose a new certificateless public key encryption system, and implement it for securing e-mail systems. Certificateless cryptography, which is in contrast to traditional public key crypto-systems, does not require the use of certificates to guarantee the authenticity of public key. It does rely on the use of a trusted third party (TTP) who is in possession of a master key, just like the identity-based public key cryptography. However, certificateless public key crypto-system does not suffer from the key escrow property, whereas, it is a problem in the identity-based public key crypto-systems. Moreover, in our system, we add some new properties like level and time-stamp to limit the ability of receivers and to promote the safety of the system. Time-stamp ensures that the ciphertext cannot be decrypted before the indicated time and a level ensures that only the user with the corresponding identity and level can decrypt the ciphertext. In addition, a new feature is also introduced which is called the time-release encryption. Time-release encryption allows the encrypter to publish a release key so that the ciphertext can be decrypted by the receiver before the time indicated in the time-stamp when necessary.

Kyoto University (京都大学) / 0048 / 新制・論文博士 / 博士(工学) / 乙第12740号 / 論工博第4091号 / 新制||工||1575(附属図書館) / 30553 / (主査)教授 大津 宏康, 教授 松岡 俊文, 教授 清野 純史 / 学位規則第4条第2項該当

近年來，隨著網際網路的普及，電子商務蓬勃發展，線上拍賣蔚為風氣，然而新事業往往帶來新的風險。在電子商務環境下，企業應採行必要的控制，以使線上交易順利安全地完成，並確保客戶的隱私、增加顧客的信賴感，進而提昇企業營運與聲譽。線上拍賣所涉及外部人士相當多，其所提供的個人及競價交易資料相當龐雜。因此，從事線上拍賣之公司執行內部控制時，除考慮其內部環境之控管外，也應考量其對於線上拍賣參與者之影響。 本研究之目的在於探討線上拍賣環境下的交易控制。根據相關文獻，本研究彙整出一套線上拍賣交易控制實務的評估架構及準則，以國內兩大線上拍賣網站：Yahoo！與eBay為個案，進行比較及分析，並作為設計研究問卷之基礎。其次，本研究利用問卷調查目前參與線上拍賣者以及潛在使用者對於現有線上拍賣交易控制之看法，藉以瞭解填答者對於不同交易控制構面之滿意度及其影響因素。 經由上述之個案研究及問卷資料統計分析，本研究發現： 1、 在個案分析及比較方面，就隱私性而言，兩個案網站皆僅提供制式的隱私權政策，使用者無法選擇部分同意，而被迫提供超過其意願之資料或無法禁止第三者使用其資料。在交易完整性方面，兩個網站皆提供相當完整但繁複之政策，但可考慮將所有政策彙整歸類，以便於使用者夠迅速取得必要之資訊。至於交易安全性方面，兩網站可增加對使用者之溝通，讓使用者不但明瞭其自身的義務，亦能瞭解企業對保護整體拍賣系統之承諾。 2、 就滿意度而言，eBay使用者對於該網站政策之滿意度高於Yahoo！使用者，但Yahoo！使用者對於該網站提供之交易平台之滿意度則高於eBay使用者。 3、 就問卷統計分析結果而言，拍賣網站使用者最為重視：（1）網站必須足以完善保障其個人資料及隱私權，以及（2）網站足以確保交易之完整性。換言之，使用者擔心其所提供之各項資料考能遭到竊取、盜用或不當使用，並憂慮交易過程中可能發生的詐欺或不公平行為。不過，使用者雖然相當擔心其所面臨的風險，其對於網站相關政策之瞭解，卻不是全面及深入的，並認為此等政策僅有普通的完善度，滿意度也僅略高於普通。 4、 使用者及潛在使用者對於拍賣交易之整體看法顯著不同，前者較後者傾向肯定線上拍賣，並有較高的願意繼續於線上交易，即使在發現可能遇見交易風險時，也較傾向繼續使用該交易平台。 5、 問卷發放方式會影響實證結果。本研究問卷同時採用網路發放及現場發放，兩種來源回收的問卷在基本資料上有以下之差異： （1） 年齡差異：網路樣本較現場樣本年輕。 （2） 職業差異：網路樣本多為學生，現場樣本多為實務界人士。 （3） 交易次數差異：網路樣本較現場樣本有較多次的交易經驗。 （4） 上網時數差異：網路樣本之上網時數高於現場樣本。 進一步分析顯示，兩組樣本對於政策之認同、資料安全、政策瞭解度、危害考量及整體滿意度皆有顯著差異。網路填答者對網路政策認同度高，較不擔心資料安全問題，遭遇危害後也較願意繼續使用交易平台，整體滿意度也較佳，但卻不如現場填答者願意瞭解拍賣網站政策。因此，後續研究者似應考量不同問卷發放方式及對象，對於其實證結果可能帶來的影響。 6、 綜合上述可知，無論就個案比較分析或問卷結果而言，兩個案網站之隱私性、完整性及安全性政策皆未臻完備，仍有進步的空間。換言之，現有使用者及潛在使用者對於目前交易平台所提供之相關政策之雖非不滿意，卻也不甚肯定其完善性。基於隱私性、完整性以及安全性政策之完善程度為顧客選擇交易網站之重要原因，兩網站似應進一步改善其相關政策，以增進顧客對其之信任及滿意度。 / In recent years, with the prevalence of the Internet, electronic commerce becomes a popular form of business. More people are participating in online auctions. However, new business brings new risks. In electronic commerce, organizations must implement necessary controls to secure their online transactions and to protect their customers’ privacy. By gaining the customers’ trust, a corporation can build up its reputation and enhance its businesses. Online auction involves numerous parties and lots of personal and transaction data. Consequently, when designing and implementing its internal controls, an online auction firm should consider not only the control of its internal environment, but also the effects of these controls on the outside parties involved. The purpose of this study is to explore the transaction controls for online auction. Based on relevant literature, we developed a set of guidelines for evaluating the transaction controls for online auction. Two famous online-auction sites, Yahoo! and eBay, were compared and analyzed with these guidelines. The results also served as the basis of our research questionnaire, which was used to collect data from both the current online auction participants and the potential users. The survey provided evidence with respect to the respondents’ overall opinion of online auction transaction controls, as well as their levels of satisfaction on different aspects of controls and the factors affecting their satisfaction. Our research findings are as follows: 1. Both Yahoo! and eBay provide standardized privacy policy statements. The users do not have the option for partial agreement. They are often forced to provide extra personal data and can’t prevent the third party’s use of the data. As for transaction integrity, both online-auction sites provide fairly complete and detailed policies. However, finer summarization and classification of these policies is needed to facilitate the users’ access of the information. For transaction security, both websites should improve the communication with their users such that the commitment to secure their online auction systems is well understood. 2. In general, eBay users are more satisfied with its policy than Yahoo! users. However, Yahoo! users’ level of satisfaction of the transaction platform is higher than that of eBay users. 3. Based on the survey, the users care most about a website’s ability to protect their personal data and privacy as well as the integrity of online transactions. That is, they are concerned about the possible theft and misuse of their data and the fraud or inequity occurred in the transaction process. However, given the concern on these risks, the users’ understanding of or attempt to understand the related policies is not as thorough or comprehensive as it can be. Their satisfaction with the related policies is only slightly above average. 4. The overall opinion about online auction is significantly different between the current users and non-users (potential users). The former group has a more positive view on online auction and is more willing to continue their online transactions. Even with the potential transaction risks, they intend to remain on the same transaction platform. 5. Different ways of distributing research questionnaires may affect the survey results. In this study, we use both on-line survey (through a BBS) and on-site survey. These two groups of respondents have the following differences in profile: (1) the on-line respondents are, on average, younger than the on-site respondents, (2) most of the on-line respondents are students, whereas the on-site respondents are mostly practitioners, (3) the on-line respondents use the on-line auction more frequently, and (4) the on-line respondents spent more time on the Internet. Additional analyses indicate that the above two groups differ significantly in the acceptance and understanding of website policies, the concern over data security and risks, as well as their overall satisfaction of the websites. In general, the on-line respondents are more positive toward the websites’ policies, less concerned about data security, willing to accept the potential risks, and more satisfied with the websites’ transaction controls. Therefore, future research should consider the potential effects of different ways of distributing questionnaire on its survey results. 6. In summary, both online auction websites’ policies on privacy, transaction integrity and transaction security are not as comprehensive or complete as proposed by the relevant literature. Both users and non-users are only moderately satisfied with these policies. Since the completeness of the above policies are determining factors in the users’ choice of transaction platform, both websites should further improve their policies on transaction controls and privacy to enhance their customers’ confidence and satisfaction in using the platforms.

本研究透過文獻研究法，利用文獻、理論、法令及實務見解，進行對中國、越南及台灣間的總體經濟、銀行及中小企業之台商比較分析後瞭解。中小企業是台灣經濟發展中之重大關键要素。然受國際品牌廠商要求、或因生產成本提高，不再具有國際比較利益、或為就近需求市場、或因衛星生產體系的遷移而外移。 企業經營五要素─產、銷、人、發、財等五項中，資金是企業經營重大原素，一如血液之於人體般的不可或缺；研究顯示，中小企業經營多以家族型態經營，會計制度偏向規避稅賦，財務依賴少數股東。當其向銀行舉借資金時，則受限1.經營規模不大2.擔保不足、欠缺被認可之保證人3.資訊不透明(會計制度不健全，報表為節稅而粉飾)等因素；銀行在評估授信案件，本質上必須把資產安全列為第一優先考量。近年來，受國際金融監理規範日趨嚴格、國內監管法令、及銀行內部風控要求影響，銀行經營授信業務成本是日益增高。台灣銀行業朝大型、金控化發展、業務轉向是趨勢。原照顧中小企業為主的中小企業銀行，也紛紛改制成商業銀行，使中小企業授信管道更形縮減。銀行有其金融中介角色的使命，但中小企業者經營管理上必須透明，否則在金融環境巨幅變遷下，未來企業向銀行舉借資金，勢必將面臨嚴峻的挑戰。

京都大学 / 0048 / 新制・論文博士 / 博士(工学) / 乙第13009号 / 論工博第4134号 / 新制||工||1649(附属図書館) / 32937 / (主査)教授 中北 英一, 教授 立川 康人, 准教授 宇野 伸宏 / 学位規則第4条第2項該当 / Doctor of Philosophy (Engineering) / Kyoto University / DFAM

京都大学 / 0048 / 新制・論文博士 / 博士(薬学) / 乙第13172号 / 論薬博第772号 / 新制||薬||240(附属図書館) / (主査)教授 小野 正博, 教授 髙倉 喜信, 教授 掛谷 秀昭 / 学位規則第4条第2項該当 / Doctor of Pharmaceutical Sciences / Kyoto University / DFAM

近年來網路應用蓬勃的發展，經由網頁應用程式提供服務或從事商業行為已經成為趨勢，因此網頁應用程式自然而然成為網路攻擊者的目標，攻擊手法也隨著時間不斷的翻新。已經有許多的方法被提出用來防範這些攻擊，增加網頁應用程式的安全性，如防火牆的機制以及加密連線，但是這些方法所帶來的效果有限，最根本的方法應為回歸原始的網頁應用程式設計，確實的找出應用程式本身的弱點，才能杜絕不斷變化的攻擊手法。以程式分析的技術來發現這些弱點是常見的方法之一，程式分析又分為靜態分析和動態分析，兩種分析技術都能有效的找出這些弱點。我們整理了近幾年的網頁應用程式分析技術，多採用靜態分析，然而比較後發現靜態分析的技術對於Java的網頁應用程式的分析，無法達到精確的分析結果，原因在於Java語言所具有的特性，如：變數的多型、反射機制的應用等。靜態分析在處理這些問題具有先天上的缺陷，由於並沒有實際的去執行程式，所以無法獲得這些執行時期才有的資訊。 本研究的重點將放在動態的程式分析技術上，也就是於程式執行期間所進行的分析，來解決分析Java網頁應用程式的上述問題。為了在程式執行期間得到可利用的分析資訊，我們運用了AspectJ的插碼技術。我們的工具會先將負責收集資訊的模組插入應用程式的源碼，並以單元測試的方式執行程式，於程式執行的過程中將分析資訊傳遞給分析模組，利用Java 語言的特性進行汙染資料的追蹤 。另外，我們考慮到以動態分析的方式偵測弱點會因為執行的路徑，導致一些潛在的弱點無法被發現，所以我們利用了線上分析的概念，設計出了線上的污染資料流分析模組，我們的工具結合了上述兩個分析模組所產生的分析結果，提供開網頁應用程式弱點資訊。 / In recent years, development of web application is flourishing and the increasing population of using internet, providing customer service and making business through network has been a prevalent trend. Consequently, the web applications have become the targets of the web hackers. With the progress of information technology, the technique of web attack becomes timeless and widespread. Some approaches have been taken to prevent from web attacks, such as firewall and encrypted connection. But these approaches have a limited effect against these attack techniques. The basic method should be taken is to eliminate the vulnerabilities inside the web application. Program analysis is common technique for detecting these vulnerabilities. There are two major program analysis approaches: static analysis and dynamic analysis. Both these approaches can detect vulnerabilities effectively. We reviewed several program analysis tools. Most of them are static analysis tool. However, we noticed that it is insufficient to analysis Java program in a static way due to the characteristic of Java language, e.g., polymorphism, reflection and more. Static has its congenital defects in examining these features, because static analysis happens when the program is not executing and lacks of runtime information. In this thesis, we focus on dynamic analysis of programs, where the analysis occurs when the program is executing, to solve the problems mentioned above in Java web application. In order to retrieving the runtime analysis information, we utilize the instrumentation mechanism provided by AspectJ. We instrument designed module in to the program and gather the needed information and execute the program in a unit testing approach. Our dynamic analysis module retrieves the information from instrumented executing program and utilizes the characteristic of Java to perform the tainted data tracking. We considered the dynamic tracking mechanism will leave some vulnerabilities undiscovered when the program is not completely executed. Hence we adopt the online analysis concept and design an online analysis module to find out the potential vulnerabilities which cannot be detected by dynamically tracking the tainted data. Our analysis tool finally integrates these two analysis results and provides the most soundness analysis result for developers.

京都大学 / 新制・課程博士 / 博士(工学) / 甲第24893号 / 工博第5173号 / 新制||工||1988(附属図書館) / 京都大学大学院工学研究科社会基盤工学専攻 / (主査)教授 中北 英一, 教授 佐山 敬洋, 教授 田中 賢治 / 学位規則第4条第1項該当 / Doctor of Philosophy (Engineering) / Kyoto University / DFAM