【作者】 王以刚；

【导师】 邵世煌； 陈家训；

【作者基本信息】 东华大学 ， 控制理论与控制工程， 2001， 博士

【摘要】 在信息化时代，计算机网络及其应用空前发展，以网络为平台的信息传输等各类应用对计算机网络系统中数据的安全性和保密性提出了很高要求。网络中的数据一般有静态数据和动态数据。静态数据泛指各网站存贮的数据，既包含可供访问的数据又包含不得随意公开的保密数据；而动态数据则泛指在网上传输的数据。针对这二类数据，目前的安全手段亦可分二类，以防火墙为主结合其它如口令、人体特征识别等技术的安全体系常用于静态数据的保护，以数据加密／解密为主的安全体系常用于动态数据的保护。作为一个实用的网络，动态数据流的安全保护显得尤为突出。 本文主要围绕动态数据的安全保护，研究相关的密码机制和体制，并根据不同的密码机制的研究，尝试将其与本文给出的一个网络数据安全传输系统EDBSmail的设计和应用相结合，从而为满足各不同层次的网络安全通信服务。 本文在研究的分组加密算法中，提出了左、右不对称分组加密的思想，即在某一明文的加密过程中，将不同加密算法揉合后再对分组进行加密处理，可在不增加算法开销的同时，显著提高该密码的抗攻击能力。同时，在分组加密算法中，给出了一种非线性S盒的设计方法，可设计不同位长的S盒，增加密钥K位长，提高加密算法抗攻击能力。 在认证算法的研究中，给出了一种新的非线性hash算法，该hash算法与MD—4，MD—5和SHA等认证算法的最主要区别在于，将非线性S盒揉合进hash中，使其安全性更强。 此外，作者还给出了一种便于记忆、具有容错特性的秘密保护算法，和一种基于hash函数的分组加密算法，它们都将是EDBSmail中的有效组成部分。 本文结合对各种加密算法的探讨和研究，给出了一种基于加密库的安全电子邮件系统EDBSmail。EDBSmail的主要设计思想是：将已有各种加密算法作为算法库的一个组件，允许用户根据不同需要或安全等级调用不同算法，允许新的加密算法添加到库中，更为重要的是该算法库提供了用户自定义加密算法的接口。由于加密算法库的创建，使得不同加密算法由用户自定义组合加密的方法成为可能。 EDBSmail算法库采用COM技术来实现，可达到中粒度组件重用，以保证在今后版本更新时软件的重用性。此外，EDBSmail还吸收了其它安全传输系统中的特点，如：结合PKI技术和秘密共享密钥保护算法，创建公钥库；结合Winsock技术创建UA(用户代理)；设置便于审计的通信日志文件；应用数字签名算法于信息不可否认等等。更多还原

【Abstract】 In the information times, with the unprecedented development of computer network, various application of information transfer on network platform would need more security and secrecy. In the network, normally, the data can be divided into static data and dynamic data, static data is stored in workstation, dynamic data is transferred on the network. To counter these data types, at present, there are two security methods: fire-wall combined with password, human body’s characteristics distinguish and other techniques are often used to safeguard the static data, and data encryption and description are often used to safeguard dynamic data . As a practical network, the safety of dynamic data especially will be given prominence to.This paper mainly deals with the security protect of dynamic data, researches related cryptograph mechanism and system, and try to combine design with application depending on different researches, which is concerned with EDBSMail running on Internet/Intranet. Thereby, it could satisfy the need of different network security communication.In this paper, depending on research block encryption algorithms, the left and right sides unsymmetrical encryption will be proposed. That is, when a plain text to be encrypted, different encryption algorithms should be combined first, and then, the plain text would be processed by the combined algorithm. This method will not only waste no time, but also can strengthen the ability of defencing attack notably. At the same time, the design method of nonlinear S-boxes is given out, the method allows to design different bit length of S-box, and thereby, the secret key length can be increased which would strengthen the ability defenced attack of encryption algorithm.In authentication algorithm research, a new nonlinear hash algorithm is taken up. It is different from MD-4. MD-5 and SHA, combined with S-box to make the security stronger.Otherwise, a secret protected algorithm and a block encryption algorithm based on hash function are taken up also. They are all of efficient parts of EDBSMail.In the end, through discussing and researching combine with various encryption algorithms, an electronic mail system based on encryption Data-Base is taken up, which is running on Internet and Intranet The main idea of designing is to take various encryption algorithms as a component of the Data-Base, and allow user to select any algorithm by it’s need, meanwhile, the security level is considered. User can add new algorithm into the Data-Base by itself. As a very important characteristic, an interface to definite algorithm is offered by the algorithm DB. With the Data-Base created, it is possible that user can combine different algorithms into one algorithm.The COM (Component Object Model) is used in EDBSMail and middle size package reuse can be realized. Otherwise, other characteristics are also absorbed in EDBSMail, such as: created public key Data-Base with PKI and share secret to protect private key; created user agency with Winsock, set up daily files record which would be audited easily; applied digital signature in not deny and etc .更多还原