【作者】 刘远航；

【导师】 鞠九滨；

【作者基本信息】 吉林大学 ， 计算机软件与理论， 2004， 博士

【摘要】 随着计算机应用对社会生活各方面的渗透，利用计算机进行各种信息处理已越来越成为一种趋势。由于这些信息多涉及到国家的军事、政治、经济秘密以及一些个人隐私，所以计算机安全越来越受重视。计算机安全涉及加密、认证、访问控制、入侵检测等多个方面。作为信息安全基础的公钥基础设施（PKI）已经成为当今计算机安全领域研究的热点问题。本文专注于对公钥基础设施的一些关键的技术问题进行研究，为公钥基础设施的开发和部署提供理论基础。本文所做的主要工作包括以下五个部分：首先，总结了PKI的体系结构，讨论了PKI的信任模型，并对各种模型的优、缺点进行了评价。总结了PKI信任域之间互操作的七种模式以及域间交叉认证应该遵循的基本原则。提出了一个典型的基于桥接交叉认证模式的桥CA系统（CNBCA）的设计。其次，针对PKI的证书机制、证书注销的模式等PKI的重要技术问题进行了论述。文中给出了一种双证书的具体实现，结合该双证书机制以及属性证书、Cookie技术对SSL协议的安全性进行了改进，提出一种改进的TLS协议ETLS，改进后的协议安全性更高，具有良好的访问控制特性以及抗DOS攻击能力。第三，给出了一种高效的证书注销发布算法ECIA。根据该算法给出了关于CRL查询引起的网络负载的计算方法。应用该算法可以在对系统构造影响最小的情况下，降低PKI系统的尖峰负载，提高PKI系统的可用性。第四，将PKI技术与基于生物特征的认证技术进行结合，设计了一个基于生物特征认证技术的PKI系统的框架BPKI，大大提高了PKI系统终端访问控制的安全性。第五，给出无线PKI（WPKI）领域中的无线小证书（Mini-Cert）一种格式及其业务管理流程。同时应用该种格式的无线小证书对一个实际的WPKI系统WSCA进<WP=89>行了实验和测试，得到部分测试数据。对这些技术的研究将有助于指导我们对WPKI新技术进一步的研究工作。最后，结合以上各章的内容，对全文工作进行了总结，并指出了进一步工作的方向。更多还原

【Abstract】 Content: As computers are used widely, it is a trend to use it for processing information, which covers confidential military, government, economy and personal data. Techniques of computer security, which involve cryptography, Authentication, access control, intrution detection, are attracting more attention. As an infrastructure of the information security, PKI is a hot topic in the research field of computer security.This paper focuses on studying and analyzing some key techniques of Public Key Infrastructure. All the research result will lay the foundation of development and deployment of a PKI. Five parts are contained in this paper, which listed below:Firstly, after a brief description of components, characteristic and functions of a PKI, a deep study on PKI architectures and trust models are made, and a comparation of the advantages or disadvantages of each model is given. The seven cross certification models of PKI and a principle of the cross models method are summarised. A representative design of a cross certification model based on the bridge is given, which is called China Bridge CA (CNBCA). All above work will be a guide to make a choice of the four trust models when we are preparing for deployment a real PKI system.Secondly, a deep study on the certificate mechanism of PKI is made. It indicates the advantages of the dual certificate mechanism. The TLS protocol with the dual certificate mechanism is rebuilt. At the end of this part, an improved TLS protocol, ETLS, which is based on the attribute certificate, dual certificate and Cookie, is proposed.Thirdly, the issuing mechanism of certificate status based on CRL is discussed in detail. Contraposed with the traditional CRL issuing mechanism, an improved CRL issuing algorithm is brought forward, and the performance is analysed. An evaluation method of the network load along with the CRL searching is brought forward, which is the guide of the solution of the issusing of certificate status in a real PKI.Fouthly, the combination of PKI and Biometrics is discussed in detail. After a brief intrudution of Biometrics, a frame of a PKI system based on the biometric, which is called BPKI, is brought out to bridge the gap between authentication and the end-user in PKI applications. Finally, we make some conclusion and outline future directions based on the BPKI system.Fifthly, the hot topic, the new direction of PKI, which is called WPKI, is discussed in detail. A kind of WPKI mini-certificate format is brought out and applied in the <WP=91>WSCA of the WPKI system. We have got some experiment data through the WSCA’s testing. The research results of this technique will be a guide to the WPKI research directions in the future.Lastly, the contents of the paper are summarized and the future works to do are proposed.更多还原