【作者】 范恒英；

【导师】 何大可；

【作者基本信息】 西南交通大学 ， 密码学， 2002， 硕士

【摘要】 Internet应用需要有为网络通信提供机密性、完整性和身份认证服务的安全机制。密码技术提供了实现这种安全机制的基础。对称密钥密码技术提供了机密性服务；杂凑函数和消息认证码提供了完整性服务；非对称密钥密码技术(公钥密码技术)提供了身份认证服务。对称密钥密码系统的缺陷是密钥分发困难。非对称密钥密码系统由于可以公开公钥，从而较好地解决了密钥分发问题。公钥证书提供了一种将公钥拥有者身份信息和公钥绑定在一起的方法。公开密钥基础设施被用于创建、管理、存储、分发和吊销公钥证书。传输层安全协议(TLS)和安全套接字层协议(SSL)基于对称密码技术、非对称密码技术、消息认证码技术、公钥证书和公开密钥基础设施技术提供了保证网络通信数据的机密性、完整性和对通信各方进行认证的机制。OpenSSL实现了SSL2.0、SSL3.0和TLS1.0。OpenSSL提供了丰富的TLS／SSL编程接口，可用于构建复杂的TLS／SSL应用。OpenSSL也提供了一些具有证书颁发机构(CA)功能的实用程序，可用于为SSL客户和服务器签发证书。 现今的许多网络应用使用IPSec、TLS／SSL、SET等安全技术(或协议)来保护其网络通信。但是，也有一些不具备足够的安全能力的网络应用仍在运行。这些不安全的应用不能保证通信数据的机密性、完整性和通信各方身份的真实性。我们可以重新设计开发这些应用以解决其安全问题。但有时，因为某些原因，我们可能不愿重新开发这些应用。即使要重新开发这些应用，在应用的新版本开发完成之前，我们仍需继续使用现有不安全版本。因此，我们希望能够在不重写这些不安全应用的情况下保证它们的通信安全。本文介绍了作者设计开发的安全信息传输系统SIT-TLS。该系统基于TLS协议和代理机制，可在不修改原有应用代码的情况下，为不具备安全能力的应用提供安全的数据传输服务和身份认证服务。更多还原

【Abstract】 Internet aplications need a security mechanism that can provide privacy,integrity and authentication services for network communications. Cryptography technology provides the basis for such a mechanism. Symmetric cryptosystems can provide privacy service;Hash functions and message authentication codes can provide integrity service;Asymmetric cryptosystems (public key cryptosystems) can provide authentication service. The limitation of symmetric cryptosystems is that the key distribution is difficult. Asymmetric cryptosystems can make their public keys published and provide a better solution for the key distribution issue. A public key certificate provides a method for binding a public key and its owner’s identity informations. Public key infrastructures can be used to create,manage,store,distrbute and revocate certificates. Based on symmitric cryptographic techniques,asymmitric cryptographic techniques,message authentication code techniques,public key certificate and public key infrastructure techniques,Transport Layer Security (TLS) protocol and Secure Sockets Layer (SSL) protocol provide security mechanisms used to provide provacy,integrity for network communication data and authenticate the communication parties. OpenSSL implements SSL2.0,SSL3.0 and TLS 1.0. OpenSSL provides abundant TLS/SSL application programming interface and can be used to construct complicated TLS/SSL applications. OpenSSL also provides some utility programs with Certificat Authority (CA) functions that can be used to create certificates for SSL clients and servers.Many current network applications protect their network communications by using security technologies (or protocols) such as IPSec,TLS/SSL,SET etc. But some network applications without adequate security features are still running. These unsecure applications cannot provide privacy,integrity for communication data and authentication of communication parties. We may redevelope these applications to solve their security problems. But sometimes,for some reasons,we would not like to redevelope these applications. Even if we decide to redevelope these applications,we will have to use the current unsecure versions before new versions are available. So,we hope we can secure the communications of these unsecure applications without rewriting them. This article introduces the Secure Information Transmission System (SIT-TLS) developed by the author. Based on TLS protocol and proxy mechanism,this system can provide secure data transmission service and authentication service for unsecure applications without modifying their codes.更多还原