【作者】 谭寒生；

【导师】 周明天；

【作者基本信息】 电子科技大学 ， 计算机软件与理论， 2003， 硕士

【摘要】 随着Internet的普及，网络应用尤其是电子商务和电子政务开始成为重要的网上活动，网络安全因其在网络应用中的重要性，日益成为一个不容忽视的问题。人们需要在网络中为用户提供身份鉴别和权限信息，以保证网络交互的安全。PKI (Public Key Infrastructures公钥基础设施)以密码学为理论基础，提供身份鉴别、机密性、完整性和不可否认性服务，成为网络应用中信任和授权的源泉。PKI以身份证书为载体，同时记录用户的身份信息和权限信息。然而在PKI的实际应用过程中，人们发现身份和权限有很多不同的属性，尤其在有效期上，权限由于不同的环境会经常变化，而身份则相对固定。将二者绑定到一个证书上不仅不利于对身份和权限的有效管理，而且需要频繁更新证书，给签证机关带来很大的工作量。鉴于以X.509v3为基础的PKI系统中上述身份持久性与用户权限短暂性之间的矛盾日益显著，2000年X.509v4协议提出授权管理基础设施PMI的概念。PMI分离了X.509v3标准中PKI的权限管理功能，提供更为严格、方便和高效的访问控制机制，是一种基于PKI系统之上的、实现访问权限管理的体系。 本文分析了X.509v4的PMI基本框架，在此基础上建立了基于角色委托机制的PMI模型，提出了PMI原型设计方案，并讨论了架构中证书管理、角色管理和策略管理的一些关键问题。最后在参考PKI系统基础上，实现了一个原型PMI——Mini PMI，并对其性能进行了简单分析。 XML作为一种元语言，具有平台无关性、自描述性等重要特征，正成为网络应用不可或缺的数据表示方式。XML可以根据需要定制，使之符合特定要求。目前XML安全性的研究也正如火如荼。本文探讨了安全XML技术在PMI系统中的应用，所设计的PMI系统完全基于XML格式，包括策略、日志以及证书等，使之可以与网络服务框架有机地结合起来，从而保证安全可信网络服务的效率。更多还原

【Abstract】 With the development of Internet, network applications especially E-Business and E-Government become very popular in Internet. Because of its importance in the network applications, network security increasingly becomes a big problem we cannot ignore. To guarantee the security of network actions, we should provide and discriminate information of identity and authorization for users. PKI ( Public Key Infrastructures) , which is based on cryptography and provide authentication, confidentiality, integrity and non-repudiation, turns into the source of authentication and authorization in Internet. PKI records people’s identities and privileges into public key certificate. In PKI system, however, we can find that identities and privileges have different attributes, especially in period of validity. Privileges often update in different condition while identities remain fixed in duration. Binding these two things to one certificate not only impair the efficiency of management of identities and privileges, but also bring much workload to CA(Certification Authority) for frequent updates of the certificate. Because the contradiction between permanent authentication identity and changeable authority attributes mentioned above in PKI (based on X.509v3) becomes more and more evident, PMI (Privilege Management Infrastructures) concept is brought inX.509v4 in 2000. PMI separates the management function of privileges in the X.509v3 and offers a more strict, convenient and efficient access mechanism. PMI, based on PKI, realizes a management system of access privileges.Based on analyzing the framework of PMI in X.509v4, a model based on role-based delegation mechanism is presented. The design of prototype PMI, some key problems such as certificate management, role management and policy management are discussed in thethesis. Finally, the implement of a PMI system-Mini PMIis realized with the reference of PKI system, as well as its performance analyzing.XML, as a meta-language, is becoming the necessary data description in network applications as its platform-independence and self- description. XML can be customized on demand to fit for special requirement. The design of PMI system we done and its major modules, such as policy, log and certificate are conforming to XML formats. Thus we can combine it to network service framework and guarantee the efficiency of network service security and trust.更多还原