【作者】 秦大力；

【导师】 谢冬青；

【作者基本信息】 湖南大学 ， 计算机应用技术， 2004， 硕士

【摘要】 开放计算环境中用户之间的安全通信存在着安全分析主体多样化、安全信息收集困难、安全度量相对化和安全需求比较复杂等特点，信任管理模型方面的研究为解决这些问题提供了思路和框架。本文综合分析了近年来信任管理方面的研究进展和信任评估模型，指出以往的信任管理模型很难应用到受控资源分布于不同管理域的开放计算环境中。为了适应开放环境中对于安全主体授权和认证的需求，本文建立了基于路径代数的主观信任评估模型，重点在于信任关系的表述与度量和信任关系组合算法的设计。 以往的信任管理模型对信任证据的分析方法比较复杂，信任推荐过程存在着主观性，并且完全依赖可信的第三方来进行信任关系验证。本文通过详细设计基于PKI的数字证书签发和管理系统，给出了证书认证和签发的基本类和接口设计，采用X.509数字证书作为授权和认证的基本凭证，并通过对实体安全特性的分析，定义出安全策略与凭证的描述方式，以此作为信任关系评估的基础。 为了解决以往的信任评估方法适应性不足的问题，本文提出了基于路径代数的信任关系组合算法，对信任网络中的整体信任状况进行量化分析，通过对可信第三方以及目标实体信任程度的度量、推导和综合评估，将主观的信任度量转化成相对客观的组合信任评估值，从而合理有效地监视和管理开放环境中安全实体之间的信任关系，并对算法进行了改进以适应某些不具备确定信任度量的信任环境。 本文在Web应用环境中测试和验证了信任组合算法的效率和安全性，主要考察在实验环境中恶意推荐、评估主体的准确度以及信任评估的噪声值对信任组合计算的影响，实验数据表明，本文提出的信任组合算法可以得出较为客观准确的信任关系评估值。更多还原

【Abstract】 There are some new requirements between the security principals in the open computing system. We must find a new mechanism, which can set up and evaluate trust relationships. Trust management involves the specification of trust requirements, the analysis of these requirements to ascertain possible conflicts and the use of risk and experience information to aid in the on-line monitoring of these trust relationships. But how to supervise and administer trust relationship is still not resolved, especially in open computing systems. This dissertation presents evolvement of trust management in recent years, analyzes the factors of trust management models, and points out some problems in past models. In order to meet the requirement of trust management in open computing system, we bring forward a subjective trust relationship evaluation model based on path algebra, and define an efficiency described method of security credential and policy.This dissertation expatiates on the background, motivation and requirement of trust management, discusses the context and mathematic property of trust. We also discuss the existing trust management model and their shortages, such as description and measurement of trust and evaluated mechanisms is not reasonable, analyses method for trust evidence is complex, trust commend is subjective, and validation of trust relationship only rely on the third part. Consequently, we design digital certificate management system in particular, present basic class and interface of the system, and adopt X.509 certificate as basic credential for authentication and authorization. We also define the described method of security credential and policy as the foundations of trust relationship evaluation.The former evaluated method of trust has the problem of adaptability, and therefore we put forward an algorithm of trust relationship combination based on path algebra. This algorithm analyses the whole trust status of trust network, and converts subjective trust measurement into relative objective value of trust evaluation. This dissertation also ameliorates the algorithm of trust relationship combination to adapt certain trust environment that has no definite trust measurement.We have experimented and verified the efficiency and security of the algorithm of trust relationship combination in Web application environment, and reviewed somefactors, such as malevolent recommended trust, evaluated precise of principals and noisy in trust evaluation that may influence trust combination computation. The data of the experiment indicates that the algorithms of trust relationship combination can obtain evaluated value of trust relationship objectively and precisely.更多还原