【作者】 王岳宏；

【导师】 仲秋雁；

【作者基本信息】 大连理工大学 ， 管理科学与工程， 2006， 硕士

【摘要】 随着信息技术的发展和网络应用的日益普及,计算机网络安全已经成为必须面对和解决的问题。公钥基础设施PKI是目前保证网络信息安全的主流解决方案,但它在技术上仍存在一些不足,诸如系统之间互操作性差,客户端部署应用复杂等问题严重的影响了PKI技术的广泛应用。 本论文深入的研究和分析了XKMS及其相关知识,XKMS是W3C所发布的XML安全标准之一,它提供了一个通用的PKI接口,可以将很多原来由客户端完成的复杂的PKI操作交由服务器来完成,在解决PKI系统互操作性问题的同时还可以降低PKI应用复杂性。本论文设计并实现了一个基于LDAP和XKMS的PKI原型系统,同时以Java语言实现了一个可以提供实现XKMS服务的API工具包。本论文重点论述了系统中的XKMS服务器和LDAP目录服务器的设计与实现,对其安全性和运行效率等关键问题进行了分析并给出了解决方案。改进了证书撤销状态验证机制,并重新定义了目录数据结构以更好支持XKMS服务的实现,同时以严格的访问控制和SSL协议来保证LDAP目录服务的安全性,实现了LDAP SSL连接池来提高目录服务的访问效率。采用WebService技术对外发布XKMS服务,从而把PKI的复杂性从客户端转移到XKMS服务端,屏蔽了PKI底层的实现过程。XKMS服务采用同步消息的传输模式,以SSL协议保证消息传递的安全性,以两阶段请求协议来防止拒绝服务攻击。最后以三个典型场景——证书查询、证书验证及两阶段请求协议证书验证对XKMS服务进行应用分析。 本论文所实现的XKMS服务可以直接为基于XML数字签名和XML加密的应用程序提供安全方便的密钥/证书服务,同时可以降低PKI客户端部署应用复杂性,为XKMS的实际推广应用提供了借鉴参考。更多还原

【Abstract】 With the population of Information Technology and Networks, people find it necessary and urgent to resolve the security problem. PKI (Public Key Infrastructure) is the leading solution to ensure the security in networks, but it still has some drawbacks in technique, such as bad interoperation between different systems and difficult deployment in client applications, etc. The complexity of PKI hinders its large-scale applications.This paper researches and analyzes XKMS and its relevant technology deeply, XKMS is one of the XML security standards that published by W3C. It provides a general purpose interface to use PKI, makes server do the complicated PKI tasks of instead of by the client. It can solve the inter-operation Problem and reduce the complexity of client application. This Paper designs and implements a PKI system which is based on LDAP and XKMS, and also implements a SDK by Java which can provide API to implement XKMS. This paper focuses on the discussion of design and implementation of XMKS server and LDAP server in the system, gives the analysis and solution of the security, efficiency and other keystone of the system. It improves the mechanism of how to validate the certificate revocation status, redesigns the Directory structure to sport XKMS service, insures the security of the LDAP by using the strict access control and SSL protocol, and also implements the LDAP connection pool to enhance the LDAP access efficiency. This system uses Web Service to provide XKMS service to transfer the complexity from client to server, and shields the process of underlying PKI. XKMS server adopts synchronous processing mode, using SSL protocol to insure the security of message transmission, employs two-phase request protocol to protect against denial of service attack. This paper makes the application analysis by there typical scene - certificate location, certificate validation and validation by two-phase request protocol.This System can offer safe and convenient key/certificate service directly for the application based on XML Signature and XML Encryption, it also can reduce the complexity of deployment of client PKI applications. This paper gives a reference for implementing XKMS in practice.更多还原