【作者】 张燕燕；

【导师】 张立群；

【作者基本信息】 山东大学 ， 软件工程， 2007， 硕士

【摘要】 随着网络以及经济的飞速发展，电子商务已经成为21世纪最主要的经济增长方式，但如何保证Internet网上信息传输的安全，是发展电子商务的重要环节。对此世界各国进行了多年的研究，初步形成了一套完整的Internet安全解决方案，即目前被广泛采用的PKI／CA技术。PKI即“公开密钥体系”，是一种遵循既定标准的密钥管理平台，它能够为所有网络应用提供加密和数字签名等密码服务及所必需的密钥和证书管理体系。而证书认证系统是证书和密钥的管理平台，是整个PKI体系的核心部件，可以为用户生成加密证书和签名证书，采用KMC-CA-RA体系结构，支持密钥托管服务，符合国家密码管理局的安全性要求。本文所描述的证书认证系统，是为广东省电子商务认证中心(简称广东CA)研制开发的。广东CA是经广东省政府批准成立的、提供信任服务和安全认证服务的权威机构、是国家信息办的电子商务批准试点。作为省政府认可的数字认证平台，主要从事电子商务安全证书的制作、颁发和管理，提供在线的信任服务，为电子商务应用保驾护航。项目开发小组经过系统的论证与分析，确定了以公开密钥技术为基础，对生命周期内的数字证书进行全过程管理的安全系统，采用RCA—CA—SCA—RA—LRA层次结构，包含三个子系统：密钥管理系统、证书认证中心(CA)系统、证书注册(RA)系统，各子系统协调工作共同完成证书申请、证书更新、证书注销、证书恢复、证书分发、证书存储、证书状态查询等功能流程。1、密钥管理系统提供安全可靠的加密密钥对的管理功能，负责加密密钥对的生成、存储、分发、备份、更新、撤销、归档和恢复等。2、CA系统主要实现如下功能：用户注册、用户请求审核、证书生成、证书注销、证书更新、证书恢复、证书存储、证书分发、证书状态查询、证书黑名单(CRL)的生成发布。3、RA支持多级体系，包括：本地RA、远程RA、LRA等，系统提供B／S和C／S两种模式，提供RA系统的管理功能、统计查询、审计功能、证书申请、证书审核、证书下载、制证、证书更新、证书恢复、证书注销、证书黑名单查询、下载等。本文实现的证书认证系统具有可靠性、安全性和兼容性，系统的研发对于保障我国电子商务的安全具有深远意义，能够从全方位为用户提供密钥管理、证书管理和密码服务。目前，本系统已得以实施，发挥了重大的社会效益和经济效益。本人作为项目开发小组的成员，参加了项目的研发，遇到问题时与其它成员共同讨论、一起解决，具体承担了对客户需求的整理和部分细化分析工作，参与了系统的概要设计、系统业务流程模块的详细设计，承担了后台签名服务模块的设计研发工作，在研发过程中积极与客户进行交流沟通，对项目的顺利完成起到促进作用。基于本人在项目中的工作及论文的完整性，本文简要介绍了证书认证系统的系统开发背景及目前国内外该领域的研究现状，描述了电子商务中证书认证系统的功能及技术要求，描述了作为一个实际运营的CA系统需具备的功能、处理方式及系统的设计与实现。最后结合用户的使用情况，对系统的总体实现进行总结，分析系统的可靠性、安全性和兼容性。更多还原

【Abstract】 With the rapid development of Internet, there are more and more countries and companies focus on the security of transaction through public network. PKI(Public Key Infrastructure) become a stardard of Key management,it can provide all kinds of Encryption and signature service for network application. Certificate authentication system is the core component of PKI, so it is very important in the implement of PKI.This paper gives a proposal for implementing certificate authentication system, and the system will be implemented in e-commerce authentication center of GuangDong province which can generate signing certificate and encrypting certificate for users. E-commerce authentication center of GuangDong province is an authority for providing trust service and authentication service, and its foundation is auhorized by government of GuangDong province. The certificate authentication system follows KMC-CA-RA structure, and can provide keys escrow service,it is conform to the secure requirement of national cipher beaura, and can compatible to the current system.Certificate authentication system will manage all certicates in life span, and use the structure of RCA-CA-SCA-RA-LRA. There are three subsystem: key management system, certificate authority system and register agent system, these subsystem cooperately complete certificate application, certificate update, certificate revocation, certificate recover, certificate distribution, certificate store, certificate validation equiry,etc.Key management system will manage all encrypting key pair, and can provide the follows service: key generation, key store, key distribution, key backup, key revoke, key archive, and key recover.Certificate authority system realizes the follows function: user register, user requirement check, and certificate generate, certificate update, certificate revocation, certificate recover, certificate distribution, certificate store, certificate validation equiry, certificate revoke list generate, certificate revoke list issue. Register agent system support hierche structure, including: local register agent, remote register agent, and can be used in B/S and C/S application. RA system provides the follows function: system management, audit and equiry, certificate apply, certificate request check, certificate download, certificate update, certificate recove, certificate revoke, certificate revoke list request and download.Furthurmore, this paper gives the detail implementation of signing server program (CASIGNSERVER), and define the data struction used in the program. Signing server program can provide data signature service for CA signing a certificate and a certificate revoke list, CA root key can be stored in different encrypt devices which usually used to improve the security of root key, signing server program running as a backup service and can support Unix system and Linux system.Certificate authentication system can be used to provide certificate and key escrow service for commercial authentication organization. Commercial authentication organization is authorities which provide trust and secure authenticate service for a province area, the foundation of CA must be warrant by government, the main task of CA is certificate generate, certificate update, certificate revocation, certificate recover, certificate distribution, certificate store, certificate validation equiry, certificate revoke list generate, certificate revoke list issue. At last, the certificate authenticate system is dependable, secure and compatible, and can provide key management sevice, certificate management service, and key escrow service, the development of this system will enhance the security in electronic transaction. Now the reseach of network security has come into a new stage, and we believe there will make a progress in certificate authentication system development and implementation in a few years.As main programmer of this project, I attend the whole development process, and undertake revising requirement from customer and analyzing it partially in detail. The author takes part in outline design, and also attends certificate work flow design in detail. For the integrity of this paper and take the advantage of my attributes to project, this thesis introduces background and research status of certificate authentication system, then describe the realization of a CA in running the main part as follows: system function,method of transaction, system design and system implementation. At last, we conclude the dependability, security and compatibility of implement system according the user’s experience.更多还原