【作者】 李嘉华；

【导师】 宋明秋；

【作者基本信息】 大连理工大学 ， 系统工程， 2008， 硕士

【摘要】 近几年，随着越来越多的嵌入式设备，如移动电话、PDA、家庭网关、工控设备等，接入到Internet，这些设备的安全问题受到了广泛的关注。而作为网络安全技术基础的认证技术也顺理成章地成为人们关注的热点问题。由于嵌入式环境与桌面的分布式环境有很大的区别，一般分布式系统中的认证协议并不能直接运用到嵌入式平台上。作为向家庭、汽车、小型办公室和其他环境提供下一代互联网服务的领先标准，Open Services Gateway Initiative(OSGi)平台目前仅有的几种认证协议也存在着运算量大或密钥分发不便等问题。本文针对以上问题，对基于OSGi平台的认证协议进行了全面而深入的研究，主要工作包括以下四个部分：在第一部分的嵌入式认证协议设计中，主要研究了安全协议的设计方法与嵌入式系统的特点，结合对称和非对称密钥加密系统的优点，以KryptoKnight和X.509协议为基础，提出了一种新的基于混合加密的OSGi认证协议，该协议能较好地满足OSGi平台环境对认证协议最小性、易管理性和单点登录的要求。在第二部分的协议形式化分析中，主要研究了安全协议形式化分析的发展和CSP分析方法，对协议进行了CSP建模，并对入侵者的行为作出有效的描述；设计出对安全属性的规范化表达，并使用模型检测工具FDR对协议的安全性进行检测。在第三部分的协议实现中，主要研究了协议实现层次上的安全问题及其设计的方法，使用安全性较强的Java语言对协议给与实现。并且该实现能避免目前绝大部分形式化分析方法不能检测的类型缺陷攻击和多协议攻击。最后，在论文第四部分的协议应用实例中，研究了OSGi平台的程序架构，把新的认证协议应用到OSGi平台的Telnet Console服务中，实现用户的安全远程登录。结果表明新的协议是可靠的，并具有较好的实际应用价值。更多还原

【Abstract】 Over the past few years, with more and more embedded devices such as mobile phones, home gateways and controlling devices are connected to the internet, their security have attracted public attention. Therefore, the authentication technique, which is a fundamental function of the security technique, has become a focus on research.Since there are many differences, such as framework, transaction capability, network bandwidth and so on, between enbedded environment and distributed service environment, the current authentication protocols for general systems can’t be applied directly to the embedded systems.The Open Services Gateway Initiative (OSGi) organization is the leading standard for next-generation Internet services to homes, cars, consumer electronics, small offices, and other environments. Howerver, the existing authentication protocols for the OSGi have the shortcomings neither of the mass operation nor of the inconvenience of creating and distributing secret keys. So, in this thesis, we study the authentication protocol for OSGi in depth, and our research consists of the following four parts:In the first part - design of the authentication protocol for embedded sytems, we studied the methods for designing security protocol and the characteristics of embedded systems, and the following results are achieved: (1) Based on the KryptoKnight and X.509 protocols, we propose a new authentication protocol for OSGi. This protocol combines the advantages of the symmetric and public key cryptography and meets the requirements of the OSGi, including manageability, minimality and single-sign on.In the second part - formal analysis of the protocol, we studied the formal methods for analysis of security protocols and the CSP mothod, and the following results are achieved: (2) Modelling the protocol with CSP and describe the intruders’ ablities formally; (3) Developing the specifications to express security properties and check the security properties of the protocol using FDR - a model checker for CSP.In the third part - implementation of the new protocol, we studied the security issues in the implement level and the skills to develop a security protocol, and the following results are achieved: (4) The protocol is implemented in Java and this implementation can prevent type flaw attacks and multi-protocol attacks.In the forth part - a simple application, we studied the structure of OSGi framework and the following result is achieved: (5) The weak authentication module of the OSGi telnet console service is replaced by our authentication protocol. So users can login the gateways much more safely.更多还原