【作者】 王铭严；

【导师】 李明；

【作者基本信息】 华东师范大学 ， 通信与信息系统， 2007， 硕士

【摘要】 随着Interrnet的广泛应用,网络安全问题日益突现。为了确保数据在网络上传输时的安全性,加密是一种有效的手段。早期加密系统采用对称密钥加密,通信双方共享相同的密钥,用于加密与解密。由于对称加密系统过于依赖密钥的保密性,不利于密钥的交换,所以人们引入了公开密钥系统。在公开密钥系统中,通信双方各自持有一对密钥对,其中公钥公开,私钥保密,保证了密钥交换的安全性。在此种方式下,加密与解密采用不同的密钥,因此公开密钥系统又称为非对称加密系统。公钥系统已被广泛应用于网络安全的各个领域,主要用于加密传输数据和实现数字签名。传统的公钥系统都是基于证书体系的,即公钥的分配依靠证书来实现。证书中包含了用户的身份ID、公钥、证书的有效期以及权威机构(CA)对该证书的签名,只有经过CA签名的证书才是有效、合法的证书。因而,CA在基于证书的公钥系统中,起着至关重要的作用,证书的签发、更新、撤销与验证都离不开它。但是,证书的管理是要耗费一定资源的,因为CA往往需要管理庞大的证书,同时,还增加了通信双方进行证书认证的步骤。在不降低通信安全的前提下,为了省去这些麻烦,Shamir就提出了基于身份的公钥系统。在基于身份的公钥系统中,用户的身份ID就是公钥,公钥就是用户的身份D,这样用户ID就和公钥自然地绑定了,不再需要通过证书进行绑定,同时也省去了证书认证,从而大大简化了公钥系统的实现。本文在深入研究基于身份的公钥系统的基础上,在基于网络处理器的安全网关系统上,实现了基于身份的公钥系统,并且利用网络引擎资源,优化了系统性能。本文的主要工作有以下四个方面:1)研究了基于证书的公钥系统和基于身份的公钥系统,比较它们的异同,分析了基于身份的公钥系统具有的优势;2)对网络处理器IXP425的应用进行了介绍,分析了网络处理器相比X86系列CPU和通用嵌入式CPU在网络处理能力方面的优势;3)研究了基于身份的公钥系统的各种算法,并将它们应用到安全网关系统之中;4)利用IXP425的网络引擎资源优化了基于身份的公钥系统。将基于身份的公钥系统和网络处理器同时应用于安全网关系统设备,是本文的创新之处。更多还原

【Abstract】 With Internet is used frequently, the problems about network security appear more often. In order to protect data transferred in networks, encryption is a good method. In early time, cryptosystem uses sym-encryption, in which the two communicators use one same key to do encryption and decryption. The system relies on the security of the key too much, and this doesn’t benefit the exchange of the key, so people introduce Public-key Cryptosystem. In Public-key Cryptosystem, each communicator has a pair of keys himself. The public key is opened and the private key is only known by the owner. This makes the exchange of the key safer.Public-key Cryptosystem is used in many areas of network security. It can be used for encryption and digital signature. Traditional Public-key Cryptosystem is based on certificates. This means that the distribution of public keys relies on certificates. A certificate contains ID, public key, validation-date and signature of CA. Only the certificates that signed by CA are validated. So CA plays a great role in certificate-based Public-key Cryptosystem. The distribution, update, recall and validation of certificates can’t be done without CA.Since the management of certificates costs a lot, CA must manage a large amount of certificates. In addition, validations of the certificates for the two communicators are needed. In order to get rid of these disadvantages, Shamir introduced a cryptosystem based on identity. In this system, the ID is the public key and vice versa. So the ID is associated with the public key naturally, and the association and the validation of certificates are no needed. This simplifies the realization of Public-key Cryptosystem.This paper does a deep research in Identity-based Public-key Cryptosystem, and then realizing this system in a security gateway based on network processor. The usage of network engines can optimize the system. The main work of the paper contains the following four areas: 1) research certificate-based Public-key cryptosystem and Identity-based Public-key cryptosystem, and do comparisons to show the advantages of Identity-based Public-key cryptosystem; 2) introduce the applications of network processor IXP425, and compare it with X86 CPU and general embedded CPU; 3) research the arithmetics of Identity-based Public-key cryptosystem and apply them into security gateway; 4) use network engines of EXP425 to optimize Identity-based Public-key cryptosystem. The usage of Identity-based Public-key cryptosystem and network processor will do a great optimization for the security gateway system, which is an innovation of this paper.更多还原