PKI技术及其发展现状

一、安全基础设施 普适性基础就是一个大环境(例如公司组织)的基本框架,一个基础设施可视作一个普适性基础。电力供应基础设施就是我们熟悉的一个例子。电源插座可以让各种电力设备获得运行所需要的电压和电流。基础设施所遵循的原理是:只要遵循需要的原则,不同的实体就

认证字典及其在PKI中的应用研究

认证字典是一类重要的数据结构,它在众多研究领域都具有重要的理论和应用价值.文中介绍了认证字典的基本概念和原理,引入了时间约束,给出了一种新的认证字典分类方法.从认证字典在PKI中的应用出发,分析了其实现技术;并简单地分析和比较了基于不同认证字典实现的证书撤销方案.

RSA-Based Password-Authenticated Key Exchange, Revisited

The RSA-based Password-Authenticated Key Exchange (PAKE) protocols have been proposed to realize both mutual authentication and generation of secure session keys where a client is sharing his/her password only with a server and the latter should generate its RSA public/private key pair (e, n), (d, n) every time due to the lack of PKI (Public-Key Infrastructures). One of the ways to avoid a special kind of off-line (so called e-residue) attacks in the RSA-based PAKE protocols is to deploy a challenge/response method by which a client verifies the relative primality of e and φ(n) interactively with a server. However, this kind of RSA-based PAKE protocols did not give any proof of the underlying challenge/response method and therefore could not specify the exact complexity of their protocols since there exists another security parameter, needed in the challenge/response method. In this paper, we first present an RSA-based PAKE (RSA-PAKE) protocol that can deploy two different challenge/response methods (denoted by Challenge/Response Method1 and Challenge/Response Method2). The main contributions of this work include: (1) Based on the number theory, we prove that the Challenge/Response Method1 and the Challenge/Response Method2 are secure against e-residue attacks for any odd prime e; (2) With the security parameter for the on-line attacks, we show that the RSA-PAKE protocol is provably secure in the random oracle model where all of the off-line attacks are not more efficient than on-line dictionary attacks; and (3) By considering the Hamming weight of e and its complexity in the RSA-PAKE protocol, we search for primes to be recommended for a practical use. We also compare the RSA-PAKE protocol with the previous ones mainly in terms of computation and communication complexities.

一种入侵容忍的CA方案

CA(certificate authority)是PKI中的关键设施.CA的私有密钥一旦泄露,该CA签发的所有证书就只能全部作废.保护在线服务CA的私钥也就成为一个非常重要的课题.不是从保护系统或检测入侵出发来保证CA的安全,而是确保当少数部件被攻击或占领后,CA系统的机密信息并没有暴露.通过将私钥分发给不同的部件,并保证任何一个在线的部件无法恢复CA的私钥,从而保护了CA私钥的保密性.

一种基于身份的多信任域网格认证模型

分析了现有的网格认证框架中存在的问题，提出了一种基于身份的多信任域网格认证模型．该模型以基于身份的PKI为基础，避免了基于传统PKI的认证框架的诸多缺点．同时，该模型提供了跨信任域的双向实体认证功能．模拟试验表明，该认证模型比基于传统PKI的认证框架更轻量、更高效．而且由于该模型可以在多信任域的环境下工作，故而比W Mao提出的只能在单一信任域中工作的认证框架更符合网格认证的实际需要．

一种高效和可扩展的OCSP系统

证书状态查询是PKI中的一个关键问题,OCSP是解决这个问题的一种重要机制。本文分析了OCSP协议的技术细节,并在此基础上设计了一种高效的、可扩展的OCSP系统。文中对该系统的关键技术和其自身的安全性问题进行了详细的论述。最后,给出了关于OCSP机制的一些未决问题以及某些思考。

IBC模型在Web安全体系中的应用研究

针对目前基于公钥证书的PKI体系所固有的网络开销大,证书往来过于频繁等缺点,提出并分析了基于身份加密体系(IBC体系)的认证架构和互动模型,说明了IBC模型相对于PKI体系结构的优缺点。针对XML签名和XML加密这两个Web-Security核心协议,比较了使用X.509公钥证书体系和IBC无证书方式在SOAP协议中的实现方式。证明了在保证信息安全的同时,使用IBC模型可以大幅降低网络传输内容,提高了SOA体系的效率和可扩展性。

NMR Spectra of polyimides: Interpretation and local chain motion study

Three kinds of high-performance polyimides 1 (poly(ketone-imide) PKI), 2 (poly(ether-imide) PEI) and 3 (poly(oxy-imide) POI) were studied using nuclear magnetic resonance (NMR). The NMR spectra of the polyimides were assigned according to the comprehensive consideration of the substitution effect of different substituting groups, viz. distortionless enhancement by polarization transfer (DEPT), no nuclear Overhauser effect (NNE), analysis of relaxation time, and two-dimensional correlated spectroscopy (COSY) techniques. The structural units of these three polyimides were determined. Carbon-13 and proton relaxation times for PEI and PKI were interpreted in terms of segmental motion characterized by the sharp cutoff model of Jones and Stockmayer (JS model) and anisotropic group rotation such as phenyl group rotation and methyl group rotation. Correlation times for the main-chain motion are in the tens of picosecond range which indicates the high flexibility of polyimide chains. Correlation times for phenyl group and methyl group rotations are more than 1 order of magnitude lower and approximately 1 order of magnitude higher than that of the main chain, respectively.

3种聚酰亚胺分子的核磁共振碳谱及氢谱的分析

本文报道了3种高性能聚酰亚胺（PKI，PEI和POI）的核磁共振定量碳谱及氢谱。利用这3种样品化学结构的相似性，根据PEI的DEPT谱，PEI和POI的二维同核化学位移相关谱（2D-COSY），碳氢自旋晶格弛豫时间以及化学位移的理论计算，详细分析并归属了3种聚酰亚胺的碳谱峰和氢谱峰，同时验证了其重复单元结构的正确性。