基于Suite-B的密码令牌接口系统的设计与实现

发布时间：2019-07-03 11:00

【摘要】：随着网络攻击、网络陷阱等安全风险的增加,包括我国在内的诸多国家均颁布了适用于各自国家的密码算法套件,算法套件有其不同的保护范围和保护信息等级。或许早已意识到RSA算法存在被破解的安全风险,美国国家安全局于2009年颁布了包含ECC算法的Suite-B密码算法套件并投入使用。在我们国内,因缺少Suite-B算法套件在网络安全和数据加密等方面的应用案例及指导规范,绝大多数的网络应用系统仍然在使用基于RSA算法的算法套件,安全风险较高。本文主要针对在网络安全领域应用非常广泛的PKCS#11接口系统采用Suite-B算法套件的系统实现进行研究分析,并提出面向对象方法对令牌接口系统进行需求分析和设计实现。首先,本文对令牌接口系统进行需求分析,提出系统需要实现的功能目标,包括令牌管理、会话管理等；其次,在系统设计过程中,本文完成令牌对象等类设计、关键流程设计等工作,为系统实现奠定基础；第三,采用C++语言进行系统实现,其中密码算法逻辑由LibTomCrypto提供；最后,本文通过测试工具验证接口系统的各类功能；此外,本文还提出利用面向对象方法中的纯虚技术和派生技术实现算法套件的扩展性要求。本文的研究结果表明通过PKCS#11可以实现Suite-B算法套件的应用,本课题的研究结果一方面为应用程序提供Suite-B算法套件规范应用的简单范例,其次也为其他研究人员提供PKCS#11设计与实现参考案例。
[Abstract]:With the increase of the security risk such as network attack and network trap, many countries, including our country, have promulgated the cipher algorithm suite for the respective countries, and the algorithm suite has its different protection range and protection information level. It may have been realized that the RSA algorithm has a security risk of being cracked, and the National Security Agency promulgated a suite of suite-B cipher algorithms that contain the ECC algorithm in 2009 and is put into use. In our country, because of the lack of application case and guidance specification of Suite-B algorithm suite in network security and data encryption, most network application systems still use the RSA algorithm-based algorithm suite, and the security risk is high. In this paper, the system implementation of Suite-B algorithm suite is applied in the field of network security, and the object-oriented method is put forward to analyze and design the token interface system. Firstly, this paper analyzes the requirement of the token interface system, and puts forward the function object that the system needs to realize, including token management, session management, etc. Secondly, in the process of system design, this paper completes the work of class design, key process design, etc. of the token object. the invention provides a foundation for system implementation; thirdly, a system implementation is carried out by using a C ++ language, wherein the password algorithm logic is provided by LibTomCrypto; and finally, the various functions of the interface system are verified through a test tool; and moreover, In this paper, the extensibility of the algorithm suite is realized by using the pure virtual technique and the derivation technique in the object-oriented method. The results of this paper show that the application of Suite-B algorithm suite can be realized through PKCS # 11. The research result of this project is a simple example of the application of Suite-B algorithm suite specification for application, and then provides the design and implementation of PKCS # 11 for other researchers.
【学位授予单位】：中国科学院大学(工程管理与信息技术学院)
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP311.52;TP393.08

【参考文献】