基于PKI的多算法小型CA软件的设计与实现

发布时间：2018-01-23 12:31

本文关键词： 数字证书 PKI CA 国际标准加密算法国产商用加密算法　出处：《中国科学院大学(中国科学院工程管理与信息技术学院)》2017年硕士论文　论文类型：学位论文

【摘要】：某设备的检测平台需要使用数字证书进行测试工作,但是传统的证书申请方式有着耗时长、复杂、低效、算法不全面、成本较高等问题。本文所实现的基于PKI(Public Key Infrastructure,公钥基础设施)的多算法小型CA(Certificate Authority,认证中心)软件专为测试工作服务,解决了上述问题。本文及所实现的基于PKI的多算法小型CA软件的工作主要包括了以下几大方面:(1)研究了PKI体系的原理及技术要点,重点分析了各类密码算法的原理、功能与应用方法,特别是非对称国际算法RSA与国密SM2算法在证书生成与使用过程中的意义与作用。(2)研究了CA的产生背景、研究现状和总体架构,分析了传统的证书申请方式的优点,并分析了这些申请方式应用于特定测试活动中的不足,提出了本文的所要实现的软件对于测试人员在测试工作中所起到的实际意义。(3)分析了CA的工作原理与功能,重点研究证书请求文件与数字证书的格式、功能与应用,以及证书撤销模式与流程。在软件中自行实现了部分国密算法的动态库封装,并以其和Openssl算法库为基础分别实现了SM2和RSA非对称公私钥对的生成、对称加密和摘要算法的实现。研究并实现了SM2及RSA证书请求文件的生成和解析、根证书与用户证书的签发、验证、撤销以及证书撤销列表文件的生成等功能。同时结合国密规范,研究了双证书模式下SM2签名证书与加密证书的关系,实现了SM2加密证书的生成与加密私钥的保护算法。(4)研究并实现了本地数据库的存取方式与方法,使之能较为完美地匹配软件的数据查询、存取、删改等功能。本文所实现的小型CA软件可以在Windows系统中简单、快速、多样化地为测试人员提供测试所需的、符合标准的RSA与SM2证书,并有申请、签发、解析、撤销、验证和查询等功能,同时支持符合国密规范的SM2签名、加密双证书。该软件免去了传统证书申请方式的各种不便与繁琐之处,解决了设备检测平台对于证书服务的需求,保障了测试的质量,节约了测试时间和成本。
[Abstract]:The testing platform of a certain equipment needs to use digital certificate to carry on the test work, but the traditional certificate application way has the time-consuming, the complexity, the low efficiency, the algorithm is not comprehensive. The implementation of this paper is based on PKI(Public Key Infrastructure. Public key Infrastructure) the multi-algorithmic mini-#en0# Authority.Authentication Authority (Authentication Authority) software is dedicated to testing work. The work of this paper and the implementation of multi-algorithm small CA software based on PKI mainly includes the following aspects: 1) the principle and technical points of PKI system are studied. The principle, function and application of all kinds of cryptographic algorithms are analyzed in detail. Especially the significance and function of asymmetric international algorithm RSA and Guomai SM2 algorithm in certificate generation and usage. This paper analyzes the advantages of the traditional certificate application methods, and analyzes the shortcomings of the application of these applications in specific testing activities. This paper puts forward the practical significance of the software to testers in testing work. It analyzes the working principle and function of CA, and focuses on the format of certificate request file and digital certificate. Functions and applications, as well as certificate revocation mode and flow. In the software, the dynamic library encapsulation of partial secret algorithm is realized. The asymmetric public and private key pairs of SM2 and RSA are generated on the basis of SM2 and Openssl algorithm library, respectively. The realization of symmetric encryption and digest algorithm. The generation and analysis of SM2 and RSA certificate request file, the issuance and verification of root certificate and user certificate are studied and realized. At the same time, this paper studies the relationship between SM2 signature certificate and encryption certificate in dual certificate mode. SM2 encryption certificate generation and encryption private key protection algorithm. 4) Research and implementation of the local database access methods and methods, so that it can perfectly match the software data query, access. The small CA software implemented in this paper can provide the testing personnel with RSA and SM2 certificates which are simple, fast and diversified in Windows system. It also has the functions of application, issuance, resolution, revocation, verification and query, and supports SM2 signature in accordance with the country secret specification. The software eliminates all kinds of inconvenience and triviality of traditional certificate application, solves the requirement of certificate service in equipment testing platform, ensures the quality of test, and saves test time and cost.
【学位授予单位】：中国科学院大学(中国科学院工程管理与信息技术学院)
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP311.52;TN918.4

【相似文献】