WSS在基于浏览器和USBKey的数字证书签发系统中的研究与应用

发布时间：2018-01-21 07:47

本文关键词： WebSocket WebSocket安全浏览器 USBKey 数字证书签发　出处：《郑州大学》2017年硕士论文　论文类型：学位论文

【摘要】：为保证B/S系统的安全性,一些安全性要求较高的领域使用用户终端外接设备如USBkey等作为安全保障。操作系统出于安全性考虑禁止浏览器直接访问用户的本地资源和外接设备,浏览器插件解决了这一问题。插件技术没有统一的标准,不同内核的浏览器支持的插件技术不同。目前使用较多的ActiveX和NPAPI插件技术由于存在安全隐患逐渐不再被浏览器支持。郑州信大捷安的基于浏览器和USBKey的数字证书签发系统现有的安全控件也存在这些问题。为此,本文提出使用HTML5中的WebSocket协议作为浏览器对USBKey访问的解决方案,在用户本地构建WebSocket安全服务对USBKey操作并与浏览器通信,进而根据浏览器端需求将数字证书签发到USBKey中。主要工作如下:分析了WebSocket协议的通信原理,在此基础上设计了使用WebSocket访问本地资源的WebSocket解决方案。在用户本地实现WebSocket服务并通过该服务对用户的本地资源或硬件设备进行访问或操作,由该服务与浏览器客户端通信将操作结果发送给浏览器。随着HTML5的逐渐推广与应用,遵循HTML5标准的浏览器即可使用该解决方案,不会因浏览器内核而产生限制,解决了插件技术存在的浏览器兼容性问题。设计了WebSocket解决方案的安全增强型WSS服务模型。在上述解决方案的基础上,考虑到浏览器与WebSocket服务通信的安全性,对WebSocket协议中定义的wss连接进行研究,设计了基于TLS层的WebSocket安全(WSS)服务模型,并提出了该模型的实现方法以及配置方案。使用数字证书建立WSS服务与浏览器双方信任的通道,保证双方通信的安全性。实现了使用WSS数字证书签发系统。研究了信大捷安UKey设备的数字证书签发系统的需求和USBKey提供的硬件接口;将WebSocket解决方案和WSS服务模型结合当前的业务需求进行实现,并封装为安全控件。系统使用该控件实现了通过浏览器向用户的USBKey内签发数字证书。对系统进行功能性和浏览器兼容性测试,其测试结果也验证了使用WebSocket作为浏览器访问本地硬件资源中间件的可行性与可靠性。
[Abstract]:In order to ensure the safety of the B/S system, the user terminal of some high security areas such as external devices such as USBkey security operating system. Considering safety banned browser direct access to the user's local resources and external equipment, browser plug-ins to solve this problem. The plug-in technology has no unified standard, different kernel the browser supports plug-in technology. At present the ActiveX and NPAPI plug-in technology due to the existence of security risks gradually no longer be browser support. The letter Zhengzhou victory Ann browser and USBKey digital certificate issued based on the existing security control system also has these problems. Therefore, this paper proposes to use the HTML5 WebSocket protocol as the solution the browser visit to the USBKey, build the WebSocket security service for USBKey operation and communication in the local browser users, and According to the demand of the browser will digital certificate issued by USBKey. The main work is as follows: the analysis of the communication principle of WebSocket protocol, on the basis of the design using WebSocket to access the local resources WebSocket solution. In the user's local implementation of WebSocket service and the service of local resources or hardware device on the user to access or by operation. The browser service and client communication operation result is sent to the browser. With the gradual popularization and application of HTML5, follow the standard HTML5 browser can use the solution, not because the browser kernel generates constraints, solve the browser compatibility issues of plug-in technology exist. WebSocket is designed to solve the security enhanced WSS service model in the scheme. Based on the above solutions, taking into account the safety of the browser service and WebSocket communication, the WebSocket agreement The definition of the WSS connection of TLS layer is designed based on WebSocket security (WSS) service model, and put forward a method to realize the model and configuration. The use of digital certificates to establish mutual trust with the browser WSS service channel, to ensure the safety of the communication between the two parties. The use of WSS digital certificate issued by the hardware system. Study on the interface of digital certificate letter issued an UKey victory equipment system requirements and provide USBKey; will combine the current business needs of WebSocket solution and WSS service model, and package for safety control. Use the control system realizes the digital certificate to the user through the browser USBKey function and browser. The compatibility test of the system, the test results also verify the feasibility and reliability of using WebSocket as a browser to access the local hardware resources of middleware.

【学位授予单位】：郑州大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP309;TP393.092

【相似文献】