一种新的私钥安全存取方案  

A New Accessing and Storing Private Key Scheme

作　　者：潘恒[1] 徐斌[2] 祝跃飞[1] 

机构地区：[1]信息工程大学信息工程学院,河南郑州450002 [2]机械工业部第六设计研究院易普公司,河南郑州450007

出　　处：《计算机应用研究》2005年第10期105-107,110,共4页Application Research of Computers

基　　金：国家"973"计划资助项目(G1999035804);国家自然科学基金资助项目(90204015;19931010);河南省杰出青年基金资助项目(0212001400)

摘　　要：安全的私钥存取机制是构建可靠PKI系统的关键问题之一。从对私钥拥有者的强身份认证和保护私钥存储机密性这两个角度出发,提出了一种新的基于GQ(Guillou-Quisquater)零知识身份认证体制的私钥安全存取方案。该方案将端实体的私钥以密文形式存放在CA中。当端实体使用私钥时,系统采用双因素认证技术(GQ体制和秘密值h)验证端实体身份,可以有效抵御认证过程中潜在的各种攻击,同时避免信息泄漏。此外,端实体首次使用私钥后,重新生成保护密钥,利用该保护密钥对私钥加密,再将密文传回CA,从而最大限度地确保了私钥传输和存储的机密性。To build an effective Public Key Infrastructure （PKI）, a secure way of accessing and storing the users＇ private keys is very essential. The present paper proposes a new, secure scheme based on GQ （Guillou-Quisquater） identification scheme. It can not only corroborate the identity of a private key owner but enhance the confidentiality of the private key storage as well. The users＇ encrypted private keys are stored at Certificate Authority （CA）. In order to avoid the different types of malicious attacks and to ensure the minimum information leak during the authentication process, the GQ identification scheme is used so that only the legal user can be verified and get his private key. In addition, to enhance the confidentiality of the private key storage and transmission, as soon as the legal user finishes using the private key, a new protective key will be reproduced. The private key encrypted by the new protective key will then be transmitted to CA again.

关 键 词：PKI GQ认证体制 保护密钥 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]