利用双证书机制改进SSL/TLS协议  

Improving SSL/TLS protocol using double-certificate mechanism

作　　者：李晓峰[1] 赵海[1] 周艳[1] 宁宣杰[1] 

机构地区：[1]东北大学信息科学与工程学院,辽宁沈阳110004

出　　处：《信息安全与通信保密》2007年第11期22-24,27,共4页Information Security and Communications Privacy

摘　　要：在PKI技术规范发展的过程中目前形成两种证书机制:单证书机制和双证书机制[1]。近年来,在欧洲等国家又掀起多证书协议的研究[2],但尚不成熟。单证书是目前广泛存在和应用的证书机制,但用证书的加密和签名在PKI中是两种应用,因为,在SSL协议的应用中都采用双证书机制。为此,论文重点讨论了双证书机制的实现与应用,以及它对SSL/TLS通信协议进行的安全性改进,如改进了TLS的访问控制、增加抵抗DoS攻击特性等相关研究。At present, there are two certificate mechanisms with the development of PKI system, one is single-certificate mechanism, and the other is double-certificate mechanism. In these years, there are many researches on doublecertificate mechanism in Europe, while which are not mature enough. Although single-certificate mechanism is widespread presently, yet the encryption and the signature using certificates are two different applications, and it is doublecertificate mechanism that has been used in SSL protocol. Therefore, this article puts emphasis on the implementation of double-certificate mechanism and the improvement of SSL/TLS protocol using this mechanism, such as improving the access control of TLS, enhancing the counteraction ability of DOS attack.

关 键 词：数字证书 SSL协议 SSL/TLS通信协议 PKII PMII ACL DOS攻击 

分 类 号：TP393.04[自动化与计算机技术—计算机应用技术]