CA系统安全性的分层多方面设计  

Multi-layer and Multi-aspect Design of CA System Security

作　　者：兰丽娜[1] 杨涛海[2] 

机构地区：[1]北京邮电大学网络教育学院,北京100088 [2]信息产业部电信研究院,北京100083

出　　处：《计算机工程》2007年第23期179-181,共3页Computer Engineering

摘　　要：CA系统本身的安全性是影响Internet电子商务安全的关键问题。分析了CA系统的总体网络结构,提出了一种CA系统的分层多方面安全性设计方案,阐述了网络层安全设计和应用层安全设计。网络层安全采用划分安全区、多层防火墙保护、交换以太网等方法;应用层采用软件代码签名防篡改、数据包增加时间戳防重放攻击、敏感数据内存零化及数据库加密存储、集中监控等8个方面的安全性设计。该设计已实际应用于某CA中心,达到了良好的安全性目标。CA system security is the key problem to influence the security in E-commerce. This paper analyzes the network architecture of CA system, and presents a multi-layer and multi-aspect security architecture of CA system. The security design fncuses on the network layer and application layer. Firewalls divide CA system network into different security grade areas. The following methods are employed in the application layer for security protects： add the digital signature at the end of the software to prevent invalid code modify, add the sender time stamp in the packets to prevent repeat packets attack, clear to zero in memory and save the important data as encrypted in the database to prevent invalid reading, use central monitor system. The design is employed in a real CA system successfully.

关 键 词：CA系统 网络层安全 应用层安全 防火墙 时间戳 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]