公钥基础设施(PKI)应用中的信任问题与安全解决方案  

Trust Problem in PKI Application and Its Secure Solution

作　　者：宁红宙[1] 华刚[1] 金端峰[1] 

机构地区：[1]航天信息股份有限公司数字技术研究院

出　　处：《中国安全科学学报》2007年第10期140-144,共5页China Safety Science Journal

摘　　要：详细论述受信证书链的替换原理、方法和过程,及其引发的用户错误受信问题。通过分析得到安全证书链的长度为小于3,但由于实际应用的业务需要和安全性需要,证书链的长度通常至少为3。最后针对上述问题给出了一种安全解决方案,通过结合存储用户个人证书的USBKEY硬件设备,采用物理信任点代替逻辑信任点来防止受信证书的替换,为用户构建安全可靠的网络信任环境。The substitution principle, method and process of trusted certificates and the problem of wrong trust are detailed in this paper. By analysis, the secure length of certificates chain is less than 3. But in actual application, the length of certificates chain is at least 3 for the requirement of business and security. Aiming at this problem, a secure solution is provided, which uses physical trust point to substitute logic trust point to avoid trust certificates substitution by combining USBKEY, a kind of hardware for storing personal certificate with certificates chain. This solution builds up a secure and reliable network trust environment for users.

关 键 词：信任 证书 证书链 CA(证书权威)系统 PKI(公钥基础设施)体系 

分 类 号：X913.2[环境科学与工程—安全科学] TP309[自动化与计算机技术—计算机系统结构]