基于Spring Security的虚拟实验安全机制的研究与实现  

Research and implementation of security mechanism of virtual experiment based on Spring Security

作　　者：王小飞 王元鑫 袁涛 嵇绍康 WANG Xiaofei;WANG Yuanxin;YUAN Tao;JI Shaokang(Naval Aeronautical Engineering Institute Qingdao Branch,Qingdao 266041,China)

机构地区：[1]海军航空大学青岛校区,山东青岛266041

出　　处：《电子设计工程》2021年第5期80-84,89,共6页Electronic Design Engineering

摘　　要：针对虚拟实验平台的Web服务安全问题,从身份认证、授权访问和安全传输这3个方面采取措施来保证虚拟实验Web资源的安全访问。在身份认证层面,采用安全系数极高的RAS加密认证方式;在授权访问层面,通过整合Spring Security安全框架与J2EE构架来保证得到授权的用户访问Web资源时的安全性;在信息传送安全性层面,对XML加/解密算法改进设计,提高信息传送的安全性和快捷性。从以上3个层面确立的安全机制的目的在于为得到授权的用户提供一个安全稳定的教学环境来进行虚拟实验,确保教学活动的有序进行。To the question of Web service security about virtual experiment,the Web resource can be accessed safely from identity authentication,access control and transport security is insured.In identity authentication,the style of RSA authentication is adopted.In access control,the Web resource can be accessed by compounding Spring Security and J2EE truss is insured.In transport security,the security and facility of data transport by improving the encrypting and decrypting of XML are advanced.This security mechanism aims at providing a safely and steady virtual experiment teaching entironment.

关 键 词：WEB服务安全 Spring Security RSA认证 XML加密 

分 类 号：TN91-4[电子电信—通信与信息系统]