券商行业商用密码应用与实践  

Application and Implementation of Commercial Cryptographic Algorithm in Securities Industry

作　　者：严星宇 赵川 徐雁飞 Yan Xingyu;Zhao Chuan;Xu Yanfei(Guolian Securities Co.,Ltd.,Wuri,Jiangsu 214121;College of Information Security,Jiangsu Electronic Information Product Quality Superoision&Inspection Institute,Wuxi,Jiangsu214073)

机构地区：[1]国联证券股份有限公司,江苏无锡214121 [2]江苏省电子信息产品质量监督检验研究院,江苏无锡214073

出　　处：《信息安全研究》2023年第7期707-712,共6页Journal of Information Security Research

摘　　要：介绍了商用密码应用工作的背景,分析了证券网上交易系统的密码应用现状与存在的安全风险,提出了一种新的网上交易密码应用方案,从系统架构、涉及的关键密码技术、重点密码应用场景3个方面进行详细说明,论证了商密在加强用户身份认证、数据传输加密方面发挥的重要作用,改进了传统方案需要依靠硬件USB-Key才能实现密码功能的弊端,对其他行业推广商密应用也有借鉴作用.This paper introduces the background of the application of commercial cryptographic algorithm,analyzes the current situation and security risks of the cryptographic application of the securities online trading system,and proposes a new online trading cryptographic application scheme witch is explained in detail from three aspects of system architecture,key cryptographic technologies involved and key cryptographic application scenarios,demonstrates the important role played by the State Secret in strengthening user identity authentication and data transmission encryption,improves the drawbacks of traditional solutions that rely on hardware USB-Key to achieve cryptographic functions.The research is also useful for other industries to promote the application of commercial cryptographic algorithm.

关 键 词：协同签名 商用密码算法 交易系统 身份认证 SSL协议 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]