密码服务API通用可组合框架  

The Universally Composable Framework of Cryptographic Service APIs

作　　者：徐开勇[1] 袁庆军 谭磊 陆思奇 

机构地区：[1]解放军信息工程大学密码工程学院,郑州450001 [2]解放军外国语学院,洛阳471003

出　　处：《密码学报》2017年第4期405-412,共8页Journal of Cryptologic Research

摘　　要：密码服务API是各类信息系统获取密码服务的入口,为信息系统的密钥协商、信息加密和身份认证等提供密码算法的调用与处理,当前攻击者针对API设计缺陷或漏洞,绕过系统安全策略或者非正常调用密码处理过程,从而达到欺骗密码服务系统,获取密码系统内部的密码资源或秘密信息.本文通过研究密码服务API功能函数组合应用的安全性证明问题,提出了密码服务API的通用可组合框架,旨在通过形式化分析方法对密码服务API的安全性进行验证.在通用可组合安全框架下,添加了支持密码服务API全局状态的记录、读取和操作,提出了密码服务API通用可组合安全框架.对理想模型下、现实模型下和混合模型下的密码服务API执行过程进行了形式化描述,通过基础定理的证明验证了在API通用可组合框架下,以API基础功能为基础,验证复杂API安全性是可行的.Cryptographic service APIs is the interface that providing cryptographic service for other information systems such as Key agreement, encryption and authentication. Aimed at API's design defects, attackers can bypass the system' s security policies or call interfaces illegally, so as to deceive the cryptographic service system to obtain the keys or resources in the system. This paper studies the security proof of password service API function application problems, proposes a universally composable framework of cryptographic service APIs,aiming to verify the security of cryptographic service APIs by formal analysis method. Under the framework of universally combinable security framework, added support for the cryptographic service APIs' global status recording, reading and operation, a universally combinable framework for cryptographic service APIs is proposed. This paper describs a formal description of the cryptographic service APIs' implementation under the ideal model,the realistic model and the mixed model, and proves that it is feasible to validate the complex API security based on the API basic function under the universally composable framework of cryptographic service APIs.

关 键 词：密码服务API 通用可组合框架 全局状态 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]