一種基于容忍入侵技術(shù)的CA方案

CA是PKI中的關(guān)鍵設(shè)施.CA的可信任性依賴于CA的私鑰。CA的私鑰一旦泄露,該CA簽發(fā)
的所有證書就只能全部作廢。確保CA的私鑰不泄漏極其重要。容忍入侵技術(shù)不是通過傳統(tǒng)的防火墻或入侵檢測技術(shù)來保證CA的安全,而是確保當(dāng)少數(shù)部件遭受入侵后,CA系統(tǒng)的機(jī)密信息并沒有泄漏，即具有容忍入侵性。通過RSA加密算法和(t,n)秘密共享機(jī)制,將私鑰分發(fā)給不同的共享服務(wù)器,并且私鑰在任何時候都無需重構(gòu)，保護(hù)了CA私鑰的保密性，增強(qiáng)了CA的容忍入侵性.
關(guān) 鍵 詞: 容忍入侵;認(rèn)證中心;秘密共享

A Based Intrusion Tolerant CA Scheme CHAI，zheng-yi，ZHANG，hao-jun
(Department of information science and technology，henan university of technology, zhengzhou， henna，China 450007) Abstract：CA is the key infrastructure to the PKI。its reliability relies on its private key。 Once its private key is revealed, all the certificates signed by the CA must be cancelled. so it is very important to ensure the CA private key is not revealed. Intrusion Tolerant ensure the security of the CA by the way that even if some part of the CA is broken, the CA private key is still safe, instead of by the firewall and Intrusion detection. by RSA and (t,n) secret shared method, it distribute private key to different sharing servers. The private key needn’t be reunion at any time to protect the security of the CA and enhance the Intrusion Tolerant of CA.
Keywords: Intrusion Tolerant；certificate authority；secret sharing