基于服务端密钥存储的网络计算机数字证书系统

为了解决在网络计算机系统中部署数字证书系统时存在的终端实体对私钥数据的存储需求和网络计算机无本地存储特性的矛盾,提出一种基于服务端密钥存储的网络计算机数字证书应用系统的设计与实现方案。该方案基于公钥基础设施体系架构,采用了随机数、"盐"和多轮迭代等手段保证系统的安全性,并且通过在客户端进行密钥生成和加解密操作的方式实现了系统的可扩展性。系统实现的结果表明:由于无需借助外部密钥存储设备,该系统在保证安全性和可扩展性的同时,实施复杂度和成本均降低。

CA system in network computer environment based on server-end private-key storage mechanism

A design and implementation scheme was devised for a certificate authority(CA) system in network computer environments based on a server-end privatekey storage mechanism to solve the conflict between private-key storage demands of the end-entity and the nonstorage character of network computer systems.The scheme was based on the public key infrastructure(PKI) architecture with system security achieved by various means such as random numbers,salt,and multiple round iterations.The scheme also ensures system scalability by assigning key derivation and encryption/decryption operations to the client-end.System implementation tests show that the system complexity and cost are reduced without impairing system security and scalability because external private-key storage equipment is not needed.