PKI培训海外(英文版)(共37张).pptx

《PKI培训海外(英文版)(共37张).pptx》由会员分享，可在线阅读，更多相关《PKI培训海外(英文版)(共37张).pptx（37页珍藏版）》请在淘文阁 - 分享文档赚钱的网站上搜索。

1、1 1为了安全为了安全 总是握奇总是握奇2009年1月14日Security payment and trusted Security payment and trusted compute productions linecompute productions linePKI introduction2 2为了安全为了安全 总是握奇总是握奇Content Information Security Background PKI Foundation A Whole PKI System Standards and reference3 3为了安全为了安全 总是握奇总是握奇the primary

2、 target of the information security assure the sender is himself defend the document be readed/writed without the authentication defend the amend for document without the authentication sender dont denied the documents the arbitration authority4 4为了安全为了安全 总是握奇总是握奇the essence and countermeasure of th

3、e security threatssecurity threatscountermeasuresLawlessly access system for operating documentsAccess control/operation controlWiretap the information or leakdocument encryptForgery transaction or deliver documentauthentication the documents sourcedocuments be sophisticated or deleteddocument integ

4、ralitySender or receiver deny the documentsundeniable5 5为了安全为了安全 总是握奇总是握奇PKI (Public Key infrastructure) Public Key Infrastructure (PKI) Supply the solutions for the security of electronic world6 6为了安全为了安全 总是握奇总是握奇Content Information Security Background PKI Foundation A Whole PKI System Standards an

5、d reference7 7为了安全为了安全 总是握奇总是握奇PKI？ Infrastructure Infrastructure based on Public Key Supply security basic architecture by public key principle and technology8 8为了安全为了安全 总是握奇总是握奇symmetrical Key encrypt/decrypt processtwo parts use the same key9 9为了安全为了安全 总是握奇总是握奇problems about the symmetrical Key m

6、anage the keys and assure confidentiality are the important problems1010为了安全为了安全 总是握奇总是握奇public Key encrypt principle public Key encrypt(asymmetrical Key) a pair of keys(private Key and public key) instead of the symmetrical key sended information is encrypted by public key, receive part use the pri

7、vate key decrypt information public key may spread freely private and public key do the digital signature and validate the signature Assure the integrality and authentication sender1111为了安全为了安全 总是握奇总是握奇asymmetrical key encrypt process one public key and one private key 1212为了安全为了安全 总是握奇总是握奇compare a

8、bout two encrypt typessymmetrical keyasymmetrical keykey countsSingle key A pair of keys（private and public Keys）statementKey must secrecyA public key and a private keymanagementsimple and difficulty for management need digital certification and trusted third partencrypt velocityquicklyslowlyapplica

9、tionmass data informationsmall data information1313为了安全为了安全 总是握奇总是握奇Digest arithmeticverify the information be not sophisticated output result is computed by the digest arithmetic The result have the same length, usually is 128 bits or 160 bits, now we have the 32*8 bits-different input, the same ou

10、tput-every bit does hash the files with same hash results is impossible Any change will have the different hash result1414为了安全为了安全 总是握奇总是握奇Digital Signature OperationDataMD5SHA1SHA2561515为了安全为了安全 总是握奇总是握奇Terms signature private key encrypt validate signature public key decrypt asymmetrical encrypt p

11、ublic key encrypt asymmetrical encrypt decrypt private key decrypt1616为了安全为了安全 总是握奇总是握奇Content Information Security Background PKI Foundation A Whole PKI System Standards and reference1717为了安全为了安全 总是握奇总是握奇Scene two people(parts) 小明jack 小华harry event 小明写信给小华jack write the information to harry Keys ty

12、pe1818为了安全为了安全 总是握奇总是握奇1919为了安全为了安全 总是握奇总是握奇2020为了安全为了安全 总是握奇总是握奇asymmetrical Key mechanical is enough? we also do these: information security policy- define the rule of key mechanical operation generate Key、store and manage how to generate the Key and digital certificate, how to issue and use.2121为

13、了安全为了安全 总是握奇总是握奇The target of PKI confidentiality transaction information secrecy integrality transaction information integrity reality identity is reality and may be verified undeniable transaction behavior is undeniable2222为了安全为了安全 总是握奇总是握奇Modules in the PKI System信息安全政策information security policy

14、；注册管理中心(Registration Authority, RA)证书管理中心(Certificate Authority, CA)；证书发布系统(Directory Service, DS)PKI应用系统PKI application system2323为了安全为了安全 总是握奇总是握奇Registration Authority, RA RA is the middle interface between users and CA, it accept and authenticate the users documents and bring forward the applica

15、tion for certification.2424为了安全为了安全 总是握奇总是握奇CA (certificate Authority) CA is the basement of PKI system The digital certificate life cycle, CA include: Issue the digital certificate with users ID、Public Key、Digital certificate available data of certificate CA may abolish the certification according

16、the CRL (Certificate revocation List)2525为了安全为了安全 总是握奇总是握奇about digital certificate contents in certification: private information CA information Public key of users Available data Digital signature for certification contents by CA 2626为了安全为了安全 总是握奇总是握奇X.509 Digital certificate format2727为了安全为了安全 总是

17、握奇总是握奇Digital certificate sketch map2828为了安全为了安全 总是握奇总是握奇Digital certificate and ID CardName: Brian LiuSerial number:484865Issued by:ABC corp CAIssue date:1997 01 02Expiration date: 1999 01 02Public key: 38ighwejb38ighwejbDigital Signature: hwefdsafhwefdsaf2929为了安全为了安全 总是握奇总是握奇Digital certificate li

18、fe cycle 3030为了安全为了安全 总是握奇总是握奇Certificate Issuehow to get the certificate RA or the application(smartcardusbkey) generate the public and private keys RA transfer a certificate request with public key to CA(RA validate the identity of user) CA issue the certificate to user application or smartcard or

19、 usbkey store the certificate CA release the certificate3131为了安全为了安全 总是握奇总是握奇Certification Authentication verify the validity of certificate: 小华取得小明的证书? application performance process get jacks certification and CAs root certification compute the hash of jacks certificate by CAs root public key get

20、 the hash of jacks certificate compare two hash data check out the time3232为了安全为了安全 总是握奇总是握奇Certificate issue system Certificate can be issued by multiple styles under the PKI framework User self or LDAP(目录服务)3333为了安全为了安全 总是握奇总是握奇PKI applications PKI applications include: communication between web s

21、ervice and browser E-mail Electronic Data Interchange, EDI online tax online bank Virtual Private Network, VPN3434为了安全为了安全 总是握奇总是握奇Content Information Security Background PKI Foundation A Whole PKI System Standards and reference3535为了安全为了安全 总是握奇总是握奇Standards and reference for PKI3636为了安全为了安全 总是握奇总是握奇3737为了安全为了安全 总是握奇总是握奇演讲完毕，谢谢观看！