摘要
随着Internet的飞速发展，诸如电子商务、电子政务、自动化办公等数字化应用正在世界范围内迅速崛起，人们的生产、生活方式正发生着深刻地变革。但伴随着网络应用的迅速发展，网络的安全问题也日益突现出来，严重制约着Internet及其相关网络应用的进一步发展。
Web本质上就是运行在Internet上的客户机／服务器应用程序。Internet上的各种网络应用几乎全部以Web的形式出现。由于Internet是一个开放的环境，各种信息将通过公共网络进行传输，因此保障Web系统安全的关键性问题之一在于保证信息的传输安全。本论文即为相关研究工作的总结。
针对Web系统中信息传输所面临的安全威胁，本论文提出了一种基于安全信道的信息传输方案，并详细阐述了该机制的设计、实现和调配的全过程。该安全信道通过综合运用X.509证书、密钥交换协议、对称密码算法和消息摘要等安全技术，保证了通信消息的机密性与完整性。整个安全信道建立在应用层上，使得该机制灵活高效，能针对不同文件的具体要求提供不同的安全服务。整个系统，无论服务端或客户端，全都采用Java技术实现。这使得系统可以提供真正的跨平台的系统集成服务，不仅有利于该机制与现有的Web系统整合，方便用户的应用，也有利于系统日后的扩展和维护，体现了Web技术的最新发展动向。
通过对安全信道的分析论证，该安全机制结构严谨，能有效抵御各种常见的安全攻击，具有较强的安全性能。由于该安全信道采用了最新推出的高级数据加密标准AES，使得该机制具有较高的起点，能在很长一段时期内提供可靠的安全保护。
理论和实践证明，通过使用安全信道，可以有效解决Web系统的信息传输安全问题，解除用户对于信息安全的顾虑，从而使得网络应用可以得到更快、更好的发展。该项研究为解决Web的安全问题进行了一个有益的探讨，其成果给出了一种新的Web安全问题的解决方案，有着切实的应用与发展前景。
A number of the digital applications, such as E-business, OA, etc, are growing up in the global range along with rapid progress of Internet. The mode of life is also changing very profound. However, the status of the network security is becoming worse at the same time. Furthermore, the security problems restrict the farther development of the Internet.
The Web is actually a giant client-server system in the Internet. Almost all the network application in the Internet present itself as the form of Web. Security of the information transmission is a key issue among others, since Internet is an open network. This thesis reflects my researches on this topic.
According to some kinds of existed attacking methods that are aimed at the Web system, we propose a new scheme, which transmits the information through the security channel. The scheme is described in detail in the thesis. In order to ensure the secret and integrity of transmission, we synthetically use some security technologies, including X.509 certificate, the key exchange protocol, encryption and message digest. The security channel is built on the application layer. It can provide different services according to different request. The whole system is implemented with Java, so it can offer the true cross-platform systems solutions. Not only it can be easily incorporated into the exited Web system, but also it can easily maintain in the future. This programming style is the trend of developing Web system.
The analytical results indicate that the security channel has the compact structure and the best security. It can resist exited diversified security attacks. Since Advanced Encryption Standard is adopted, the security channel has a very good security. This mechanism will be effective in a long time.
With the security channel, the problem of information transmission in the Web System can be well resolved; thus the network application will develop more quickly than today. In short, we propose a new scheme for resolving the problem of security. This scheme can be put into practice and it has a broad prospect.
引文
[1]蒋伟进，许宇辉．基于体系结构的网络与信息安全研究．计算机正程与应用，2000．37(9)：157～159
[2]张兴军，钱德沛，张然．一种实现Web应用服务器安全的新方法．计算机工程与应用，2001．37(19)：16～18
[3]何全胜，姚国祥．网络安全需求分析及安全策略研究．计算机工程，2000．26(6)：56～58
[4]王作芬，弄芙蓉，黄本雄．虚拟专用网中IPSec隧道技术的研究与实现．计算机工程，2001．27(6)：118～119
[5]宋志敏，王卫京．SSL V3.0及其安全性分析．计算机工程与应用，2000．36(10)：145～147
[6]杨千里，王育民．电子商务技术与应用．北京：电子工业出版社，1999．96～101
[7]黄理，李积善，曹林有，等．网站开发新动力—用JSP轻松开发Web网站．北京：北京希望电子出版社，2001．46～52
[8]Eckel.B.Java编程思想．北京：机械工业出版社，1999．14～20
[9]Jaworski.J.Java安全手册．北京：电子工业出版社，2001．12～27
[10]John Zukowski.Java 2从入门到精通．北京：电子工业出版社，1999．721～730
[11]卢开澄．计算机密码学：计算机网络中的数据保密与安全．北京：清华大学出版社，1998．1～3
[12]Schneier,B.应用密码学：协议、算法与C源程序．北京：机械工业出版社，2000．3～399
[13]吴文玲，冯登国，卿斯汉．简评美国公布的15个AES候选算法．软件学报，1999．10(3)：225～230
[14]RSA Laboratories. PKCS #7. Cryptographic Message Syntax Stand. 1993-11-01
[15]Network Working Group. RFC2104. HMAC: Keyed-Hashing for Message Authentication. 1997-02
[16]郭庆平，金庆华，徐凯声．数字签名技术及其应用．武汉交通科技大学学报，1999．23(5)：508～512
[17]易江波，赵战生，阮耀平．SSL及使用SSLeay实现证书的签发和管理．计算机应用研究，2001．18(1)：76～78
[18] 方美琪．电子商务概论．北京：清华大学工业出版社，1999．185～233
[19] 朱树人，李伟琴．安全信道的建立及应用研究．计算机科学，2001．28(3)：50-52
[20] 裴继奎，李大兴．X.509中身份认证协议的安全性描述．计算机应用，2001．21(10)：64-68
[21] 曾志峰，杨义先．网络安全的发展与研究．计算机工程与应用，2000．36(10)：1～3
[22] 何明星，范平志．新一代私钥加密标准AES进展与评述．计算机应用研究，2001．18(10)：4-6
[23] National Institute of Standards and Technology. FIPS PUB 197. Announcing the ADVANCED ENCRYPTION STANDARD (AES). 2001-11-26
[24] National Institute of Standards and Technology. FIPS PUB 186-2. DIGITAL SIGNATURE STANDARD (DSS). 2000-01-27
[25] How to Implement a Provider for the Java~(TM) Cryptography Architecture. http://java.sun.com/j2se/1.3/docs/guide/security/HowToImplAProvider.html
[26] How to Implement a Provider for Java~(TM) Cryptography Extension. http://java.sun.com/products/jce/doc/guide/How ToImplA Provider. html
[27] Java~(TM) Cryptography Architecture (JCA) API Specification & Reference. http://java.sun.com/j2se/1.3/docs/guide/security/CryptoSpec.html
[28] Construct secure networked applications with certificates-Certificates add value to public-key cryptography.http://www.javaworld.com/javaworld/jw-01-2001/jw-0112-howto.html
[29] Construct secure networked applications with certificates-Learn to use X.509 certificates. http://www.javaworld.com/javaworld/jw-02-2001/jw-0216-howto.html
[30] Construct secure networked applications with certificates-Use the Java CRL and X509CRL classes. http://www.javaworld.com/javaworld/jw-03-2001/jw-0316-howto.html
[31] Construct secure networked applications with certificates-Authenticate clients and servers, and verify certificate chains. http://www.javaworld.com/javaworld/jw-04-2001/jw-0413-howto.html
[32] 张淮中．实现基于HTTP的servlet与applet的通信．计算机工程与设计，2000．21(6)：16-19
[33] 刘彩虹，陆倜．Internet E-mail的核心协议研究与实现．计算机工程与应用，2001．37(6)：65～68
[34]Bill Brogden.Java开发指南——Servlets和JSP篇，北京：电子工业出版社，2001．245-270
[35]The Java 2 Platform API Specification.http://java.sun.com/products/jdk/1.3/docs/api/index.html
[36]杨智，王凤琴，王丽琴．在VB6.0中实现base64编码／解码．计算机应用，2000．20(9)：28-30
[37]王克宏．Java2程序设计．北京：清华大学工业出版社，2000．269～281
[38]Java~(TM) Plug-in Html Specification. http://java.sun.com/products/plugin/1.3/docs/tags.html
[39]Performance problem or design problem. http://www.javaworld.com/javaworld/jw-03-2000/jw-03-javaperf_3.html
[40]Make Java fast: Optimize. http://www.javaworld.com/javaworld/jw-04-1997/jw-04-optimize.html
[41]Tweak your IO performance for faster runtime. http://www.javaworld.com/javaworld/jw-11-2000/jw-1117-performance.html
[42]数据库连接池浅析．http://61.144.28.245/hjc/web/doc/jdbc/4.html
[43]JDBC usage for industrial-strength performance http://www.javaworld.com/javaworld/jw-02-2000/jw-02-ssj-jdbc2.html
[44]Tomcat全攻略．http://www-900.ibm.com/developerWorks/java/1-tomcat/index.shtml
[45]Sun Microsystems, Inc. Java Servlet Specification v2.3. 2000-08-15