IBE-XKMS：一个基于XML的IBE密钥管理服务体系

doi:10.3969/j.issn.1000-0801.2010.07.007

Abstract

Abstract:

In this paper,the differences between PKI and identity-based encryption（IBE）are firstly analyzed,and the advantages of building XKMS infrastructure for IBE are in detail discussed. An XKMS-like service architecture for IBE, named IBE-XKMS, is then proposed, and the modules of system management, identity authentication, key generation and key management are designed, as well as the service component logic relationships are described. Next, the key management service interfaces of four categories are proposed. Besides the basic XKMS services, IBE-XKMS also provides two types of key involved operations to implement the IBE encryption envelope and signature service, which can be utilized to develop some IBE-enabled secure web application without code on client. It is noted that IBE-XKMS provides a service framework with full IBE application supported for the next generation network of web service. At last, a prototype of IBE-XKMS is developed, on which the tests on the service response performance and the SOAP message communication cost are conducted, comparing with that of PKI-enabled XKMS.

Key words: PKI, IBE, XKMS, XML, Web Service, key management

Tieming Chen,Wei Li,Jiamei Cai,Shilong Ma. IBE-XKMS: XML-Based IBE Key Management Service Infrastructure[J]. Telecommunications Science, 2010, 26(7): 22-31.

Figures/Tables 10

References 24

1	Koblitz N ， Menezes A . A survey of publick-key cryptosystems， SIAM Review Archive， 2004,46(4): 599-634.
2
3	. A survey of public key infrastructures，
4	Papazoglou M P ， Heuvel W J . Web services management：a survey. IEEE Internet Computing， 2005,9(6): 58-64
5	. XML key management specificationXKMS 2.0). , May22005
6	Crampton J , Lim H W , Paterson K G . What can identity-based cryptography offer to web service? In: Proceedings of the 2007 ACM Workshop on Secure Web Services, New York,ACM, 2007
7	lin J , Jing J , Liu P . A framework for intrusion tolerant certification authority system evaluation. In: Proceedings of IEEE Symposium on Reliable Distributed Systems, October 2007
8	Shamir A , . Identity-based cryptosystems and signature schemes. . advances in cryptology.In:Proceedings of CRYPTO 84,, Berlin, 1984
9	Boneh D , Franklin M K , Identity-based encryption from the weil pairing advances in cryptology. In: Proceedings of CRYPTO 2001, Berlin, 2001
10	Boyen X . Multipurpose identity-based signcryption a swiss army knifer for identity-based cryptography.
11
12
13
14	Martin L . Identity-based encryption and beyond. IEEE Security and Privacy, 2008,6(5): 62-64
15	胡亮，初剑峰，林海群等. IBE 体系的密钥管理机制. 计算机学报， 2009，32(3): 544~556
16	张剑青, 刘旭东, 怀进鹏 . 基于XML的密钥管理的研究与实现. 计算机研究与发展， 2003，40（1）: 75～80
17	Park N . Moon K . Jang J , etal. Implementation of streamlining PKI system for Web services. In：Proceedings of ICCSA 2005，Singapore， May 2005
18	唐邵华，甘志勇 . 基于XKMS的PKI服务的设计与实现. 电子与信息学报， 2005，27(2): 314-317
19	Alvaro G , Farrell S . Lindberg T , 等. XKMS working group interoperability status report. In：Proceedings of Public Key Infrastructure， Berlin， 2005
20	Central authentication service. an opensource project.
21	CAS generic handler：a generic authentication handler for CAS.
22	Apache CXF：an open source service framework. .
23	Bethencourt J , Sahai B . Waters A . Ciphertext-policy attribute-based encryption. In: Proceedings of the 2007 IEEE Symposium on Security and Privacy, Washington, 2007
24	Bobba R , Khurana H . AlTurki M , et al. PBES: a policy based encryption system with application to data sharing in the power grid In: Proceedings of the 4th International Symposium on Information, Computer, and Communications Security, Sydney, Australia, March2009

Metrics

Recommended 0

No Suggested Reading articles found!

服务类型	服务名称	服务功能	请求参数	响应参数
X-PPIS	Locate	查询ID所在域的公开参数及其安全密钥策略	ID,DN（domain name）	用户公开参数 PP 和相应的密钥
				策略参数（Si,i=1,2,3）
	Validate	验证ID 所在域获取的PP（public parameters）是否有效	ID,DN,PP	公开参数PP是否有效
X-PKIS	Register	用户通过Web Service 注册ID，获取ID 公开参数PP，并获取ID的私钥	ID,DN,Rc（revocation code，撤销验证码），	公开参数PP 和ID 私钥SK_ID（采用相应的安全密钥策略）
			Ac（authentication code，身份认证码）,Si（i=1,2,3）
	Revoke	用户通过验证码撤销注册的密钥	ID,Rc	撤销是否成功，若成功则注销ID注册信息
	Recover	用户重新请求并恢复ID私钥	ID,DN,Ac,Si（i=1,2,3）	用户公开参数PP和恢复的ID私钥
	Reissue	用户可重新设置策略参数，并可重新分发ID私钥	ID,DN,Ac,Si（i=1,2,3）	重新发布的ID私钥
X-PPCS	Envelope	用户请求生成XML 数字信封，即以接收方ID公钥加密对称密钥生成数字信封，由对称密钥加密明文形成密文	ID,DN,Ac；消息 M，接收方ID，接收方DN,Si（i=1,2,3）	用接收方ID公钥加密的数字信封
	Verify	用户请求发送方 ID 对消息 M 的 XML 签名验证	签名值σ，消息M；发送方ID和DN	ID对M签名是否有效
X-PKCS	Sign	用户请求自己对消息散列H（M）的XML 数字签名	ID,DN,Ac，消息散列H（M）	ID对H（M）的签名是否成功
	Unenvelope	用户请求对XML数字信封的解封	ID,DN,Ac，用ID公钥对消息M的数字信封	用ID 私钥解封数字信封得到的消息M

[1]	Yuyang GAO, Juhao LI, Yongqi HE, Zhangyuan CHEN. Weakly-coupled real-time SDM technology for short-reach optical transmission [J]. Telecommunications Science, 2022, 38(7): 31-36.
[2]	Ming CHENG, Zhe DU, Dezhi ZHANG. A novel CWDM bearer scheme for 5G fronthaul network [J]. Telecommunications Science, 2021, 37(9): 139-146.
[3]	Zhiyong MA. Discussion on technical solutions to fibre-optic home networking [J]. Telecommunications Science, 2021, 37(5): 170-176.
[4]	Yingying SU, Dan LI, Honglin YE. Resource public key infrastructure RPKI: status and problems [J]. Telecommunications Science, 2021, 37(3): 75-89.
[5]	Ye OUYANG,Aidong YANG,Fanyu MENG. A game theory-assisted machine learning methodology for subscriber churn behaviors detection [J]. Telecommunications Science, 2020, 36(6): 79-89.
[6]	Yuan CHEN,Tieming CHEN,Qijie SONG,Dongjie MA. IBEXSec:a universal security framework for industrial internet terminal access [J]. Telecommunications Science, 2020, 36(3): 19-26.
[7]	Xiaolian CHEN,Yi QIN,Jie ZHANG,Yajie LI,Haokun SONG,Huibin ZHANG. Optical fiber eavesdropping detection method based on machine learning [J]. Telecommunications Science, 2020, 36(11): 61-67.
[8]	TANG Yang,ZHANG Yiying,HE Yeshen,WANG Cong,LEI Ming. A PKI-based multi-channel unified identity authentication method for energy information system [J]. Telecommunications Science, 2019, 35(6): 41-49.
[9]	ZHU Hong,SHAO Qi. Analysis of value-added services of power communication network in energy internet [J]. Telecommunications Science, 2019, 35(6): 50-59.
[10]	SHAO Shuai,SHANG Zhijun,WANG Zhongfeng,XIN Guoliang,LI Yueyue,KONG Xiangyu,PENG Xujing. A QoS-based network planning method for power fiber to the home [J]. Telecommunications Science, 2019, 35(6): 78-88.
[11]	Yonghua FENG,Xiang LI,Quan CAO,Zhixia GUO. Development and trend prospect of “tri-ultra” optical fiber communication system technology [J]. Telecommunications Science, 2019, 35(4): 24-32.
[12]	Jianjun TANG,Junjie LI,Chengliang ZHANG,Yuhua CONG,Haomin GONG. Research and experiment of open quantum cryptography communication system architecture and co-fiber transmission technology [J]. Telecommunications Science, 2018, 34(9): 28-36.
[13]	Weichun GE,Huanhuan LUO,Guiping ZHOU,Yingjie WANG,Xiangyu KONG,Luyao GUAN,Chuang SONG,Min ZHANG,Qing LI. Resource management scheme of power fiber to the home network slicing [J]. Telecommunications Science, 2018, 34(9): 153-159.
[14]	Junsen LAI,Rui TANG,Bingbing WU,Wenxuan WU,Hongfa LI,Guojun LIU,Wenyu ZHAO,Haiyi ZHANG. Analysis on the research progress of space division multiplexing in optical fiber communication [J]. Telecommunications Science, 2017, 33(9): 118-135.
[15]	Hangdong ZHANG,Li ZHAN. Low noise figure C+L-band erbium-droped fiber amplifier [J]. Telecommunications Science, 2017, 33(7): 120-123.

IBE-XKMS: XML-Based IBE Key Management Service Infrastructure

RichHTML

PDF下载

Knowledge

Cited

Abstract

Cite this article

share this article

Figures/Tables 10

References 24

Related Articles 15

Metrics

Recommended 0