【作者】 张亚玲；

【导师】 张璟；

【作者基本信息】 西安理工大学 ， 机械电子工程， 2008， 博士

【摘要】 网络化制造系统是采用先进的网络技术、制造技术及其他相关技术构建的面向企业特定需求的制造系统。研究网络环境下企业之间电子合同的公平签署、动态虚拟企业联盟中的身份认证机制、远程协同设计中的身份认证和设计文档的安全传输管理等安全问题,设计高效、安全的信息安全解决方案具有重要的理论意义和应用价值。本文在分析网络化制造系统的安全特征和安全需求的基础上,综合应用现代密码理论和信息安全技术,对网络化制造环境中的信息安全问题进行了深入研究,有针对性地给出了相关解决方案。主要研究成果如下：针对网络化制造中企业之间电子合同签署的公平性问题,在分析现有同时签名方案安全缺陷的基础上,研究提出了两个适合企业之间电子合同公平签署的数字签名协议i2PCS1和i3PCS1。i2PCS1协议的特点是将合同内容与关键数绑定形成关键数映像,以防止这一过程中的消息替代攻击；而i3PCS1协议的特点是关键数的释放由盟员企业完成,使得盟员企业在这一过程中更具有优势,以抵消盟主企业在合作过程中所拥有的自然优势,使得协议更具公平性。新协议为网络化制造中企业之间电子合同签署的公平性提供了一个高效安全的解决方案。针对同时签名中的时效认证问题,研究了数字时间戳方案,为合同签名的时效性认证提供可行的途径。针对动态虚拟企业联盟中的身份认证机制问题,分析了现有虚拟企业信任交互认证方案在成员增减协议中存在的安全缺陷,研究提出了一个改进的抗联盟攻击的虚拟企业信任交互认证方案。新方案通过赋予虚拟企业盟主关于私钥的一个决定因子,使得VCA的私钥生成和证书颁发必须有盟主的参与。新方案保持了信任权限可灵活分配的优点,同时完善了虚拟企业信任交互方案的安全性。针对网络化制造环境下协同设计中同一文档的设计人员为多个的特殊情况,提出了两种适用于协同设计环境的数字签名方案,其一是高效安全的多重数字签名方案,适合多个设计人员共同签署一份设计文档的应用场景；其二是多签名者强指定验证者方案,适合于多个设计人员同时签名一份设计文档,并指定唯一的验证者验证签名有效性的应用场景。新方案为协同设计环境下设计文档的数字签名提供了有效的解决方案。针对协同设计环境下设计文档在不安全网络中传输的机密性安全需求,提出了面向项目组的无证书广播加密方案,新方案基于设计人员身份和设计小组身份,提供项目小组级别的设计信息的广播加密和解密机制,采用无证书公钥密码技术,解决了基于身份的公钥密码中的密钥托管问题。新方案不需要公钥基础设施(PKI)支持,成本低,安全高效,适合中小型企业应用。在信息安全理论研究的基础上,基于B／S模式与Spring框架,设计了一个协同设计文档管理平台。在系统的安全解决方案中首次将"PIATS"消隐数字签名方案使用在VRML模型中,实现了在不出示完整文档的情况下认证文档中的部分内容,解决了不可见性和完整性之间的矛盾。更多还原

【Abstract】 Networked manufacturing system is constructed by using advanced network technology, manufacturing technology and other related technology to fit the special needs of manufacturing. It is of great importance to research on information security problems in the networked manufacturing system such as fair digital signatures on digital contracts between enterprises, the identity authentication between enterprises, the identity authentication in cooperation design system and the documents secure transforming in network setting, so to design solution schemes aimed at those information security problems for the networked manufacturing system is of both practical and theoretical importance.In this doctoral dissertation, based on analyzing the security characteristic and the security demand of the networked manufacturing system, the information security problems in the networked manufacturing system are studied deeply and feasible solution aimed at these problems are presented. The main research results are as follows:Aimed at the fair exchange problem of digital contract signatures between enterprises in networked manufacturing, based on analyzing the security flaws in existing concurrent signatures scheme, two digital signature protocols to fit the demand of fair exchange of the digital contract are presented, named i2PCS1 and i3PCS1. The characteristic of the i2PCS1 protocol is that the content of the contract is bound with the key stones to form the key stone fix to prevent the message substitute attack efficiently. The distinct advantage of i3PCSl protocol is that its keystones are published by the leaguer member. This characteristic make the leaguer member enterprise has some advantage over the hegemonic enterprise in this protocol to counteract advantage hold by hegemonic enterprise in cooperation and make the protocol has more impartiality. The new protocol is an efficient security scheme for digital contract signatures between enterprises in networked manufacturing system. Aimed at the problem of time authentication in digital signature, time-stamp scheme is studied. The new time-scheme supply a feasible method for the time authentication of the digital contract signatures.Aimed at the problem of the identity authentication in dynamic enterprises alliance, based on analyzing the security flaws in member joining and quitting protocol of existing interactive authentication scheme for virtual enterprises, an improved interactive authentication scheme against collusion attack for virtual enterprises is proposed. By assigning an important parameter as partial private key to the hegemonic enterprise in virtual enterprises, the hegemonic enterprise is required to take part in the private key generation and certificate issue for the Virtual Certificate Authority (VCA) in the new scheme. The new scheme not only maintains the excellence that leaguer members’share set can be assigned flexibly, but also remedies the security flaw in the existing interactive authentication scheme for virtual enterprises.Aimed at the special situation which several designer may collaborate to finish a designing work in networked manufacturing system, two signature schemes for coordinated design are proposed. The one is an efficient security multi-signature scheme, which is conformable for the situation that many designers sign one document together; and another one is multi-signers strong designated verifier signature scheme which is conformable for the situation that many designers sign one document together and assign an exclusive verifier who can verify the signature. These new schemes supply effective approach for document collaborative signatures in networked manufacturing system.Aimed at the confidentiality requirement of information transfers in collaborative design system, a certificateless broadcast encryption scheme based on design team is presented. Based on designer’s identity and the design team’s identity, the new scheme offers an efficient encryption mechanism and decryption mechanism on the level of design team. The new scheme belongs to certificateless broadcast encryption; the private key escrow problem in ID-based public key system is solved. So it is fit for the confidentiality requirement of information transfers in collaborative design system including many design teams. The new scheme doesn’t need the public key infrastructure (PKI), so it is fit for small middle enterprises for its low cost, high security and efficiency.Based on the theory of information security, a document management platform is designed with B/S architecture model and Spring framework. In the security scheme of this system, the sanitizable digital signature technology "PIATS" is used to documents in VRML format, the authentication of partial file is realized without the whole file being demonstrated, the contradiction between invisibility and integrity is solved.更多还原