CA是PKI中的關鍵設施.CA的可信任性依賴于CA的私鑰。CA的私鑰一旦泄露,該CA簽發(fā)
的所有證書就只能全部作廢。確保CA的私鑰不泄漏極其重要。容忍入侵技術不是通過傳統(tǒng)的防火墻或入侵檢測技術來保證CA的安全,而是確保當少數(shù)部件遭受入侵后,CA系統(tǒng)的機密信息并沒有泄漏，即具有容忍入侵性。通過RSA加密算法和(t,n)秘密共享機制,將私鑰分發(fā)給不同的共享服務器,并且私鑰在任何時候都無需重構，保護了CA私鑰的保密性，增強了CA的容忍入侵性.
關 鍵 詞: 容忍入侵;認證中心;秘密共享

A Based Intrusion Tolerant CA Scheme CHAI，zheng-yi，ZHANG，hao-jun
(Department of information science and technology，henan university of technology, zhengzhou， henna，China 450007) Abstract：CA is the key infrastructure to the PKI。its reliability relies on its private key。 Once its private key is revealed, all the certificates signed by the CA must be cancelled. so it is very important to ensure the CA private key is not revealed. Intrusion Tolerant ensure the security of the CA by the way that even if some part of the CA is broken, the CA private key is still safe, instead of by the firewall and Intrusion detection. by RSA and (t,n) secret shared method, it distribute private key to different sharing servers. The private key needn’t be reunion at any time to protect the security of the CA and enhance the Intrusion Tolerant of CA.
Keywords: Intrusion Tolerant；certificate authority；secret sharing