摘要
随着计算机网络技术的发展和应用领域的不断拓宽，计算机信息系统的安全引起了人们的高度重视。由于计算机网络具有信息的流动性，资源的分布性，连接的开放性和连接形式的多样性等特征，致使网络易受到黑客和病毒的攻击，因此计算机网络的安全问题变得越来越突出。
本文论述了应用密码学以及数据加密和数字签名(Digital Signature)的原理及发展；同时介绍了面向对象方法学的思想和技术，指出随着面向对象技术和分布式应用技术的发展，面向对象的通讯机制正变得越来越流行，安全对象的提出为此种通讯机制提供了必要的安全保证。
安全对象(Secure Object)是建立在普通网络对象的基础上，通过将安全属性和网络对象集成而得到。本论文正是结合网络中的安全目标和网络对象的特点，在对网络的安全模型利用面向对象的分析方法进行分析的基础上，抽象出了网络对象所具有的安全属性和方法。同时针对不同的安全域采用不同的安全策略(规则)，提出采用访问控制表实现对对象的存取控制，并且将对象的安全属性分装在自身对象中，因而保证了对象的安全。具体实现是结合数据加密技术和签名技术，对其中的访问控制表、安全属性等内容由对象拥有者进行数字签名保护，从而构造了完整的安全对象。用户在使用时，调用安全接口并根据对象的属性和所处范围的安全策略来判断是否具有对对象的访问控制、资源存取等操作权限，保证了对象的安全访问。
最后本文以一个公文网上传输系统为例，将论文提出的技术应用于软件开发的实验中，作了比较成功的尝试。
With the rapid development of network and its wide use, people now pay
more attention to the security of computer information system. The network is
liable to be attacked by the hacker and virus because of the fluidness of
information, the distribution of resource, the opening of connection and diversity
of connection forms. So the security problem is become more and more serious.
The thesis introduces the principle and development of Applied
Ciyptography, Encr,ption and Digital Signature. It also introduces the thought
and technology of the Object-Oriented methodology.
With the development of the Object-Oriented technology and distribution
application, Object-Oriented communication has become popular. Secure-Object
is a guaranty for this mechanism.
Secure-Object is based on the normal network object It results from the
integration of security and network objects. The thesis integrates the property of
network object ,security aim and abstract the security property, method and
realize the access control of the security object with ACL (access control list),
based on the analysis of the network security model with Object-Oriented
method. It encapsulates the property within the objects according to the different
rules in different domain to ensure the security of object. With the technology of
enciyption and digital signature, the signature is given to the ACL, secure
property by the owner of the object in order to create a complete Secure-Object.
The security interface must be called when the object is used. The interface can
judge if a user has the right to access the object and so on. So it protects the
secure access to the object
At last, this thesis tries the method referred above on a example of a system
for the transfer of official documents and succeed in doing so.
引文
[1] Andrew S.Tanenbaum著·王小虎等译·计算机网络·清华大学出版社
[2] Leendert van Doorn, Martin Albadi等·Secure Network Objects·http://www.citeseer.com
[3] Ruibing Hao, Kyungkoo Jun等·An Aspect-Oriented Approach to Distributed Object Security·http://www.citeseer.com
[4] 黎敬涛·分布计算与异构数据环境分析·昆明理工大学学报·1999
[5] Bruce Schneier著·吴世忠等译·应用密码学·机械出版社
[6] 居俤·数据签名单机模拟系统·南京邮电学院学报·1997
[7] 张文政·访问控制与数字签名·电脑技术信息·1999
[8] Coad P．and Yourdon E著·面向对象的设计·北京大学出版社·1994
[9] 王斌君、卢安国著·面向对象的方法学与C++语言，陕西师范大学出版社·1995
[10] 张文政·网络安全·电脑技术信息·1999
[11] 蔡建宇·CORBA安全参考模型·计算机应用研究·1999
[12] 王宇·分布式环境中的安全对象签名技术·计算机工程·2000
[13] 洪宇·协同工作环境下网上公文传送的安全机制·计算机工程·2000
[14] Thomas Y.C. Woo·Designing a Distributed Authorization Service·http://www.citeseer.com
[15] 沈建·采用公钥自能卡加密的数据通信设计·计算机工程·2001
[16] 林琪·文件全文信息的网络安全传输·计算机工程·2000
[17] 周欣然·Windows Sockets编程界面上的网络服务程序设计·微型计算机应用·1999
[18] 陈庆章·微软信息密码系统·电脑编程与维护·2000
[19] 微软电子文档·MSDN Library Visiual Studio 6.0
[20] 隆益民·数字签名技术·现代计算机·2000
[21] Ham L, Kielser·New scheme for digitial multisignatures·Electr Lett·1989
[22] Shao Z·Signature schemes based on factoring and discerete logarithms·IEEE Proc Comput Digit Tech·1998
[23] Diffie W, Hellman M. E·New directions in cryptography·IEEE Trans on Information Theory·1977, IT-22(6):74-84
[24] Security, Berkeley·IEEE ComputerSociety Press·1982. 11-20
[25] Geore Coulouris, Jean Dollimore·Secure communication in non-uniform trust enviroments·ECOOP Workshop on Distributed Security·1998
[26] Prasun Dewan, HongHai Shen·Access Control for Collaborative Environments·http://www.citeseer.com
[27] James Hughes·A Universal Access, Smart-Card-Based, Secure File System. http://www.citeseer.com
[28] Butler Lampson·Authentication in Distributed Systems: Theory and Practice·http://www.citeseer.com
[29] Unix和Windows环境下的SOCKETS通信·电脑与信息技术·2000
[30] 张秀芝·一种基于Java语言的分布式对象处理框架·小型微型计算系统·2001
[31] Leendert van Doom·An Object Model for Flexible Distributed Systems·http://www.citeseer.com
[32] Nicholas Yialelis·A Security Framework Supporting Domain Based Access Control in Distributed Systems·IEEE·1996
[33] N. Asokan·Server-Supported Signatures. Jouanal of computer Secutity·1997
[34] R. L. Rivest·A Method for Obtaining Digitial Signatures and Public-Key Cryptosystems·http://www.citeseer.com