Research And Implementation On Security Mechanism For Electronic Procecurement System Based On PKI

With the recent development in our country's information technology, E-commerce has been gradually used in the enterprise, and the application has changed from simple information announcement to high level information integration, which provided a strong impetus to the shift of procurement model, and shaped a new procurement model, named Electronic-Procurement. The opening and sharing features of the Internet have provided an underlying platform for Electronic-Procurement, but it also have bring about lots of threats to the procurement activity and the security of information, including the authenticity of user's identity threat, the information confidentiality threat, information integrity threat, and the threat of undeniable information. The initial results of theory and software are achieved according to the research and development on the security problem above.Application technologies in E-commerce based on PKI are investigated on the basis of studying in cryptography, and PKI architecture and its entity function are analyzed. After the work above, a security model is put forward, which meets Electronic-Procurement system's secure requirements. The security model which use encryption, digital envelope and digital signature technique is based on PKI security architecture with CA authentication as its core.The solution of encrypting and implementing digital signature on the client side, and constructing smart client system is put forward after dissecting the problem of how to fulfill the security model based on B/S.On the basis of theory research, an enterprise digital certificate authentication center is established based on Windows Server 2003 system. The scheme ofauthentication based on security model, the encryption and digital signature system are implemented on Microsoft Visual Studio 2005 platform, by applying of the authentication technique which is combined with digital certificate and ASP.Net's forms authentication, applying of the data encryption technique, digital envelope technique and the digital signature technique, which provide the effective secure support for the Electronic Procurement System.All the work discussed above is presented in this paper.