课件学习过程跟踪系统安全设计及实现..docxVIP

上海交通大学硕士学位论文摘要摘要课件学习过程跟踪系统是一个能够真实、准确地记录在线和离线课件学习过程的系统，它能够为远程教育过程考核体系提供详实的基础数据，解决了长期以来由于无法准确记录课件学习过程而使过程考核流于形式的问题。由于系统使用 SOAP 协议作为数据存储和传输的协议，传统的安全解决方案无法满足 SOAP 安全性的需求，因此必须结合课件学习过程跟踪系统的特点对 SOAP 协议安全性进行深入研究并给出系统安全性设计实现方案。本文首先对 SOAP 消息及其特点进行了简要介绍，并进一步分析了SOAP 消息的安全性需求：端到端的消息安全、选择性安全保护、传输协议无关性、长期确认性。针对以上安全性需求，以及 SSL 等传统技术所存在的不足，引入了 WS-Security 安全规范。本文在概述课件学习过程跟踪系统架构的基础上，指出了系统的登录认证、课件识别、本地帐户和学习记录存储及学习记录传输等功能模块中存在的安全问题，并对上述功能模块的安全性设计需求以及实现的限制因素进行了分析。本文利用 WS-Security 安全规范中的 XMLI 页上海交通大学硕士学位论文摘要Encryption、XML Signature 等技术，结合安全威胁分析，设计并实现了安全登录认证消息机制、课件识别防伪、本地帐户和学习记录存储保密防篡改、学习记录安全传输等功能，满足了课件学习过程跟踪系统的的安全性需求。关键词：学习过程，跟踪，Web Services，SOAP，WS-SecurityII 页上海交通大学硕士学位论文ABSTRACTABSTRACTThe tracing system to courseware learning process is a system whichcan record online or offline courseware learning process exactly. It canprovide more detailed basic data to process-assessmentin distanceeducation and resolves the problem that the process-assessment tends to besimple because the former technology is unable to record the coursewarelearning process accurately. Due to the usage of SOAP as the protocol tostore and transfer data in the system, the traditional security solution cannotfulfil the security requirment of SOAP, we must carry through an in-depthstudy on the security of SOAP considering the characteristic of the tracingsystem to courseware learning process and put forward a solution of thesystem security design.In this dissertation, there is a simple introduction to SOAP message andits characteristics firstly, and we analyse the security requirements of SOAPmessageinfurther:end-to-endmessagesecurity,selectivesecurityprotection,independenceoftransferprotocol,long-termaffirmance.Considering these security requirement and the deficiency of the traditionaltechnology such as SSL, we apply WS-Security criterion.We summarize the framework of tracing system to courseware learningIII 页上海交通大学硕士学位论文ABSTRACTprocess firstly, introduce the security problems that exist in the functionmodules such a