近年來隨著電子商務的普及，網路交易安全的問題慢慢受到一般大眾的重視。目前能有效解決這問題的技術首推CA-PKI，即公開金鑰憑證管理系統。然而市面上CA-PKI相關產品的種類琳瑯滿目，每家廠商都宣稱自己的產品功能最強、最完備。以使用者的觀點而言，可不希望單憑廠商的片面之詞就接受這樣的產品。因為公鑰憑證在未來網路虛擬世界中將可被用來認證個人身份、保護使用者機密資料的隱密性、確保網路交易的有效性等等。這些需求都需要有功能適當、實作嚴謹的CA-PKI系統來加以配合與管理。使用者可能希望CA-PKI產品的設計廠商在產品功能說明外，還要附上額外的信心保證，保證CA-PKI產品確實是如說明文件上所言在運作，以協助他們挑選符合自己需求且用起來安心的CA-PKI產品。
為了實現這個理想，成功大學資訊安全實驗室設計了一套與共通評估準則相結合的評估流程。這個評估流程可概分為兩個階段：第一個階段，依據「CA-PKI系統功能等級劃分」一文中所提出的分類方法對CA-PKI系統進行評估、分等，並賦予一功能等級。第二個階段，利用共通評估準則所提出的評估程序對CA-PKI系統進行評估，並賦予一評估保證等級。
本論文研究的重點著重在評估的第一階段。為了簡化此階段的評估工作，讓評估過程更加容易進行，因而針對此階段中的工作設計了一套自動化評估流程。配合XML的使用，這套自動化評估流程能夠針對CA-PKI系統的PP ( Protection Profile，簡稱PP )與CA-PKI系統實作部分進行自動化評估。如此，不啻能降低評估人員的負擔，亦能縮短評估時程，提昇評估效率。

none

[1] Bruce Schneier, “Secrets & Lies:digital security in a networked world”, John Wiley & Sons, Inc, 2000.
[2] 賴溪松, 韓亮, 張真誠, “近代密法學及其應用”, 松崗, pp.6-7,1995
[3] NBS FIPS PUB 46, “Data Encryption Standard,” National Bureau of Standards, U. S. Department of Commerce (Jan. 1977).
[4] X. Lai and J. Massey, “A Proposal for a New Block Encryption Standard,” in Proceeding of EUROCRYPT ‘90(Springer-Verlag, Berlin, 1991),pp.389-404.
[5] National Institute of Standards and Technology, “The Advanced Encryption Standard”, http://csrc.nist.gov/aes/, 2000.
[6] J. Nechvatal, “Public-Key Cryptography,” in Contemporary Cryptology:The Science of Information Integrity, G. J. Simmons, ed.,Piscatoway,N.J.: IEEE Press, pp.177-288,1992.
[7] R.Rivest, ”The MD5 Message Digest Algorithm”, RFC 1321,1992.
[8] NIST FIPS PUB 180, ”Secure Hash Standard,” National Institue of Standards and Technology, U.S. Department of Commerce, DRAFT, 1993.
[9] W. Diffie and M. E. Hellman, “New Directions in Cryptography,” IEEE Transaction on Information Theory, Vol.IT-22, No.6, pp.644-654, Nov.1976.
[10] Rivest R.L., Shamir A., Adleman L.:”A method for Obtaining Digital Signature
and Public-key Cryptosysm” Communication of ACM, vol, 21, pp120-126, 1978.
[11] ElGamal,T., ”A Public Key Cryptosystem and a Signature Scheme Based on
Discrete Logarithms” IEEE Trans.on Info.Theory, vol.31, pp469-472, 1985.
[12] Schneier B.: ”Applied Cryptography” ,John Wiley and Sons, Inc., pp17-24,1994.
[13] Common Criteria, “Common Criteria for Information Technology Security Evaluation”, Version 2.1, ISO/IEC 15408, 1999.
[14] ITU-T, Recommendation X.509, ” The Directory-Authentication Framework,”
International Telecommunication Union, 1997.
[15] RFC 2560 ”X.509 Internet Public Key Infrastructure Online Certificate Status
Protocol-OCSP”, June.1999.
[16] Annabelle Lee, “Certificate Issuing and Management Components Family of
Protection Profiles Version 1.0”, NIST, 2001
[17] ITU-T, Recommendation X.208, ”Specification of Abstract Syntax Notation
One,” (ASN.1), International Telecommunication Union, 1988.
[18] ITU-T, Recommendation X.209, ”Specification of Basic Encoding Rules for
Abstract Syntax Notation One,” International Telecommunication Union, 1988.
[19] ITU-T Recommendation X.690 “Information technology - ASN.1 encoding
rules:Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER)
and Distinguished Encoding Rules (DER),” Internatal Telecommunication
Union, 1994.
[20] A String Representation of Distinguished Names (OSI-DS 23 (v5)), S.
Hardcastle-Kille,1993.
[21] CCITT X.500 Series (1992) | ISO/IEC 9594,1--9, Information Technology –
Open Systems Interconnection -- The Directory, 1992.
[22]黃宗立,張中和,曾宏偉,吳賀祥, “CA-PKI系統功能等級劃分”, 國立成功大學
資訊工程研究所資訊安全實驗室著, 2002.
[23] Trusted Computer Systems Evaluation Criteria, US DoD 5200.28-STD,
December 1985.
[24] Information Technology Security Evaluation Criteria, Version 1.2, Office for
Official Publications of the European Communities, June 1991.
[25] Common Criteria, “Common Criteria for Information Technology Security Evaluation Part 1: Introduction and general model”, Version 2.1, ISO/IEC 15408, 1999.
[26] Common Criteria, “Common Criteria for Information Technology Security Evaluation Part 2: Security Functional Requirements”, Version 2.1, ISO/IEC 15408, 1999.
[27] Common Criteria, “Common Criteria for Information Technology Security Evaluation Part 3: Security Assurance Requirements”, Version 2.1, ISO/IEC 15408, 1999.
[28] Information technology – Security techniques – “Guide for the production of protection profiles andsecurity targets”, ISO/IEC PDTR 15446, 2000.
[29] Common Evaluation Methodology, “Common Methodology for Information Technology Security Evaluation Part 1: Introduction and general model”, Version 0.6, 1997.
[30] Common Evaluation Methodology, “Common Methodology for Information Technology Security Evaluation Part 2: Evaluation Methodology”, Version 1.0, 1999.
[31] http://csrc.nist.gov/cc/.
[32] World Wide Web Consortium( W3C ), “Extensible Markup Language (XML) Version 1.0 (Second Edition)”, http://www.w3.org/XML/, October 2000.
[33]曾宏偉,黃宗立, “公開金鑰憑證管理系統安全評估與自動化測試之研究”, 成功大學資訊工程研究所碩士論文, 2002.
[34] World Wide Web Consortium( W3C ), “Standard Generalized Markup Language (SGML)”, ISO 8879, 1986.
[35] World Wide Web Consortium( W3C ), “Information technology -- Hypertext Markup Language (ISO-HTML)”, ISO/IEC 15445, 1999.
[36] Benoît Marchal, XML by Example, Second Edition, QUE, 2002.