B GIO DC V O TO

B GIO DC V O TO

TRNG I HC K THUT CNG NGH TP.HCM

KHOA CNG NGH THNG TIN

-----------o0o-----------

N TT NGHIP

TM HIU V NG DNG CA CA TRN MI TRNG WINDOWS SERVER 2008.

Sinh Vin Thc Hin:

1. CAO HUY LN

2. NGUYN HU LC

Gio Vin Hng Dn:

TS. NG TRNG SNTHNH PH H CH MINH 2009Li cm n((

Li u tin chng em xin t lng bit n su sc n Thy ng Trng Sn, ngi thy cho chng em nhng nh hng v nhng kin rt qu bu v ti ny. Cm n Thy ch dy v hng dn chng em rt tn tnh t lc la chn ti cng nh trong qu trnh thc hin n.

Chng em cng xin gi li cm n n Khoa CNTT trng i Hc K Thut Cng Ngh TP HCM to iu kin cho chng em thc hin n tt nghip ny. Cm n cc Thy, C trong khoa tn tm ging dy, cho chng em nhng kin thc tht hu ch trong nhng nm qua.

Chng em xin cm Thy C, bn b cng kho du dt, gip chng em tin b trong sut nhng nm hc qua. Xin cm n gia nh v b bn, nhng ngi lun bn cnh, khuyn khch v gip chng em trong mi hon cnh kh khn.

c hon thnh trong thi gian rt hn hp, n ny chc chn cn nhiu khim khuyt, knh mong qu Thy C v cc bn tn tnh ch bo. Chng em xin cm n nhng thy c, bn b v ngi thn v s c nhng gp chn tnh cho ni dung ca n ny, chng em c th tip tc i su tm hiu v ng dng trong thc tin cng tc.

Mt ln na chng em xin chn thnh cm n cc Thy du dt v hng dn tn tnh trong thi gian qua. Xin knh chc cc Thy di do sc khe v thnh cng trong cuc sng.

Nhm sinh vin thc hin.

LI NI U

((Tnh trng an ton mng ti Vit Nam ngy mt nghim trng, khng phi v trnh ca nhng tin tc hackers qu cao kh i ph, nhng nhng l do khch quan khc nhau lm cho gii IT b kh khn khi cn bo v an ton thng tin. Theo bo co mi nht ca Ban C Yu Chnh Ph, gn 60% cc website ca nhng c quan nh nc, cc c quan kinh doanh trn mng, hay cc t chc tn dng b hacker thm nhp v tn cng nhm tm nhng thng tin c li cho chng.

Tnh trng hacker th nc no cng c, thm ch nc cng pht trin cao th hacker cng nhiu v cng t ra c tay ngh ht sc kh i ph. Vit Nam ang l nc c tnh trng tin tc lng hnh kh ph bin tuy lnh vc internet ca Vit Nam cha c xem l cao nht trong khu vc. Nhiu website ca Vit Nam ang hot ng trn mng ton cu c tnh cht thng tin l ch yu ch cha t ti mc mua bn, trao i trc tuyn nh a s cc nc khc.

Vic ny gy lo ngi khng nhng cho chnh ph m nhng doanh nghip t nhn cng bt an khng km, c bit l nhng doanh nghip ang chun b vic mua bn trn mng. Vin cnh thiu an ton khin khng t c s ngng trin khai vic to nhng trang nh phc v yu cu kinh doanh trao i hay mua bn trc tuyn. Vic ny cng trc tip gy tr ngi cho tng trng kinh t trong thi i hi nhp ton cu hin nay.

Ngy nay, vic giao tip qua mng Internet ang tr thnh mt nhu cu cp thit. Cc thng tin truyn trn mng u rt quan trng, nh m s ti khon, thng tin mt... Tuy nhin, vi cc th on tinh vi, nguy c b n cp thng tin qua mng cng ngy cng gia tng. Hin giao tip qua Internet ch yu s dng giao thc TCP/IP. y l giao thc cho php cc thng tin c gi t my tnh ny ti my tnh khc thng qua mt lot cc my trung gian hoc cc mng ring bit. Chnh iu ny to c hi cho nhng ''k trm''cng ngh cao c th thc hin cc hnh ng phi php. Cc thng tin truyn trn mng u c th b nghe trm (Eavesdropping), gi mo (Tampering), mo danh (Impersonation) .v.v. Cc bin php bo mt hin nay, chng hn nh dng mt khu, u khng m bo v c th b nghe trm hoc b d ra nhanh chng.

Do vy, bo mt, cc thng tin truyn trn Internet ngy nay u c xu hng c m ho. Trc khi truyn qua mng Internet, ngi gi m ho thng tin, trong qu trnh truyn, d c ''chn'' c cc thng tin ny, k trm cng khng th c c v b m ho. Khi ti ch, ngi nhn s s dng mt cng c c bit gii m. Phng php m ho v bo mt ph bin nht ang c th gii p dng l chng ch s (Digital Certificate). Vi chng ch s, ngi s dng c th m ho thng tin mt cch hiu qu, chng gi mo (cho php ngi nhn kim tra thng tin c b thay i khng), xc thc danh tnh ca ngi gi. Ngoi ra chng ch s cn l bng chng gip chng chi ci ngun gc, ngn chn ngi gi chi ci ngun gc ti liu mnh gi.

Ngy nay, mt gii php an ninh ton din cnh tranh vi PKI thc s cha c tm thy. T gc gii php cng ngh, iu ny lm cho vic chn la tr nn n gin hn. Nhiu hng khc cng cung cp cc gii php PKI, song nu bn tng u t cho cc cng ngh ca Microsoft trong doanh nghip ca mnh, bn c th s tn dng c nhng li th m tp on khng l ny c c.

PKI cho php bn to ra mt quan h tin cy gia cc chng thc ca cc t chc khc nhau v gii php PKI ca Windows Server 2008 cng bao gm tnh nng ny. N gip bn bt u vi mt phm vi quan h tin cy khng ln v cho php bn m rng phm vi ny trong tng lai. PKI l cng ngh xc thc u tin v hon thin nht s dng phng php m ho da trn kho b mt v kho cng cng. Tuy nhin, PKI cng bao gm c vic ng dng rng ri cc dch v bo mt khc, bao gm dch v d liu tin cy, thng nht d liu v tng th v qun l m kho.

n Tm hiu v ng dng ca CA trn mi trng Windows Server 2008 gii thiu nhng kin thc tng qut v h thng cung cp dch v chng ch s CA, h tng kha cng khai PKI, chng ch s v cc thnh phn quan trng khc xy dng h thng m ha, cung cp chng ch s, bo m thng tin trao i trn mng.Mc lc

Li cm n

Li ni u

Danh mc cc t vit tt

Danh mc cc hnh

Mc lc

Chng 1: Tng quan

1.1 t vn

1.2 Tnh hnh s dng dch v chng ch s

1.2.1 Vit Nam

1.2.2 Tnh hnh mt s nc khc

1.2.3 Nhim v n

Chng 2: Chng ch s v h tng c s kha cng khai

2.1 Chng ch s

2.2 nh dng X.509

2.2.1 nh dng X.509 version 1

2.2.2 nh dng X.509 version 2

2.2.3 nh dng X.509 version 3

2.3 Cc loi chng ch s

2.3.1 Chng ch s CA

2.3.2 Chng ch s thc th cui

2.3.3 Li ch ca chng ch s

2.3.4 ng dng ca chng ch s

2.4 Tng quan v h tng kha cng khai PKI

2.4.1 Gii thiu

2.4.2 Cc thnh phn c bn ca PKI

2.4.3 Chc nng ca PKI

2.4.4 Cc m hnh tin cy ca PKI

Kt chng

Chng 3: CA trn Windows Server 2008

3.1 Cc loi CA

3.1.1 Root v Subordinate CA

3.1.2 Enterprise CA v Stand-alone CA

3.1.2.1 Enterprise CA

3.1.2.2 Standalone CA

3.2 Qu trnh ci t mt CA

3.2.1 Ci t Root CA

3.2.2 Ci t Subordinate CA

3.3 Cp pht v qun l chng ch s

3.3.1 Cp pht t ng

3.3.2 Cp pht khng t ng

3.4 Chng ch s mu

3.4.1 Chng ch s mu version 1

3.4.2 Chng ch s mu version 2

3.4.3 Chng ch s mu version 3

3.4.4 Cc mu chng ch mc nh trong Windows Server 2008

3.5 Yu cu chng ch s

3.5.1 S dng Certificate Request Wizard

3.5.2 S dng Web Enrollment

Kt chng

Chng 4: Kt qu thc nghim

4.1 M hnh demo v cc bc chun b

CHNG 1: TNG QUAN

1.1 t vn :Mun bo v d liu m ch da vo vic m ho d liu l rt nguy him. Ngy c nhiu tin tc c th c trm d liu, tro i d liu v mo danh xm nhp mt cch to tn v thin ngh.

Cho ti nay vic mt m ha d liu l mt phng php mnh bo v nhng d liu quan trng hoc ring t khng b xm phm bi s soi mi tc mch hay dng tm c c . Tuy nhin, cc phng tin truyn thng th gii tng thut kh nhiu v kh nng r r d liu c nhn ca khch hng nh m s bo him x hi, thng tin th tn dng

p ng nhng tiu chun nghim ngt vn i hi d liu phi c lu tr v bo v trong sut thi gian no , cc cng ty phi tuyn chin vi nn nh cp, tro i d liu bng mt bin php gm nhiu tng lp m mc thp nht l mt m ha v mc cao nht l tch hp nhiu ch k in t, chng thc in t v qun l kha theo trt t cp bc (hierachical key).

Vic kt ni qua mng Internet hin nay ch yu s dng giao thc TCP/IP. TCP/IP cho php cc thng tin c gi t mt my tnh ny ti mt my tnh khc thng qua mt lot cc my trung gian hoc cc mng ring bit trc khi n c th i ti c ch. Tuy nhin, chnh v tnh linh hot ny ca giao thc TCP/IP to c hi cho bn th ba c th thc hin cc hnh ng bt hp php, c th l:

- Nghe trm (Eavesdropping): Thng tin vn khng h b thay i, nhng s b mt ca n th khng cn. V d, mt ai c th bit c s th tn dng, cc thng tin cn bo mt ca bn.

- Gi mo (Tampering): Cc thng tin trong khi truyn i b thay i hoc thay th trc khi n ngi nhn. V d, mt ai c th sa i mt n t hng hoc thay i l lch ca mt c nhn.

- Mo danh (Impersonation): Thng tin c gi ti mt c nhn mo nhn l ngi nhn hp php. C hai hnh thc mo danh sau:

+ Bt chc (Spoofing): Mt c nhn c th gi v nh mt ngi khc. V d, dng a ch mail ca mt ngi khc hoc gi mo mt tn min ca mt trang web.

+ Xuyn tc (Misrepresentation): Mt c nhn hay mt t chc c th a ra nhng thng tin khng ng s tht v h. V d, c mt trang web mo nhn chuyn v kinh doanh trang thit b ni tht, nhng thc t n l mt trang chuyn n cp m th tn dng v khng bao gi gi hng cho khch.Nhiu sn phm thc hin lu tr thng hay truyn v lu d liu dng n gin hoc thng qua mt gii thut mt m ha n s. Trong khi nhiu k thut tinh xo c dng m bo d liu lu phng tin b nh ban u khng th truy cp bi ngi khng c thm quyn th d liu lu phng tin backup li cho nhng ngi khng c thm quyn truy cp v khi phc mt cch thoi mi.

Mt m ha l mt cch lm tt nhng li ch ca n cn hn ch. l l do ti sao s an ton trong d liu cn phi tch hp cc ch k in t, cc chng thc in t v phng php qun l kha theo trt t cp bc.

p dng chng ch s cho chng thc in t l gii php hu hiu nht bo m an ton thng tin, l c s cho ngi gi, nhn v cung cp d liu, thng tin qua mng, k kt cc hp ng, thanh ton in t, ha n, chng t in t

Cng vi s pht trin ca cc ng dng trn mng c bit cc ng dng nh Chnh ph in t, thng mi in t th chng thc in t tr thnh mt yu t khng th thiu c. Vic ra i ca chng thc in t khng nhng p ng c cc nhu cu hin nay ca x hi m cn c tc dng rt to ln trong vic pht trin cc ng dng trn mng. Chng thc in t l hot ng chng thc danh tnh ca nhng ngi tham gia vo vic gi v nhn thng tin qua mng, ng thi cung cp cho h nhng cng c, nhng dch v cn thit thc hin vic bo mt thng tin, chng thc ngun gc v ni dung thng tin. H tng cng ngh ca chng thc in t l c s h tng kha cng khai ( PKI Public Key Infrastructure) vi nn tng l mt m kha cng khai v ch k s.

Ngi s dng chng thc in t s cc c quan cung cp dch v chng thc in t (CA Certification Authority) cung cp cho chng ch s v phi c gn mt cp kha m ( kha b mt v kha cng khai ) c th tham gia s dng chng thc in t trong cc ng dng m mnh tham gia.

Chng thc in t c cc chc nng chnh sau:

Tnh xc thc: m bo xc nh c thc th hp php.

Tnh bo mt: M ha thng tin gi i trn mng, m bo b mt thng tin.

Tnh ton vn d liu: Xc nh thng tin nhn c c ng nh thng tin c gi i khng hay b thay i.

Tnh khng th chi b: Chng thc in t m bo cho ngi s dng khng th chi b cc d liu m mnh gi.

Chnh v c nhng tnh nng nh vy nn chng thc in t c s dng trong kh nhiu cc ng dng nh:

K vo ti liu in t.

Th in t bo m.

Thng mi in t.

Bo v mng WLAN (Wireless Local Area Network ).

Bo m an ton cho cc dch v Web.

Mng ring o VPN

1.2 Tnh hnh s dng dch v chng ch s :

1.2.1 Vit Nam:

Chng ch s, trong phm vi ca d tho Tiu chun quc gia, l tp tin mang thng tin v kho cng khai ca mt c nhn, t chc hay thit b, ng dng mun truy nhp vo h thng. Chng ch s c dng trong cc dch v chng thc s dng ch k s trn nn tng c s h tng kho cng khai qua Internet.

Tiu chun ITU-T X.509 c s dng rng ri nht hin nay da trn h tng kha cng khai PKI. Ti Vit Nam, hin cha c tiu chun no v khun dng chng ch s, nn cc t chc cung cp chng ch s vn da theo mu khun dng ca cc t chc pht hnh chng ch s ln trn th gii (nh Verisign).D tho tiu chun v chng ch s c xy dng nhm mc ch a ra mt tiu chun chung v khun dng cc chng ch s, p dng ph hp vi iu kin thc t trong nc, c kh nng tng thch vi khu vc v th gii. Tiu chun s c khuyn khch p dng trong phm vi ton quc, gp phn thc y trin khai cc dch v chng thc ch k s v trao i d liu in t an ton ti Vit Nam.Trong bi cnh mng Internet pht trin mnh m, cc nh cung cp dch v vin thng trong nc ang n lc pht trin cc dch v thng mi in t nhm to u th cnh tranh.

Trc nhu cu s dng chng thc in t ngy cng tng cao, trong thi gian qua ti Vit Nam c mt s n v cung cp v th nghim dch v chng thc in t nh cng ty VASC, cng ty VDC, Trung tm tin hc - B Khoa hc v Cng ngh, Ban C yu Chnh ph, mt s ngn hng... Ngoi ra cn mt s n v cng th nghim xy dng cc t chc cung cp chng ch s CA (Certificate Authority) ni b. Cc nh cung cp chng ch s ny hu ht l cc CA ring r, ngha l t cp chng ch cho mnh, ch c CA ca VDC l i l cho CA ca cng ty VeriSign. Ngoi ra trong cc nh cung cp chng ch s CA nu ch c CA ca VASC v CA ca VDC l cung cp dch v chng thc cho cng ng. Cc ng dng s dng chng thc in t Vit Nam ch yu l k vo d liu in t, th in t bo m, xc thc quyn truy nhp, thanh ton in t Vit Nam, c hnh lang php l v giao dch in t l cc o lut nh Lut Giao dch in t, Ngh nh s 26/2007/N-CP quy nh chi tit thi hnh Lut giao dch in t v ch k s v chng thc in t; Ngh nh s 27/2007/N-CP v giao dch in t trong hot ng ti chnh...

Ngoi ra cn phi k n Lut Cng ngh thng tin do B Bu chnh, Vin thng ch tr son tho.

Vn t ra l s phi hp gia cc n v xy dng cc vn bn php l ny nh th no trnh c s chng cho v ni dung chng thc in t trong cc vn bn ny.