SSL协议基于数字证书在通信实体间建立传输层安全通道,保证了通信过程的机密性、不可否认性和完整性。基于USBKey和引擎机制,我们提出了一种采用双证书机制的增强型安全通道建立方案,通过数字签名算法硬件实现和私钥保护等机制进一步提高了SSL协议的安全性。在此设计基础上,实现了该方案,并通过分析和试验,验证了该方案的正确性和有效性。 The SSL protocol establishes a transport-layer secure channel between communicating entities based on digital certificates to ensure the confidentiality, non-repudiation and integrity of the communication process. Based on the USBKey and the engine mechanism, we propose an enhanced secure channel setup scheme based on dual-certificate mechanism. The security of the SSL protocol is further enhanced by mechanisms such as hardware implementation of digital signature algorithm and private key protection. On the basis of this design, the scheme is realized, and the correctness and effectiveness of the scheme are verified through analysis and experiment.