基于可信计算平台的自动信任协商分析-analysis of automatic trust negotiation based on trusted computing platform.docxVIP

中南民族大学硕士学位论文 基于可信计算平台的自动信任协商研究 I II 摘 要 网络环境中陌生实体间信任关系的建立是实现资源共享和互操作的前提。自 动信任协商作为一种新型的访问控制技术，它为处 于不同安全域的陌生实体间建 立信任关系提供有效地方法，进而实现动态授权。信任协商必须重点考虑的是协 商过程中双方的隐私保护问题以及如何提高协商效率。可信计算的主要思想是在 终端平台内部加入安全芯片，作为底层信任根，辅以其他硬件、固件和软件，利 用自下而上逐级的完整性度量构建信任链的方式，使终端平台变成一个可信的运 行环境。 文章先对可信计算平台作了研究，主要包括：平台的体系结构、TPM 各功能 组件以及平台的原理机制，接着研究了自动信任协商，包括信任协商的相关概念、 体系结构、基于 XML 的策略语言、常见的攻击与防范等。由于 可信 PC 机是目前 应用最广泛的可信计算平台，本文提出了一种基于可信 PC 机的自动信任协商框 架模型。文章先后说明了可信 PC 机的结构与功能，提出了框架的整体结构图， 分别说明各模块的功能。其中，引入信任域的概念，提出了一种新型的信任度评 估方法，并描述了基于该框架的完整的信任协商流程。将信任协商中典型的实例 应用于本文提出的框架中，分别对该实例采用的两种极端协商策略以及融合了信 任度的自适应策略的协商过程进行了直观的描述。对各种情况的时间开销进行比 较，突出了融合了信任度的自适应策略在协商效率上的优势，并且对整个协商框 架的安全性进行了理论上的分析。最后，总结全文并指出该 ATN 框架模型在未来 的研究方向。 关键词：可信计算平台；TPM；信任域；信任评估；自动信任协商  Abstract It’s the premise that establishing a trust relationship between strangers in the network environment to realize the sharing resources and interoperability. Automated trust negotiation as a new access control technology, establish ing a trust relationship between strangers in different security domains effectively, so as to realize the dynamic authorization. The trust negotiation must focus on considering the problem of privacy protection and how to improve negotiation efficiency. The main idea of trusted computing is to add security chip inside the terminal platform as the underlying root of trust, combined with other hardware, firmware and software, using integrity measurement step by step from bottom to top to build a chain of trust, aimed at the terminal platform become a trusted operating environment. The article first made a study of trusted computing platform , mainly including: platform architecture, each functional components of the TPM and platform principle mechanism. And then study the automated trust negotiation, including related concepts and architecture of it. XML based policy language, common attacks and prevention. As the trusted PC is currently the most widely t rusted computing platform, the paper presents an automated tru