基于可信密码模块的数据安全管理系统关键技术分析-key technology analysis of data security management system based on trusted cryptographic module.docxVIP

国防科学技术大学研究生院硕士学位论文 第 i 页 摘 要 随着数字化、信息化进程的发展，计算机中数据的安全性问题越来越得到人 们的重视。信息化程度越高，业务对信息系统的依赖性就越强，数据的重要性也 越高。能否有效保存、读取、保护好这些数据，越来越成为业务稳定和发展的关 键因素。传统的信息安全系统主要由防火墙、反病毒软件和入侵检测系统构成， 虽然能在一定程度上阻止病毒、木马的入侵，防止数据泄漏，但传统的信息安全 系统是以防外为重点，缺乏对数据本身的保护。 可信计算的研究兴起为我们解决重要数据的安全管理提供了好的解决思路。 可信计算指一个可信的组件，操作或过程的行为在任意操作条件下是可预测的， 并能很好地抵抗不良代码和一定的物理干扰造成的破坏。可信计算提供的安全功 能有：终端设备认证、数据完整性校验、用户身份认证、用户权限合法性、端口 控制和管理、数据的加密存储、重要信息的硬件保护等。在数据安全管理系统中 引入可信计算的思想，能够从源头上保护重要数据的安全，最大程度的防止失泄 密事件的发生。 本课题在可信硬件（可信密码模块）的支持上，通过设计相关软件系统（数 据安全管理系统），确保整个内网系统的数据安全。通过服务端可信启动，确保 服务端可信；通过基于过滤驱动的文件系统保护模块，实现客户端可信登陆、应 用程序运行可信，确保客户端重要数据的安全；通过可信磁盘模块，实现内外磁 盘划分，确保移动存储介质可信。 关键词：数据安全，可信计算，过滤驱动，磁盘保护。 第 ii 页 ABSTRACT With the development of process of digital and information, the security issues of data in computer have been paid more and more attention. The more the degree of informatinization, the more that business rely on information system and therefore the higher the importance of data. Whether these data can be effectively saved, read, and protected become the key factor of business stability and development. Traditional information security system mainly consists of firewall, anti-virus software and intrusion detection system. Although traditional information security system can prevent the invasions of virus and Trojan in some condition, it is to prevent threaten outside and lack of the protection of data itself. Rise of the research of trusted computing provides a good idea to solve security management of critical data. Trusted Computing refers to a trusted component, which means behavior of operation and process is predictable in any condition and can very well resist damage caused by bad code or some physical disturbance. The security features that Trusted Computing provides are: Terminal Authentication, Data Integrity Verification, User Authentication, User Rights Legitimacy, Port Control and Management, Data Encrypted Storage, and Hardware Protection of Critical Information. Trusted Computing embeded in data security manageme