【作者】 贾伟；

【导师】 彭新光；

【作者基本信息】 太原理工大学 ， 计算机应用技术， 2010， 硕士

【摘要】 计算机网络的飞速发展给人们的生活带来了极大的便利,电子商务的发展更是改变了人们传统的生活方式。在网络给人们引来巨大便利和商机的同时,网络安全问题也越来越成为威胁计算机发展的主要因素。可信计算正是在这个大背景下发展起来的,可信计算能从计算机内部保证数据和配置的安全,提高了计算机的安全性。可信计算的远程认证是为了解决远程实体间的认证问题,可信计算小组TCG先后发布的可信认证方案是Privacy CA和直接匿名认证DAA。这两种方案都是基于远程平台的可信平台模块TPM中的平台配置信息PCR值和身份认证密钥AIK,不同的是DAA引入了时间戳标示。但这种基于二进制的认证过多的暴露了远程平台的信息,在开放的分布式应用中系统更新、备份等很难实现,基于属性的认证克服了二进制认证的缺陷,但也存在一次认证,静态认证等固定缺陷。虚拟技术引入到可信远程认证中,提高了认证的易实现性和认证结果的可信性。但现存的认证方案在认证效率和具体的应用上都显现出不足。本文正是从认证效率和具体的应用上入手,提出了基于过滤机制的认证方案,并提出了适用于Web服务的认证方案和具体的过滤策略。本文主要作了以下三方面的工作：(1)分析了现存的虚拟可信认证方案,把虚拟可信认证方案分为两类：基于语言的虚拟认证和基于虚拟机的认证；并分析了这两种认证策略各自的优、缺点。这两种认证方案是本文的研究的基础,本文的主要工作正在对这两种方案的改进。(2)提出了引入过滤机制的认证方案。基于语言的虚拟可信认证,采用语言虚拟机从程序的语义层认证程序的具体行为,提高了认证可信性,但程序的语义的定义是很困难的,客户和服务器都需要语言虚拟机才能进行认证,并且加重了服务器的通信负担；基于虚拟机的认证本质还是二进制认证。本文结合两种认证方案的优点,把进行认证服务的语言虚拟机,改为一个服务器的真实的“虚拟”,通过把未认证过的程序在虚拟服务器上运行,并把程序运行的结果作为认证的标准。认证过滤器专门负责对程序认证的过滤,它的设计是该方案的核心内容,关乎认证的成败。为认证通过的程序建立程序信任列表,认证过的程序下次则不用再进行认证,提高了认证的效率。并针对Web服务器并结合程序分类思想,提出了具体的认证和过滤策略。最后结合基于虚拟机认证的优点,提出了适用于大型服务器的过滤认证机制。(3)通过开源的TPM Emulator和IAIKjTSS在Linux之上搭建了可信认证环境。Web服务器选用Tomcat,通过认证信任表的动态改变,实现了程序的认证过滤,验证了本文提出的基于Web服务的认证过滤策略的可行性。更多还原

【Abstract】 The computer network’s rapid development takes greatly advantage to people’s lives, the development of electronic commerce is changing people’s traditional way of life. At the same time network brings huge business opportunities and advantage, the network’s security is increasingly becoming the main factors that threaten the development of the computer, Trusted Computing is developed at this background, Trusted Computing can ensure data and configuration’s security from internal, and that improves the security of computers.Trusted Computing remote attestation is to solve the remote platform’s authentication; TCG (Trusted Compute Group) has released the trusted attestation’s proposal-Privacy CA and DAA by order. Both proposals are based on PCR and AIK that embedded in the TPM, unlike Privacy CA, DAA introduced in Load-time. But this binary attestation exposures too much the remote platform’s information, system’s updates and backups are difficult to achieve in the opened and distributed applications, property-based attestation overcomes the binary attestation’s flaws, but there are still attestation-once, static attestation flaws.Bringing virtual technology into remote trusted attestation, improves attestation’s achievability and result’s credibility. But exiting attestation proposals is insufficiency in efficiency and specific applications. This paper proposed filter-based attestation, from efficiency and specific applications, and proposed proposal and specific filter strategy for Web services. Three aspect jobs have been taken as follow:(1)Analyze the existing virtual trusted attestation proposals, these include language-based virtual attestation and virtual machine-based attestation, and analyzed two proposals’advantages and disadvantages. These attestation proposals is the basis of our study, this paper’s main work is to improve two proposals.(2)Filter-based attestation was proposed. Language-based virtual trusted attestation attests program’s behavior from program’s semantic by language virtual machine, improves attestation’s credibility, but it is very difficult to define program’s semantic, both client and server need language virtual machine for attestation, and increases server’s communication burden; virtual machine-based attestation is also the binary attestation in nature. This paper combines two attestation proposal’s advantages, changes virtual language machine into a true "virtual" server, let programs run in the virtual server, attest these’s behavior form run’s result. Attestation filter filters program’s attestation; it is the core part of this proposal. Establish program trusted table for program that has been attested in the virtual server, and proposed attestation proposal and filter strategy for Web services. At last, proposed proposal for big server.(3)We build a trusted environment through open-source TPM Emulator and IAIK jTSS on Linux, select Tomcat as Web server. Realized program’s filtering through attestation trusted table, that proved the proposal that proposed by this paper is feasible.更多还原