基于可信代理的访问控制模型研究

发布时间：2018-05-16 22:08

本文选题：可信存储 + 访问控制　；参考：《河北大学》2014年硕士论文

【摘要】：随着计算机技术的发展，计算机网络中各种攻击手段层出不穷，网络信息系统的安全性、可靠性和可用性等问题变得越来越重要，，而可信计算技术能够有效的解决这些问题。因此，研究实现安全可靠的可信存储机制，具有良好的理论价值和实践意义。本文提出了一种TPM和CA相结合的用户身份证书管理机制，基于TPM和CA实现可信身份认证机制，在属性认证协议的基础上，对属性证书添加了实时的组件完整性度量值，增强了协议的安全性；基于TPM实现保密性和完整性两个维度以及能力和属性两个方面相结合的数据安全访问策略，在TPM硬件支持下，利用可信代理对数据访问的主体和客体分别进行量化评级，在不可信的服务器与不可信的用户之间建立信任关系，实现了两者之间安全可靠的互操作，降低了用户和服务器被攻击的风险，保障了系统的可信运行，与现有的访问控制策略相比具有更高的安全性。本文以实现用户与服务器间保密性与完整性相统一的访问控制为目标，对可信访问控制模型进行了研究，提出了更加灵活和安全的可信评价体系，为保障信息系统的保密性和完整性提供了一种新思路。
[Abstract]:With the development of computer technology, all kinds of attacks in computer network emerge in endlessly. The security, reliability and usability of network information system become more and more important, and trusted computing technology can effectively solve these problems. Therefore, it has good theoretical value and practical significance to study the secure and reliable trusted storage mechanism. In this paper, a user identity certificate management mechanism combining TPM and CA is proposed. Based on TPM and CA, the trusted identity authentication mechanism is implemented. On the basis of attribute authentication protocol, a real-time component integrity measure is added to the attribute certificate. It enhances the security of the protocol, realizes the data security access policy based on TPM, which combines two dimensions of confidentiality and integrality, ability and attribute, and is supported by TPM hardware. The subject and object of data access are rated quantitatively by trusted proxy, and the trust relationship between the untrusted server and the untrusted user is established, and the secure and reliable interoperation between them is realized. It reduces the risk of users and servers being attacked, ensures the trusted operation of the system, and has higher security compared with the existing access control policies. In order to realize the unified access control of confidentiality and integrity between the user and the server, the trusted access control model is studied, and a more flexible and secure trusted evaluation system is proposed in this paper. It provides a new way to protect the confidentiality and integrity of information system.
【学位授予单位】：河北大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【参考文献】