存储器机密性完整性保护技术研究

发布时间：2018-03-19 23:17

本文选题：存储器安全　切入点：机密性保护　出处：《哈尔滨工程大学》2012年硕士论文　论文类型：学位论文

【摘要】：在现有的大多数计算机系统中，数据以明文方式进行传输、保存，使其容易受到各种攻击。存储器作为数据存放的重要载体，对数据安全起着至关重要的作用。针对存储器的保护主要包括两部分：机密性保护和完整性保护。机密性确保攻击者不能理解所获得的数据，完整性确保了系统可以及时检测到对数据的非法篡改。本文首先介绍了存储器保护的基本模型及几个典型的保护框架。然后针对现有的存储器机密性保护技术和完整性保护技术做了详细的介绍和比较。针对机密性和完整性保护操作的特点，在指出PE-ICE方案不足的基础上提出了一种先扩散后加密的方法PCIP来同时保护数据机密性和完整性。该方法通过往保护数据块中增加冗余校验数据来将完整性保护操作和机密性保护操作统一起来。相比PE-ICE的直接块加密方法，PCIP使用计数器加密方式对数据进行加密，在加密效率上有了较大的提升，同时，通过冗余数据进行完整性校验也比使用复杂Hash算法来计算校验值的方法降低了系统延迟，，从而保证了加密和校验的实时性。在PCIP的基础上，为了减少片内存储开销，提高系统的实用性和效率，本文采用两种不同的树保护机制对保存在片外的计数器值进行保护：PCIP_Tree和PCIP+BMT。两者各有优缺点，前者在数据更新方面可以并行进行而在CTR校验时无法并行；后者与之相反。最后，本文对上述方案使用SimpleScalar模拟工具运行10个处理器标准性能测试程序进行测试，实验结果表明，本文提出的PCIP方法相比PE-ICE在程序运行效率上具有较大的优势。同时，在PCIP上采用的两种树保护机制对性能影响较小。
[Abstract]:In most existing computer systems, data are transmitted and preserved in clear text, which makes them vulnerable to various attacks. Protection against storage consists of two parts: confidentiality protection and integrity protection. Confidentiality ensures that an attacker does not understand the data obtained. Integrity ensures that the system can detect illegal tampering with data in time. This paper first introduces the basic model of memory protection and several typical protection frameworks, then introduces and compares the existing memory confidentiality protection technology and integrity protection technology in detail. And integrity protection operations, On the basis of pointing out the shortage of PE-ICE scheme, this paper puts forward a method of first diffusion and encryption, PCIP, to protect data confidentiality and integrity simultaneously. This method can protect integrity by adding redundant check data to protect data block. Compared with PE-ICE 's direct block encryption method, it uses counter encryption method to encrypt data. The efficiency of encryption has been greatly improved. At the same time, the system delay is reduced by using redundant data for integrity check than by using complex Hash algorithm to calculate the verification value, thus ensuring the real-time performance of encryption and verification. On the basis of PCIP, in order to reduce the cost of in-chip storage and improve the practicability and efficiency of the system, this paper uses two different tree protection mechanisms to protect the counter value stored on the chip. The former can be parallel in terms of data updating and cannot be parallel in CTR validation; the latter is the opposite. Finally, this paper tests 10 standard performance test programs using SimpleScalar simulation tools. The experimental results show that the proposed PCIP method has more advantages than PE-ICE in running efficiency. The two tree protection mechanisms used on PCIP have little effect on performance.
【学位授予单位】：哈尔滨工程大学
【学位级别】：硕士
【学位授予年份】：2012
【分类号】：TP333;TP309

【相似文献】