可信信道技术研究
文献类型：学位论文
| 作者 | 周玲丽 |
| 学位类别 | 硕士 |
| 答辩日期 | 2010-06-04 |
| 授予单位 | 中国科学院研究生院 |
| 授予地点 | 北京 |
| 导师 | 张振峰 |
| 关键词 | 可信信道，可信计算，基于口令的认证，基于TPM的远程证明，匿名性 |
| 学位专业 | 信息安全 |
| 中文摘要 | 随着互联网的高速发展，人们的许多行为由现实生活中转移到了互联网世界，比如电子商务、网上银行、电子政务等。当前互联网上的许多安全敏感的客户端-服务端应用都使用SSL/TLS或IPSec来建立安全信道，以保护客户端与服务端之间的通信。这些协议实现了客户端与服务端之间的双向认证和数据的安全传输。但是，使用SSL/TLS或IPSec建立的安全信道并没有确保终端本身的安全性。可信计算（TrustedComputing）中的远程证明机制可用于证明终端本身的完整性和可靠性，但不能直接提供安全信道。 可信信道是在安全信道的基础上，利用TPM的远程证明技术，将终端的完整性密码地绑定到安全信道，并且保护双方终端配置的隐私性。因此，研究可信信道技术对互联网安全有着重要的意义，有助于解决网络安全中的基本信任问题，以及互联网数字服务的安全问题等。目前，国内外已有一些可信信道的设计方案，大体分为两类：（1）将基于证书的SSL/TLS与TPM远程证明相结合以建立可信信道；（2）将Diffie-Hellman密钥交换协议和TPM远程证明相结合以建立可信信道。基于口令的认证密钥交换协议（PAKE）是实现安全信道的另一种有趣的技术，因为其具有易于记忆、使用方便、不需额外的密码设备来存储高熵的密钥。 然而，将PAKE与TPM远程证明结合以建立可信信道的研究工作很少。 本文主要从可信信道的安全需求出发，分析已有的两类可信信道设计方案的安全性，指出已有的方案容易遭受一种新的合谋攻击。针对上述合谋攻击和传统的中间人攻击，我们利用口令认证密钥交换协议，提出了一种新的协议来建立基于口令的可信信道。我们的方案不同于基于证书的可信信道实现方法，使用了一种新的绑定方法来抵抗上述攻击。同时，我们还将该方法应用到已有的基于证书SSL和TPM远程证明的可信信道方案中。 另外，考虑到电子商务、电子政务等安全应用中用户对匿名性的需求，而现有的可信信道方案未曾考虑到用户的匿名性，本文引入了匿名可信信道的概念，并提出了匿名可信信道的设计方法，给出了一个具体的协议用以建立匿名可信信道， 并证明了该协议满足匿名可信信道的安全需求。 |
| 英文摘要 | With the development of Internet, many people shift their activities from the real world to the Internet, such as e-commerce, online banking, e-government. Most of the security-sensitive Client-Server applications used today typically employed secure channels such as SSL/TLS or IPSec to protect communication between the client and server. These protocols provide mutual authentication and secure data transmission between the endpoints. However, secure channels such as SSL/TLS or IPSec don't protect the security of the endpoints themselves. So far as we know, Trusted Computing could solve this problem, it provides the mechanism of TPM-based Attestation to attest the integrity and reliability of the endpoints, however, it can't provide secure channel directly. Based on secure channel, Trusted Channel binds the configuration/integrity information to the secure channel, and protects the privacy of the integrity of the involved parties. Therefore, in the field of network security, it's significant to study on the technology of Trusted Channel, it helps to address the basic trust problems in network security, and helps to address the security problems of digital services et al. There were many schemes of Trusted Channel at home and abroad, and they can be divided into two categories:(1)Combining certificate-based TLS and TPM-based Attestation. (2)Combining Diffie-Hellman key exchange and TPM-based Attestation. Password-based authenticated key exchange (PAKE) is an interesting technique for establishing secure channels since PAKE is human-memorable, and simpler to use than having additional cryptographic devices capable of storing high-entropy secret keys. So it seems interesting to construct a Trusted Channel scheme, which combines PAKE and TPM-based Attestation. Such scheme has not been proposed so far as we know. In this paper, according to the security requirements of Trusted Channel, we analysis the security flaws of two kinds of existing Trusted Channel schemes. They are vulnerable to a new kind of collusion attack. To resist the above collusion attack and the traditional replay attack, we propose a new protocol to establish trusted channels, which adopts PAKE. Our scheme uses an efficient binding approach, which is different from the scheme of certificate-based TLS and TPM-based attestation, to resist the proposed collusion attack. Our approach can also be applied to trusted channels with certificate-based TLS and TPM-based attestation. In previous solutions on trusted channels, which based on TLS and TPM-based attestation, two parties can authenticate each other, but their identities turn to be revealed. This should be inconvenient in the case that clients desire to hide their identities in high security applications, such as e-commerce, e-government. For this purpose, we introduce the concept of Anonymous Trusted Channel, and propose the designing methods of Anonymous Trusted Channel. Consequently, we propose a protocol to efficiently set up an Anonymous Trusted Channel, and provide the detailed security proof. |
| 学科主题 | 计算机科学技术基础学科 |
| 语种 | 中文 |
| 公开日期 | 2010-06-06 |
| 源URL | [http://124.16.136.157/handle/311060/2312]  |
| 专题 | 软件研究所_信息安全国家重点实验室_学位论文 |
| 推荐引用方式 GB/T 7714 | 周玲丽. 可信信道技术研究[D]. 北京. 中国科学院研究生院. 2010. |
入库方式： OAI收割
来源：软件研究所
浏览0
下载0
收藏0
其他版本
除非特别说明，本系统中所有内容都受版权保护，并保留所有权利。