一种基于可信计算的分布式使用控制系统  

A Distributed Usage Control System Based on Trusted Computing

作　　者：初晓博[1,2] 秦宇[1,2] 

机构地区：[1]中国科学院软件研究所信息安全国家重点实验室,北京100190 [2]信息安全共性技术国家工程研究中心,北京100190

出　　处：《计算机学报》2010年第1期93-102,共10页Chinese Journal of Computers

基　　金：国家"八六三"高技术研究发展计划项目基金(2007AA01Z412);国家科技支撑计划项目基金(2008BAH22B06)资助~~

摘　　要：随着互联网络等分布式环境的发展,如何控制已经分发的数据成为一个重要的安全问题.最近提出的使用控制概念和模型虽然适用于描述该类问题,但其实施机制研究仍处于起步阶段.文中给出一种基于可信计算技术的分布式使用控制系统,有效地支持和实现了使用控制模型的3个特点:丰富的策略决策因素、控制的持续性和主客体属性的变异性.实验证明该方案具有较高性能,是一种分布式计算环境下的行之有效的使用控制实施解决方案.As the development of distributed environment such as internet, controlling usage of data after it has been released to a different control domain from its provider＇s becomes an important security issue. Recently proposed usage control concept and model are suitable for describing this issue but the area of usage control enforcement mechanism has not been fully explored yet. This paper proposes a novel distributed usage control system based on trusted computing technology, which could implement and support all three features of usage control model： abundant policy decision elements, control continuity and mutability of attributes. Experiments show the system enjoys good performance and can be used as an effective solution for usage control enforcement in distributed computing environments.

关 键 词：可信计算 使用控制 分布式访问控制 LINUX安全模块 可信扩展访问控制标记语言 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]