基于可信密码模块的远程证明协议  

Remote Attestation Based on Trusted Cryptography Module

作　　者：赵佳[1,2] 韩臻[1] 刘吉强[1] 章睿[1] 

机构地区：[1]北京交通大学计算机与信息技术学院,北京100044 [2]福建师范大学网络安全与密码技术重点实验室,福州350007

出　　处：《北京交通大学学报》2010年第2期33-37,共5页JOURNAL OF BEIJING JIAOTONG UNIVERSITY

基　　金：国家"863"计划项目资助(2007AA01Z410);北京交通大学科技基金资助项目(2008RC060);网络安全与密码技术福建省高校重点实验室开放课题(09A007);长江学者与创新团队发展计划项目资助(IRT0707)

摘　　要：可信密码模块是以我国研发的密码算法为基础,结合国内安全需求与产业市场,借鉴国际先进的可信计算技术框架与技术理念自主创新研发的.本文中首先对可信计算平台密码技术方案和国际可信计算组织规范在密码算法、授权协议和密钥管理等几方面进行了比较.基于可信密码模块,提出的基于隐藏属性证书的远程证明方案,用属性证书代替平台配置信息,不仅能有效防止隐私性的暴露,而且可以在系统升级和备份过程中完成可信检测,提高了实现的效率.Trusted cryptography modules are based on basic cryptographic algorithms developed independently by our country,and combined with domestic security requirements,industrial market requirements,international frameworks and concepts of advanced trusted computing technologies.In this paper,firstly,we compare the trusted cryptography modules with the specifications of cryptographic algorithms,authorization protocols and key management defined by international trusted computing group.Secondly,a new remote automated anonymous attestation scheme is proposed,which uses property-based certificate instead of platform configuration information.The proposed scheme can hide the identity of platform through applying signature,efficiently complete trust checking in the procedures of system upgrade and backup.

关 键 词：可信计算 远程证明 可信密码模块 属性证书 椭圆曲线签名 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]