可信模块与强制访问控制结合的安全防护方案  

Security protection scheme using mobile trusted module and mandatory access control

作　　者：李涛[1] 胡爱群[1] 

机构地区：[1]东南大学信息科学与工程学院,南京210096

出　　处：《东南大学学报（自然科学版）》2011年第3期513-517,共5页Journal of Southeast University：Natural Science Edition

基　　金：国家高技术研究发展计划(863计划)资助项目(2009AA01Z427);"十一五"国家支撑计划资助项目(2008BAH33B03)

摘　　要：基于可信计算思想,通过在现有移动终端中加入移动可信计算模块,并在核心网中加入安全服务提供者和安全软件提供商,构架了面向移动终端的统一安全防护体系,为用户提供安全服务.该方案有效利用了移动终端操作系统的特性,将基于角色的访问控制与可信验证相结合,实现了高效的可信链传递,使没有授权证书的非法软件和非法进程不能在系统中运行,保证了系统的安全性.软件证书由安全服务提供者与软件提供商协商进行统一管理.文件读写及网络访问速度的实验结果表明,该安全防护方案引起的系统性能下降约为6%～16%,适用于构建高效的移动安全整体防护体系.Based on the theory of trusted computing and by adding mobile trusted module,security service provider and security software to the existing mobile network,the unified security protection system is established to provide security services to users.This scheme efficiently utilizes the functions of operating system,and makes combination of role-based access control with trust authentication.So the trusted chain transmission is accomplished efficiently.Software and courses without legal certificates are unable to run in the protected system so as to ensure the system security.The certificate is totally managed by security service provider and software provider.Experiments of files reading and writing and network access indicate that the scheme may cause a system performance decrease of 6% to 16%.The scheme can be applied in building a high efficiency holistic security system for mobile communications.

关 键 词：可信计算 移动安全防护体系 移动可信模块 强制访问控制 

分 类 号：TN918.9[电子电信—通信与信息系统]