TRSF:一种移动存储设备主动防护框架  

TRSF:Implementing Active Removable Storage Protection via Trusted Virtual Domains

作　　者：马俊[1] 王志英[1] 任江春[1] 刘聪[1] 伍江江[1] 程勇[1] 梅松竹[1] 

机构地区：[1]国防科技大学计算机学院,湖南长沙410073

出　　处：《电子学报》2012年第2期376-383,共8页Acta Electronica Sinica

基　　金：国家自然科学基金青年基金(No.60903240);核高基重大专项(No.2010ZX01045-001-002-5)

摘　　要：移动存储设备属于被动设备,其安全防护往往依赖于终端系统的安全机制,在提供安全性的同时会降低系统可用性.本文提出了一种基于可信虚拟域的移动存储设备结构框架TRSF(TrustedRemovable StorageFramework)实现存储设备的主动防护.TRSF将智能卡芯片和动态隔离机制绑定到存储设备中,并由片上操作系统构建从底层可信平台模块到隔离运行环境的可信数据通道,从而为移动存储设备在非可信终端系统中被非可信进程访问和使用提供一个可信虚拟环境.最后基于TRSF实现了一款主动安全U盘UTrustDisk.与没有增加主动防护机制相比,增加该机制导致平均读写性能开销分别增加了7.5%和11.5%.As removable storage medias are passive devices, their security policies depend on mechanisms in connected terminal systems, which will reduce the availability while providing security. This paper presents TRSF, a framework of removable stor- age based on trust virtual domain to implement active protection. TRSF solidifies a smart card and an isolation mechanism into the storage device and builds trust data channels from the device to the isolated usage environment in terminal system. So TRSF is able to provide trust virtual environment for data access and usage of removable storage even in untrust terminal systems by untrust processes. We implement an intelligent USB disk based on TRSF called UTmstDisk to evaluate the framework. The average overhead on read and write caused by mast chain mechanism is 7.5 % and 11.5 %.

关 键 词：可信虚拟域 主动防护 可信存储 信任链 隔离 片上操作系统 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]