一种基于虚拟隔离的数据可信存储技术研究与实现  

Research and Implementation of a Trusted Data Storage Technology Based on Virtual Isolation

作　　者：伍江江[1] 王志英[1] 马俊[1] 任江春[1] 程勇[1] 梅松竹[1] 

机构地区：[1]国防科学技术大学计算机学院,湖南长沙410073

出　　处：《计算机工程与科学》2012年第5期58-62,共5页Computer Engineering & Science

基　　金：国家自然科学基金资助项目(60903204)

摘　　要：针对数据在开放式网络环境中存储和使用过程中存在的信息泄露风险,本文提出了一种基于虚拟隔离的数据可信存储体系结构。该结构借鉴可信计算技术中的信任根源的设计思想,通过可信存储根来验证用户身份合法性和管理数据访问权限,并将数据集中加密存储在服务器中;在终端用户对数据的使用过程中,利用本地内存和磁盘虚拟隔离技术保证数据在使用过程中的安全性,防止非授权用户和进程将数据泄漏到非保护区域。对本文所设计实现的基于虚拟隔离的数据可信存储系统的测试和安全性分析表明:该结构能够很好地保障开放网络环境中数据的存储、使用、流转和销毁的全生命周期的安全。Against the risk of information leakage because of that the data is stored and used in an open network environment,this paper presents a trusted data storage architecture based on virtual isolation.The structure draws on the design idea of trusted root in the trusted computing technology,in the architecture,the credible storage root is used to verify the legitimacy of user identity and manage data access,and the data is stored with centralized encryption in the server;while the end-user use the data,the local memory and disk virtual isolation techniques are used to ensure data security,preventing nonauthorized users and processes to leak information to non-protected areas.The security analysis and testing toward the credible data storage system based on virtual isolation which are designed and implemented in this article shows that the structure can guarantee the security of the entire life cycle including storage,use,transfer and destruction when the data locates in the open network environment.

关 键 词：信息泄露 虚拟隔离 可信存储 信任根源 可信存储根 集中加密 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]