基于TCM的可信事件日志生成方法  

Trusted generation method for event logs based on TCM

作　　者：王健[1] 程帅帅[1] 

机构地区：[1]北京交通大学计算机与信息技术学院,北京100044

出　　处：《北京交通大学学报》2013年第5期93-99,共7页JOURNAL OF BEIJING JIAOTONG UNIVERSITY

基　　金：中央高校基本科研业务费专项资金资助(2012JBZ010;2012JBM041;2011JBM217);新世纪优秀人才支持计划项目资助(NCET-11-0565);教育部高校创新团队项目资助(IRT201206)

摘　　要：系统事件日志记录是系统安全审计最重要的数据源.现有的日志保护机制主要解决事件日志生成后的数据完整性保护方面的问题,但对于日志数据生成阶段的可信生成方面还没有解决.本文主要贡献是提出了一种基于TCM模块的可信事件日志生成方法,为事件日志提供了生成时的数据完整性、可认证性等安全特性,增强了事件日志数据的可信性,通过分析证明了本方法的有效性和可实施性.System event log is the most important data source for system security auditing, which is vulnerable to malicious tampering or deleted, the event log data integrity protection has roused the attention of the researchers. Existing log protection mechanisms mainly solve the data integri- ty protection in the event log after it has generated, such as log data storage backup integrity pro- tection and efficiency, but they have not been solved for the log data phase of credible generation. This paper puts forward a credible event log generation approach based on TCM module. It also provides the data integrity, authentication security features and so on when the event log is gener- ating, and enhances the events log data credibility. It proves that this method is effective and practical through the analysis.

关 键 词：日志安全 TCM 可信生成 操作拦截 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]