可信基线及其管理机制  

Trust Baseline Concept and Management Architecture

作　　者：黄强 孔志印 常乐 张德华 

机构地区：[1]信息保障技术重点实验室,北京100072

出　　处：《信息网络安全》2016年第9期145-148,共4页Netinfo Security

摘　　要：在分析信息安全工程中安全基线技术的研究历史以及现状的基础上,文章基于可信计算平台提供的系统完整性及数据完整性验证功能,针对可信计算技术实际应用中出现的策略管理困难,以及传统信息安全工程中提出的可信度保障和评估需求,用确保信息系统确定可信度状态基本保证的方式定义了可信基线的概念。文章从当前可信度评估方法欠缺、可信计算技术推广以及安全机制类比角度分析了引入该概念的必要性,对可信基线与安全基线的内涵特征进行了比较,阐明了两者关系。文章设计了可信基线管理机制框架,论述了可信基线作用是能够提供系统TCB可信度保证,说明了应把握可信基线管理与安全基线管理相关又相互分离的管理原则。可信基线管理机制的建立能够简化传统安全基线的构建工作,有助于可信与安全机制策略上的融合,有助于可信计算系统的部署、管理、维护。Based on the review of research history on security baseline and not only data but also system integrity protection ability provided by trusted computing platform, trust baseline concept was proposed to promote the traditional security baseline construction procedure and resolve actual problems of trust policy management in trusted computing platform deployment. Trust baseline concept is defined by the minimal guarantee of certain trust degree of information system. We emphasis the necessity o f promotion of this concept with shortcoming of trust evaluation and analogy of security mechanism. On the basis of comparison of security baseline and trust baseline, the relationship of them is discussed and the function of trust baseline for providing system TCB assurance is presented. The trust baseline management structure was designed to contribute to trusted computing platform’s usage, arrangement and administration, combining trust and security mechanisms and policies and trust level evaluation.

关 键 词：可信计算 可信计算基 安全基线 可信基线 可信管理 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]