基于SSH的可信信道建立方法研究  

Research on Establish SSH-based Trusted Channels

作　　者：范博[1] 杨润垲 黎琳[2] 

机构地区：[1]中国电子技术标准化研究院,北京100007 [2]北京交通大学计算机与信息技术学院,北京100044

出　　处：《信息网络安全》2018年第1期45-51,共7页Netinfo Security

基　　金：国家自然科学基金[61402035]

摘　　要：现有安全信道技术与TCG远程证明技术集成后,其安全性得到提高。文章提出了一种构建基于SSH的可信信道的方法,称为"可信SSH"。可信SSH从安全的角度出发,不仅实现了平台状态信息与SSH安全信道的真实绑定,而且保护了平台状态信息的隐私。从功能角度看,可信SSH具有以下特点:证明灵活性、向后兼容、可扩展性,这些特性体现在SSH中使用的任何会话密钥交换算法都可以在可信 SSH中无缝使用。文章提供了可信SSH在open ssh的实现及其他功能评估。The security of existing secure channel technologies can be improved when being integrated with TCG remote attestation techniques. This paper proposes a practical approach to establish SSH-based trusted channels, denoted as trusted SSH. From the security point of view, trusted SSH not only achieves the authentic binding of the platform state information to the SSH secure channel, but also retains the privacy of the platform state information. From the functionality point of view, trusted SSH has the following features: attestation flexibility, backward compatibility and scalability. It is reflected in the aspect that any session key exchange algorithm used in SSH can be seamlessly used in Trusted SSH. These characteristics of security, functionalities and scalability are achieved in an efficient way. We also implement trusted SSH based on open SSH for evaluating its other features.

关 键 词：SSH 可信计算 远程证明 可信信道 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]