基于TPM芯片加密的计算机取证技术研究  

Research on Computer Forensics Technology Based on TPM Chip Encryption

作　　者：王崇鹏 徐志强 WANG Chong-peng;XU Zhi-qiang(Beijing Public Security Bureau Net Security Team,Beijing China,100029;Xiamen Xing Baibang Technology Co.,Ltd.,Xiamen China,361008)

机构地区：[1]北京市公安局网安总队,北京100029 [2]厦门市兴百邦科技有限公司,厦门361008

出　　处：《山西警察学院学报》2019年第4期41-45,共5页Journal of Shanxi Police College

摘　　要：随着计算机网络安全形势越来越严峻,国内外越来越重视安全芯片的研究与发展,其中手机等移动设备的加密机制已日趋完善,而计算机在加密方面的发展还处于非常落后的状态,目前计算机在硬件方面的加密方式不多,其中最具代表性的就是利用TPM芯片对计算机进行加密。TPM芯片具有产生加解密密钥与存储管理密钥的功能,能够进行高速的资料加解密。伴随着硬件的发展与软件加密技术的成熟,势必出现更多的具有加密芯片的计算机设备,而与之对应的电子数据取证行业势必也会带来更多的挑战。文章着重探讨了TPM芯片的发展与原理,针对不同的加密方式进行阐述,抓住当前常用的BitLocker加密方式结合TPM芯片,以不同的取证形式解决TPM芯片加密的问题,也对今后计算机的取证趋势进行展望。With the computer network security situation getting more serious,more and more attention have be paid to the research and development of security chips at home and abroad,in which mobile phones and other mobile devices encryption mechanism has been more and more perfect,but the development of computers in encryption is still at backward state,the current computer in hardware encryption is not much,and one of the most representative is the use of TPM chips to encrypt computers.The TPM chip has the function of generating the decryption key and the storage management key,which can realize high-speed data and decryption.With the development of hardware and the maturity of software encryption technology,there will inevitably be more computer devices with encryption chips,and the corresponding electronic data forensics industry will certainly bring more challenges.This paper mainly discusses the development and principle of TPM chip,expounds different encryption methods,captures the commonly used BitLocker encryption method combined with TPM chip,solves the problem of TPM chip encryption in different forms of forensics,and looks forward to the trend of computer forensics in the future.

关 键 词：TPM 芯片加密 物理模块 BITLOCKER 动态交互 

分 类 号：D918.2[政治法律—法学]