论文部分内容阅读
目前导致安全事件的主要原因是主机软、硬件结构存在设计漏洞并且对用户没有进行严格的认证和授权控制。传统安全防范的重点放在对服务器和网络的保护上,而忽略终端接入者本身的安全。但大多数的攻击事件都是由终端接入者本身不安全而引起发的,所以只有从终端接入的源头就建立起安全体系,内外共防来构造真正安全可信的网络环境。本文在参考现有认证技术和可信计算的特点的基础上,提出了一种基于可信计算平台的网络可信接入认证模型。利用此模型可以解决设备安全接入的认证问题。通过使用国际通用准则(CC)评估后,也确定了此方法的有效性。通过认证后的设备需要使用OSAP认证协议向服务资源发出申请,鉴于此协议存在替换攻击的缺陷,本文提出改进的OSAP方法来增强协议的安全性。在863项目“可信计算系统平台”中的实际应用证明上述的模型和方法的有效性,并展现了其良好的应用前景。
The main cause of the current security incidents is the host software and hardware design vulnerabilities exist and the user does not have strict authentication and authorization control. The traditional security precautions focus on the protection of servers and networks, while ignoring the security of the terminal users themselves. However, most of the attacks are caused by the insecure access of the terminal subscribers. Therefore, a security system is established only from the source of the terminal access, and both internal and external networks are designed to be truly secure and trusted. In this paper, based on the existing authentication technology and the characteristics of trusted computing, this paper proposes a trusted network access authentication model based on trusted computing platform. This model can be used to solve the problem of device security access authentication. The validity of this method has also been confirmed by using the International Common Criteria (CC) assessment. The certified device needs to use the OSAP authentication protocol to apply for service resources. In view of the defect of replacement protocol attack, this paper proposes an improved OSAP method to enhance the security of the protocol. The practical application of the 863 project “Trusted Computing System Platform” proves the validity of the above models and methods and shows their good application prospects.