基于文件保险箱的集中加密存储技术的研究与实现
|
摘要
加密文件系统是一种较新式的数据加密存储方式。同传统数据加密方式相比,其在可用性及安全性方面取得了长足的进步。但目前的加密文件系统只能服务于操作系统用户,无法对应用服务程序用户的数据起到保护作用。为此,本文提出保护应用服务程序用户数据安全的新方法:使用加密文件系统的方式来加密应用服务程序的数据。
论文首先研究了如何使用加密文件系统支持应用服务程序的用户:提出加密文件系统空间技术,将加密数据按用户体系归类到各个加密文件系统空间中;通过允许不同用户体系用户访问各自加密文件系统空间中的数据,使得加密文件系统可以直接服务于应用服务程序的用户,继而为操作系统上运行的不同服务程序提供灵活的存储加密支持。在此基础上,为对用户间共享的加密数据提供保护,论文采用了加密文件系统访问控制技术保护共享的加密数据。
论文进一步对支持应用服务程序时,如何保证加密文件系统密钥结构的安全性及高效性进行了研究。为减少用户需要解密的密钥数量,降低在解密密钥时网络及用户智能卡的负载,论文采用了四级密钥结构,将需要用户解密的密钥数量保持为一个;为防范密钥在传输过程中遭窃取,论文采用了密钥安全解密技术,采用密钥“替身”代替密钥在网络上传递,即使密钥“替身”被窃取也不会威胁到密钥安全。
根据这些研究结果,课题设计并实现了集中式文件加密存储平台。论文最后给出其在KYLIN操作系统上的实现方式,并对其安全性及性能进行了测评。测评表明,本文研究的技术对加密文件系统造成的I/O性能损失在3.4%至6.6%之间。
Cryptographic file system is a new kind of data encrypting storage method. Comparing to the traditional data encryption methods, its most significant improvement lies in security and usability. But cryptographic file system can only serve users of OS, it can't protect data of service application users. So this paper creates a new way to protect data of service application users: use cryptographic file system.
In this paper, we introduced cryptographic file system space technique to categorize encrypted data according to their users' system. By letting users from different applications to access data in different cryptographic file system space, service application can use cryptographic file system to protect their data. On this basis, we introduced access control technique to protect shared data between users of service application.
This paper also focuses on how to guarantee the security and efficiency of key structure. For reducing the numbers of keys needed to decrypt, a four-level key structure is introduced to reduce the overload of network and user's smartcard while decrypting keys. In case of key leaking in network transmission of decrypting, this paper introduced a secure key decrypting technique which use a key substitute to decrypt through network, the key can keep safe even substitute is stolen.
The result of this paper is an implementation of centralized file encryption storage platform, which is shown at the last part. The test of the platform shows techniques in this paper caused loss in I/O efficiency is between 3.4% and 6.6%.
论文首先研究了如何使用加密文件系统支持应用服务程序的用户:提出加密文件系统空间技术,将加密数据按用户体系归类到各个加密文件系统空间中;通过允许不同用户体系用户访问各自加密文件系统空间中的数据,使得加密文件系统可以直接服务于应用服务程序的用户,继而为操作系统上运行的不同服务程序提供灵活的存储加密支持。在此基础上,为对用户间共享的加密数据提供保护,论文采用了加密文件系统访问控制技术保护共享的加密数据。
论文进一步对支持应用服务程序时,如何保证加密文件系统密钥结构的安全性及高效性进行了研究。为减少用户需要解密的密钥数量,降低在解密密钥时网络及用户智能卡的负载,论文采用了四级密钥结构,将需要用户解密的密钥数量保持为一个;为防范密钥在传输过程中遭窃取,论文采用了密钥安全解密技术,采用密钥“替身”代替密钥在网络上传递,即使密钥“替身”被窃取也不会威胁到密钥安全。
根据这些研究结果,课题设计并实现了集中式文件加密存储平台。论文最后给出其在KYLIN操作系统上的实现方式,并对其安全性及性能进行了测评。测评表明,本文研究的技术对加密文件系统造成的I/O性能损失在3.4%至6.6%之间。
Cryptographic file system is a new kind of data encrypting storage method. Comparing to the traditional data encryption methods, its most significant improvement lies in security and usability. But cryptographic file system can only serve users of OS, it can't protect data of service application users. So this paper creates a new way to protect data of service application users: use cryptographic file system.
In this paper, we introduced cryptographic file system space technique to categorize encrypted data according to their users' system. By letting users from different applications to access data in different cryptographic file system space, service application can use cryptographic file system to protect their data. On this basis, we introduced access control technique to protect shared data between users of service application.
This paper also focuses on how to guarantee the security and efficiency of key structure. For reducing the numbers of keys needed to decrypt, a four-level key structure is introduced to reduce the overload of network and user's smartcard while decrypting keys. In case of key leaking in network transmission of decrypting, this paper introduced a secure key decrypting technique which use a key substitute to decrypt through network, the key can keep safe even substitute is stolen.
The result of this paper is an implementation of centralized file encryption storage platform, which is shown at the last part. The test of the platform shows techniques in this paper caused loss in I/O efficiency is between 3.4% and 6.6%.
引文
[1]Shoriak Timothy.SSL/TLS Protocol Enablement for Key Recover.Computer and Security,2000(1)
[2]Ferguson P,Huston G.What is VPN.The Internet Protocol Journal,1998(4):22-23
[3]Fred Sandsmark.新的互联网业务机会带来新的安全挑战.http://www.cisco.com/cn/poweredby/html/art_securing_business_0100.shtml
[4]CSI Computer Security Institute.2003 CSI/FBI Computer Crime and Security Survey.www.gocsi.com
[5]D.Atkins,W.Stallings,P.Zimmermann.PGP Message Exchange Formats.RFC-1996,1996(8)
[6]EncryptText.http://www.chilkatsoft.com/encryptText.asp
[7]邢常亮,卿斯汉,李丽萍.一个基于Linux的加密文件系统的设计与实现.计算机工程与应用,2005(17)
[8]BestCrypt Volume Encryption.http://www.jetico.corn/index.htrn#/bcve.htm.
[9]M.Blaze.A Cryptographie File System for Unix.In Proceedings of the First ACM Conference on Computer and Communication Security,NY USA,Nov.1993(9)
[10]钟经纬.基于Kylin的加密文件系统研究与实现.国防科技大学研究生院学位论文,2005
[11]Rivest R.A Method for Obtaining Digital Signatures and Public-Key Cryptosystems.Communications of the ACM,1978(2):120-126
[12]Microsoft TechNet.Protecting Data by Using EFS to Encrypt Hard Drives.http://www.microsoft.com/technet/seeurity/smallbusiness/topics/cryptographyetc/pro tect data efs
[13]D.A.Solomon.Inside Windows NT(Microsoft Programming Series).Microsoft Press,1998.
[14]Michael A.Halcrow.eCryptfs v0.1 Design Document.http://ecryptfs.sf.net
[15]Michael A.Halcrow.A stacked cryptographic file system,http://ecryptfs.sf.net
[16]Steven M.Bellovin and Michael Merritt.Limitations of the Kerberos authentication system.In USENIX Conference Proceedings pages 253-267,Dallas,TX,Winter 1991
[17]Michael A.Halcrow.eCryptfs:An Enterprise-class Cryptographic File system for Linux.http://ecryptfs.sf.net
[18]Phillip Rogaway.The Security of DESX.Department of Computer Science Engineering ⅡBuilding University of California Davis,CA 95616 USA
[19]Ermelindo Mauriello.TCFS:Transparent Cryptographic File System,Linux Journal,1997,1997(40)
[20]Marshall Kirk McKusick.The Design and Implementation of the FreeBSD operation system,人民邮电出版社,2006
[21]W.Richard Stevens.Advanced Unix Programming Environment.机械工业出版社,北京2000
[22]马建峰,郭渊博.计算机系统安全,西安电子科技大学出版社,2005
[23]Eike Born,Helmut Stiegler.Discretionary access control by means of usage conditions,Computers and Security,Jul.1994(5):437-150
[24]Rivest R.The MD5 Message-Digest Algorithm.RFC 1321.MIT Laboratory for Computer Science and RSA DATA Security.Inc,1992(4)
[25]Sherman S.M.Chow,Lucas C.K.Hui,S.M.Yiu.A genetic anti-spyware solution by control list at kernel level.Journal of Systems and Software,Feb.2005(2):227-234
[26]Bell DE.Secure computer systems:unified exposition and multics interpretation.MTR-2997 MITRE Corp
[27]S Jajodia,R.Sandhu.Toward a Multilevel Secure Relational Data Model.In Proceedings ACMSIGMOD,Denver,Colorado,1991(5):50-59
[28]喻鋆.SeMail安全邮件系统的研究与实现.国防科技大学研究生院学位论文,2006
[29]M.Crispin.Internet Message Access Protocol-Version 4revl,RFC 2060,1996(12)
[30]J.Myers,Carnegie Mellon.IMAP4 Authentication Mechanisms,RFC 1731,1994(12)
[31]Blum R著,杜鹏译.开发源码邮件系统安全,人民邮电出版社,2002
[32]Erik Riedel,Mahesh Kallahalla,Ram Swaminathan.A framework for evaluating storage system security.Proceedings of the FAST 2002 Conference on File and Storage Technologies
[33]William Stallings著,刘玉珍等译.密码编码学与网络安全--原理与实践(第三版).北京.电子工业出版社,2002
[34]Carlisle Adams,Steve Lloyd.Understanding PKI:Concepts,Standards,and Deployment Considerations,Second Edition.Addison-Wesley,2002.
[35]Charles P.Wright,Michael C.Martino,Erez Zadok.NCryptfs:A Secure and Convenient Cryptographic File System.http://www.am-utils.org/docs/ncryptfs/
[36]E.Zadok,I.Badulescu,A.Shender.Cryptfs:A Stackable Vnode Level Encryption File System.Technical Report CUCS-021-98,1998
[37]Daniel P.Bovet,Marco Cesati.Understanding the Linux Kernel 3rd Edition.Sebastopol,CA,US,O'Reilly,2005
[38]Mark E.Russinovich,David A.Solomon,Microsoft Windows Internals,电子工业出版社,2007
[39]http://www.coker.com.au/bonnie++/
[40]Jef Bonwick.The Slab allocator:An Object-Caching Kernel Memory Allocator.http://www.lisoleg.net
[2]Ferguson P,Huston G.What is VPN.The Internet Protocol Journal,1998(4):22-23
[3]Fred Sandsmark.新的互联网业务机会带来新的安全挑战.http://www.cisco.com/cn/poweredby/html/art_securing_business_0100.shtml
[4]CSI Computer Security Institute.2003 CSI/FBI Computer Crime and Security Survey.www.gocsi.com
[5]D.Atkins,W.Stallings,P.Zimmermann.PGP Message Exchange Formats.RFC-1996,1996(8)
[6]EncryptText.http://www.chilkatsoft.com/encryptText.asp
[7]邢常亮,卿斯汉,李丽萍.一个基于Linux的加密文件系统的设计与实现.计算机工程与应用,2005(17)
[8]BestCrypt Volume Encryption.http://www.jetico.corn/index.htrn#/bcve.htm.
[9]M.Blaze.A Cryptographie File System for Unix.In Proceedings of the First ACM Conference on Computer and Communication Security,NY USA,Nov.1993(9)
[10]钟经纬.基于Kylin的加密文件系统研究与实现.国防科技大学研究生院学位论文,2005
[11]Rivest R.A Method for Obtaining Digital Signatures and Public-Key Cryptosystems.Communications of the ACM,1978(2):120-126
[12]Microsoft TechNet.Protecting Data by Using EFS to Encrypt Hard Drives.http://www.microsoft.com/technet/seeurity/smallbusiness/topics/cryptographyetc/pro tect data efs
[13]D.A.Solomon.Inside Windows NT(Microsoft Programming Series).Microsoft Press,1998.
[14]Michael A.Halcrow.eCryptfs v0.1 Design Document.http://ecryptfs.sf.net
[15]Michael A.Halcrow.A stacked cryptographic file system,http://ecryptfs.sf.net
[16]Steven M.Bellovin and Michael Merritt.Limitations of the Kerberos authentication system.In USENIX Conference Proceedings pages 253-267,Dallas,TX,Winter 1991
[17]Michael A.Halcrow.eCryptfs:An Enterprise-class Cryptographic File system for Linux.http://ecryptfs.sf.net
[18]Phillip Rogaway.The Security of DESX.Department of Computer Science Engineering ⅡBuilding University of California Davis,CA 95616 USA
[19]Ermelindo Mauriello.TCFS:Transparent Cryptographic File System,Linux Journal,1997,1997(40)
[20]Marshall Kirk McKusick.The Design and Implementation of the FreeBSD operation system,人民邮电出版社,2006
[21]W.Richard Stevens.Advanced Unix Programming Environment.机械工业出版社,北京2000
[22]马建峰,郭渊博.计算机系统安全,西安电子科技大学出版社,2005
[23]Eike Born,Helmut Stiegler.Discretionary access control by means of usage conditions,Computers and Security,Jul.1994(5):437-150
[24]Rivest R.The MD5 Message-Digest Algorithm.RFC 1321.MIT Laboratory for Computer Science and RSA DATA Security.Inc,1992(4)
[25]Sherman S.M.Chow,Lucas C.K.Hui,S.M.Yiu.A genetic anti-spyware solution by control list at kernel level.Journal of Systems and Software,Feb.2005(2):227-234
[26]Bell DE.Secure computer systems:unified exposition and multics interpretation.MTR-2997 MITRE Corp
[27]S Jajodia,R.Sandhu.Toward a Multilevel Secure Relational Data Model.In Proceedings ACMSIGMOD,Denver,Colorado,1991(5):50-59
[28]喻鋆.SeMail安全邮件系统的研究与实现.国防科技大学研究生院学位论文,2006
[29]M.Crispin.Internet Message Access Protocol-Version 4revl,RFC 2060,1996(12)
[30]J.Myers,Carnegie Mellon.IMAP4 Authentication Mechanisms,RFC 1731,1994(12)
[31]Blum R著,杜鹏译.开发源码邮件系统安全,人民邮电出版社,2002
[32]Erik Riedel,Mahesh Kallahalla,Ram Swaminathan.A framework for evaluating storage system security.Proceedings of the FAST 2002 Conference on File and Storage Technologies
[33]William Stallings著,刘玉珍等译.密码编码学与网络安全--原理与实践(第三版).北京.电子工业出版社,2002
[34]Carlisle Adams,Steve Lloyd.Understanding PKI:Concepts,Standards,and Deployment Considerations,Second Edition.Addison-Wesley,2002.
[35]Charles P.Wright,Michael C.Martino,Erez Zadok.NCryptfs:A Secure and Convenient Cryptographic File System.http://www.am-utils.org/docs/ncryptfs/
[36]E.Zadok,I.Badulescu,A.Shender.Cryptfs:A Stackable Vnode Level Encryption File System.Technical Report CUCS-021-98,1998
[37]Daniel P.Bovet,Marco Cesati.Understanding the Linux Kernel 3rd Edition.Sebastopol,CA,US,O'Reilly,2005
[38]Mark E.Russinovich,David A.Solomon,Microsoft Windows Internals,电子工业出版社,2007
[39]http://www.coker.com.au/bonnie++/
[40]Jef Bonwick.The Slab allocator:An Object-Caching Kernel Memory Allocator.http://www.lisoleg.net