面向虚拟化平台的透明加密系统设计与实现

面向虚拟化平台的透明加密系统设计与实现 Design and Implementation of a Virtualization Platform Oriented Transparent Cryptographic System 高汉军 GAO Hanjun1 1 first-author 寇鹏 KOU Peng1 1 王丽娜 WANG Lina1 1 2 余荣威 YU Rongwei1 1 董永峰 DONG Yongfeng1 1 武汉大学计算机学院 武汉大学计算机学院 School of Computer,Wuhan University School of Computer,Wuhan University 武汉大学空天信息安全与可信计算教育部重点实验室 武汉大学空天信息安全与可信计算教育部重点实验室 Key Laboratory of Aerospace Information Security and Trusted Computing ofMinistry of Education,Wuhan University Key Laboratory of Aerospace Information Security and Trusted Computing ofMinistry of Education,Wuhan University 针对虚拟化平台下数据防泄漏系统的要求,本文结合可信平台模块（trusted platform module,TPM）的密钥管理优势,提出了一种基于eCrytpfs文件系统的透明加密系统设计与实现方法.该文件保护系统MeCryptfs（modified-eCryptfs）使用自定制TPM密钥管理模块,改善了eCryptfs用户空间的密钥管理部分,通过取消多用户模式进一步增强了整个系统的安全性.测试结果表明,该透明加密系统具有较高的性能,能够满足加解密透明性要求. For the requirements of the virtualization platform of data leakage prevention system,considering the trusted platform module’s advantages of key management,a transparent cryptographic filesystem based on the eCrytpfs is proposed and the corresponding implementation is introduced in this paper.The MeCryptfs,modified-eCryptfs,improves the key management in eCryptfs’s userspace by customizing a TPM key management module and eliminates multi-user mode to enhance the security of the whole system.Finally,test results show that the new transparent cryptographic system has a high performance to meet the transparency requirements of encryption and decryption. 透明加密 密钥管理 虚拟机 MeCryptfs加密系统 transparent cryptographic key management virtual machine MeCryptfs cryptographic system 10.14188/j.1671-8836.2010.02.013 TP309.7 国家高技术研究发展计划（863）项目（2009AA01Z442,2008AA01Z404）;国家自然科学基金资助项目（90718006,60970114） 2010-02-01 2021-04-01 2 56