可信计算环境构建机制研究进展

Research progress of trusted computing environment

可信计算环境构建是通过软硬件结合的方式构建满足可信计算定义的系统,使其上进行的计算具有真实性、机密性、可控性等特性,并利用这些特性来弥补仅依靠传统安全防护方式的不足,从而更好地解决计算机安全面临的挑战和问题。介绍了可信计算环境构建的硬件基础,归纳了近年来基于静态可信度量根、动态可信度量根以及轻量虚拟机监控器的可信计算环境的构建机制,分析了现有可信计算环境构建机制的优势和不足;通过对可信计算环境中信任链的分析,指明了今后的研究方向。

Trusted computing environment provides a new arena to address the challenges in computer security by combining software and hardware to meet the definition of trusted computing. The authenticity, confidentiality, controllability and other properties that it provides can make up the deficiencies of traditional security methods. This paper describes the hardware basis of trusted computing, summarizes the recent trusted computing environment which is based on the DRTM （Dynamic Root of Trust for Measurement） and SRTM （Static Root of Trust for Measurement）, analyzes the advantages and disadvantages of existed trusted computing environment, and indicates the direction of future research by analyzing the trust chain.