請用此 Handle URI 來引用此文件：
http://tdr.lib.ntu.edu.tw/jspui/handle/123456789/40780完整後設資料紀錄
| DC 欄位 | 值 | 語言 |
|---|---|---|
| dc.contributor.advisor | 曹礎承 | |
| dc.contributor.author | Pei-Yu Wang | en |
| dc.contributor.author | 王貝瑜 | zh_TW |
| dc.date.accessioned | 2021-06-14T17:00:00Z | - |
| dc.date.available | 2008-08-04 | |
| dc.date.copyright | 2008-08-04 | |
| dc.date.issued | 2008 | |
| dc.date.submitted | 2008-07-28 | |
| dc.identifier.citation | [1] Y. Kim, F. Maino, M. Narasimha, and G. Tsudik, 'Secure group services for storage area networks,' Security in Storage Workshop, 2002. Proceedings. First International IEEE, pp. 80-93, 2002.
[2] 'Trusted Computing Group. Mobile Phone Specifications. ,' https://www.trustedcomputinggroup.org/specs/mobilephone/. [3] 'TCPA resources, IBM Watson Research. ,' http://www.research.ibm.com/gsal/tcpa 2003. [4] X. Zou, 'Secure group communications and hierarchical access control,' University of Nebraska, Lincoln, 2000. [5] J. C. Birget, X. Zou, G. Noubir, and B. Ramamurthy, 'Hierarchy-based access control in distributed environments,' Communications, 2001. ICC 2001. IEEE International Conference on, vol. 1, 2001. [6] Y. Sun and K. J. R. Liu, 'Scalable hierarchical access control in secure group communications,' INFOCOM 2004. Twenty-third AnnualJoint Conference of the IEEE Computer and Communications Societies, vol. 2, 2004. [7] L. Seitz, J. M. Pierson, and L. Brunie, 'Key management for encrypted data storage in distributed systems,' IEEE Security in Storage Workshop, pp. 20–30. [8] D. Maziores, M. Kaminsky, M. F. Kaashoek, and E. Witchel, 'Separating key management from file system security.' [9] K. Fu, M. F. Kaashoek, and D. Mazieres, 'Fast and secure distributed read-only file system.' [10] M. Blaze, 'Key Management in an Encrypting File System.' [11] M. Blaze, 'A cryptographic file system for UNIX,' Proceedings of the 1st ACM conference on Computer and communications security, pp. 9-16, 1993. [12] G. Cattaneo and G. Persiano, 'Design and implementation of a transparent cryptographic file system for UNIX,' Unpublished Technical Report, July, 1997. [13] J. Kubiatowicz, D. Bindel, Y. Chen, S. Czerwinski, P. Eaton, D. Geels, R. Gummadi, S. Rhea, H. Weatherspoon, and C. Wells, 'OceanStore: an architecture for global-scale persistent storage,' Proceedings of the ninth international conference on Architectural support for programming languages and operating systems, pp. 190-201, 2000. [14] S. Rhea, P. Eaton, D. Geels, H. Weatherspoon, B. Zhao, and J. Kubiatowicz, 'Pond: the OceanStore prototype,' Proc. of FAST, vol. 2003, 2003. [15] M. Kallahalla, E. Riedel, R. Swaminathan, Q. Wang, and K. Fu, 'Plutus: Scalable secure file sharing on untrusted storage.' [16] K. E. Fu, 'Group Sharing and Random Access in Cryptographic Storage File Systems,' MASSACHUSETTS INSTITUTE OF TECHNOLOGY, 1999. [17] K. Fu, S. Kamara, and T. Kohno, 'Key regression: Enabling efficient key distribution for secure distributed storage,' ISOC Network and Distributed System Security Symposium (NDSS 2006), 2006. [18] E. Goh, H. Shacham, N. Modadugu, and D. Boneh, 'SiRiUS: Securing remote untrusted storage,' Proceedings of the Tenth Network and Distributed System Security (NDSS) Symposium, pp. 131–145, 2003. [19] D. Naor, M. Naor, and J. Lotspiech, 'Revocation and Tracing Schemes for Stateless Receivers,' Advances in Cryptology-CRYPTO, vol. 1, pp. 41–62, 2001. [20] M. van Dijk, J. Rhodes, L. F. G. Sarmenta, and S. Devadas, 'Offline untrusted storage with immediate detection of forking and replay attacks,' Proceedings of the 2007 ACM workshop on Scalable trusted computing, pp. 41-48, 2007. [21] B. G. Chun, P. Maniatis, S. Shenker, and J. Kubiatowicz, 'Attested append-only memory: making adversaries stick to their word,' Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles, pp. 189-204, 2007. [22] D. MacIver, 'Penetration testing Windows Vista BitLocker drive encryption,' Presentation, Hack In The Box, September, 2006. [23] M. A. Halcrow, 'eCryptfs: An Enterprise-class Encrypted Filesystem for Linux,' Proceedings of the 2005 Linux Symposium, pp. 201–218. [24] L. Lamport, 'Password authentication with insecure communication,' Communications of the ACM, vol. 24, pp. 770-772, 1981. [25] M. J. Don Coppersmith, 'Almost Optimal Hash Sequence Traversal ' Springer Berlin / Heidelberg, pp. 102-119, 2003. [26] G. A. Selim and D. T. Peter, 'Cryptographic solution to a problem of access control in a hierarchy,' ACM Trans. Comput. Syst., vol. 1, pp. 239-248, 1983. [27] M. Stephen and G. A. Selim, 'New Key Generation Algorithms for Multilevel Security,' in Proceedings of the 1983 IEEE Symposium on Security and Privacy: IEEE Computer Society, 1983. [28] E. Gudes, 'The design of a cryptography based secure file system ' IEEE Transactions on Software Engineering vol. 6, pp. pp. 411-420, 1980. [29] H. Weatherspoon, P. Eaton, B.-G. Chun, and J. Kubiatowicz, 'Antiquity: exploiting a secure log for wide-area distributed storage,' European Conference on Computer Systems Proceedings of the 2nd ACM SIGOPS/EuroSys European Conference on Computer Systems, pp. 371 - 384 2007. [30] M. Jeanna Neefe, R. Drew, M. C. Adam, Y. W. Randolph, and E. A. Thomas, 'Improving the performance of log-structured file systems with adaptive methods,' SIGOPS Oper. Syst. Rev., vol. 31, pp. 238-251, 1997. [31] B. Hari, M. F. Kaashoek, K. David, M. Robert, and S. Ion, 'Looking up data in P2P systems,' Commun. ACM, vol. 46, pp. 43-48, 2003. [32] A. R. P Druschel, 'Pastry: Scalable, distributed object location and routing for large-scale peer-to-peer systems,' ACM SIGCOMM, 2001. [33] P. F. S Ratsanamy, M Handley, R Karp 'A Scalable Content-Addressable Network,' ACM SIGCOMM Conference, 2001. [34] I. M. Stoica, R. Liben-Nowell, D. Karger, D.R. Kaashoek, M.F. Dabek, F. Balakrishnan, H. , 'Chord: a scalable peer-to-peer lookup protocol for Internet applications,' Proceedings of ACM SIGCOMM, pp. 17- 32, 2003. [35] J. K. BY Zhao, AD Joseph, 'Tapestry: a fault-tolerant wide-area application infrastructure ' ACM SIGCOMM Computer Communication Review, 2002. [36] H. Attiya and J. Welch, Distributed Computing: Fundamentals, Simulations, and Advanced Topics: Wiley-Interscience, 2004. [37] C. Attiya, D. Dolev, and J. Gil, 'Asynchronous Byzantine consensus,' Proceedings of the third annual ACM symposium on Principles of distributed computing, pp. 119-133, 1984. [38] D. Malkhi, M. Reiter, and A. Wool, 'Annual ACM Symposium on Principles of Distributed Computing ' Proceedings of the sixteenth annual ACM symposium on Principles of distributed computing pp. 249 - 257 1997. [39] N. Haller, 'The s/key (tm) one-time password system,' Symposium on Network and Distributed System Security, pp. 151-157, 1994. [40] D. Preneel, 'Remote Attestation on Legacy Operating Systems With Trusted Platform Modules,' Electronic Notes in Theoretical Computer Science, vol. 197, pp. 59-72, 2008. [41] L. F. G. Sarmenta, 'contributors. TPM/J: Java-based API for the Trusted Platform Module (TPM).' | |
| dc.identifier.uri | http://tdr.lib.ntu.edu.tw/jspui/handle/123456789/40780 | - |
| dc.description.abstract | 隨著行動電子設備愈來愈發達、網路愈來愈普及，網路儲存系統儼然成為了一個熱門的話題以及研究方向，如Microsoft 日前推出的SkyDrive以及Google一直炒熱的網路硬碟服務話題，都顯示是網路儲存服務未來的重要性。在學術研究方面，許多的網路儲存系統研究皆愈趨成熟，然而，其背後亦衍生出許多的安全議題及效率問題，而這個議題也深深的影響到了網路儲存服務的普遍性以及實用性。特別是在於資料分享上面依然有許多可以加以研究之處，包括了使用者的存取控制以及資料分享時的鑰匙傳遞，目前大多的解決方式都是用極複雜的演算法，試圖讓資料分享者可以在分享資料的同時將鑰匙資料散播的可能性減少到最小。但因此也增加了效率上、以及實用上的問題。
有鑒於此，本研究提出了由鑰匙鏈來加密不同版本的資料，鑰匙鏈的加解密速度不但可以改善資料加解密的速度，由於鑰匙鏈是一連串相關性的密鑰，亦可使得儲存系統以及使用者大量的減少鑰匙的儲存量。另外，為了增加減化加解密造成的安全性問題，本研究使用了信賴運算團體Trusted Computing Group (TCG)所發展出來的TPM可信任安全平台模組來保護傳送中的密鑰，並隱藏部分鑰匙的資訊，讓使用者在得到分享資料時，可以由TPM做解密的動作，但卻無法得知任何鑰匙的資訊，亦無法在未授權的情況下分享鑰匙給他人。本研究將安全等級分為四個層級來討論，用上述方法為不同層級提供解決方案，有效的證明，在相同安全層級裡提供了較快速的方法。 | zh_TW |
| dc.description.abstract | Abstract. In this thesis, we address the problem of low-efficiency and high-cost access revocation in a distributed storage system. The design of our security model is based on two concepts. First, to reduce the amount of re-encryption, we assume our system is based on lazy revocation. Second, we show how to enhance the security of access control by implementing the current Trusted Platform Module TPM 1.2 technology without any assumption of trust in the BIOS, CPU, or OS of the client. We use a version-based archival storage system called Antiquity, which stores each version of a data object in a permanent, read-only form. In addition, we explain how to use key chains (key rotation) for file version control in a distributed storage system based on the concept of ‘one key per new version.’ To strengthen the servers trust in the client, we use the trusted hardware of the TPM (Trusted Platform Module) technology for network access control and hide a portion of the key information from users. We evaluate the performance of the implementation using the Antiquity Storage on an IBM laptop embedded with a TPM 1.2 chip, and demonstrate how access revocation security can be enhanced by using trusted computing technology. | en |
| dc.description.provenance | Made available in DSpace on 2021-06-14T17:00:00Z (GMT). No. of bitstreams: 1 ntu-97-R95725016-1.pdf: 1875326 bytes, checksum: 4a9acb9c18749aa6b89af9fe6644621d (MD5) Previous issue date: 2008 | en |
| dc.description.tableofcontents | 論文摘要 I
THESIS ABSTRACT II Table of Contents III List of Figures V List of Tables I Chapter 1 Introduction 1 1.1 Background 1 1.2 Motivation 2 1.3 Objectives 4 1.4 Thesis Outline 5 Chapter 2 Related Works 7 2.1 Related works of Global Storage System 7 2.1.1 OceanStore 7 2.1.2 Plutus—Key regression 8 2.1.3 Cepheus 10 2.1.4 SiRiUS 11 2.2 Other related works about TPM 12 2.2.1 TPM introduction 12 2.2.2 Related works of TPM 14 2.2.3 TPM API 16 2.3 Cryptography 16 Chapter 3 Design Requirements and Solution Overview 19 3.1 Security Levels 19 3.2 Data Structure Background 20 3.3 Threat model and Assumptions 22 3.4 System Entities 23 3.5 Trusted Platform Module (TPM) 24 3.6 Access control models and key revocation overview 26 3.7 Solution Details 26 3.7.1 Data structure and data encryption scheme—using key rotation 27 3.7.2 Client and platform verification 29 3.7.3 Write Access Control 30 3.7.4 Read access control 33 3.7.5 User revocation 34 Chapter 4 System Implementation and benchmarks 37 4.1 Performance of the basic TPM functions 37 4.2 Performance of the TPM with bound/unbound data 38 4.3 Performance of key delivery 38 4.4 Performance of reading/writing files 39 4.5 Performance comparison of different security levels 40 Chapter 5 Conclusions 42 5.1 Contributions 42 5.2 Future Work 43 | |
| dc.language.iso | en | |
| dc.title | 基於Antiquity儲存系統之存取控制架構 | zh_TW |
| dc.title | Using Key Rotation and TPMs for Encrypted File System Access Control –
Based on Antiquity Storage System | en |
| dc.type | Thesis | |
| dc.date.schoolyear | 96-2 | |
| dc.description.degree | 碩士 | |
| dc.contributor.oralexamcommittee | 陳建錦,林俊叡 | |
| dc.subject.keyword | 可信賴平台模組(TPM),key rotation,鑰匙鏈,Antiquity儲存控制,存取控制,密鑰管理, | zh_TW |
| dc.subject.keyword | TPM, key rotation, key chain, Antiquity Storage System, access control, key management, | en |
| dc.relation.page | 46 | |
| dc.rights.note | 有償授權 | |
| dc.date.accepted | 2008-07-30 | |
| dc.contributor.author-college | 管理學院 | zh_TW |
| dc.contributor.author-dept | 資訊管理學研究所 | zh_TW |
| 顯示於系所單位： | 資訊管理學系 | |
文件中的檔案：
| 檔案 | 大小 | 格式 | |
|---|---|---|---|
| ntu-97-1.pdf 目前未授權公開取用 | 1.83 MB | Adobe PDF |
系統中的文件，除了特別指名其著作權條款之外，均受到著作權保護，並且保留所有的權利。