- 期刊
電腦資料交換之實體隔離機制探討－植基於身分驗證之USB存取管控研究
The Discussions in Physical Isolation of Computer Data: A Study on USB Devices Access Management Based on Identity Verification Mechanism
摘要
為能杜絕來自網際網路的威脅並保護企業內部資料安全，多數企業採取實體隔離措施，並以集中式儲存媒體管控系統，結合白名單及權限管控進行管理，其中白名單係以硬體裝置序號為基礎，然考量裝置序號亦可透由人工燒錄而成，一旦有心人士偽冒為白名單USB裝置，則可在於企業內部主機獲合法資料存取。為能明確賦予企業內部公用USB裝置及公用電腦具備不可否認之數位身分，並以單次作業授權結合使用者資料交換作業行為，建立安全且可線上稽核之作業環境。本研究整合自我認證機制、橢圓曲線密碼系統及隨機背包難題之應用，建構具身分驗證之USB存取管控系統，管理者掌握管控內作業電腦及USB裝置授權資訊及稽核紀錄，使用者可依實務需求進行USB存取授權申請，並藉由橢圓曲線加密應用強化資料傳輸安全，落實裝置存取管理及後續稽核查驗，期能達到存取服務更具彈性及高安全性。
並列摘要
In order to protect the internal data against the cyberthreats from the Internet, corporations mostly enforce the network isolation policy. Based on USB storage media control with a centralized management system, USB devices can be managed through a whitelist and permission access mechanism. In sight of the whitelist is based on the serial number of the hardware device, and that, those device serial numbers can be manually burned. What's more, a fake whitelisted USB device can be used to access internal computers legally. The research integrates the application of Self-Certified scheme, Elliptic Curve Cryptography and Random Knapsack mechanism, to ensure that the internal USB devices and computers for public use have an undeniable digital identity, constructing a USB access control system with Identity Verification. Besides, the administrator manages the authorization information and audit records of all internal computers and USB devices. Moreover, users can apply for USB access authorization according to practical needs. With the architecture of Elliptic Curve encryption, we can strengthen data transmission security to implement device access management and online audit. Through the control mechanism combining the one-time authorization and data exchange, in this way, we can establish a flexible and high security access services with a safer and auditable operating environment.