专控计算机分离式文件存储的研究.pdf

摘 要
专控计算机是一种重要的敏感文件管理工具，可以用以存储大量的敏感文件，
但它在提供数据安全保证的同时也存在一定的安全隐患。“斯诺登事件”发生后，
信息安全成为新的热点，由于专控计算机中存放数据的敏感性，必须采取有效措
施保护其中存储文件数据的安全。目前，尽管专控计算机已经采取了与互联网物
理隔离的方法，但仍然存在系统访问控制方式简单、数据能够随意访问和复制的
问题。通过 USB、光盘等引导介质访问计算机可以绕过原有的系统数据访问控制
机制，从而获取专控计算机中的文件数据，造成敏感数据泄露或丢失。此外，专
控计算机大量数据都是以明文数据的形式存放，一旦磁盘丢失，也会造成数据外
泄。
针对上述问题，为了提高专控计算机文件数据保护的安全强度，本文研究了
文件系统原理、加密文件系统实现原理、USB Key 技术和数据加密算法，设计了
目录数据分离存储的文件存储方法，自制了 USB Key 硬件设备，实现了一个分离
式文件存储系统。系统主要由 USB Key 安全管理中心和专控计算机客户端程序两
部分组成，用以实现对专控计算机文件数据的全面保护。

关键词： USB Key 目录数据分离的文件存储方法 密码算法
Abstract
The special control of computer has become an important tool for managing
sensitive files and it can store an enormous range of sensitive files, but some security
danger may exist when it provides data security guarantee. “Company Norden events”
attracted more and more people to information security which then became a new hot
spot. It is essential to take effective measures to maintain the security of the stored data
and files because of the sensitivity of data stored in the special control of computer. At
present, although the special control of computer has been isolated from Internet
physically, there are still many problems, such as the simple method of access control,
the arbitrariness of access to data and copying of data. Moreover, using guiding
mediums like USB, CD and so on to visit computer, the control mechanism of the old
data system can be skipped then the files and data in the special control of computer
can be acquired, which leads to the leakage and loss of sensitive data. In addition, these
computers use non-encrypted mobile disk for a lot of data storage. Once the mobile
disk is lost, data will leak out.
In order to increase the security intensity of files and data stored in the special
control of computer, we have studied the principle of file system, system realization