通過對可信計算及其主要功能“遠端證明”的分析，提出“應用證明”的概念及原理，并說明支持應用證明所需的安全機制。分析現有主流操作系統所使用的保護結構和訪問控制模型，說明應用證明在當前的主流操作系統上是無法實現的。通過對能力系統EROS 進行改進，使其充分支持應用證明，并提高系統的安全性及可信性。
關鍵詞：可信計算；遠端證明；應用證明；能力系統
Abstract: Through the analysis of the trusted computing and its main function remote attestation, the paper roposes the concept and principle of application attestation, and explains the security echanism that needs to upport application attestation. The paper analyses the protection frame and the access control model of the ainstream operating system, and points out that it is impossible to implement application attestation on the
mainstream operating system. Through the modification of the capability system EROS, the modified EROS can ell support the application attestation and improve the system’s security and trusting degree.
Keywords: trusted computing; remote attestation; application attestation; capability system
1