《分析efs加解密的过程以及其存在的局限性》由会员分享，可在线阅读，更多相关《分析efs加解密的过程以及其存在的局限性（12页珍藏版）》请在金锄头文库上搜索。
1、 分析 EFS 加解密的过程以及其存在的局限性EFS（Encrypting File System，加密文件体系）是 Windows 2000/XP/VISTA 所特有的一个实用功能，关于 NTFS 卷上的文件和数据，都能够直接被操作体系加密保管。若是硬盘上的文件现已运用 EFS 进行了加密，即便一个攻击者能拜访到硬盘上，因为没有解密的密钥，文件也是不可用的，在很大程度上提高了数据的安全性。这种特性关于移动用户、经过宽带衔接的用户、对敏感数据有更高安全需求的组织的长处是清楚明了的。EFS ( Encrypting File System, the encrypting file system
2、) is a utility function for the typical Windows 2000/XP/VISTA, about NTFS volume of documents and data, can be directly by the operating system encryption storage. If the file on the hard disk has been using EFS for encryption, even if an attacker can visit to the hard disk, because there is no decr
3、yption key, the file is not available, greatly improve the security of data. The characteristics of mobile users, through a broadband connection, the user of sensitive data has higher security needs of the advantage is clear.EFS 能够被以为除 NTFS 外的第二层防护，为拜访一个被加密的文件，用户有必要有拜访到文件的 NTFS 权限。http:/ 分析 EFS 加解密的
4、过程以及其存在的局限性 http:/在关联 NTFS 权限的用户能看到文件夹中的文件，但不能翻开文件除非有相应的解密密钥。相同，一个用户有相应的密钥但没有相应的 NTFS 权限也不能拜访到文件。所以一个用户要能翻开加密的文件，一起需求 NTFS 权限宽和密密钥。EFS can be considered the second layer of protection in addition to NTFS, to visit an encrypted file, the user need to visit to the file NTFS permission. The association
5、 of NTFS users can see the files in a folder, but the file could not be opened unless there is a corresponding decryption key. The same, a user has a corresponding key but no corresponding NTFS permissions cannot visit to a file. So a user can open the encrypted file, together with the requirement o
6、f NTFS access width and secret key.EFS 加密是根据公钥战略的。在运用 EFS 加密一个文件或文件夹时，体系首要会生成一个由伪随机数组成的FEK (File Encryption Key，文件加密钥匙)，然后将运用FEK 和数据扩大规范 X 算法创立加密后的文件，并把它存储到硬盘上，一起删去未加密的原始文件。随后体系运用用户的公钥加密 FEK，并把加密后的 FEK 存储在同一个加密文件中。而在拜访被加密的文件时，体系首要运用http:/ 分析 EFS 加解密的过程以及其存在的局限性 http:/当时用户的私钥解密 FEK，然后运用 FEK 解密出文件。The
7、 EFS encryption is based on public key strategy. In the use of EFS encrypt a file or folder, the system first generates a composed of pseudo random number FEK ( File Encryption Key, file encryption keys ), and then by using FEK and data to expand the specification of X algorithm create encrypted fil
8、es, and store it to the hard disk, delete the original unencrypted. File. Then the system using the users public key encryption FEK, and put the encrypted FEK stored in the same file encryption. The encryption is in visiting files, system used in the first private key to decrypt the FEK when the use
9、r, and then use FEK to decrypt the file.二、运用 EFS 的长处Two, the use of EFS.EFS 加密机制和操作体系紧密联系，因而不用为了加密数据装置额定的软件，节省了运用本钱。拜访一个加密的文件不需求用户任何的操作，而从前的第三方的文件加密东西需求用户每次拜访文件时键入口令，它们并没有与文件体系或操作体系进行无缝地集成。EFS encryption mechanism and operation system are closely http:/ 分析 EFS 加解密的过程以及其存在的局限性 http:/connected, so do
10、not have to encrypt data device rated software, saves the use cost. Visit an encrypted file does not need any user operation, and the former third party file encryption things needs of users visit file type the password, they are not with the file system or operating system for seamless integration.
11、EFS 集成进文件体系，因而一个歹意的用户不能绕过文件体系拜访到硬盘，并且，一切运转在内核方式的 EFS驱动程序不能由用户直接拜访。EFS integrated into the file system, so a user a baleful can not bypass the file system calls to the hard disk, and, all running in kernel mode EFS driver cannot be directly accessed by the user.EFS 加密体系对用户是通明的。若是某用户加密了一些数据，那么该用户对这些数据
12、的拜访将是彻底答应的，并不会遭到任何约束。而其他非授权用户企图拜访加密过的数据时，就会收到“拜访回绝”的过错提示。EFS 加密的用户验证进程是在登录 Windows 时进行的，只需登录到 Windows，就能够翻开任何一个被授权的加密文件。The EFS encryption system is transparent to the user. If a user to encrypt the data, then the user of these data will be http:/ 分析 EFS 加解密的过程以及其存在的局限性 http:/completely to visit, an
13、d was not subject to any constraint. While other unauthorized users attempt to visit the encrypted data, will receive the “ visit to “ the fault tips. User authentication process of EFS encryption is performed in the login Windows, simply login to the Windows, you can open any authorized encrypted f
14、ile.EFS 暗码组联系了对称加密（DESX）和非对称加密（RSA）的长处，数据运用对称加密进行加密，优于对数据运用非对称加密（用这种办法仅 FEK 被加密）。EFS password group symmetric encryption ( DESX ) and asymmetric encryption ( RSA ) strengths, data encryption using symmetric encryption, is better than that of the data by using asymmetric encryption ( in this way, onl
15、y FEK is encrypted ).Windows 的 CryptoAPI 体系答应用户在智能卡上存取他们的私钥，这比将钥匙放在硬盘或软盘上更为安全，这也使多个方位拜访成为能够。Windows CryptoAPI system allows the user in a smart card access their private key, this ratio will be the key on the hard disk or floppy disks is more safe, it also makes a range of visit to become.http:/ 分析
16、EFS 加解密的过程以及其存在的局限性 http:/三、怎么运用 EFS 加密Three, how to use EFS encryption当一个用户运用 EFS 去加密文件时，有必要存在一个公钥和一个私钥，若是用户没有，EFS 效劳将会主动发作一对。关于初级用户来说，即便他彻底不懂加密，也能加密文件，能够对单个文件进行加密，也能够对一个文件夹进行加密，这样一切写入文件夹的文件将主动被加密。When a user uses EFS to encrypt the file, it is necessary to have a public key and a private key, if the user does not have EFS service, will take
