《分析EFS加解密的过程以及其存在的局限性.doc》由会员分享，可在线阅读，更多相关《分析EFS加解密的过程以及其存在的局限性.doc（12页珍藏版）》请在金锄头文库上搜索。
1、http:/ 分析EFS加解密的过程以及其存在的局限性 http:/ 分析EFS加解密的过程以及其存在的局限性EFS（Encrypting File System，加密文件体系）是Windows 2000/XP/VISTA所特有的一个实用功能，关于NTFS卷上的文件和数据，都能够直接被操作体系加密保管。若是硬盘上的文件现已运用EFS进行了加密，即便一个攻击者能拜访到硬盘上，因为没有解密的密钥，文件也是不可用的，在很大程度上提高了数据的安全性。这种特性关于移动用户、经过宽带衔接的用户、对敏感数据有更高安全需求的组织的长处是清楚明了的。EFS ( Encrypting File System, t
2、he encrypting file system ) is a utility function for the typical Windows 2000/XP/VISTA, about NTFS volume of documents and data, can be directly by the operating system encryption storage. If the file on the hard disk has been using EFS for encryption, even if an attacker can visit to the hard disk
3、, because there is no decryption key, the file is not available, greatly improve the security of data. The characteristics of mobile users, through a broadband connection, the user of sensitive data has higher security needs of the advantage is clear.EFS能够被以为除NTFS外的第二层防护，为拜访一个被加密的文件，用户有必要有拜访到文件的NTFS
4、权限。在关联NTFS权限的用户能看到文件夹中的文件，但不能翻开文件除非有相应的解密密钥。相同，一个用户有相应的密钥但没有相应的NTFS权限也不能拜访到文件。所以一个用户要能翻开加密的文件，一起需求NTFS权限宽和密密钥。EFS can be considered the second layer of protection in addition to NTFS, to visit an encrypted file, the user need to visit to the file NTFS permission. The association of NTFS users can se
5、e the files in a folder, but the file could not be opened unless there is a corresponding decryption key. The same, a user has a corresponding key but no corresponding NTFS permissions cannot visit to a file. So a user can open the encrypted file, together with the requirement of NTFS access width a
6、nd secret key.EFS加密是根据公钥战略的。在运用EFS加密一个文件或文件夹时，体系首要会生成一个由伪随机数组成的FEK (File Encryption Key，文件加密钥匙)，然后将运用FEK和数据扩大规范X算法创立加密后的文件，并把它存储到硬盘上，一起删去未加密的原始文件。随后体系运用用户的公钥加密FEK，并把加密后的FEK存储在同一个加密文件中。而在拜访被加密的文件时，体系首要运用当时用户的私钥解密FEK，然后运用FEK解密出文件。The EFS encryption is based on public key strategy. In the use of EFS en
7、crypt a file or folder, the system first generates a composed of pseudo random number FEK ( File Encryption Key, file encryption keys ), and then by using FEK and data to expand the specification of X algorithm create encrypted files, and store it to the hard disk, delete the original unencrypted. F
8、ile. Then the system using the users public key encryption FEK, and put the encrypted FEK stored in the same file encryption. The encryption is in visiting files, system used in the first private key to decrypt the FEK when the user, and then use FEK to decrypt the file.二、运用EFS的长处Two, the use of EFS
9、.EFS加密机制和操作体系紧密联系，因而不用为了加密数据装置额定的软件，节省了运用本钱。拜访一个加密的文件不需求用户任何的操作，而从前的第三方的文件加密东西需求用户每次拜访文件时键入口令，它们并没有与文件体系或操作体系进行无缝地集成。EFS encryption mechanism and operation system are closely connected, so do not have to encrypt data device rated software, saves the use cost. Visit an encrypted file does not need an
10、y user operation, and the former third party file encryption things needs of users visit file type the password, they are not with the file system or operating system for seamless integration.EFS集成进文件体系，因而一个歹意的用户不能绕过文件体系拜访到硬盘，并且，一切运转在内核方式的EFS驱动程序不能由用户直接拜访。EFS integrated into the file system, so a us
11、er a baleful can not bypass the file system calls to the hard disk, and, all running in kernel mode EFS driver cannot be directly accessed by the user.EFS加密体系对用户是通明的。若是某用户加密了一些数据，那么该用户对这些数据的拜访将是彻底答应的，并不会遭到任何约束。而其他非授权用户企图拜访加密过的数据时，就会收到“拜访回绝”的过错提示。EFS加密的用户验证进程是在登录Windows时进行的，只需登录到Windows，就能够翻开任何一个被授权的
12、加密文件。The EFS encryption system is transparent to the user. If a user to encrypt the data, then the user of these data will be completely to visit, and was not subject to any constraint. While other unauthorized users attempt to visit the encrypted data, will receive the visit to the fault tips. User
13、 authentication process of EFS encryption is performed in the login Windows, simply login to the Windows, you can open any authorized encrypted file.EFS暗码组联系了对称加密（DESX）和非对称加密（RSA）的长处，数据运用对称加密进行加密，优于对数据运用非对称加密（用这种办法仅FEK被加密）。EFS password group symmetric encryption ( DESX ) and asymmetric encryption (
14、RSA ) strengths, data encryption using symmetric encryption, is better than that of the data by using asymmetric encryption ( in this way, only FEK is encrypted ).Windows 的CryptoAPI体系答应用户在智能卡上存取他们的私钥，这比将钥匙放在硬盘或软盘上更为安全，这也使多个方位拜访成为能够。Windows CryptoAPI system allows the user in a smart card access thei
15、r private key, this ratio will be the key on the hard disk or floppy disks is more safe, it also makes a range of visit to become.三、怎么运用EFS加密Three, how to use EFS encryption当一个用户运用EFS去加密文件时，有必要存在一个公钥和一个私钥，若是用户没有，EFS效劳将会主动发作一对。关于初级用户来说，即便他彻底不懂加密，也能加密文件，能够对单个文件进行加密，也能够对一个文件夹进行加密，这样一切写入文件夹的文件将主动被加密。Whe
16、n a user uses EFS to encrypt the file, it is necessary to have a public key and a private key, if the user does not have EFS service, will take the initiative to attack a pair. On the primary users, even if he is not completely understand encryption, can encrypt files, can encrypt files, can also encrypt a folder, and all write folder file will automatically be encrypted.一旦用户发布指令加密文件或企
