An enhanced scheme of enforcing DTE security policy based on trusted computing technology

As a classical security policy, DTE (domain and type enforcement) is usually used to protect the integrity of information and implemented in many famous security operating systems. But there are three main questions for most systems that have implemented DTE security policy as follows: 1) security policy enforcing module is easy to be tampered and bypass before loaded; 2) The content of security policy file is easily to be disclosed and modified; 3) The system is prone to suffer from "changed-name" attack. Trusted computing provides novel ideas and methods to solve the question of information security. The paper presents an enhanced scheme of enforcing DTE security policy based on trusted computing technology, it is scalable and can deal with the questions mentioned above well. It analyses the whole design of scheme in details and implements a prototype system to demonstrate the feasibility. Experiment results show that it has accepted performance overhead.