運用雲端機制之個人資訊設備的資料保護方法探討

洪長宏

資料保護方法 ； RSA演算法 ； 電子信封 ； 個人資訊設備 ； Data protection method ； RSA algorithm ； electronic envelope ； personal information device

電腦稽核

28期（2013 / 07 / 13）

8 - 13

繁體中文

因企業比個人所面對的資安風險要高出許多，所以，一般的資安討論均是以企業為對象。為因應快速發展的個人資訊設備，故本文特地著重在個人資訊設備的資料保護方法的探討。本文除了以ISO 27001: 2005為基底， 整理個人資訊設備可用的保護措施外，也提出以非對稱金鑰對來保護個人資料，引用資料交換的電子信封封裝模式成為個人資訊設備的資料保護模式。當然，由於個人資訊設備通常不使用硬體載具來儲存金鑰對，而以檔案來儲存金鑰對，使得金鑰對容易遭受竊取及暴力破解的風險。故本文的重點即在提出檔案金鑰對的保護及保存的方法。希望藉由本方法的討論，能得到更多的迴響及對資料保護有更多元的模式。

Because enterprise face high risk of information security, so the general discussion are based enterprise information security for the object. In response to the rapid development of personal information devices, so this paper focuses specifically on data protection method of personal information devices.In this paper, ISO 27001: 2005 as the base, organize personal information protection measures, but also proposes an asymmetric key pair to protect personal data, reference electronic envelope encapsulation method as personal information device data protection method. Due to personal information devices typically do not use hardware to store the key pair, and a file to store the key pair, making the key pair vulnerable to the risk of theft and violent crack. Therefore, the focus of this paper is to propose key pair file protection and preservation methods.

1. D. Cooper and S. Santesson and S. Farrell and S. Boeyen and R. Housley and W. Polk, 2008, Internet X. 509 Public Key Infrastructure Certificate and Certificate Revocation List （ CRL） Profile, RFC 5280..
2. PKCS # 1 v 2. 1: RSA Cryptography Standard , RSA Laboratories, June 14, 2002.
3. ISO/IEC 27002: 2005, Information technology - Security techniques - Code of practice for information security management..