China Cyberspace Security Strategy and Implications //
中國網絡空間安全戰略思考與啟示
General Secretary Xi pointed out that no network security is no national security, no information will be no modernization. Internationally, the United States on security in cyberspace absolute dominance, they establish hegemony, rules, seeking advantage to control the world, to China’s cyberspace poses a severe challenge.
A US cyberspace security strategy revelation
(a) by the US cyberspace security “policy”, “plan” a national strategy to enhance
the United States in cyberspace is a strategic understanding of the development process. First released in 1998, Presidential Decree No. 63 (PDD63) “Clinton administration policy on critical infrastructure protection,” followed in 2000 issued a “national plan for the protection of information system v1.0”. The Bush administration immediately after the September 11, 2001 issued Executive Order No. 13231 “Information Age critical infrastructure protection,” and announced the establishment of “President Critical Infrastructure Protection Committee” on behalf of its government fully responsible for national security in cyberspace . And to study the drafting of a national strategy, in February 2003 formally issued “to protect cyberspace national strategy”, and posting confidential level No. 54 National Security Presidential Decree in 2008, set up a “comprehensive national cybersecurity plan,” the plan in the “Manhattan” (World War II atomic bomb) name, the specific content of the “Einstein” one, two, three composition, aimed at building the federal government and major information systems engineering protection, the establishment of a unified national security posture information sharing and command system.
(Ii) US cyberspace security strategy to further improve
in April 2008, President Bush issued a “44th president submitted the report to protect the network security space,” suggesting how the next US government to strengthen security in cyberspace.
February 2009, the Obama administration after a comprehensive demonstration, announced the “Cyberspace Policy Assessment – Ensuring credible and robust information and communications infrastructure,” the report, the cyberspace security threats as “the most serious faced by the national economy nationwide one of the challenges and safe country “and declared that” digital infrastructure will be considered national strategic asset, the protection of this infrastructure will be a priority of national security “, a comprehensive plan of strategic measures to defend cyberspace.
June 2009, US Defense Secretary Robert Gates issued an order formally establishing the United States “Cyberspace Command” to the harmonization of network security and protection of US forces to carry out cyber warfare and other military operations. The command part of the US Strategic Command, the preparation of one thousand, in May 2010, the US Cyber Command officially start work.
(C) international and cyberspace war strategy
in May 2011, the White House cybersecurity coordinator Schmidt released in the United States “cyberspace international strategy”, its strategic intentions clear, namely to establish hegemony, rules, seeking advantage, control the world ; in July, the US Department of Defense released “cyberspace operations strategy” put forward five strategic measures for defending US interests in cyberspace, making the United States and its allies and international partners can continue to obtain from the innovation in the information age beneficial.
October 2012, Obama signed the “American Action Network Policy” (PDD21), the law gives the US military has carried out non-traditional combat power, clearly spread from network-centric warfare to cyberspace operations and the like.
In February 2013, Obama published Executive Order No. 13636 “Enhanced network security of critical infrastructure,” clearly states that the policy action to enhance the nation’s critical infrastructure and maintain environmental security and resilience.
In April 2013, Obama Ma Xiangguo submit “fiscal year 2014 defense budget priorities and select” proposed to 2016 reorganized into 133 network forces, including the national task force 68, combat task force 25, the network defense forces 40.
February 2014, the US National Institute for Standards and Technology “to enhance critical infrastructure cybersecurity” that “the United States critical infrastructure to enhance network security framework” (V1.0), emphasizing the use of business-driven network security operations guide, and four levels, the organization’s risk management process. According to different levels of network security risk points
of April 23, 2015, the Pentagon released a new version of network security strategy summary, the first public should cyberwarfare as a future military conflict tactical options, an explicit proposal to increase the US military deterrence in cyberspace and offensive capability.
Not only the United States in full swing and the implementation of international cyberspace war strategy, NATO cyberspace security framework, issued recently shows that there are currently more than one hundred countries in the world have a certain network warfare capabilities, the National Cyber Security Strategy published up to as many as 56.
Thus, cyberspace has become after land, sea, air, space is the fifth largest sovereign area of space, but also the evolution of the international strategy in the military field, which is China’s network security posed a severe challenge, we should actively respond, accelerate the construction of network security system, to defend our national sovereignty cybersecurity.
Second, build the active defense technology security system
(a) immunity trusted computing architecture
computer architecture now used in the design calculation when only the pursuit of speed and no safety factor, such as the difficult task of isolating the system, no memory protection, cross-border, this led directly to the presence service network computing environment, a large number of security issues, such as source configuration can be tampered with, it is implanted malicious programs executed by using a buffer (stack) overflow attacks, illegally take over the system administrator permissions.
Trusted Computing is the result of the development of information science, is a novel immune trusted computing model.Trusted computing using parallel computing and defense dual architecture, at the same time to obtain the computation of security protection, so that the calculation result is always as expected, can be measured to calculate the full control, it is not disturbed.
Compare current most network security system, which is mainly by a firewall, intrusion detection and virus prevention and other components, known as the “third kind.” The image of that, these passive blocking killing is a temporary solution, and trusted computing to achieve active immunization computer architecture, and human immunodeficiency as timely identify “self” and “non-self” ingredients, thereby undermining and exclusion of harmful substances into the body, so that there are shortcomings and gaps being exploited by attackers. .
Cloud computing, big data application of new information technology, networking, industrial systems, mobile Internet, virtual dynamic heterogeneous computing environment requires credible immune system as its base support. Construction of triple protection framework trusted security management center security system can be supported by the structure, to ensure operation behavior, resource allocation, data storage cartridge policy management credibility, the attacker reached the entrance, an unauthorized person can not get vital information, theft Confidential information can not read, can not tamper with systems and information system paralysis not work and can not afford to rely on aggressive behavior of protective effect, if there is credible mechanism, “shock web”, “flame”, “heart blood” and other malicious code may since kill off.
(Ii) China Trusted Computing technology innovation
China Trusted Computing in 1992 and officially approved research and large-scale application early (TCG, established in 2000) in the international Trusted Computing Group.
TCG Trusted Computing research program found that the system problems are: (1) the limitations of cryptography: TCG public key cryptography algorithm using only the RSA, SHA1 hash algorithm only supports series, avoided symmetric cryptography, the resulting key design management, key migration and complicated licensing agreement, but also a direct threat to the security of passwords; (2) the system structure is irrational: TPM calls TCG plug is a passive architecture, dynamic initiative measure can not be performed.
China Trusted Computing over a long period of research, not only to solve the above problems TCG, but also the formation of independent innovation system, its innovative points include:
(1) Trusted Computing Platform password innovative programs
using national self-designed algorithm, credible computing a cryptographic module (TCM), with symmetric cipher and asymmetric cryptography combined system, improve the safety and efficiency; dual certificate structure, simplify certificate management, improved usability and manageability of.
(2) trusted platform control module innovation
presented trusted platform control module (TPCM), TPCM self-control as a trusted root node implant trusted source, be trusted root control functions on the basis of TCM, realized with a password based active control and measurement; TPCM prior to startup of the CPU and BIOS to verify, thereby changing the TPM as the traditional idea of passive devices, to achieve TPCM active control of the whole platform.
(3) a credible innovation board
increase in the amount of confidence in the board trusted platform node (TPCM + TCM), plus a host constitutes a credible two-node, to achieve trust transfer of the operating system, providing reliable hardware environment for the upper platform ; implementation of hardware control bus credible level of peripheral resources, power on the CPU front of the Boot ROM TPCM initiative to measure, so that in the chain of trust “powered first time” to start building; and the use of multi-metric agent establishes a chain of trust for dynamic and virtual measures to provide support.
(4) a credible basis to support innovative software
using host-based software system + double trusted software system architecture ,, trustworthy software group is the Trusted Computing Platform Trusted capabilities to achieve the credibility of all software elements, the host software The system provides active protection of the credibility of the amount of storage, and reporting.
(5) Trusted Network Connect innovation
based on three ternary and other trusted connection architecture, access requester, triple control and identification and access control policies arbiter between; ternary centralized management, improve infrastructure security and manageability; and access requester and the access controller to achieve a unified policy management, improve the system overall credibility.
(Iii) core technology controlled by others to solve the problem
(1) China Trusted Computing industrialization conditions are met. “Long-term Scientific and Technological Development (2006-2020)” made it clear “to the development of high trusted network focusing on the development of network security technology and related products, the establishment of network security technology security system”, “five” plan works trusted computing project regarded as the focus of development, the trusted computing standard series of progressive development, and study of more than 40 units, more than 400 participants, the standard of innovation have made technology validation, to declare more than 40 patents. Many units and departments have developed a chip, machine, software, and network connections and other trusted components and equipment in accordance with relevant standards, and has been effectively used in critical systems in the national grid scheduling. April 16, 2014, established the Zhongguancun Trusted Computing Industry Alliance, and vigorously promote the industrialization and marketization.
(2) laying the foundation for the comprehensive alternative to foreign products. April 2014, Microsoft stopped support for Windows XP Service country about 200 million running XP operating system, the terminal will face a situation of no service; and Windows 8 and Vista (2006 Government procurement is not clear) is the same architecture, Windows8 upgrade is not only costly, but also lose control over security and the secondary development rights. Trusted computing innovation reinforcement XP system can easily upgrade existing equipment as a trusted computer system, a credible alternative service patching services, applications do not change the system, to facilitate the application.
Based on open source technology to develop independent operating system is a realistic option. After 20 years of research, we have accumulated considerable reserves in the operating system and key technologies, which is a breakthrough in technology accumulation mainly based on the open source operating system made. From the perspective of inheritance, we need to select the source as a technical route; from a development perspective, the current is too late to re-encode the formation of a completely new operating system, you want to share the wealth of human knowledge, open source is still a realistic option. Independent innovation is not blocking them out safe, but to fully inherited and developed.
To achieve the “five may” “have a”:
understood: open source system to fully grasp the details, there can be confusion unknown code;
editable: should be based on open source code understood completely customize the code;
Reconfigurable: for specific application scenarios and security requirements, based on open source code refactoring, forming a customized new architecture;
credible: to strengthen the independent operating system immunity with trusted computing technology to prevent autonomous system vulnerability system security;
available: applications and operating system to do the adaptation, ensuring independent operating system to replace foreign products.
We have independent intellectual property rights: to own intellectual property rights on the final autonomous operating system, and deal with intellectual property issues are using open source technologies. GPL open source technology to be bound by the agreement, our country based on existing open source operating system has not encountered significant intellectual property disputes, but just because there is no large-scale application of these systems, once I customize the operating system form a climate, will face challenges in this regard.
Meanwhile, in the process of implementation of the localization of alternative strategies, the trusted protection system fully supports localization of hardware, software, although there are more domestic product defects and loopholes can make credible security flaws and vulnerabilities will not be attacked use ensure more secure than foreign products, localization is self-controlled, safe and reliable escort.
Faced with increasingly severe international cyberspace situation, we should be based on national conditions, innovation-driven, solving the kinds of problems. Adhere to defense in depth, to build a strong network security system, to build China into a world power network security and work hard!
Original Mandarin Chinese:
習總書記指出，沒有網絡安全就沒有國家安全，沒有信息化就沒有現代化。國際上，美國在網絡空間安全上佔據絕對優勢，他們確立霸主，制定規則，謀求優勢來控制世界，給我國的網絡空間安全提出了嚴峻的挑戰。
一、美國網絡空間安全戰略啟示
（一）美國將網絡空間安全由“政策”、“計劃”提升為國家戰略
美國在網絡空間戰略是一個認識發展的過程。首先是1998年發布的第63號總統令（PDD63）《克林頓政府對關鍵基礎設施保護的政策》，緊接著2000年發布了《信息系統保護國家計劃v1.0》。布什政府在2001年911事件後馬上發布的第13231號行政令《信息時代的關鍵基礎設施保護》，並宣布成立“總統關鍵基礎設施保護委員會”，由其代表政府全面負責國家的網絡空間安全工作。並研究起草國家戰略，於2003年2月正式發布《保護網絡空間的國家戰略》，又於2008年發布機密級的第54號國家安全總統令，設立“綜合性國家網絡安全計劃”，該計劃以“曼哈頓”（二戰研製原子彈）命名，具體內容以“愛因斯坦”一、二、三組成，目的是全面建設聯邦政府和主要信息系統的防護工程，建立全國統一的安全態勢信息共享和指揮系統。
（二）美國網絡空間安全戰略進一步完善
2008年4月，布什總統發布了《提交第44屆總統的保護網絡空間安全的報告》，建議美國下一屆政府如何加強網絡空間安全。
2009年2月，奧巴馬政府經過全面論證後，公佈了《網絡空間政策評估——保障可信和強健的信息和通信基礎設施》報告，將網絡空間安全威脅定位為“舉國面臨的最嚴重的國家經濟和國家安全挑戰之一”，並宣布“數字基礎設施將被視為國家戰略資產，保護這一基礎設施將成為國家安全的優先事項”，全面規劃了保衛網絡空間的戰略措施。
2009年6月，美國國防部長羅伯特.蓋茨正式發布命令建立美國“網絡空間司令部”以統一協調保障美軍網絡安全和開展網絡戰等軍事行動。該司令部隸屬於美國戰略司令部，編制近千人， 2010年5月，美國網絡司令部正式啟動工作。
（三）網絡空間國際和戰爭戰略
2011年5月，美國白宮網絡安全協調員施密特發布了美國《網絡空間國際戰略》，其戰略意圖明顯，即確立霸主，制定規則，謀求優勢，控制世界；同年7月，美國國防部發布《網絡空間行動戰略》，提出5大戰略措施，用於捍衛美國在網絡空間的利益，使得美國及其盟國和國際合作夥伴可以繼續從信息時代的創新中獲益。
2012年10月，奧巴馬簽署《美國網絡行動政策》(PDD21)，在法律上賦予美軍具有進行非傳統作戰權力，明確從網絡中心戰擴展到網絡空間作戰行動等。
2013年2月，奧巴馬發布第13636號行政命令《增強關鍵基礎設施網絡安全》，明確指出該政策作用為提升國家關鍵基礎設施並維護環境安全與恢復能力。
2013年4月，奧巴馬向國會提交《2014財年國防預算優先項和選擇》提出至2016年整編成133支網絡部隊，其中國家任務部隊68支，作戰任務部隊25支 ，網絡防禦部隊40支。
2014年2月，美國國家標準與技術研究所針對《增強關鍵基礎設施網絡安全》提出《美國增強關鍵基礎設施網絡安全框架》（V1.0），強調利用業務驅動指導網絡安全行動,並為四個等級，組織風險管理進程。按網絡安全風險程度不同分
2015年4月23日，美國五角大樓發布新版網絡安全戰略概要，首次公開要把網絡戰作為今後軍事衝突的戰術選項之一，明確提出要提高美軍在網絡空間的威懾和進攻能力。
不僅美國緊鑼密鼓執行網絡空間國際和戰爭戰略，最近頒布的北約網絡空間安全框架表明，目前世界上有一百多個國家具備一定的網絡戰能力，公開發表網絡安全戰略的國家達56家之多。
由此可見，網絡空間已經成為繼陸、海、空、天之後的第五大主權領域空間，也是國際戰略在軍事領域的演進，這對我國網絡安全提出了嚴峻的挑戰，我們應積極應對，加快建設我國網絡安全保障體系，捍衛我國網絡安全國家主權。
二、構建主動防禦的技術保障體系
（一）可信免疫的計算體系結構
現在使用的計算機體系結構在設計時只追求計算速度並沒有考慮安全因素，如係統任務難以隔離、內存無越界保護等，這直接導致了網絡化環境下的計算服務存在大量安全問題，如源配置可被篡改、惡意程序被植入執行、利用緩衝區（棧）溢出攻擊、非法接管系統管理員權限等。
可信計算是信息科學發展的結果，是一種新的可信免疫計算模式。可信計算採用運算和防禦並行的雙體系架構，在計算運算的同時進行安全防護，使計算結果總是與預期一樣，計算全程可測可控，不被干擾。
對比當前大部分網絡安全系統，其主要是由防火牆、入侵監測和病毒防範等組成，稱為“老三樣”。形象的說，這些消極被動的封堵查殺是治標不治本，而可信計算實現了計算機體系結構的主動免疫，與人體免疫一樣，能及時識別“自己”和“非己”成份，從而破壞與排斥進入機體的有害物質，使有缺陷和漏洞不被攻擊者利用。 。
雲計算、大數據、物聯網、工業系統移動互聯網、虛擬動態異構計算環境等新型信息技術應用都需要可信免疫體係作為其基礎支撐。構建可信安全管理中心支持下的三重防護框架能夠保障體系結構，確保操作行為、資源配置、數據存儲盒策略管理的可信，達到攻擊者進不去、非授權者重要信息拿不到、竊取保密信息看不懂、系統和信息篡改不了、系統工作癱不成和攻擊行為賴不掉的防護效果，如果有可信機制，“震網”、“火焰”、“心臟滴血”等惡意代碼可不殺自滅。
（二）中國可信計算技術創新
中國可信計算於1992年正式立項研究並規模應用，早於國際可信計算組織（TCG，2000年成立）。
研究TCG可信計算方案發現其體系存在的問題有：（1）密碼體制的局限性：TCG公鑰密碼算法只採用了RSA，雜湊算法只支持SHA1系列，迴避了對稱密碼，由此導緻密鑰管理、密鑰遷移和授權協議的設計複雜化，也直接威脅著密碼的安全；（2）體系結構不合理：TCG的TPM外掛調用是一種被動體系結構，無法執行動態主動度量。
中國可信計算經過長期攻關，不僅解決了TCG的上述問題，還形成了自主創新的體系，其創新點包括：
（1）可信計算平台密碼方案創新
採用國家自主設計的算法，提出了可信計算密碼模塊（TCM），以對稱密碼與非對稱密碼相結合體制，提高了安全性和效率；採用雙證書結構，簡化證書管理，提高了可用性和可管性。
（2）可信平台控制模塊創新
提出了可信平台控制模塊（TPCM），TPCM作為自主可控的可信節點植入可信源根，在TCM基礎上加以信任根控制功能，實現了以密碼為基礎的主動控制和度量；TPCM先於CPU啟動並對BIOS進行驗證，由此改變了TPM作為被動設備的傳統思路，實現了TPCM對整個平台的主動控制。
（3）可信主板創新
在可信平台主板中增加可信度量節點（TPCM+TCM），構成了宿主加可信的雙節點，實現到操作系統的信任傳遞，為上層提供可信硬件環境平台；對外設資源實行總線級的硬件可信控制，在CPU上電前TPCM主動對Boot ROM進行度量，使得信任鏈在“加電第一時刻”開始建立；並利用多度量代理建立信任鏈，為動態和虛擬度量提供支撐。
（4）可信基礎支撐軟件創新
採用宿主軟件系統+可信軟件基的雙系統體系結構，，可信軟件基是可信計算平台中實現可信功能的可信軟件元件的全體，對宿主軟件系統提供主動可信度量、存儲、報告等保障。
（5）可信網絡連接創新
採用基於三層三元對等的可信連接架構，進行訪問請求者、訪問控制者和策略仲裁者之間的三重控制和鑑別；對三元集中控管，提高架構的安全性和可管理性；並對訪問請求者和訪問控制者實現統一的策略管理，提高系統整體的可信性。
（三）解決核心技術受制於人問題
（1）中國可信計算產業化條件具備。 《國家中長期科學技術發展（2006-2020年）》明確提出“以發展高可信網絡為重點，開發網絡安全技術及相關產品，建立網絡安全技術保障體系”，“十二五”規劃有關工程項目都把可信計算列為發展重點，可信計算標準系列逐步製定，研究制定單位達40多家，參加人員達400多，標準的創新點都作了技術驗證，申報專利達40多項。不少單位和部門已按有關標準研製了芯片、整機、軟件和網絡連接等可信部件和設備，並在國家電網調度等重要係統中得到了有效的應用。 2014年4月16日，成立了中關村可信計算產業聯盟，大力推進產業化、市場化。
（2）為全面替代國外產品打基礎。 2014年4月微軟公司停止對Windows XP的服務支持，全國約2億台運行XP操作系統的終端將面臨無人服務的局面；而Windows 8和Vista（2006年政府明確不採購）是同類架構，升級為Windows8不僅耗費巨資，還會失去安全控制權和二次開發權。利用自主創新的可信計算加固XP系統可以方便的把現有設備升級為可信計算機系統，以可信服務替代打補丁服務，應用系統不用改動，便於推廣應用。
基於開源技術發展自主操作系統是現實選擇。經過20多年的攻關，我們在操作系統關鍵技術上有相當的積累和儲備，這些技術積累主要是在開源操作系統基礎上取得的突破。從繼承的角度，我們需要選擇開源作為技術路線；從發展的角度，目前也來不及重新編碼形成一套完全新的操作系統，要共享人類知識財富，開源依然是現實選擇。自主創新不是封閉起來搞安全，而是要充分繼承和發展。
要做到“五可”“一有”：
可知：對開源系統完全掌握其細節，不能有不可知代碼的困惑；
可編：要基於對開源代碼的理解，完全自主編寫代碼；
可重構：面向具體的應用場景和安全需求，對基於開源技術的代碼進行重構，形成定制化的新的體系結構；
可信：通過可信計算技術增強自主操作系統免疫性，防範自主系統中的漏洞影響系統安全性；
可用：做好應用程序與操作系統的適配工作，確保自主操作系統能夠替代國外產品。
有自主知識產權：要對最終的自主操作系統擁有自主知識產權，並處理好所使用的開源技術的知識產權問題。開源技術要受到GPL協議的約束，目前我國現有基於開源的操作系統尚未遇到知識產權方面的明顯糾紛，但這僅僅因為這些系統尚無規模應用，一旦我自主操作系統形成氣候，必然會面臨這方面的挑戰。
同時，在我國實施國產化替代戰略的過程中，可信防護體系全面支持國產化的硬件、軟件，儘管國產化產品存在更多的缺陷和漏洞，可信保障能使得缺陷和漏洞不被攻擊利用，確保比國外產品更安全，為國產化自主可控、安全可信保駕護航。
面對日益嚴峻的國際網絡空間形勢，我們要立足國情，創新驅動，解決受制於人的問題。堅持縱深防禦，構建牢固的網絡安全保障體系，為我國建設成為世界網絡安全強國而努力奮鬥！
Original Source: X