中文摘要：

加密技术只能对通信数据的内容进行保护，在电子投票、电子医疗、电子商务和电子现金等一些特殊的应用领域，用户的身份、行为、地理位置等隐私信息的保护程度是评估整个系统安全性的重要因素之一．常用的隐私保护方法是利用匿名通信技术来抵抗窃听和流量分析攻击，但匿名通信技术在增强用户身份等隐私信息保护的同时，恶意用户的身份与行为也受到了匿名保护，如何保护合法用户隐私的同时又能防止恶意行为的攻击是推动匿名通信技术大规模应用的关键．作者以增强计算机安全的可信计算技术为基础，提出一种基于可信平台模块的可控可信匿名通信系统架构，该架构通过群组通信技术实现发送方的身份匿名，在通信链路上采用加密嵌套封装的数据通信方法实现用户行为、地理位置等隐私信息的保护．利用这一框架实现的匿名通信方案是由用户向身份管理中心注册获取群组信息、通过可信性评估的用户从节点服务器下载信任节点、用户用随机选择的信任节点建立匿名通信链路、服务提供方对恶意匿名行为用户的追踪等4个功能模块组成．作者对这些模块的协议进行了体系化设计，并给出了每个模块对应的协议方案．通过对方案的安全性、可信性、匿名性、效率等方面的分析与仿真，表明该方案具有较好的安全性、可控性与可信性，可以满足未来互联网环境下大规模部署匿名通信系统的需要．

英文摘要：

Encryption technology can only carry on the protection to the correspondence data content, but in some special application fields, such as e-voting, e-health, e-commerce and ecash, the protection degree of private information, like user＇s identity, behavior, geographical location and so on, is one of important attributes to assess the overall system security. The anonymous communication technology that is strongly resistant to both eavesdropping and traffic analysis is the commonly used privacy protection method, but this technology can not only enhance an user＇s identity information but also protect a malicious user＇s identity and behavior. How to protect an authorized user＇s privacy and prevent malicious attacks is the key of promote the largescale application of anonymous communication technology. A controllable and trusted anonymous communication architecture that build up the computer security with trusted computing based on the trusted platform module is proposed. The architecture realizes the sender＇s anonymity through a group communication technology, and achieves the protection of privacy information in user behavior, user geographical position by encapsulating package with nested eneryptions in communication link. The anonymous communication scheme based on the architecture consists of four functional modules, such as getting group information by the user register for authenticationmanagement center （AMC）, trusted user node list that was downloaded from the server after the user have passed the trusted evaluation, established anonymous communication link by randomly selected node, and traceable service of malicious behavior to services provider. This paper has carried on the systematization design to these modules, and gives each module a corresponding protocol. It is shown that the scheme has good security, controllability and credibility by analysis and simulation of safety, dependability, anonymity, and efficiency. The scheme can meet the demand of the large scale deployment of anonymou