基于信任扩展的可信云执行环境
|
摘要
针对单点信任传递技术无法应对云环境多节点动态信任问题,提出云环境并行信任传递机制.该机制根据可信计算技术思路,结合云计算工作模式与新特点,将信任划分为静态信任和动态信任,分别给出静态信任根和动态信任根定义,将二者整合形成云执行环境的可信基,静态度量与动态度量有机结合,并行传递信任,将信任从可信基逐级扩展到用户应用资源.经过信任规则谓词逻辑形式化推理,证明了该机制信任扩展正确、有效.测试结果表明:上述机制可达到系统完整性保护目的,系统性能开销在可接受范围之内,不影响用户正常使用.
To solve the problem that single-node trust transfer technique could not be suitable for dynamic multi-nodes trust,parallel trust transfer mechanism was proposed in cloud environment.On the basis of new operating modes and features of cloud computing,the trust was divided into static trust and dynamic trust in terms of the idea of trusted computing technology.Meanwhile,the definitions of static trust root and dynamic trust root were respectively given to be integrated into the trust base for cloud execution environment.Combined with static measurement and dynamic measurement,trust was transferred from the trust base to applications in parallel.Predicate logic formal reasoning proves that the trust can be extended properly and effectively.Experimental results illustrate that the system integrity protection is achieved,and the performance overhead is restricted within an acceptable range,without affecting daily application.
To solve the problem that single-node trust transfer technique could not be suitable for dynamic multi-nodes trust,parallel trust transfer mechanism was proposed in cloud environment.On the basis of new operating modes and features of cloud computing,the trust was divided into static trust and dynamic trust in terms of the idea of trusted computing technology.Meanwhile,the definitions of static trust root and dynamic trust root were respectively given to be integrated into the trust base for cloud execution environment.Combined with static measurement and dynamic measurement,trust was transferred from the trust base to applications in parallel.Predicate logic formal reasoning proves that the trust can be extended properly and effectively.Experimental results illustrate that the system integrity protection is achieved,and the performance overhead is restricted within an acceptable range,without affecting daily application.
引文
[1]Ali M,Khan S U,Vasilakos A V.Security in cloud computing:opportunities and challenges[J].Information Sciences,2015,305:357-383.
[2]Xu P,Chen H,Zou D,et al.Fine-grained and heterogeneous proxy re-encryption for secure cloud storage[J].Chinese Science Bulletin,2014,59(32):4201-4209.
[3]Zou D,Zhang W,Qiang W,et al.Design and implementation of a trusted monitoring framework for cloud platforms[J].Future Generation Computer Systems,2013,29(8):2092-2102.
[4]沈昌祥,张焕国,王怀民,等.可信计算的研究与发展[J].中国科学:信息科学,2010,40(2):139-166.
[5]Xiang S,Zhao B,Yang A,et al.Dynamic measurement protocol in infrastructure as a service[J].Tsinghua Science and Technology,2014,19(5):470-477.
[6]Yu F,Zhang H,Zhao B,et al.A formal analysis of trusted platform module 2.0hash-based message authentication code authorization under digital rights management scenario[J].Security and Communication Networks,2015,8:2462-2476.
[7]Berger S,Cáceres R,Goldman K A,et al.vTPM:virtualizing the trusted platform module[J].Usenix Security,2006,15:305-320.
[8]IBM.Tpod[EB/OL].[2015-07-12].http:∥domino.research.ibm.com/comm/research-people.nsf/pages/taiga.reports.html/$FILE/RT0564.pdf.
[9]Zhang F,Wang J,Sun K,et al.HyperCheck:a hardware-assisted integrity monitor[J].Dependable and Secure Computing IEEE Transactions on,2013,11(4):332-344.
[10]Seol J,Jin S,Lee D,et al.A trusted IaaS environment with hardware security module[J].IEEE Trans on Services Computing,2015(1):1-14.
[11]Jaeger T,Sailer R,Shankar U.PRIMA:policy-reduced integrity measurement architecture[C]∥Proceedings of the 11th ACM Symposium on Access Control Models and Technologies.LakeTahoe:Computer Science,2006:19-28.
[12]纪祥敏,赵波,向騻,等.基于扩展LS2的VMM动态度量形式化分析[J].山东大学学报:理学版,2014,9(9):1-8.
[2]Xu P,Chen H,Zou D,et al.Fine-grained and heterogeneous proxy re-encryption for secure cloud storage[J].Chinese Science Bulletin,2014,59(32):4201-4209.
[3]Zou D,Zhang W,Qiang W,et al.Design and implementation of a trusted monitoring framework for cloud platforms[J].Future Generation Computer Systems,2013,29(8):2092-2102.
[4]沈昌祥,张焕国,王怀民,等.可信计算的研究与发展[J].中国科学:信息科学,2010,40(2):139-166.
[5]Xiang S,Zhao B,Yang A,et al.Dynamic measurement protocol in infrastructure as a service[J].Tsinghua Science and Technology,2014,19(5):470-477.
[6]Yu F,Zhang H,Zhao B,et al.A formal analysis of trusted platform module 2.0hash-based message authentication code authorization under digital rights management scenario[J].Security and Communication Networks,2015,8:2462-2476.
[7]Berger S,Cáceres R,Goldman K A,et al.vTPM:virtualizing the trusted platform module[J].Usenix Security,2006,15:305-320.
[8]IBM.Tpod[EB/OL].[2015-07-12].http:∥domino.research.ibm.com/comm/research-people.nsf/pages/taiga.reports.html/$FILE/RT0564.pdf.
[9]Zhang F,Wang J,Sun K,et al.HyperCheck:a hardware-assisted integrity monitor[J].Dependable and Secure Computing IEEE Transactions on,2013,11(4):332-344.
[10]Seol J,Jin S,Lee D,et al.A trusted IaaS environment with hardware security module[J].IEEE Trans on Services Computing,2015(1):1-14.
[11]Jaeger T,Sailer R,Shankar U.PRIMA:policy-reduced integrity measurement architecture[C]∥Proceedings of the 11th ACM Symposium on Access Control Models and Technologies.LakeTahoe:Computer Science,2006:19-28.
[12]纪祥敏,赵波,向騻,等.基于扩展LS2的VMM动态度量形式化分析[J].山东大学学报:理学版,2014,9(9):1-8.