虚拟可信平台模块动态信任扩展方法

将可信计算技术应用到虚拟计算系统中,可以在云计算、网络功能虚拟化（network function virtualization,简称NFV）等场景下,提供基于硬件的可信保护功能.软件实现的虚拟可信平台模块（virtual trused platform module,简称vTPM）基于一个物理TPM（physical TPM,简称pTPM）,可让每个虚拟机拥有自己专属的TPM,但需要将对pTPM的信任扩展到vTPM上.现有方法主要采用证书链来进行扩展,但在虚拟机及其vTPM被迁移后,需要重新申请vTPM的身份密钥证书,可能会存在大量的短命证书,成本较高,且不能及时撤销旧pTPM对vTPM的信任扩展,也不能提供前向安全保证.提出了一种vTPM动态信任扩展（dynamic trust extension,简称DTE）方法,以满足虚拟机频繁迁移的需求.DTE将vTPM看作是pTPM的一个代理,vTPM每次进行远程证明时,需从一个认证服务器（authenticaiton server,简称AS）处获得一个有效的时间令牌.DTE在vTPM和pTPM之间建立了紧密的安全绑定关系,同时又能明显区分两种不同安全强度的TPM.在DTE里,vTPM被迁移后,无需重新获取身份秘钥证书,旧pTPM可及时撤销对vTPM的信任扩展,而且DTE可提供前向安全性.从原型系统及其性能测试与分析来看,DTE是可行的.     

CyberGuarder: A virtualization security assurance architecture for green cloud computing

As the sizes of IT infrastructure continue to grow, cloud computing is a natural extension of virtualisation technologies that enable scalable management of virtual machines over a plethora of physically connected systems. The so-called virtualisation-based cloud computing paradigm offers a practical approach to green IT/clouds, which emphasise the construction and deployment of scalable, energy-efficient network software applications (NetApp) by virtue of improved utilisation of the underlying resources. The latter is typically achieved through increased sharing of hardware and data in a multi-tenant cloud architecture/environment and, as such, accentuates the critical requirement for enhanced security services as an integrated component of the virtual infrastructure management strategy. This paper analyses the key security challenges faced by contemporary green cloud computing environments, and proposes a virtualisation security assurance architecture, CyberGuarder, which is designed to address several key security problems within the ‘green’ cloud computing context. In particular, CyberGuarder provides three different kinds of services; namely, a virtual machine security service, a virtual network security service and a policy based trust management service. Specifically, the proposed virtual machine security service incorporates a number of new techniques which include (1) a VMM-based integrity measurement approach for NetApp trusted loading, (2) a multi-granularity NetApp isolation mechanism to enable OS user isolation, and (3) a dynamic approach to virtual machine and network isolation for multiple NetApp’s based on energy-efficiency and security requirements. Secondly, a virtual network security service has been developed successfully to provide an adaptive virtual security appliance deployment in a NetApp execution environment, whereby traditional security services such as IDS and firewalls can be encapsulated as VM images and deployed over a virtual security network in accordance with the practical configuration of the virtualised infrastructure. Thirdly, a security service providing policy based trust management is proposed to facilitate access control to the resources pool and a trust federation mechanism to support/optimise task privacy and cost requirements across multiple resource pools. Preliminary studies of these services have been carried out on our iVIC platform, with promising results. As part of our ongoing research in large-scale, energy-efficient/green cloud computing, we are currently developing a virtual laboratory for our campus courses using the virtualisation infrastructure of iVIC, which incorporates the important results and experience of CyberGuarder in a practical context.     

Security-Preserving Live Migration of Virtual Machines in the Cloud

Hypervisor-based process protection is a novel approach that provides isolated execution environments for applications running on untrusted commodity operating systems. It is based on off-the-shelf hardware and trusted hypervisors while it meets the requirement of security and trust for many cloud computing models, especially third-party data centers and a multi-tenant public cloud, in which sensitive data are out of the control of the users. However, as the hypervisor extends semantic protection to the process granularity, such a mechanism also breaks the platform independency of virtual machines and thus prohibits live migration of virtual machines, which is another highly desirable feature in the cloud. In this paper, we extend hypervisor-based process protection systems with live migration capabilities by migrating the protection-related metadata maintained in the hypervisor together with virtual machines and protecting sensitive user contents using encryption and hashing. We also propose a security-preserving live migration protocol that addresses several security threats during live migration procedures including timing-related attacks, replay attacks and resumption order attacks. We implement a prototype system base on Xen and Linux. Evaluation results show that performance degradation in terms of both total migration time and downtime are reasonably low compared to the unmodified Xen live migration system.     

具有瀑布特征的可信虚拟平台信任链模型

将虚拟化技术与可信计算相结合构建的可信虚拟平台及其信任链模型是目前的一个研究热点。目前大部分的研究成果采用在虚拟平台上扩展传统信任链的构建方法,不仅模型过粗且逻辑不完全合理,而且还存在底层虚拟化平台和顶层用户虚拟机两条分离的信任链问题。为此,提出一种具有瀑布特征的信任链模型——TVP-QT,该模型以硬件可信平台模块（TPM）为起点,在底层虚拟化平台和顶层用户虚拟机信任链之间加入可信衔接点。当信任链从底层虚拟化平台传递到可信衔接点时,由可信衔接点负责对用户虚拟机的可信虚拟平台模块（vTPM）进行度量,之后将控制权交给vTPM,由vTPM负责对用户虚拟机启动的组件及应用进行度量。该模型中可信衔接点具有承上启下的瀑布特征,能满足虚拟化环境的层次性和动态性特征,保证了整个可信虚拟平台的可信性。不仅从理论上证明了该模型的正确性,而且对实例系统的分析和讨论也表明了该模型的通用性与可行性;在Xen中对该模型进行了仿真实验,实验结果表明该信任链传递理论可以保证可信虚拟化环境在整个运行过程是安全可信的。     

Secure embedded system hardware design – A flexible security and trust enhanced approach

Embedded systems have found a very strong foothold in global Information Technology (IT) market since they can provide very specialized and intricate functionality to a wide range of products. On the other hand, the migration of IT functionality to a plethora of new smart devices (like mobile phones, cars, aviation, game or households machines) has enabled the collection of a considerable number of data that can be characterized sensitive. Therefore, there is a need for protecting that data through IT security means. However, eare usually dployed in hostile environments where they can be easily subject of physical attacks. In this paper, we provide an overview from ES hardware perspective of methods and mechanisms for providing strong security and trust. The various categories of physical attacks on security related embedded systems are presented along with countermeasures to thwart them and the importance of reconfigurable logic flexibility, adaptability and scalability along with trust protection mechanisms is highlighted. We adopt those mechanisms in order to propose a FPGA based embedded system hardware architecture capable of providing security and trust along with physical attack protection using trust zone separation. The benefits of such approach are discussed and a subsystem of the proposed architecture is implemented in FPGA technology as a proof of concept case study. From the performed analysis and implementation, it is concluded that flexibility, security and trust are fully realistic options for embedded system security enhancement.     

基于虚拟化内存隔离的Rowhammer攻击防护机制

随着虚拟化技术的发展与云计算的流行,虚拟化环境下的安全防护问题一直受到广泛的关注。最近的Rowhammer攻击打破了人们对于硬件的信赖,同时基于Rowhammer攻击的各种攻击方式已经威胁到了虚拟化环境下的虚拟机监视器以及其他虚拟机的安全。目前业界已有的对Rowhammer攻击的防御机制或者局限于修改物理硬件,或者无法很好的部署在虚拟化环境下。本文提出一种方案,该方案实现了一套在虚拟机监视器层面的Rowhammer感知的内存分配机制,能够在虚拟机监视器层面以虚拟机的粒度进行Rowhammer攻击的隔离防护。测试表明,该方案能够在不修改硬件,以及引入较小的性能开销（小于6%的运行时开销和小于0.1%的内存开销）的前提下,成功阻止从虚拟机到虚拟机监视器以及跨虚拟机的Rowhammer攻击。     

基于虚拟机的虚拟计算环境研究与设计

通过对基于虚拟机的虚拟计算环境典型系统的分析,给出了CROWN虚拟计算平台CIVIC(CROWN- based infrastructure for virtual computing)的设计.CIVIC集成多种虚拟机技术,可以为用户提供独立、隔离的计算环境,可以为管理人员提供硬件资源和软件资源的集中管理功能,支持对应用程序的透明性,屏蔽底层硬件资源的动态性、分布性和异构性.实验结果表明,CIVIC能够方便、高效地为用户定制所需计算环境.     

Improving the virtualization of rich applications by combining VNC and streaming protocols at the hypervisor layer

Virtual desktop infrastructure (VDI) solutions seek to provide a satisfactory user experience at the client side when accessing remote desktop applications, even from mobile devices with limited capabilities. This paper presents a new approach, improving on previous work by the authors, in which a combination of Virtual Network Computing (VNC) and streaming protocols allowed efficient remote web access to virtualized applications within a cloud architecture. The new approach simplifies virtual machine templates, from which virtual machine instances are deployed, by centralizing software modules, greatly simplifying their management. Our new contribution consists of an integrated solution with specific WebM video encoding modules in charge of application visual output processing, an Hypertext Transfer Protocol (HTTP) streaming server, and a VNC server. The solution can be installed in the hypervisor of the host machines instead of replicating the servers and modules throughout the guest (virtual) machines that run the virtualized applications. Consequently, their implementations are unique and independent of the operating system of the virtual machines. In short, it is not necessary to provide different implementations for different operating systems, which reduces the complexity of virtual machine templates and greatly simplies platform management. To demonstrate our solution, we have modified the Quick Emulator (QEMU)‐Kernel‐based Virtual Machine (KVM) hypervisor source code accordingly. We also present qualitative and quantitative analyses that demonstrate that the new approach is advantageous in terms of software management and quality of experience, compared with our previous work and other well‐known thin clients, contributing to the enhancement of VDI systems. Copyright © 2015 John Wiley & Sons, Ltd.     

A method for trust management in cloud computing: Data coloring by cloud watermarking

With the development of Internet technology and human computing, the computing environment has changed dramatically over the last three decades. Cloud computing emerges as a paradigm of Internet computing in which dynamical, scalable and often virtualized resources are provided as services. With virtualization technology, cloud computing offers diverse services (such as virtual computing, virtual storage, virtual bandwidth, etc.) for the public by means of multi-tenancy mode. Although users are enjoying the capabilities of super-computing and mass storage supplied by cloud computing, cloud security still remains as a hot spot problem, which is in essence the trust management between data owners and storage service providers. In this paper, we propose a data coloring method based on cloud watermarking to recognize and ensure mutual reputations. The experimental results show that the robustness of reverse cloud generator can guarantee users embedded social reputation identifications. Hence, our work provides a reference solution to the critical problem of cloud security.     

利用可信计算技术改善云计算的安全性

云计算影响了互联网上世界上任何地方远程服务器处理、数据存储和共享的方式。这种共享多种分布式资源方式,使得安全问题更加复杂化。本文分析了云计算环境下的安全服务,通过整合可信计算环境来建立云计算系统。可信计算平台模式可以提高云计算的安全性。可信计算模式重要的安全服务包括加密,认证,完整性和保密性等都可以用在云计算系统中。     

云环境中可信虚拟平台的远程证明方案研究

云环境中如何证明虚拟平台的可信,是值得研究的问题.由于云环境中虚拟平台包括运行于物理平台上的虚拟机管理器和虚拟机,它们是不同的逻辑运行实体,具有层次性和动态性,因此,现有的可信终端远程证明方案,包括隐私CA （privacy certification authority,简称PCA）方案和直接匿名证明（direct anonymous attestation,简称DAA）方案,都并不能直接用于可信虚拟平台.而TCG发布的Virtualized Trusted Platform Architecture Specification 1.0版中,可信虚拟平台的远程证明方案仅仅是个框架,并没有具体实施方案.为此,提出了一种自顶向下的可信虚拟平台远程证明实施方案——TVP-PCA.该方案是在虚拟机中设置一个认证代理,在虚拟机管理器中新增一个认证服务,挑战方首先通过顶层的认证代理证明虚拟机环境可信,然后通过底层的认证服务证明运行于物理平台上的虚拟机管理器可信,顶层和底层证明合起来确保了整个虚拟平台的可信,有效解决了顶层证明和底层证明的同一性问题.实验结果表明,该方案不仅能够证明虚拟机的可信,而且还能证明虚拟机管理器和物理平台的可信,因而证明了云环境中的虚拟平台是真正可信的.     

Addressing cloud computing security issues

The recent emergence of cloud computing has drastically altered everyone’s perception of infrastructure architectures, software delivery and development models. Projecting as an evolutionary step, following the transition from mainframe computers to client/server deployment models, cloud computing encompasses elements from grid computing, utility computing and autonomic computing, into an innovative deployment architecture. This rapid transition towards the clouds, has fuelled concerns on a critical issue for the success of information systems, communication and information security. From a security perspective, a number of unchartered risks and challenges have been introduced from this relocation to the clouds, deteriorating much of the effectiveness of traditional protection mechanisms. As a result the aim of this paper is twofold; firstly to evaluate cloud security by identifying unique security requirements and secondly to attempt to present a viable solution that eliminates these potential threats. This paper proposes introducing a Trusted Third Party, tasked with assuring specific security characteristics within a cloud environment. The proposed solution calls upon cryptography, specifically Public Key Infrastructure operating in concert with SSO and LDAP, to ensure the authentication, integrity and confidentiality of involved data and communications. The solution, presents a horizontal level of service, available to all implicated entities, that realizes a security mesh, within which essential trust is maintained.     

TPM可迁移密钥安全性分析与研究

TPM密钥迁移机制使密钥按照迁移特性分为了可迁移密钥和不可迁移密钥两类,本文深入分析可迁移密钥的安全性,指出可迁移密钥存在的安全问题.首先,利用密钥迁移机制,TPM所有者能将TPM内部可迁移密钥以迁移块的形式导出,解密迁移块能获得可迁移密钥私钥.其次,TPM用户能通过密钥迁移机制将非TPM产生的用户可控密钥构造成迁移块,作为迁移密钥导入到TPM内部.此外,用户使用TPM密钥加载命令能将非TPM产生的用户可控密钥作为TPM产生的可迁移密钥加载到TPM中.在对TPM规范理论分析的基础上,本文从技术角度给出了攻击可迁移密钥安全性的实现方法,并对部分安全问题提出了解决方案.通过分析,本文指出TPM提供密钥迁移机制的同时,也降低了可迁移密钥的安全保护强度.因此,用户在使用可迁移密钥时,应增强安全意识,在安全要求高的操作中尽量不要使用TPM可迁移密钥.     

Safeguarding Cloud Computing Infrastructure: A Security Analysis

Cloud computing is the provision of hosted resources, comprising software, hardware and processing over the World Wide Web. The advantages of rapid deployment, versatility, low expenses and scalability have led to the widespread use of cloud computing across organizations of all sizes, mostly as a component of the combination/multi-cloud infrastructure structure. While cloud storage offers significant benefits as well as cost-effective alternatives for IT management and expansion, new opportunities and challenges in the context of security vulnerabilities are emerging in this domain. Cloud security, also recognized as cloud computing security, refers to a collection of policies, regulations, systematic processes that function together to secure cloud infrastructure systems. These security procedures are designed to safeguard cloud data, to facilitate regulatory enforcement and to preserve the confidentiality of consumers, as well as to lay down encryption rules for specific devices and applications. This study presents an overview of the innovative cloud computing and security challenges that exist at different levels of cloud infrastructure. In this league, the present research work would be a significant contribution in reducing the security attacks on cloud computing so as to provide sustainable and secure services.     

基于应用π演算的可信平台模块的安全性形式化分析

可信平台模块(trusted platform module,TPM)是信息安全领域热点研究方向可信计算的关键部件,其安全性直接影响整个可信计算平台的安全性,需要对其进行安全性验证.针对已有工作对TPM规范中多类安全性问题进行形式化建模与验证过程中所存在的不足,从分析TPM和使用者的交互过程出发,使用应用π演算对TPM进行形式化建模,把TPM规范中定义的各实体行为特性抽象成为进程的并发安全性问题,在讨论并发进程中机密性、认证性和弱机密性的基础上,对交互模型进行安全性论证,提出并使用自动定理证明工具验证了对应安全属性的改进方案.     

EFADS: Efficient,flexible and anonymous data sharing protocol for cloud computing with proxy re-encryption

The concept of cloud computing has emerged as the next generation of computing infrastructure to reduce the costs associated with the management of hardware and software resources. It is vital to its success that cloud computing is featured efficient, flexible and secure characteristics. In this paper, we propose an efficient and anonymous data sharing protocol with flexible sharing style, named EFADS, for outsourcing data onto the cloud. Through formal security analysis, we demonstrate that EFADS provides data confidentiality and data sharer's anonymity without requiring any fully-trusted party. From experimental results, we show that EFADS is more efficient than existing competing approaches. Furthermore, the proxy re-encryption scheme we propose in this paper may be independent of interests, i.e., compared to those previously reported proxy re-encryption schemes, the proposed scheme is the first pairing-free, anonymous and unidirectional proxy re-encryption scheme in the standard model.     

可信云平台远程证明

可信云计算是一种全新的互联网应用模式,它即将成为人们获取信息和服务的主要方式。但在云平台向用户提供远程证明方面,还存在明显的安全漏洞和不足之处。目前所使用的证明方法暴露了平台的属性信息,使攻击者跟踪这些信息进行有针对性的攻击。使用可信环签名的远程证明方法,可以保证平台的匿名性,保护了平台隐私,提高了平台的安全性。最后,通过IKE协议验证了可信环签名方法,确保了它在云计算平台上的可行性。     

基于TEE的主动可信TPM/TCM设计与实现

可信技术正在从被动可信度量向着下一代的主动可信监控方向发展，要求TPM/TCM模块有能力主动度量和干预主机系统，传统的TPM/TCM从架构和运行机制等方面都无法满足这种能力.TEE（trusted executionenvironment）技术提供了可信执行环境和主动访控能力，为构建下一代TPM/TCM提供了基本平台，但还存在系统结构、存储以及通信等多方面挑战.提出基于ARM平台TrustZone机制的TZTCM方案，通过分核异步系统架构解决TZTCM独立可信运行和主动可信安全监控问题，基于PUF（physical unclonable functions）安全存储机制和基于UUID（universally unique identifier）的TEE安全通信机制，解决了TEE环境下可信平台模块的存储安全和通信安全问题，为设计实现主动可信TPM/TCM给出了理论和实践参考.通过实验验证了所提关键机制的有效性，实验结果表明，TZTCM在密码计算能力上较常见TPM也有很大提升.TZTCM只需要在系统中增加或修改相应的软/固件，除了主动可信监控能力，还具有低成本、高性能、低功耗、易升级等特点，相对传统TPM/TCM具有非常明显的优势.     

基于TPM的可信文件系统CIVFS的研究和实现

本文提出一种利用可信计算技术增强文件系统可信性的方法,以Linux为基础,设计实现了一个可信文件系统原型CIVFS.CIVFS是一个结合加密和完整性校验两种保护措施的文件系统,它借助堆式文件系统技术,嵌入在Linux内核中,添加了文件加密和完整性校验模块,利用TPM芯片提供的可信计算和安全存储等功能,增强了对系统安全组件和数据的安全保护.