虚拟计算平台远程可信认证技术研究

doi:10.3969/j.issn.1671-1122.2014.10.014

信息网络安全 ›› 2014, Vol. 15 ›› Issue (10): 77-80.doi: 10.3969/j.issn.1671-1122.2014.10.014

• • 上一篇

虚拟计算平台远程可信认证技术研究

郑志蓉, 刘毅

海军计算技术研究所,北京100841

收稿日期:2014-06-26 出版日期:2014-10-01 发布日期:2015-08-17
作者简介:
郑志蓉（1972-）,女,河南,高级工程师,博士,主要研究方向：信息系统安全;刘毅（1966-）,男,陕西,高级工程师,博士,主要研究方向：信息系统安全。

Research on Remote Trust Authentication in the Virtual Computing Platform

Zhi-rong ZHENG, Yi LIU

Computer Technology Institute of Navy, Beijing l00841, China

Received:2014-06-26 Online:2014-10-01 Published:2015-08-17

摘要/Abstract

摘要：

与传统的单机系统按照可信平台模块、可信BIOS、操作系统装载器、操作系统内核的信任链传递方式不同,虚拟化计算环境信任链按照可信平台模块、可信BIOS、虚拟机监控器和管理虚拟机、用户虚拟机装载器、用户虚拟机操作系统装载器、用户虚拟机操作系统内核的方式进行。文章对虚拟计算平台远程完整性验证的安全需求进行了分析。为防止恶意的虚拟机监控器篡改虚拟机的完整性证明,文章提出虚拟机平台和虚拟机管理器两级的深度认证。在对虚拟机认证过程中,远程挑战者需要通过虚拟机或者直接与虚拟平台建立联系来认证平台的虚拟机管理器层。为防止中间人攻击,文章提出将物理平台寄存器映射到各虚拟平台寄存器的方式解决虚拟机与物理平台的绑定问题。

关键词: 虚拟计算平台, 完整性度量, 可信认证

Abstract:

In the traditional computing platform, the trust chain is constructed in the way of trusted platform module, trusted BIOS, OS Loader, OS kernel. In the virtual computing platform, the trust chain is constructed in the way of trusted platform module, trusted BIOS, virtual machine monitor, manage virtual machine, user virtual machine OS Loader, user virtual machine OS kernel. The security requirement of the remote trust authentication in the virtual computing platform is analyzed. The authentication way of the virtual computing platform and the virtual machine management is put forward in order to prevent malicious virtual machine management to modify the virtual machine’s integrity proven. In the process of virtual machine authentication, remote challenger authenticate virtual machine or virtual platform. The combination of the physical PCRs and virtual PCRs way is put forward to prevent middleman attack.

Key words: virtual computing platform, integrity measurement, trust authentication

中图分类号:

TP309

郑志蓉, 刘毅. 虚拟计算平台远程可信认证技术研究[J]. 信息网络安全, 2014, 15(10): 77-80.

Zhi-rong ZHENG, Yi LIU. Research on Remote Trust Authentication in the Virtual Computing Platform[J]. Netinfo Security, 2014, 15(10): 77-80.

参考文献 9

[1]	Mell P.Grance T.The NIST definition of cloud computing[J].National Institute of Standards and technology, 2009, 53(6):50.
[2]	Vene T,Velte A,Elsenpeter R.CIoud computing,a practial approach[M]. NewYork: McGraw-Hill, Inc. ,2009.
[3]	Luo Sen-lin.Information System Security and Countermeasures[M].Beijing:Beijing Institue of Technology Press,2005.
[4]	王伟,高能,江丽娜,云计算安全需求分析研究[J].信息网络安全,2012,10(8):75-78.
[5]	冯登国,张敏,张妍,等.云计算安全研究[J].软件学报,2011,22(1):71—83.
[6]	ENGLAND P, LAMPSON B, MANFERDELL J,et al.A Trusted open platform[J]. IEEE Computer, 2003, 36(7): 55-62.
[7]	Hao Z, Zhong S, Yu N.A privacy-preserving remote data integrity checking protocol with data dynamics and public verifiability[J]. Knowledge and Data Engineering, IEEE transactions on 2011, 23(9): 1432-1437.
[8]	刘鹏. 云计算[M]. 北京:电子工业出版社, 2013.
[9]	TCG. TCG Specification Architecture Overview[EB/OL]. https://www.trustedcomputing group.org/downloads/specifications/TCG_1_0 Architecture_Overview. pdf,2013-10-10.

虚拟计算平台远程可信认证技术研究

Research on Remote Trust Authentication in the Virtual Computing Platform

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

参考文献 9

相关文章 2

编辑推荐

Metrics

本文评价

[1]	郁湧, 陈长赓, 刘强, 刘嘉熹. 基于构件的软件系统信任链模型和信任关系分析[J]. 信息网络安全, 2018, 18(3): 8-13.
[2]	邢彬, 刘吉强, 韩臻. 一种可信计算平台完整性度量的新模型[J]. 信息网络安全, 2016, 16(6): 8-14.