Abstract:

In order to reduce the size of the virtual trusted platform module (vTPM) instances and trusted computing base(TCB) of system software in virtual environment, and further to protect the confidentiality, integrity and security of the vTPM components, and solve the problem that the credibility boundariesare difficult to define under the traditional virtual trusted computing platform , this paper presents a new method and model to build credible virtual platform. Firstly, in order to prevent the attacks from malicious software and memory sniffer in Domain 0, the domain management tool of weak security in the user space of Xen privilege domain Domain 0 and the related components of vTPM are placed in a trusted domain Domain T. As the security services implementation framework above the Xen virtualization layer, Domain T can provide a higher level of security protection for the related components of vTPM. Secondly, by refactoring the management and the control application software with the privileges in Domain 0, the user space of Domain 0 is separated from the trusted computing base, and then the size of the trusted computing base of trusted virtual platform is reduced. Finally, a new trusted chain construction model based on the trusted virtual platform is designed and implemented. By comparing with the traditional trusted virtual platform, the system can effectively implement the integration of virtualization technology and trusted computing technology, and implement to run simultaneously multiple operating systems of different credible level on a physical platform, while guaranteeing each operating system having functions such as credible certification.

Key words: trusted platform module, trusted virtual execution environment, trusted computing base, trusted chain, trusted domain