摘要
可信计算平台的封装存储功能将数据的加密存储与平台配置结合起来,可提供更为强有力的数据安全服务.然而,平台配置的频繁变动如硬件更替、软件更新及系统补丁等又极大地限制了封装存储功能的使用.针对这个问题,提出了一种基于可信虚拟平台的数据封装存储方案.方案引入了虚拟PCR(vPCR)和安全属性的概念,利用可信平台模块(TPM)将数据与系统安全属性封装起来保护.该方案除能适应平台配置频繁变更的问题外,还能同时保护多个虚拟机系统中数据的安全,不受虚拟机系统配置变化的影响.该方案执行操作简单,实验结果表明与原有方案相比,TPM的负担较小,性能无显著差别.
In trusted functionality which can computing platform, one of the most important features is the sealing provide strong data security by combining data＇s encryption storage with the platform configuration. Data is sealed to the platform configuration, and the sealed data can only be unsealed and Used normally when the platform configuration at unsealing is the same as it at sealing. However, the platform configuration changes frequently with hardware exchanges, software updates and system patches, which restricts the use of the sealing functionality heavily. Aiming at this limitation, the current solutions are improved to support configuration updates based on hardware or software, but they just consider the usage of sealed data on two platforms with different configurations and the same property, which even have no implementation at all. Furthermore, the trusted platform module （TPM） has heavy burden and the efficiency is very poor in these solutions. In order to solve the problem, an approach about data sealing storage based on trusted virtualization platform is presented, which introduces the concept of virtual PCR （vPCR） and security property, and utilizes the TPM to seal data with the security property of the system. Virtual machines＇ configurations are stored in vPCRs, and their corresponding security properties will be dynamically stored into the PCR by turns before sealing or unsealing starts. The security properties are classified by the security levels. The sealing and unsealing operation must be performed according to the rule that sealed data can be successfully unsealed only if the security level of the security property when unsealing is not less than the security level of the security property when sealing. The approach can adapt to platform configurations＇ frequent changes, and also can protect data＇s security in many virtual machines without being effected by configurations＇ changes. The operation of the approach is simple. Through experiment, it is shown that the burden of the TPM is light and there is no evident decrease in efficiency compared with the former approach.
出处
《计算机研究与发展》
EI
CSCD
北大核心
2009年第8期1325-1333,共9页
Journal of Computer Research and Development
基金
国家科技支撑计划基金项目(2006BAH02A02)
国家"八六三"高技术研究发展计划基金项目(2007AA01Z412)
国家自然科学基金项目(60603017)~~
关键词
可信计算
可信平台模块
虚拟平台
数据封装
.安全属性
安全级别
trusted computing
trusted platform module （TPM）
virtualization platform
data sealing
security property
security level
