Ng-vTPM:新一代TPM虚拟化框架设计

Ng-vTPM:新一代TPM虚拟化框架设计 Ng-v TPM: A Next Generation Virtualized TPM Architecture 杨永娇 YANG Yongjiao 1 2 first-author 严飞 YAN Fei 1 2 毛军鹏 MAO Junpeng 1 张焕国 ZHANG Huanguo 1 2 武汉大学计算机学院 武汉大学计算机学院 School of Computer,Wuhan University School of Computer,Wuhan University 空天信息安全与可信计算教育部重点实验室 空天信息安全与可信计算教育部重点实验室 Key Laboratory of Aerospace Information Security and Trusted Computing Ministry of Education,Wuhan University Key Laboratory of Aerospace Information Security and Trusted Computing Ministry of Education,Wuhan University 虚拟可信平台模块v TPM（virtual trusted platform module）是云环境中提供可信功能的重要部件,针对已有v TPM在安全存储属性、可信身份属性、信任传递属性以及迁移时这些属性的保持在设计上的不足,本文提出一个Ng-v TPM框架.该框架结合TPM2.0的新特性,由物理TPM产生v TPM密钥提供安全存储属性,基于物理TPM背书平台种子与虚拟背书密钥的映射关系,提供虚拟机可信身份,将信任链由物理平台扩展到虚拟机平台,并提出使用基于平台配置寄存器策略的封装存储方法解决v TPM迁移后数据的可用性.最后以Xen-4.3.0架构为基础实现此框架.实验分析表明,该框架能够有效保证v TPM设计的安全需求. As a vital important security component in cloud,v TPM（ virtual trusted platform module） should provide the abilities of seal storage,trust identity and chain of trust,as well as trust migration. Unfortunately,those requirements are far from ongoing research works. In this paper,a Ng-v TPM framework is proposed. This framework has three features,the first one is a novel v TPM key hierarchies to protect sensitive data,the second one is the extension of chain of trust from physical host hardware to virtualized guest environment based on EPS（ Endorsement Platform Seed）,the third one is a novel PCR（ platform configuration register） policy based on sealing to solve brittleness problem for migratable v TPM. At last,we also implement this framework on Xen and TPM 2. 0 platform. According to the experiments and data analysis,our work can satisfy the above requirements correctly and efficiently. 可信计算 虚拟可信平台模块 TPM 2.0 增强授权 trusted computing virtual trusted platform module TPM 2.0 enhancement authorization 10.14188/j.1671-8836.2015.02.001 TP309 国家重点基础研究发展计划（973）项目（2014CB340600）;国家自然科学基金（61272452,61003268,61173138,91118003,61303024）资助项目 2015-02-01 2021-03-31 2 61