基于Merkle树的远程证明机制

Remote attestation scheme based on Merkle tree

针对生产控制环境中设备状态的可信验证问题,提出了一种远程证明方案.采用与管理中心协商策略,由设备平台上的可信平台模块定时地对设备平台运行状态进行完整性度量和评估,并生成完整性报告.为保证报告结果的新鲜性和完整性,在设备平台引入时间戳及Merkle树相结合的随机数方法,并保证报告结果的有效性.最后,对该方案的安全性和效率进行了分析.

A remote attestation scheme was proposed to make device＇s report its integrity status actively.According to the policy negotiated between control center and devices,the devices measured and evaluated their runtime integrity status automatically and generated integrity reports periodically with the aid of trusted platform module （TPM）.Time stamp and Merkle tree organized nonces were introduced to ensure the freshness,integrity and availability of the reports.The security and efficiency of the scheme were also analyzed.