A Method to Implement Full Anonymous Attestation for Trusted Computing Platform

Trusted computing （TC） technology is brought out by trusted computing group （TCG） to make computing as safe and reliable as people expect. Attestation is one main function specified by TCG, which is the means by which a trusted computer assures a remote computer whose platform is not tampered with. There are two protocols that implement attestation without disclosing the platform＇s real identity, which are Privacy CA-based protocol and direct anonymous attestation （DAA） protocol. However, in the first protocol the privacy CA is the bottleneck and the platform＇s identity will be disclosed if the privacy CA is compromise, while DAA protocol can do profiling when dealing with rogue hardware device. In this paper, we propose a DAA-extended new approach to ensure full anonymous attestation that can not only detect a rogue TPM, but also reveal rogue TPM＇s real identity.

The Mechanism about Key and Credential on Trusted Computing Platform and the Application Study

Trusted Computing technology is quickly developing in recent years. This technology manages to improve the computer security and archive a trusted computing environment. The core of trusted computing technology is cryptology. In this paper, we analyze the key and credential mechanism which is two basic aspects in the cryptology application of trusted computing. We give an example application to illustrate that the TPM enabled key and credential mechanism can improve the security of computer system.

TPM Context Manager and Dynamic Configuration Management for Trusted Virtualization Platform

It is absolutely critical that trusted configuration management which significantly affects trust chain establishment, sealing storage and remote attestation, especially in trusted virtualization platform like Xen whose system configuration changes easily. TPM （trusted platform module） context manager is presented to carry out dynamic configuration management for virtual machine. It manages the TPM command requests and VM （virtual machine） configurations. The dynamic configuration representa- tion method based on Merkle hash tree is explicitly proposed against TCG （trusted computing group） static configuration representation. It reflects the true VM status in real time even if the configuration has changed, and it eliminates the invalidation of configuration representation, sealing storage and remote attestation. TPM context manager supports TCG storage protection, remote attestation etc, which greatly enhances the security on trusted virtualization platform.

Efficient ID-based TPM key loading scheme for trusted platform

One important function in trusted computing is protected storage, which can protect unlimited amount of data and keys. In the existing trusted platform module （TPM） key loading scheme for trusted platform, a computing platform with TPM as its trusted anchor, the total times of loading operation is the same as the number of the loaded target object＇s ancestors, resulting in low efficiency of loading a TPM key which has many ancestors. To improve efficiency, an identity-based TPM key loading scheme is proposed. In this scheme, the times of loading operation is only two when any TPM key is loaded into TPM. Therefore, the required time cost for loading a TPM key can be reduced, especially for complex TPM key storage hierarchy. By analyzing the correctness, security, efficiency and feasibility, the proposed scheme has the better theoretical and application value.

Merkle Tree Digital Signature and Trusted Computing Platform

Lack of efficiency in the initial key generation process is a serious shortcoming of Merkle tree signature scheme with a large number of possible signatures. Based on two kinds of Merkle trees, a new tree type signature scheme is constructed, and it is provably existentially unforgeable under adaptive chosen message attack. By decentralizing the initial key generation process of the original scheme within the signature process, a large Merkle tree with 6.87×10^10 possible signatures can be initialized in 590 milliseconds. Storing some small Merkle trees in hard disk and memory can speed up Merkle tree signature scheme. Mekle tree signature schemes are fit for trusted computing platform in most scenarios.

An Improved Grid Security Infrastructure by Trusted Computing

Current delegation mechanism of grid security infrastructure （GSI） can＇t satisfy the requirement of dynamic, distributed and practical security in grid virtual organization. To improve this situation, a TC-enabled GSI is discussed in this paper. With TC-enabled GSI, a practical delegation solution is proposed in this paper through enforcing fine granularity policy over distributed platforms with the emerging trusted computing technologies. Here trusted platform module is treated as a tamper-resistance module to improve grid security infrastructure. With the implement of Project Daonity, it is demonstrated that the solution could gain dynamic and distributed security in grid environment.

Implementing Operating System Support for Extended Trusted Path in TPM-Capable Environments

Trusted path is one of the crucial features that operating systems must provide for fundamental security support. In order to explore the possibility of implementing a trusted path mechanism with the support of trusted platform module （TPM） technologies, and to support TPM capabilities in operating systems, the paper extended the scope of the conventional trusted path to cover the situation in which a user communicates with software residing on a remote host. The paper combined the concept of operating system support for trusted path with that for TPM platforms, and proposed the architecture of an extended trusted path mechanism in operating system with considerations on TPM-capable platforms support. As part of the author＇s research in secure operating systems, the work of the paper was carried out with Linux as an experimental prototype system. The research result shows that TPM capabilities can strengthen extended trusted path mechanisms of operating systems.

Modeling Trusted Computing

In this paper, a formal approach based on predicate logic is proposed for representing and reasoning of trusted computing models. Predicates are defined to represent the characteristics of the objects and the relationship among these objects in a trusted system according to trusted computing specifications. Inference rules of trusted relation are given too. With the semantics proposed, some trusted computing models are formalized and verified, which shows that Predicate calculus logic provides a general and effective method for modeling and reasoning trusted computing systems.

Architecture of Trusted PC

This paper, focusing on the trusted computing group＇s standards, explained the key concept of trusted compuling and provided the architecture of trusted PC. It built trust bottom-up by starting with trusted hardware and adding layers of trusted software. It is a system-level solution available to all applications running on the member platforms. This solution reduces the security burden on applications and thus simplifies application programming.

A Trusted Smart Phone and Its Applications in Electronic Payment

With the growing intelligence and popularity of mobile phones, and the trend of cellular network＇s convergence to IP based network, more and more mobile applications emerge on the market. For mission critical applications, like the electronic payment which will be discussed in this paper, the lack of trust in the underlying mobile infrastructure and secure interface to legacy systems （for this case, the banking systems） poses obstacles to their widespread presence in mobile services. Recently, the exposure of hacking of iPhone and other smart phones further emphasizes the criticality of establishing a trust platform for mobile applications. This paper analyzes the building blocks of the trusted smart phone, and proposes a framework to provide a trusted platform for mobile electronic payment. Such a proposed system may allow direct interface to the banking systems due to the banking industry recognized strong security, and hence, may enable its widespread use.

Modelling the Roles of Cewebrity Trust and Platform Trust in Consumers’Propensity of Live-Streaming:An Extended TAM Method

Live streaming is a booming industry in China,involving an increasing number of Internet users.Previous studies show that trust is a cornerstone to develop ecommerce.Trust in the streaming industry is different from that of other e-commerce areas.There are two major dimensions of trust in the live streaming context:platform trust and cewebrity trust,which are both important for customers to adopt and reuse a specific live streaming service.We collected questionnaire data from 520 participates who have used live streaming services in China.We model the collected data and identified factors that can influence users’propensity by an extended technology acceptance model(TAM)method.According to our analysis,both cewebrity trust and platform trust will greatly influence users’intention to reuse a certain platform.Moreover,results also indicate that cewebrity trust is far more important than platform trust.These findings can lead to several management strategies to improve the adherence of users to streaming platforms.

A Behavior-Based Remote Trust Attestation Model

While remote trust attestation is a useful concept to detect unauthorized changes to software, the current mechanism only ensures authenticity at the start of the operating system and cannot ensure the action of running software. Our approach is to use a behavior-based monitoring agent to make remote attestation more flexible, dynamic, and trustworthy. This approach was mostly made possible by extensive use of process information which is readily available in Unix. We also made use of a behavior tree to effectively record predictable behaviors of each process. In this paper, we primarily focus on building a prototype implementation of such framework, presenting one example built on it, successfully find potential security risks in the run time of a ftp program and then evaluate the performance of this model.

A New Approach of TPM Construction Based on J2810

Trusted platform model （TPM） is special-purpose integrated circuits （ICs） built into a variety of platforms to enable strong user authentication and machine attestation-essential to prevent inappropriate access to confidential and sensitive information and to protect against compromised networks. Existing TPM products have some limitations. This paper adopts J2810TPM Single Chip cryptogram MCU produced by Jetway Company to construct typical TPM after comparing existing TPM products. Finally, an improved construction approach of TPM based on J2810 is proposed.

BBACIMA:A Trustworthy Integrity Measurement Architecture through Behavior-Based TPM Access Control

Two limitations of current integrity measurement architectures are pointed out： （1） a reference value is required for every measured entity to verify the system states, as is impractical however; （2） malicious user can forge proof of inexistent system states. This paper proposes a trustworthy integrity measurement architecture, BBACIMA, through enforcing behavior-based access control for trusted platform module （TPM）. BBACIMA introduces a TPM reference monitor （TPMRM） to ensure the trustworthiness of integrity measurement. TPMRM enforces behavior-based access control for the TPM and is isolated from other entities which may be malicious. TPMRM is the only entity manipulating TPM directly and all PCR （platform configuration register） operation requests must pass through the security check of it so that only trusted processes can do measurement and produce the proof of system states. Through these mechanisms malicious user can not enforce attack which is feasible in current measurement architectures.

Root-Of-Trust for Continuous Integration and Continuous Deployment Pipeline in Cloud Computing

Cloud computing has gained significant use over the last decade due to its several benefits,including cost savings associated with setup,deployments,delivery,physical resource sharing across virtual machines,and availability of on-demand cloud services.However,in addition to usual threats in almost every computing environment,cloud computing has also introduced a set of new threats as consumers share physical resources due to the physical co-location paradigm.Furthermore,since there are a growing number of attacks directed at cloud environments(including dictionary attacks,replay code attacks,denial of service attacks,rootkit attacks,code injection attacks,etc.),customers require additional assurances before adopting cloud services.Moreover,the continuous integration and continuous deployment of the code fragments have made cloud services more prone to security breaches.In this study,the model based on the root of trust for continuous integration and continuous deployment is proposed,instead of only relying on a single signon authentication method that typically uses only id and password.The underlying study opted hardware security module by utilizing the Trusted Platform Module(TPM),which is commonly available as a cryptoprocessor on the motherboards of the personal computers and data center servers.The preliminary proof of concept demonstrated that the TPM features can be utilized through RESTful services to establish the root of trust for continuous integration and continuous deployment pipeline and can additionally be integrated as a secure microservice feature in the cloud computing environment.

Operating system network security enhancement scheme based on trusted storage

Data storage security has become the core of many network security issues.In order to achieve trusted storage and trusted measurement of network community data,this paper proposes a secure storage model based on trust extension for existing trusted storage technologies.In the process of document encryption,the key information is encrypted as well as decentralized stored by optimizing the ciphertext inverted index structure and update policy to ensure the security of index information.In the process of user access control mechanism,SAML and XACML are used in combination with role-based access control in order to achieve flexible and efficient authorization and access control.In the process of result query,ontology technology is introduced to better express the user’s query intention and improve the query accuracy.A large number of experiments demonstrate the effectiveness and feasibility of the scheme.

Design and implementation of a portable TPM scheme for general-purpose trusted computing based on EFI

In today＇s globalized digital world, networkbased, mobile, and interactive collaborations have enabled work platforms of personal computers to cross multiple geographical boundaries. The new requirements of privacy-preservation, sensitive information sharing, portability, remote attestation, and robust security create new problems in system design and implementation. There are critical demands for highly secure work platforms and security enhancing mechanisms for ensuring privacy protection, component integrity, sealed storage, and remote attestation of platforms. Trusted computing is a promising technology for enhancing the security of a platform using a trusted platform module （TPM）. TPM is a tamper-resistant microcontroller designed to provide robust security capabilities for computing platforms. It typically is affixed to the motherboard with a low pin count （LPC） bus. However, it limited in that TPM cannot be used directly in current common personal computers （PCs）, and TPM is not flexible and portable enough to be used in different platforms because of its interface with the PC and its certificate and key structure. For these reasons, we propose a portable trusted platform module （PTPM） scheme to build a trusted platform for the common PC based on a single cryptographic chip with a universal serial bus （USB） interface and extensible firmware interface （EFI）, by which platforms can get a similar degree of security protection in general-purpose systems. We show the structure of certificates and keys, which can bind to platforms via a PTPM and provide users with portability and flexibility in different platforms while still allowing the user and platform to be protected and attested. The implementation of prototype system is described in detail and the performance of the PTPM on cryptographic operations and time-costs of the system bootstrap are evaluated and analyzed. The results of experiments show that PTPM has high performances for supporting trusted computing and it can be used flexibly and portably by the user.

Anonymous authentication scheme of trusted mobile terminal under mobile Internet

In order to solve the contradictions between user privacy protection and identity authentication, an anonymous authentication scheme under mobile Internet is proposed, which is based on the direct anonymous attestation of trusted computing and uses the encrypting transfer and signature validation for its implementation. Aiming at two access mode of trusted mobile terminal under mobile Internet, self access and cross-domain access, the authentication process of each mode is described in details. The analysis shows that the scheme implements anonymous authentication on mobile Internet and is correct, controllable and unforgeable.

Confidential computing and related technologies:a critical review

This research critically reviews the definition of confidential computing(CC)and the security comparison of CC with other related technologies by the Confidential Computing Consortium(CCC).We demonstrate that the definitions by CCC are ambiguous,incomplete and even conflicting.We also demonstrate that the security comparison of CC with other technologies is neither scientific nor fair.We highlight the issues in the definitions and comparisons and provide initial recommendations for fixing the issues.These recommendations are the first step towards more precise definitions and reliable comparisons in the future.

A Security-Improved Scheme for Virtual TPM Based on KVM

Virtual trusted platform module （vTPM） is an impor- tant part in building trusted cloud environment. Aiming at the remediation of lack of effective security assurances of vTPM in- stances in the existing virtual TPM architecture, this paper pre- sents a security-improved scheme for virtual TPM based on ker- nel-based virtual machine （KVM）. By realizing the TPM2.0 speci- fication in hardware and software, we add protection for vTPM＇s secrets using the asymmetric encryption algorithm of TPM. This scheme supports the safety migration of a TPM key during VM-vTPM migration and the security association for different virtual machines （VMs） with vTPM instances. We implement a virtual trusted platform with higher security based on KVM virtual infrastructure. The experiments show that the proposed scheme can enhance the security of virtual trusted platform and has fewer additional performance loss for the VM migration with vTPM.