vTSE:一种基于SGX的vTPM安全增强方案

发布时间：2018-04-14 19:53

本文选题：可信计算 + 虚拟可信平台模块　；参考：《工程科学与技术》2017年02期

【摘要】：针对现有虚拟化可信平台架构中vTPM(virtual trusted platform module)实例缺乏有效安全保障的问题,提出一种基于Intel SGX(software guard extension)的虚拟可信平台模块安全增强方案——vTSE。该方案利用SGX技术的物理安全隔离特性,将vTPM实例的代码和数据放入SGX提供的安全隔离区域enclave中进行隔离保护;同时vTSE使用SGX具有的基于可信区身份的密封功能加密存储安全隔离区中的非易失数据。通过实验证明了本方案能够在vTPM实例运行时动态地保护其代码和数据的机密性、完整性,同时实现vTPM实例数据的安全存储。最后,从安全性和性能开销两方面进行评估,实验结果表明,vTSE的方案在保证vTPM实例运行和存储安全的同时,增加的性能开销不超过1 ms。
[Abstract]:According to the existing vTPM virtual trusted platform architecture (virtual trusted platform module) example of the lack of effective security issues, based on Intel SGX (software guard extension) - vTSE. physical security isolation scheme this scheme using SGX technology to enhance the security of the virtual trusted platform module, vTPM example code and data into safety enclave SGX provides isolation region in isolation protection; at the same time vTSE using SGX with encryption storage security isolation in nonvolatile trusted identity based sealing function. Through the experiment proves that this scheme can dynamically protect the confidentiality, the code and data in the vTPM instance runtime integrity at the same time. Implementation of secure storage vTPM instance data. Finally, evaluated from the two aspects of safety and performance overhead, the experimental results show that the vTSE scheme in vTPM guarantee While the instance runs and stores security, the increased performance overhead is not more than 1 ms.

【作者单位】：空天信息安全与可信计算教育部重点实验室;武汉大学计算机学院;
【基金】：国家自然科学基金资助项目(61272452;61303024;61003268) 国家重点基础研究发展计划资助项目(2014CB340601) 江苏省自然科学基金青年基金资助项目(BK20130372) 国家“863”课题资助项目(2015AA016002)
【分类号】：TP309

【相似文献】