度量行为信息基可信认证.docVIP

度量行为信息基可信认证文章编号:1001-9081(2012)01-0056-04 doi:10.3724/SP.J.1087.2012.00056 ?摘 要:为了提高远程认证的灵活性和效率，提出将Merkle哈希树应用到基于可信平台的行为动态验证中，给出创建认证度量行为信息基AM_AIB的过程。通过度量当前行为，计算得到行为发生时根哈希值，然后远程认证。根哈希值由可信平台模块(TPM)签名，传递给服务器端验证，如果和服务器端的根哈希值一致，表明该行为是可信的。可根据行为特性设计不同粒度的行为信息基。实验结果表明，该模型能提高时间性能，验证方式灵活，保护平台隐私，克服了基于属性验证的静态特点，确保了平台应用软件运行时可信 ?关键词:可信计算；行为动态认证；认证度量行为信息基；Merkle哈希树；可信平台模块 ?中图分类号: TP393.08 文献标志码:A ? Abstract: To improve the flexibility and efficiency of remote attestation, behavior dynamic attestation was proposed based on Merkle Hash tree. The process of creating AM_AIB tree was designed. The client measured and calculated current root Hash value which was signed by Trusted Platform Module (TPM), and then transmitted it to server?side for certification. If it was consistent with Hash value of server?side, the behavior was supposed to be credible. The model of Attestation Measurement Action Information Base (AM_AIB) could also be designed in different granularity according to the characteristics of behavior. The experimental results show the proposed method can improve the time performance and protect the privacy of platform. It is flexible and it also can overcome the static feature based on attribute verification and ensure that the platform application software runs credibly. Key words: trusted computing; behavior dynamic attestation; Attestation Measurement Action Information Base (AM_AIB); Merkle Hash tree; Trusted Platform Module (TPM) ? 0 引言? 由可信计算组（Trusted Computing Group， TCG）定义的可信平台模块（Trusted Platform Module， TPM)为平台提供了硬件度量、安全存储和身份认证的功能［1］。用来存储平台状态配置信息的寄存器即平台配置寄存器（Platform Configuration Register， PCR），软件部件被TPM测量并将相应的Hash值储存到PCRs，?通过Extend（PCR?n,value）=SHA1(PCR?n‖value）双竖线前面的逗号是否应该删除，请明确。来扩展前面的?PCRs?旧值，?每个计算平台通过其内置的身份公钥(Attestation Identity Key, AIK)标识自己的身份，利用AIK私钥对消息内容签名，证明其来源。远程认证比较是否和参考值一样来证明平台是否可信。? 远程证明是可信计算研究的方向之一，目前TCG提出基于二进制代码的远程证明［2］，针对其不足，Sadeghi等提出基于属性证明方案，关注平台安全属性而不是具体配置［3-4］；Chen等在PBA的基础上，提出基于属性证书的证明协议，通过证书进行远程认证［5］；Haldar提出语义远程认证