【摘要】 由于虚拟环境的复杂性和动态性,使用传统方法证明其安全状态时会出现运算效率低下的情况;而环签名具有运算效率高、匿名性强的特点,利用无证书公钥系统可解决密钥管理问题。为此,提出一种采用无证书环签名机制的虚拟机可信证明方案。私钥生成中心(PKG)验证平台物理环境的状态可信后,由PKG和虚拟可信平台模块(v TPM)管理器利用无证书算法共同生成v TPM签名密钥,虚拟机对外证明时采用环签名机制,将证明者的信息隐藏在环成员列表中,从而实现虚拟机对外的匿名身份证明和状态证明。在完成证明准备工作后,虚拟机不需要在每次证明和迁移时重复生成虚拟身份证明密钥(v AIK)证书,因此大大提高了证明效率;另外方案具有很强的安全性和匿名性,适用于虚拟机数量巨大的云计算环境。更多还原

【Abstract】 Due to the complexity and dynamic behavior in virtual environment, the efficiency is low when adopting traditional methods to prove the secure state of virtual machines. Ring signature has high computational efficiency and strong anonymity, so the the key management can be solved by using the certificateless public key system. A trustworthiness attestation scheme which adopted certificateless ring signature scheme in Virtual Machine( VM) was put forward. After the trusted physical environment of virtual platform was validated by the Private Key Generator( PKG), the virtual Trusted Platform Module( v TPM) signature key was generated by PKG and v TPM manager using certificateless signature algorithm,and the ring signature was employed by VM to perform remote attestation and hide attestor’s identity in ring members, which realized the attestation of VM’s anonymous identity and state. After completion of the proof preparation, the VM does not need to generate virtual Attestation Identity Key( v AIK) certificates repeatedly in the process of attestation and migration, thus greatly improving the efficiency of attestation. Consequently, the proposed scheme has strong security and anonymity, and it is suitable for the cloud computing environment with huge numbers of VMs.更多还原