Enhancing Grid Security Using Trusted Virtualization

Abstract

Abstract. Grid applications have increasingly sophisticated functional and security requirements. However, current techniques mostly protect only the resource provider from attacks by the user, while leaving the user comparatively dependent on the well-behavior of the resource provider. In this paper, we take the first steps towards addressing the trust asymmetry by using a combination of trusted computing and virtualization technologies. We present the key components for a trustworthy Grid architecture and propose an implementation. By providing multilateral security, i.e., security for both the Grid user and the Grid provider, our architecture increases the confidence that can be placed on the correctness of a Grid computation and on the protection of user-provided assets. In order to maintain important scalability and performance aspects, our proposal aims to minimize overhead. Towards this end, we propose a scalable offline attestation protocol, which allows selection of partners in the Grid with minimal overhead.

Enhancing data privacy and integrity in the cloud

“…Several systems have been built using trusted computing concepts such as the Next Generation Secure Computing Base by Microsoft [12], Trusted Execution Technology by Intel [13], secure co-processors by IBM [14], [15], and others [16]- [19]. In addition, researchers have developed systems that utilize the TPM for anonymous attestation [20], authentication [21], [22], device attestation [23], [24], digital rights management [25], digital signature [26], [27], distributed computing [28], [29], drive encryption [30], evoting [31], grid security [32], [33], identity management [34], [35], mobile agents [36], [37], on-line payment [38], [39], on-line storage [40], peer-to-peer networks [41], [42], policy enforcement [43], [44], and virtualization [45], [46]. These studies, however, do not consider a security service that will hide information from the rest of the system including the system administrator as in blind processing.…”

Security Services Lifecycle Management in On-Demand Infrastructure Services Provisioning

“…It is also perceived that implementation of such functionality will require the service hosting platform that supports Trusted Computing Platform Architecture (TCPA) and corresponding technologies to support trusted virtualisation [30,31,32]. Table 1 explains what main processes/actions take place during the different SLM/SSLM stages and what general and security mechanisms are used:…”

Securing Grid Workflows with Trusted Computing

“…Mao et al [3] propose Daonity, a system which establishes a relocatable key enabling controlled group sharing of encrypted content. Löhr et al [13] propose a scheme in which resource providers publish attestation tokens, which contain public keys from non-migratable TPM key pairs and the platform states to which private key use is bound. Each token is signed by the TPM to prove that it was produced by an authentic TPM.…”

“…2. The resource providers themselves each create a non-migratable private key bound to a specific platform state; this state and the corresponding public key are advertised as part of an attestation token [12]. The WRB pulls the attestation tokens from a service register and uses them to select appropriate resource providers.…”