基于可信根服务器的虚拟TCM密钥管理功能研究  

Research of Virtual Trusted Cryptography Module's Secret Key Management Based on the Trusted Root Server

作　　者：王冠[1,2] 袁华浩 

机构地区：[1]北京工业大学计算机学院,北京100124 [2]可信计算北京市重点实验室,北京100124

出　　处：《信息网络安全》2016年第4期17-22,共6页Netinfo Security

基　　金：北京市教委科技项目[007000546615020]

摘　　要：可信计算技术是保障云环境安全的一个重要手段。可信根服务器是利用可信计算技术保护虚拟机安全的一个很好的解决方案,这种方案的特征在于以可信芯片为基础,通过虚拟化技术产生多个虚拟可信芯片为云环境中的虚拟机提供可信服务。虚拟的可信芯片实例都集中在可信根服务器上由管理器进行统一管理。文章将国产的可信密码模块TCM芯片作为可信根服务器中的物理可信根,以可信计算密码支撑平台为基础来进行研究。文章分析了可信密码模块芯片TCM中各种密钥的特点,对可信根服务器中的密钥管理功能进行了研究,针对密钥的产生、存储和加载提出了方案。在该方案中,所有的虚拟可信密码模块v TCM密钥均通过v TCM管理器调用物理可信密码模块TCM芯片来产生,保证了密钥产生的规范性。Trusted computing is one of the important method to protect the cloud environment. The trusted root server is a good solution to protect the virtual machine with the trusted computing technology. The trusted root server is based on the physical trusted chip and provide services for all of the virtual machine by virtualizing the trusted chip in the cloud environment. The virtual trusted chips on the server are under the management of a called management part. This paper used the homemade trusted cryptography module as the root of trust and based on the cryptographic support platform for trusted computing.This paper analyzed the secret keys in the physical TCM, and researched the secret key management in the trusted root server. Finally, this paper gave a solution on the generation, storage and load for the secret keys. In the solution, all the v TCM＇s secret keys are generate in the physical TCM to keep the keys comply with the specifi cations.

关 键 词：可信根服务器 密钥管理 可信密码模块 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]