The trustworthiness analysis and evaluation are the bases of the trust chain transfer. In this paper the formal method of trustworthiness analysis of a system based on the noninterfer- ence （NI） theory of the inform...The trustworthiness analysis and evaluation are the bases of the trust chain transfer. In this paper the formal method of trustworthiness analysis of a system based on the noninterfer- ence （NI） theory of the information flow is studied. Firstly, existing methods cannot analyze the impact of the system states on the trustworthiness of software during the process of trust chain trans- fer. To solve this problem, the impact of the system state on trust- worthiness of software is investigated, the run-time mutual interfer- ence behavior of software entitles is described and an interference model of the access control automaton of a system is established. Secondly, based on the intransitive noninterference （INI） theory, a formal analytic method of trustworthiness for trust chain transfer is proposed, providing a theoretical basis for the analysis of dynamic trustworthiness of software during the trust chain transfer process. Thirdly, a prototype system with dynamic trustworthiness on a plat- form with dual core architecture is constructed and a verification algorithm of the system trustworthiness is provided. Finally, the monitor hypothesis is extended to the dynamic monitor hypothe- sis, a theorem of static judgment rule of system trustworthiness is provided, which is useful to prove dynamic trustworthiness of a system at the beginning of system construction. Compared with previous work in this field, this research proposes not only a formal analytic method for the determination of system trustworthiness, but also a modeling method and an analysis algorithm that are feasible for practical implementation.展开更多
针对BYOD(bring your own device)、移动云计算等兼具强安全性、高开放性需求的新型应用场景,提出了一种移动嵌入式平台敏感应用防护方案.为满足强安全性需求,方案基于ARM TrustZone硬件隔离技术构建可信执行环境,即使在整个操作系统内...针对BYOD(bring your own device)、移动云计算等兼具强安全性、高开放性需求的新型应用场景,提出了一种移动嵌入式平台敏感应用防护方案.为满足强安全性需求,方案基于ARM TrustZone硬件隔离技术构建可信执行环境,即使在整个操作系统内核被攻破的情况下仍能保证敏感应用的安全.为满足高开放性需求,方案实现了传统TrustZone安全方案不具备的两大优势.首先,将TrustZone保护域扩展至普通世界,安全世界不再实现具体的敏感应用,而只实现一个轻量级监控模块用以监控普通世界内核的行为.因此整个系统可信计算基不随敏感应用数量的增加而增大,减少了其可攻击面和潜在漏洞。其次,监控模块确保内核为这些敏感应用提供安全的系统服务,从而为满足开放性需求提供关键功能支持,例如提供标准系统调用接口、敏感应用动态部署和加载等.最后,方案提出了内核主动证明机制,要求内核主动提供关键信息协助监控模块验证其自身行为,有效提高了系统运行效率.在真实设备上实现了原型系统,实验结果证明了该方案的安全性和较为理想的运行效率.展开更多
基金supported by the Natural Science Foundation of Jiangsu Province(BK2012237)
文摘The trustworthiness analysis and evaluation are the bases of the trust chain transfer. In this paper the formal method of trustworthiness analysis of a system based on the noninterfer- ence （NI） theory of the information flow is studied. Firstly, existing methods cannot analyze the impact of the system states on the trustworthiness of software during the process of trust chain trans- fer. To solve this problem, the impact of the system state on trust- worthiness of software is investigated, the run-time mutual interfer- ence behavior of software entitles is described and an interference model of the access control automaton of a system is established. Secondly, based on the intransitive noninterference （INI） theory, a formal analytic method of trustworthiness for trust chain transfer is proposed, providing a theoretical basis for the analysis of dynamic trustworthiness of software during the trust chain transfer process. Thirdly, a prototype system with dynamic trustworthiness on a plat- form with dual core architecture is constructed and a verification algorithm of the system trustworthiness is provided. Finally, the monitor hypothesis is extended to the dynamic monitor hypothe- sis, a theorem of static judgment rule of system trustworthiness is provided, which is useful to prove dynamic trustworthiness of a system at the beginning of system construction. Compared with previous work in this field, this research proposes not only a formal analytic method for the determination of system trustworthiness, but also a modeling method and an analysis algorithm that are feasible for practical implementation.
文摘针对BYOD(bring your own device)、移动云计算等兼具强安全性、高开放性需求的新型应用场景,提出了一种移动嵌入式平台敏感应用防护方案.为满足强安全性需求,方案基于ARM TrustZone硬件隔离技术构建可信执行环境,即使在整个操作系统内核被攻破的情况下仍能保证敏感应用的安全.为满足高开放性需求,方案实现了传统TrustZone安全方案不具备的两大优势.首先,将TrustZone保护域扩展至普通世界,安全世界不再实现具体的敏感应用,而只实现一个轻量级监控模块用以监控普通世界内核的行为.因此整个系统可信计算基不随敏感应用数量的增加而增大,减少了其可攻击面和潜在漏洞。其次,监控模块确保内核为这些敏感应用提供安全的系统服务,从而为满足开放性需求提供关键功能支持,例如提供标准系统调用接口、敏感应用动态部署和加载等.最后,方案提出了内核主动证明机制,要求内核主动提供关键信息协助监控模块验证其自身行为,有效提高了系统运行效率.在真实设备上实现了原型系统,实验结果证明了该方案的安全性和较为理想的运行效率.
