Trusted path is one of the crucial features that operating systems must provide for fundamental security support. In order to explore the possibility of implementing a trusted path mechanism with the support of truste...Trusted path is one of the crucial features that operating systems must provide for fundamental security support. In order to explore the possibility of implementing a trusted path mechanism with the support of trusted platform module （TPM） technologies, and to support TPM capabilities in operating systems, the paper extended the scope of the conventional trusted path to cover the situation in which a user communicates with software residing on a remote host. The paper combined the concept of operating system support for trusted path with that for TPM platforms, and proposed the architecture of an extended trusted path mechanism in operating system with considerations on TPM-capable platforms support. As part of the author＇s research in secure operating systems, the work of the paper was carried out with Linux as an experimental prototype system. The research result shows that TPM capabilities can strengthen extended trusted path mechanisms of operating systems.展开更多
随着Web服务数目的增长,企业SAP(Systems Applications and Products in data processing)系统完成一次Web服务调用的响应时间开销越来越大,并且所调用的服务有部分是不可信的,严重束缚了服务请求的执行效率和调用质量。引入可信计算,...随着Web服务数目的增长,企业SAP(Systems Applications and Products in data processing)系统完成一次Web服务调用的响应时间开销越来越大,并且所调用的服务有部分是不可信的,严重束缚了服务请求的执行效率和调用质量。引入可信计算,即诚信度概念,结合工程学中的关键路径概念,创新性地提出一种基于诚信度算法的Web服务调用关键路径确定方法。针对服务注册中心提供的满足用户需求的Web服务,用诚信度算法对其进行计算,把诚信度值低于用户期望值的那部分Web服务排除在外;把可信Web服务调用过程抽象成用带权有向无环图表示的AOE(Activity On Edge)网图,使用关键路径确定算法,在图中找到一条服务调用关键路径。在关键路径上的所有服务都是关键服务,通过SAP系统客户端使用缓冲管理、业务代理等设计模式,减少关键服务的调用时间,来提高关键路径的工效,缩短服务调用响应周期,进而提高服务调用的整体执行效率和质量。通过实际系统开发,验证该算法的可行性和有效性。本系统已在某集团所属全部企业运行,降低了企业的运营成本,提高了工作效率,受到用户的满意度好评。展开更多
While smart devices based on ARM processor bring us a lot of convenience,they also become an attractive target of cyber-attacks.The threat is exaggerated as commodity OSes usually have a large code base and suffer fro...While smart devices based on ARM processor bring us a lot of convenience,they also become an attractive target of cyber-attacks.The threat is exaggerated as commodity OSes usually have a large code base and suffer from various software vulnerabilities.Nowadays,adversaries prefer to steal sensitive data by leaking the content of display output by a security-sensitive application.A promising solution is to exploit the hardware visualization extensions provided by modern ARM processors to construct a secure display path between the applications and the display device.In this work,we present a scheme named SecDisplay for trusted display service,it protects sensitive data displayed from being stolen or tampered surreptitiously by a compromised OS.The TCB of SecDisplay mainly consists of a tiny hypervisor and a super light-weight rendering painter,and has only^1400 lines of code.We implemented a prototype of SecDisplay and evaluated its performance overhead.The results show that SecDisplay only incurs an average drop of 3.4%.展开更多
基金Supported by the National Natural Science Foun-dation of China (60373054)
文摘Trusted path is one of the crucial features that operating systems must provide for fundamental security support. In order to explore the possibility of implementing a trusted path mechanism with the support of trusted platform module （TPM） technologies, and to support TPM capabilities in operating systems, the paper extended the scope of the conventional trusted path to cover the situation in which a user communicates with software residing on a remote host. The paper combined the concept of operating system support for trusted path with that for TPM platforms, and proposed the architecture of an extended trusted path mechanism in operating system with considerations on TPM-capable platforms support. As part of the author＇s research in secure operating systems, the work of the paper was carried out with Linux as an experimental prototype system. The research result shows that TPM capabilities can strengthen extended trusted path mechanisms of operating systems.
文摘随着Web服务数目的增长,企业SAP(Systems Applications and Products in data processing)系统完成一次Web服务调用的响应时间开销越来越大,并且所调用的服务有部分是不可信的,严重束缚了服务请求的执行效率和调用质量。引入可信计算,即诚信度概念,结合工程学中的关键路径概念,创新性地提出一种基于诚信度算法的Web服务调用关键路径确定方法。针对服务注册中心提供的满足用户需求的Web服务,用诚信度算法对其进行计算,把诚信度值低于用户期望值的那部分Web服务排除在外;把可信Web服务调用过程抽象成用带权有向无环图表示的AOE(Activity On Edge)网图,使用关键路径确定算法,在图中找到一条服务调用关键路径。在关键路径上的所有服务都是关键服务,通过SAP系统客户端使用缓冲管理、业务代理等设计模式,减少关键服务的调用时间,来提高关键路径的工效,缩短服务调用响应周期,进而提高服务调用的整体执行效率和质量。通过实际系统开发,验证该算法的可行性和有效性。本系统已在某集团所属全部企业运行,降低了企业的运营成本,提高了工作效率,受到用户的满意度好评。
基金This work was financially supported by the National Natural Science Foundation of China(Grant No.61379145)the Joint Funds of CETC(Grant No.20166141B08020101).
文摘While smart devices based on ARM processor bring us a lot of convenience,they also become an attractive target of cyber-attacks.The threat is exaggerated as commodity OSes usually have a large code base and suffer from various software vulnerabilities.Nowadays,adversaries prefer to steal sensitive data by leaking the content of display output by a security-sensitive application.A promising solution is to exploit the hardware visualization extensions provided by modern ARM processors to construct a secure display path between the applications and the display device.In this work,we present a scheme named SecDisplay for trusted display service,it protects sensitive data displayed from being stolen or tampered surreptitiously by a compromised OS.The TCB of SecDisplay mainly consists of a tiny hypervisor and a super light-weight rendering painter,and has only^1400 lines of code.We implemented a prototype of SecDisplay and evaluated its performance overhead.The results show that SecDisplay only incurs an average drop of 3.4%.
