A Two-Stage Remote Attestation Method Based on Intel SGX in Cloud Environment

Abstract

A two-stage remote attestation method based on Intel SGX in a cloud environment belongs to the field of information security. (1) Creation and secure initialization of the remote attestation proxy service center VRAC. (2) Creation and secure initialization of virtual nodes and vTPMs. (3) Operation of the adaptive cycle measurement module. (4) Secure execution of two-stage remote attestation. A secure remote attestation proxy center VRAC is built by modifying the vTPM architecture of KVM and introducing Intel SGX technology to create a trusted execution environment TEE. In this method, a software-simulated vTPM instance is created inside the remote attestation proxy service center, and Intel SGX is used to protect the vTPM instance and NVRAM data from memory leakage attacks and cracking attacks. A new two-stage remote attestation protocol ensures protection against man-in-the-middle attacks between the challenger and the prover. The adaptive cycle dynamic measurement scheme not only ensures the secure operation of cloud computing nodes but also reduces the performance overhead introduced by dynamic measurement.

Description

Technical Field

[0001] The present invention belongs to the field of information security, and relates to cloud computing technology, remote attestation technology, and Intel SGX technology. Background Art

[0002] As a new computing model, cloud computing has entered people's daily lives after nearly a decade of development, having a huge impact on people's work, study, entertainment, etc. Cloud computing can integrate, manage, and schedule a large number of computing resources, and provide services to a large number of users in the form of Internet services. Compared with other computing models, cloud computing has characteristics such as on-demand expansion, large scale, high reliability, and elastic scalability, and can provide a very flexible, reliable, and expandable cloud service computing platform for users.

[0003] The concept of virtualization technology was first proposed in the 1960s. Currently, the mainstream virtual machine systems include VMware, Xen, KVM, etc. From the bottom layer to the top layer, they mainly include instruction-level virtualization, hardware abstraction layer virtualization, operating system-level virtualization, programming language-level virtualization, and library-level virtualization. Among them, the virtualization technology of the hardware abstraction layer is the most widely used in the field of cloud computing. Hardware abstraction layer virtualization means simulating multiple computers on a hardware instruction level to improve the computing efficiency of the physical host platform. To achieve this goal, it is necessary to implement a privileged management software, such as a virtual machine manager VMM or a virtual machine monitor Hypervisor, to manage key hardware such as the underlying CPU processor and memory, and provide APIs for the upper-layer operating system to call.

[0004] Currently, with the rapid development of the cloud computing field, many security problems have emerged. For users of cloud computing services, if they interact rashly without being able to confirm whether the cloud computing node requesting the service is trustworthy, in the case where the integrity of the node has been damaged by an attacker or the node has been hijacked, it is very likely to cause huge losses. An important technology in trusted computing, remote attestation technology, can just be used to solve the above problems, but there are still certain defects in the remote attestation methods widely used in current mainstream virtual machines. On the one hand, the security of the remote attestation scheme that only adopts static measurement cannot guarantee the runtime integrity of the cloud node, and the direct introduction of on-demand authentication real-time dynamic measurement brings too high security costs and cannot prevent the problem of "coming and going in a hurry". On the other hand, the dual-agent remote attestation scheme cannot prevent cuckoo attacks, nor can it prevent memory leakage attacks against vTPM instances, nor can it provide the binding relationship between the vTPM instance and the virtual machine node, and the trust chain cannot be extended to the cloud node.

[0005] Intel SGX (Intel Software Guard Extensions) technology is a set of processor security extension technologies proposed by Intel. This technology does not work like antivirus software by identifying and isolating malware and viruses in the system. Instead, it supports encapsulating some important and sensitive operations and data of applications into a secure area called an Enclave, and ensures the security of internal operations and data in the trusted area by applying hardware isolation and access control to this secure area. This also provides a new solution idea for the protection of vTPM instances.

[0006] Intel SGX technology has the following main advantages compared with other technologies.

[0007] (1) Universality and strong computing performance. Intel SGX technology can provide reliable privacy and integrity guarantees for code and data with very low system performance overhead.

[0008] (2) The TCB (Trusted Computing Base) of Intel SGX is very small, the software complexity within the TCB is low, and the system stability is higher.

[0009] Research scholars at home and abroad have proposed many improved solutions for remote attestation in the cloud computing environment, mainly including the following:

[0010] (1) In the evidence collection stage of remote attestation, use the VMI (Virtual Machine Introspection) technology provided by the hypervisor to directly obtain the measurement values and measurement logs of the host and the VM, and delete the remote attestation proxy program inside the virtual node to prevent cuckoo attacks.

[0011] This VMI technology is used to obtain the PCR value of the vTPM instance by intercepting the messages exchanged between the TPM_TIS driver of the virtual machine kernel and the vTPM backend device at the hypervisor layer by the remote attestation proxy, and then judging the currently executed TPM command. If it is a vPCR-related operation, the remote attestation proxy updates the vPCR list it maintains by performing the operation of reading the PCR. After testing, the operation of obtaining the vTCR value requires continuous polling and judgment, with relatively high performance overhead and security cost.

[0012] (2) In the integrity measurement stage of remote attestation, use Intel SGX technology to protect the vTPM instance inside the cloud computing node to prevent memory leakage attacks on the vTPM instance and cracking attacks on non-volatile data of NVRAM files.

[0013] In the traditional Xen virtual machine architecture and the KVM virtual machine architecture, vTPM instances are created inside virtual nodes. An attacker can log in to the virtual node, obtain the code and data for Enclave initialization, and can also obtain the memory layout of the node and observe and record the Enclave attack surface multiple times to obtain data, deduce control flow and data flow information, and finally obtain the code and data of the Enclave.

[0014] By analyzing the remote attestation process in the cloud computing environment, it can be seen that the trustworthiness of cloud computing nodes mainly depends on the following three points:

[0015] (1) In the initialization stage, it is necessary to ensure the security of vTPM instances and NVRAM data, and ensure the mandatory binding relationship between the virtual node VM and the vTPM.

[0016] (2) In the measurement stage, it is necessary to ensure not only the integrity when the Hypervisor and the VM are loaded, but also the integrity during the runtime of the Hypervisor and the VM.

[0017] (3) In the evidence collection stage, it is necessary to ensure that the trusted evidence cannot be tampered with or cracked, and ensure that the trust chain is passed from the host power-on to the cloud computing node. Summary of the Invention

[0018] The main content of the present invention is to construct a two-stage remote attestation method based on Intel SGX in a cloud environment by combining the newly proposed adaptive periodic dynamic measurement model and remote attestation system architecture, and combining the KVM virtualization solution and Intel SGX technology. The main function is to enhance the security of remote attestation, extend the trust chain of the remote attestation process, and reduce the performance overhead brought by introducing dynamic measurement.

[0019] To achieve the objectives of the aforementioned invention, the present invention provides the following technical solution: a two-stage remote attestation method based on Intel SGX in a cloud environment. At the hardware level, processors supporting Intel SGX technology implement memory isolation for the enclave through instruction extensions and advanced access control policies. The code and data within the enclave are stored in the processor's reserved memory (PRM). As a subset of DRAM, the PRM prohibits direct access by other software, thereby building a trusted execution environment (TEE) at the hypervisor layer. At the software level, the related services of the remote attestation agent center (VRAC) are run in the hardware-based TEE, including a vTPM security protection module, a remote attestation session key storage module, an adaptive periodic dynamic metric scheduling module, and a remote attestation request processing module. This solution ensures that the SGX sealing mechanism protects the persistent storage security of NVRAM data and the second-stage remote attestation session key (RASK), preventing attackers from using virtual nodes as a springboard to obtain the private key of the RASK asymmetric key. RASK asymmetric keys secure communication between the challenger and the prover and provide a binding relationship between the prover and the VM. The private key is entrusted to the Remote Attestation Service Center (RASC). The public key is distributed to the challenger during the first phase of remote attestation for use in the second phase. Adaptive periodic dynamic metrics ensure the runtime security of cloud computing nodes while minimizing performance overhead.

[0020] The invention is characterized by comprising the following steps: (1) creation and secure initialization of a remote attestation proxy service center (VRAC); (2) creation and secure initialization of a virtual node and a vTPM; (3) operation of an adaptive cycle measurement module in combination with load level; and (4) secure execution of a two-stage remote attestation.

[0021] (1) The creation and security initialization of the remote attestation proxy service center VRAC includes: checking the integrity of each program of the remote attestation proxy service center VRAC at the hypervisor layer, and after confirming that they are correct, performing security configuration and starting each program of the remote attestation proxy service center.

[0022] (2) The creation and security initialization of virtual nodes and vTPM include: the remote attestation agent service center VRAC verifies the integrity of the system image file of the cloud computing node, and creates the cloud computing node after confirming that it is correct. At the same time, the hypervisor creates a corresponding vTPM instance in the vTPM security protection module.

[0023] (3) The operation of the adaptive cycle metric module combined with the load level includes: using the metric record table to record the number of successful and failed metric cycles of all cloud computing nodes, the load level of the cloud computing nodes, the previous metric time point, and the next metric time point calculated according to the adaptive algorithm, and performing behavior-based dynamic metrics on the cloud computing nodes according to the metric record table, and then verifying the metric results and updating the metric record table.

[0024] (4) The two-stage remote attestation secure execution includes: the first stage is the remote attestation process between the challenger and the remote attestation proxy service center VRAC at the Hypervisor layer, and the second stage is the remote attestation process between the challenger and the verifier at the VM layer.

[0025] Further, the specific steps for the creation and secure initialization of the remote attestation proxy center VRAC in step (1) include:

[0026] (1-1): First, the trusted computing technology constructs a trust chain from the root of trust to the BIOS, BootLoader, the host operating system OS, and the virtual machine monitor Hypervisor for the cloud computing host institution. One level measures one level, one level authenticates one level, and one level trusts one level, extending the trust relationship to the Hypervisor layer. Among them, the core functions of the vTPM security protection module, the remote attestation session key storage module, and the remote attestation request processing module run in the trusted execution environment TEE protected by the SGX Enclave security area.

[0027] (1-2): Calculate the digest value (SHA-256) of each program in the remote attestation proxy service center at the Hypervisor layer, and compare it with the standard digest value of the released version of the program to check the integrity of each program in the remote attestation proxy service center VRAC. After checking without errors, proceed to the next step, otherwise terminate the deployment of this cloud computing node.

[0028] (1-3): The core function codes of the vTPM security protection module, the remote attestation session key storage module, and the remote attestation request processing module in the remote attestation proxy service center are deployed to run in the trusted execution environment TEE protected by the SGX Enclave security area.

[0029] Further, the specific steps for the creation and secure initialization of the virtual node and vTPM in step (2) include:

[0030] (2-1): Calculate the digest value (SHA-256) of the cloud computing node image file at the Hypervisor layer, and compare it with the standard digest value of the released version of the image file to verify the integrity of the system image file of the cloud computing node. After checking without errors, proceed to the next step, otherwise terminate the deployment of this cloud computing node.

[0031] (2-2): After the image integrity check is correct, the SGX Driver creates an Enclave area containing the vTPM library of Libtpms2.0 as a vTPM security protection module.

[0032] (2-3): Create a corresponding software-simulated vTPM instance in the vTPM security protection module.

[0033] Furthermore, the specific steps of operating the adaptive period measurement module in step (3) in combination with the load degree include:

[0034] (3-1): First, a dynamic behavior-based measurement is performed on the cloud computing nodes according to the measurement record table. The measurement record table records the number of successful and failed measurement cycles for all cloud computing nodes, the load level of the cloud computing nodes, the time of the last measurement, and the time of the next measurement calculated according to the adaptive algorithm. The cloud computing nodes are then dynamically measured based on their behavior according to the measurement record table. The measurement results are then verified and the measurement record table is updated.

[0035] (3-2): The context information of the process in the virtual machine is obtained through virtual machine introspection (VMI) technology, and the behavior of the process in the virtual machine is tracked through the pre-built behavior rule library, while generating dynamic measurement values and measurement logs.

[0036] (3-3): During the remote certification process of the cloud computing node, the measurement value and measurement log are compared and verified with the preset standard value in the certificate center CA. If the verification result is legal, the number of successful measurements of the cloud computing node is updated by 1, otherwise the number of failed measurements of the cloud computing node is updated by 1.

[0037] (3-4) The next measurement time point is calculated based on the measurement record of the current cloud computing node through an adaptive algorithm and updated to the measurement record table.

[0038] Furthermore, the specific steps for the two-stage remote attestation security execution in step (4) include:

[0039] (4-1): The challenger VM1 challenges the remote attestation proxy service center and requests to verify the credibility of the VMM. The request processing module of the remote attestation proxy service center establishes a TLS connection with VM1. At the same time, the remote attestation proxy service center uses the AIK private key to sign SIG (TPM) with the PCR value of the host TPM, the AIK public key, and the last dynamic measurement result of VM2 in the measurement record table. PCR , PUB AIK , DMR vm2) and apply to the certificate authority CA for encapsulation as an AIK certificate. Finally, encrypt the generated AIK certificate using the public key of VM1 to obtain the encrypted AIK certificate. Transmit the encrypted AIK certificate to VM1 via a TLS connection. VM1 uses its own private key to decrypt and obtain the AIK certificate, and then uses the public key of the certificate authority CA to disassemble the AIK public key of the host and the signed PCR value of the host. Then, use the AIK public key to verify the PCR value of the host and the previous dynamic measurement result of VM2. If the PCR value is the same as the preset standard value and the previous dynamic measurement result of VM2 is also successful, it proves that the host Hypervisor layer is trusted and the running environment of VM2 is trusted at this time. At this time, return value 1 and maintain this TLS connection to continue the next stage of remote attestation.

[0040] (4-2): The session key storage module of the remote attestation proxy service center generates a set of asymmetric session keys for use in the second stage of remote attestation. The private key of the session key is only stored in the Enclave by the session key module of the remote attestation proxy service center, and the public key is transmitted to VM1 through the TLS connection between the remote attestation proxy service center and the challenger.

[0041] (4-3): The challenger VM1 challenges VM2. First, send a challenge request for VM2 to sign its vPCR value with the private key of the session key. After receiving the challenge, the internal remote attestation proxy of VM2 entrusts the challenge to the session key management module of the remote attestation proxy service center for signature. At this time, the remote attestation proxy service center first confirms the identity of the verifier who entrusts the challenge. If the verifier is VM2, then in the next step, the session key management module establishes a connection with the vTPM corresponding to VM2 through local authentication of SGX. After local authentication passes and the connection is established, the session key management module obtains the vPCR value of VM2 and signs the vPCR value with the private key of the previously generated session key SIG(vPCR vm2 ) and then transmits it to the remote attestation proxy of VM2. Finally, transmit this signature through the remote attestation connection between VM1 and VM2. After receiving it, the challenger VM1 verifies the vPCR value of VM2 by decrypting the signature with the public key of the session key and compares it with the preset standard value. If the comparison result is the same, the cloud computing node VM2 platform is trusted. At this time, return value 1 through the TLS connection between VM1 and the remote attestation proxy service center and close the connection. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is the overall framework diagram of the present invention.

[0043] Figure 2 is the flowchart of the adaptive periodic dynamic measurement execution of the present invention.

[0044] Figure 3It is the two-stage remote attestation flowchart of the present invention. Detailed implementation mode

[0045] The object of the present invention is to provide a two-stage remote attestation method based on Intel SGX in a cloud environment. The overall architecture of this solution is as Figure 1 shown, mainly including: a security initialization module, an adaptive periodic dynamic measurement module, and a two-stage remote attestation service module. The above three modules will be introduced in detail next:

[0046] I. Security initialization module

[0047] This module mainly completes the security deployment of the remote attestation proxy service center and the cloud computing virtual node, and then deploys a vTPM instance in the trusted execution environment TEE to prepare for the subsequent two-stage remote attestation. The main implementation steps are as follows:

[0048] Step 1: Start the host computer, and build a trusted chain from the root of trust to the BIOS, BootLoader, the host operating system OS, and the virtual machine monitor Hypervisor starting from the power-on of the host computer.

[0049] Step 2: Calculate the digest value (SHA-256) of each program in the remote attestation proxy service center at the Hypervisor layer, and compare it with the standard digest value of the released version of this program to check the integrity of each program in the remote attestation proxy service center VRAC.

[0050] Step 3: Deploy the core function codes of the vTPM security protection module, the remote attestation session key storage module, and the remote attestation request processing module in the remote attestation proxy service center to run in the trusted execution environment TEE protected by the SGX Enclave security area.

[0051] Step 4: Calculate the digest value (SHA-256) of the cloud computing node image file at the Hypervisor layer, and compare it with the standard digest value of the released version of this image file to verify the integrity of the system image file of the cloud computing node.

[0052] Step 5: The SGX Driver creates an Enclave area containing the vTPM library of Libtpms2.0 as the vTPM security protection module.

[0053] Step 6: Create a corresponding software-simulated vTPM instance in the vTPM security protection module.

[0054] II. Adaptive periodic dynamic measurement module

[0055] This module is mainly used to complete the dynamic measurement of all cloud computing nodes and store the results of the remote proof process between the challenger and the prover. The main implementation steps are as follows:

[0056] Step 1: Poll the cloud computing nodes that require dynamic measurement based on the Next Time in the measurement record table.

[0057] Step 2: Perform behavior-based dynamic measurement on the cloud computing nodes that reach the dynamic measurement time point.

[0058] Step 3: Use virtual machine introspection (VMI) technology to obtain the context information of the process in the virtual machine, track the behavior of the process in the virtual machine through the pre-built behavior rule library, and generate dynamic measurement values and measurement logs.

[0059] Step 4: During the remote certification process of the cloud computing node, the measurement value and measurement log are compared and verified with the preset standard value in the certificate center CA. If the verification result is legal, the number of successful measurements of the cloud computing node is updated by 1; otherwise, the number of failed measurements of the cloud computing node is updated by 1.

[0060] 3. Two-stage remote attestation service module

[0061] This module primarily serves the remote attestation process and uses Intel SGX's local authentication and sealing mechanisms to ensure the secure use of session keys and private keys during the remote attestation process, ensuring the security of the remote attestation process under the new remote attestation framework. The main implementation steps are as follows:

[0062] Step 1: The challenger VM1 initiates a challenge to the remote attestation agent service center, requesting verification of the credibility of the VMM.

[0063] Step 2: The request processing module of the remote attestation proxy service center establishes a TLS connection with VM1. At the same time, the remote attestation proxy service center uses the AIK private key to sign SIG (TPM) with the host TPM's PCR value, AIK public key, and the last dynamic measurement result of VM2 in the measurement record table. PCR , PUB AIK , DMR vm2 ), and apply to the certificate authority CA for packaging into an AIK certificate, and finally encrypt it with VM1's public key to generate an encrypted AIK certificate.

[0064] Step 3: Transmit the encrypted AIK certificate to VM1 through a TLS connection. VM1 uses its own private key to decrypt and obtain the AIK certificate.

[0065] Step 4: Use the public key of the certificate authority (CA) to disassemble the host's AIK public key and the signed PCR value. Then, use the AIK public key to decrypt the host's PCR value and VM2's last dynamic measurement result and verify them.

[0066] Step 5: The session key storage module of the remote attestation proxy service center generates a set of asymmetric session keys for use in the second phase of remote attestation. The private key of the session key is only stored in the enclave by the session key module of the remote attestation proxy service center, and the public key is passed to VM1 through the TLS connection between the remote attestation proxy service center and the challenger.

[0067] Step 6: The challenger VM1 challenges VM2 and requests VM2 to sign the vPCR value of VM2 with the private key of the session key.

[0068] Step 7: After receiving the challenge, the remote attestation agent in VM2 delegates the challenge to the session key management module of the remote attestation agent service center for signature.

[0069] Step 8: The session key management module establishes a connection with the vTPM corresponding to VM2 through SGX local authentication. After the local authentication is passed and the connection is established, the session key management module obtains the vPCR value of VM2 and signs the vPCR value with the private key of the previously generated session key SIG (vPCR vm2 ) and then transmitted to the remote attestation agent of VM2.

[0070] Step 9: The signature is transmitted through the remote attestation connection between VM1 and VM2. After receiving it, the challenger VM1 uses the session key public key to decrypt VM2's vPCR value and verify it with the preset standard value.

[0071] To introduce dynamic measurement to ensure runtime security in cloud computing environments, this paper innovatively proposes an adaptive periodic measurement model for cloud computing environments that combines the load status of cloud computing nodes with historical measurement data. The adaptive periodic measurement module maintains a dynamic measurement record table (Dynamic Measurement Record Form), which describes the periodic measurement status of each cloud computing node. The table design is shown in Table 4 below.

[0072]

[0073] Table Dynamic measurement record table

[0074] The virtual machine ID represents the unique identifier of a cloud computing node in the host. State represents the security state of the current node, where True means trusted and False means untrusted. Sn (Success Number) represents the cumulative number of successful measurements of the node since the last initialization. Fn (File Number) represents the cumulative number of failed measurements of the node since the last initialization. LS (Load State) represents the load level of the current virtual node (mainly calculated comprehensively from CPU usage, memory usage, and I / O usage). LS has 3 levels from Level1 to Level3. The higher the level, the greater the load of the cloud computer at this time, and so on. According to the dynamic measurement algorithm, the time of the next measurement point can be extended as much as possible. LastTime and Next Time are the last dynamic measurement time and the next planned measurement time respectively.

[0075] In the adaptive cycle measurement algorithm that combines the load state of cloud computing nodes and historical measurement data, the calculation formula for the measurement point NT (Next Time) is as follows:

[0076] NT = LT + SMP * IF

[0077] Among them, the SMP (Standard Measurement Period) standard measurement period can be manually set by the administrator. For the convenience of research, it is currently set to a fixed 60S. The calculation formula for the IF (Influence Factor) is:

[0078]

[0079] Algorithm 1: Adaptive Cycle Measurement Algorithm Combining the Load State of Cloud Computing Nodes and Historical Measurement Data

[0080] Input: The virtual machine vIDs to be measured, the platform state proof based on behavior, obtaining the context information VMC (Virtual Machine Context) of the processes in the virtual machine at this time through event interception of system calls and VMI technology, "behavior tracking" some behaviors of the key processes in the behavior tracking list BTL (Behavior Tracking List) of the virtual machine through the behavior rule library, and verifying the trustworthiness of the virtual machine during operation using these behavioral change characteristics BC (Behavioural raits).

[0081] Output: DMHash (Dynamic Measurement) dynamic measurement hash value

[0082] 1. Initialization

[0083] VMC = HypervisorContentRead(vIDs); / / Read the virtual machine context with the specified ID at this time

[0084] 2. Initialize SProcess = SpecialProcessFilter(VMC, BTL); / / Filter out the processes in the behavior tracking list BTL based on the read virtual machine context information

[0085] 3. Initialize BC = new ArrayList <string>();

[0086] 4. Hypervisor Behavior Monitor (BC, SProcess); / / Monitor the behavior changes of the specified behavior tracking process through the Hypervisor, and read them into BC through I / O multiplexing

[0087] 5. DMHash = TPM_SHA-1(BC); / / Call TPM to perform a Hash operation on each item of the behavior feature array BC obtained by monitoring and return the value

[0088] 6. Return DMHash.< / string>

Claims

1. A two-stage remote attestation method based on Intel SGX in a cloud environment, characterized in that, It includes the following steps: (1) Creation and secure initialization of the Remote Attestation Proxy Service Center VRAC; (2) Creation and secure initialization of virtual nodes and vTPMs; (3) Operation of the adaptive cycle measurement module combined with the load level; (4) Two-stage remote attestation secure execution; The creation and secure initialization of the Remote Attestation Proxy Service Center VRAC includes: checking the integrity of each program of the Remote Attestation Proxy Service Center VRAC at the Hypervisor layer, and after confirmation, performing secure configuration and starting each program of the Remote Attestation Proxy Service Center; The creation and secure initialization of virtual nodes and vTPMs includes: the Remote Attestation Proxy Service Center VRAC verifies the integrity of the system image file of the cloud computing node, and after confirmation, creates the cloud computing node, and at the same time, the Hypervisor creates a corresponding vTPM instance in the vTPM security protection module; The operation of the adaptive cycle measurement module combined with the load level includes: using a measurement record table to record the number of successful and failed cycle measurements of all cloud computing nodes, the load level of the cloud computing nodes, the last measurement time point, and the next measurement time point calculated according to the adaptive algorithm, and performing behavior-based dynamic measurement on the cloud computing nodes according to the measurement record table, and then verifying the measurement results and updating the measurement record table; The two-stage remote attestation secure execution includes: the first stage is the remote attestation process between the challenger and the Remote Attestation Proxy Service Center VRAC at the Hypervisor layer, and the second stage is the remote attestation process between the challenger and the verifier at the VM layer.

2. The two-stage remote attestation method based on Intel SGX according to claim 1, wherein The specific steps of the creation and secure initialization of the Remote Attestation Proxy Service Center VRAC include: Step 1: First, the trusted computing technology constructs a trust chain from the root of trust to the BIOS, BootLoader, host operating system OS, and virtual machine monitor Hypervisor for the cloud computing hosting institution, measuring level by level, authenticating level by level, and trusting level by level, and extending the trust relationship to the Hypervisor layer; among them, the core functions of the vTPM security protection module, the remote attestation session key storage module, and the remote attestation request processing module run in the trusted execution environment TEE guaranteed by the SGX Enclave security area; Step 2: Calculate the SHA-256 digest value of each program of the Remote Attestation Proxy Service Center at the Hypervisor layer, and compare it with the standard digest value of the released version of the program to check the integrity of each program of the Remote Attestation Proxy Service Center VRAC; if the check is correct, proceed to the next step, otherwise terminate the deployment of the cloud computing node; Step 3: The core function codes of the vTPM security protection module, the remote attestation session key storage module, and the remote attestation request processing module of the Remote Attestation Proxy Service Center run in the trusted execution environment TEE guaranteed by the SGX Enclave security area.

3. The two-stage remote attestation method based on Intel SGX according to claim 1, characterized in that The specific steps of the creation and secure initialization of the virtual nodes and vTPMs include: Step 1: Calculate the SHA-256 digest value of the cloud computing node image file at the Hypervisor layer and compare it with the standard digest value of the released version of the image file to verify the integrity of the system image file of the cloud computing node. If the check is correct, proceed to the next step; otherwise, terminate the deployment of the cloud computing node. Step 2: After the image integrity check is correct, the SGX Driver creates an Enclave area containing the vTPM library of Libtpms 2.0 as the vTPM security protection module. Step 3: Create a corresponding software-simulated vTPM instance in the vTPM security protection module.

4. The two-stage remote attestation method based on Intel SGX according to claim 1, wherein, The specific steps for running the adaptive cycle measurement module combined with the load level include: Step 1: First, perform behavior-based dynamic measurement on the cloud computing nodes according to the measurement record table; use the measurement record table to record the number of successful and failed cycle measurements of all cloud computing nodes, the load level of the cloud computing nodes, the previous measurement time point, and the next measurement time point calculated according to the adaptive algorithm, and perform behavior-based dynamic measurement on the cloud computing nodes according to the measurement record table. Next, verify the measurement results and update the measurement record table. Step 2: Obtain the context information of the processes in the virtual machine through the virtual machine introspection (VMI) technology, track the behaviors of the processes in the virtual machine through a pre-constructed behavior rule library, and generate dynamic measurement values and measurement logs at the same time. Step 3: During the remote attestation process of the cloud computing node, compare and verify the measurement values and measurement logs with the preset standard values in the certificate authority (CA). If the verification result is legal, increment the number of successful measurements of the cloud computing node by 1; otherwise, increment the number of failed measurements of the cloud computing node by 1. Step 4: Calculate the next measurement time point according to the measurement record of the current cloud computing node through the adaptive algorithm and update it to the measurement record table.

5. The two-stage remote attestation method based on Intel SGX according to claim 1, wherein The specific steps for the two-stage remote attestation secure execution include: Step 1: The challenger VM1 initiates a challenge to the remote attestation proxy service center, requesting to verify the credibility of the VMM; the request processing module of the remote attestation proxy service center establishes a TLS connection with VM1, and at the same time, the remote attestation proxy service center uses the AIK private key to sign the PCR value of the host TPM, the AIK public key, and the last dynamic measurement result of VM2 in the measurement record table (TPM PCR , PUB AIK , DMR vm2 ), and apply to the certificate authority CA for encapsulation as an AIK certificate, and finally encrypt it with VM1's public key to generate an encrypted AIK certificate; transmit the encrypted AIK certificate to VM1 through TLS connection, VM1 uses its own private key to decrypt and obtain the AIK certificate, and then uses the certificate authority CA's public key to disassemble the host's AIK public key and the signed PCR value, and then uses the AIK public key to decrypt the host's PCR value and VM2's last dynamic measurement result and verify them. If the PCR value is the same as the preset standard value and VM2's last dynamic measurement result is also successful, it proves that the host's Hypervisor layer is trustworthy and VM2's current operating environment is trustworthy. At this time, the value 1 is returned and the TLS connection is maintained to continue to the next stage of remote attestation; Step 2: The session key storage module of the remote attestation proxy service center generates a set of asymmetric session keys for use in the second-stage remote attestation. The private key of the session key is only stored in the Enclave by the session key module of the remote attestation proxy service center, and the public key is transmitted to VM1 through the TLS connection between the remote attestation proxy service center and the challenger. Step 3: The challenging party VM1 initiates a challenge to VM2. First, it sends a challenge request. VM2 signs its vPCR value with the private key of the session key. After receiving the challenge, the internal remote attestation agent of VM2 entrusts the challenge to the session key management module of the remote attestation agent service center for signature. At this time, the remote attestation agent service center first confirms the identity of the verifying party for the entrusted challenge. If the verifying party is VM2, then in the next step, the session key management module establishes a connection with the vTPM corresponding to VM2 through the local authentication of SGX. After the local authentication passes and the connection is established, the session key management module obtains the vPCR value of VM2, and signs the vPCR value with the private key of the previously generated session key, SIG(vPCR vm2 ) and then transmits it to the remote attestation agent of VM2. Finally, the signature is transmitted through the remote attestation connection between VM1 and VM2. After receiving it, the challenging party VM1 decrypts the vPCR value of VM2 with the public key of the session key and compares it with the preset standard value. If the comparison results are the same, the cloud computing node VM2 platform is trusted. At this time, a value of 1 is returned through the TLS connection between VM1 and the remote attestation agent service center and the connection is closed.

Images