Daonity - Grid security from two levels of virtualization

Information Security Technical Report

Volumn 12, Issue 3, 2007, Pages 123-138

  Chen, Haibo ^a   Chen, Jieyun ^b   Mao, Wenbo ^c   Yan, Fei ^d  

^a FUDAN UNIVERSITY   (China)

^b HUAZHONG UNIVERSITY OF SCIENCE AND TECHNOLOGY   (China)

^c HEWLETT PACKARD LABORATORIES   (United States)

^d WUHAN UNIVERSITY   (China)

Author keywords

Behavior conformity; Grid computing; Grid security infrastructure (GSI); Platform attestation; Platform virtualization; Resource virtualization; Secure operating systems; Trusted computing (TC); Virtual organization (VO)

Indexed keywords

DATA STORAGE EQUIPMENT; NATURAL SCIENCES COMPUTING; SECURITY OF DATA; SERVERS; VIRTUAL REALITY;

BEHAVIOR CONFORMITY; GRID SECURITY INFRASTRUCTURE (GSI); PLATFORM ATTESTATION; VIRTUAL ORGANIZATION (VO);

GRID COMPUTING;

EID: 35348963573     PISSN: 13634127     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.istr.2007.05.005     Document Type: Article

References (51)

1. Adabala S., Chadha V., Chawla P., Figueiredo R., Jose F., Krsul I., et al. From virtualized resources to virtual computing grids: the in-VIGO system. Future Gener Comput Syst 21 6 (April, 2005)
2. Bair R, editor. Agarwal D, et al. (contributors). National collaboratories horizons. Report of the August 10-12, 2004. In: National Collaboratories Program Meeting. The U.S. Department of Energy Office of Science.
3. Barham P, Dragovic B, Fraser K, Hand S, Harris T, Ho A, et al. Xen and the art of virtualization. In: Proceedings of the 19th ACM symposium on operating systems principles; 2003. p. 164-77.
4. Chen B, Morris R. Certifying program execution with secure processors. In: Proceedings of ninth hot topics in operating systems symposium; 2003. p. 133-8.
5. Chen L, Landfermann R, Loehr H, Rohe M, Sadeghi A-R, Stüble C. A protocol for property-based attestation. In: First ACM workshop on scalable trusted computing (STC'06); November 3, 2006. p. 7-16.
6. Common Criteria. Available from: .
7. Dragovic B, Fraser K, Hand S, Harris T, Ho A, Pratt I, et al. Xen and the art of virtualization. In: Proceedings of the ACM symposium on operating systems principles, Bolton Landing, NY; October 2003. p. 164-77.
8. Efstathopoulos P., Krohn M., VanDeBogart S., Frey C., Ziegler D., Kohler E., et al. Labels and event processes in the asbestos operating system. Proceedings of the 20th ACM symposium on operating systems principles (2005), ACM Press 17-30
9. Figueiredo RJ, Dinda PA, Fortes JAB. A case for grid computing on virtual machines. In: Proc. 23rd international conference on distributed computing systems (ICDCS'03), Providence, RI; 2003. p. 550.
10. Foster I., and Kesselman C. The grid: blueprint for a new computing infrastructure (1999), Morgan Kaufmann
11. Foster I, Kesselman C, Tsudik G, Tuecke S. A security architecture for computational grids. In: 5th ACM conference on computer and communications security; 1998. p. 83-92.
12. Foster I., Kesselman C., and Tuecke S. The anatomy of the grid: enabling scalable virtual organizations. Int High Perform Comput Appl 15 3 (2001) 200-222
13. Garfinkel T., Pfaff B., Chow J., Rosenblum M., and Boneh D. Terra: a virtual machine-based platform for trusted computing. Proceedings of the nineteenth ACM symposium on operating systems principles (2003), ACM Press 193-206
14. Globus Toolkit 4. .
15. Haldar V, Chandra D, Franz M. Semantic remote attestation: a virtual machine directed approach to trusted computing. In: USENIX VM; 2004.
16. Härtig H, Hohmuth M, Feske N, Helmuth C, Lackorzynski A, Mehnert F, et al., The Nizza secure-system architecture. In: Proc. of collaborate com; 2005.
17. Jaeger T., Sailer R., and Zhang Z. Analyzing integrity protection in the SELinux example policy. Proceedings of the 12th USENIX security symposium (August 2003), USENIX 69-75
18. Jaegar T., Sailer R., and Shankar U. PRIMA: policy-reduced integrity measurement architecture, SAC-MAT'06. Proceedings of the tenth ACM symposium on Access control models and technologies C9 (June 7, 2006), ACM Press, Lake Tahoe, CA, USA 19-28
19. Krsul Ivan, Ganguly Arijit, Zhang Jian, Fortes Jose AB, Figueiredo Renato JO. VMPlants: providing and managing virtual machine execution environments for grid computing. SC; 2004.
20. Lie D, Thekkath C, Mitchell M, Lincoln P, Boneh D, Mitchell J, et al. Architectural support for copy and tamper resistant software. In: Proceeding of international conference on architectural support for programming languages and operating systems; 2000. p. 168-77.
21. Lie D., Thekkath C., and Horowitz M. Implementing an untrusted operating system on trusted hardware. Proceedings of the 19th ACM symposium on operating systems principles (2003), ACM Press 178-192
22. Lorch M., Basney J., and Kafura D. A hardware-secured credential repository for grid PKIs. Proc. of 4th IEEE/ACM international symposium on cluster computing and the grid (2004), IEEE Press, New York 640-647
23. Loscocco P., and Smalley S. Integrating flexible support for security policies into the Linux operating system. Proceedings of the FREENIX track: 2001 USENIX Annual Technical Conference table of contents (2001), USENIX 29-42
24. Marchesini J., and Smith S. SHEMP - secure hardware enhancement for MyProxy (February 2005), Department of Computer Science, Dartmouth College, Hanover, New Hampshire Technical Report TR2005-532
25. National Computer Security Center. Integrity in automated information systems (September 1991)
26. NGSCB. Microsoft Corporation. Microsoft virtual server (2005). Available from:
27. Open Grid Forum. Overview of the GSI. .
28. OpenTC. Available from: .
29. In: Pearson S. (Ed). Trusted computing platforms (2003), Prentice Hall
30. Peinado M., Chen Y., England P., and Manferdelli J. NGSCB: a trusted open system. Proc. of 9th Astralasian Conference on Information Security and Privacy (2004), ACISP 86-97
31. Peinado M., Chen Y., England P., and Manferdelli J. NGSCB: a trusted open system (January 2005), Microsoft Corporation. Available from:
32. Rau S. The trusted computing platform emerging as industry's first comprehensive approach to IT security. IDC Executive Brief (February 2006). Available from:
33. Sadeghi A-R, Stüble C. Property-based attestation for computing platforms: caring about properties, not mechanisms. In: New Security Paradigm Workshop (NSPW); 2004.
34. Sailer Reiner, Jaeger Trent, Zhang Xiaolan, van Doorn Leendert. Attestation-based policy enforcement for remote access. In: ACM conference on computer and communications security; 2004a. p. 308-17.
35. Sailer R, Zhang X, Jaeger T, van Doorn L. Design and implementation of a TCG-based integrity measurement architecture. In: Proceedings of the 13th USENIX security symposium; 2004b. p. 223-38.
36. Sailer R., Valdez E., Jaeger T., Perez R., and van Doorn L. John Linwood Griffin and Stefan Berger. sHype: a secure hypervisor approach to trusted virtualized systems. IBM Res Rep (2005)
37. Sailer R, Valdez E, Jaeger T, Perez R, van Doorn L, Griffin JL, et al. sHype: secure hypervisor approach to trusted virtualized systems. Technical Report RC23511, Yorktown Heights, NY: IBM TJ Watson Research Center; February 2005b.
38. Sandhu Ravi, Zhang Xinwen. Peer-to-peer access control architecture using trusted computing technology. In: Proceedings of the 10th ACM symposium on access control models and technologies (SACMAT), Stockholm; 2005. p. 147-58.
39. Shankar U., Jaeger T., and Sailer R. Toward automated information-flow integrity for security-critical applications. Proceedings of the 13th annual network and distributed systems security symposium (2006), Internet Society
40. Shapiro J., Smith J., and Farber D. EROS: a fast capability system. Proceedings of 17th ACM symposium on operating systems principles (1999), ACM Press 170-185
41. Shi W., Lee H.-H.S., Lu C., and Ghosh M. High speed memory centric protection on software execution using one-time-pad prediction (July 2004), Georgia Institute of Technology, Atlanta, GA Report GIT-CERCS-04-27
42. Shieh A, Williams D, Sirer E, Schneider F. Nexus: a new operating system for trustworthy computing. In: Proceedings of the 20th ACM symposium on operating systems principles, WIP Session; 2005. p. 1-9.
43. Suh G, Clarke D, Gassend B, van Dijk M, Devadas S. AEGIS: architecture for tamper-evident and tamper-resistant processing. In: Proceedings of the 17th annual international conference on supercomputing; 2003a. p. 160-71.
44. Suh GE, Clarke D, Gassend B, van Dijk M, Devadas S. Efficient memory integrity verification and encryption for secure processors. In: Proc. annual IEEE/ACM international symposium on microarchitecture (MICRO); 2003b. p. 339-50.
45. TrouSerS. The open-source TCG Software Stack. .
46. Trusted Computing Group. Available from: .
47. Trusted Computing Group. Trusted computing platform alliance (TCPA) main specification, version 1.1a. Republished as Trusted Computing Group (TCG) main specification, version 1.1b (2001).
48. Trusted Computing Group. TCG TPM specification 1.2 (2003). Available from:
49. The VMware software package. Available from: .
50. Server Utilization. .
51. Zeldovich N., Boyd-Wickizer S., Kohler E., and Mazieres D. Making information flow explicit in HiStar. Proceedings of 7th USENIX symposium on operating systems design and implementation (2006), USENIX 279-292