CT-IS: Shamon: Systems Approaches for Constructing Distributed Trust

现有的分布式授权系统集中在制定ofpolicy，但执行仍然是每个主机的问题。 任何组件如果不能忠实地执行策略，都可能导致漏洞，在极端情况下，会导致授权失效。 如果不能保证授权实施的完整性，那么就无法构建可靠的分布式授权。共享引用监视器（Shamon）项目利用先进的完整性度量和虚拟机来组成分布式应用程序的一致性授权系统。 Shamon由多个物理机器上的一组引用监视器组成，这些物理机器经过完整性验证，可以在定义应用程序的虚拟机上实施一致的安全策略。 虚拟机的使用提供了粗粒度的隔离，简化了大规模分布式系统的安全策略，完整性度量确保Shamon的每个成员都可以验证其他成员是否执行此策略。Shamon项目专注于构建服务来组成和维护此类共享引用监视器。 首先，基于逻辑的方法定义，使组合的信任在执行一致的政策由Shamon referencemonitors。 这种信任组合在虚拟机的加入、离开和迁移等系统动态过程中具有很强的鲁棒性。 其次，Xen hypervisor系统通过这些信任组合服务进行了增强。 通过这种方式，受监控的应用程序将只与那些规则与其Shamon策略一致的系统进行通信。

Existing distributed authorization systems focus on the formulation ofpolicy, but enforcement remains a per-host issue. Failure of anycomponent to faithfully enforce policy can lead to vulnerabilities,and in the extreme, renders authorization impotent. Without greaterassurance in the integrity of authorization enforcement, that scalesto Internet-wide applications, reliable, distributed authorizationcannot be built.The Shared Reference Monitor (Shamon) project leverages advances inintegrity measurement and virtual machines to compose a coherentauthorization system for distributed applications. A Shamon consistsof a set of reference monitors on multiple, physical machines that areintegrity-verified to enforce a consistent security policy acrossvirtual machines that define an application. The use of virtualmachines provides coarse-grained isolation that simplifies securitypolicy for large-scale distributed systems, and the integritymeasurement ensures that each member of the Shamon can verify that theothers are enforcing this policy.The Shamon project focuses on building the services tocompose and maintain such shared reference monitors. First, alogic-based approach is defined that enables composition of trust inthe enforcement of a consistent policy by the Shamon referencemonitors. Such trust composition will be robust in the presence ofsystem dynamics including the joining, leaving and migration ofvirtual machines. Second, the Xen hypervisor system is augmented withthese trust composition services. In this way, monitored applicationswill only communicate with systems whose regulation is consistent withits Shamon policy.