CT-IS: Shamon: Systems Approaches for Constructing Distributed Trust

现有的分布式授权系统侧重于策略的制定，但执行仍然是每个主机的问题。任何组件未能忠实地执行策略都可能导致漏洞，在极端情况下，会导致授权失效。如果不能更好地保证授权实施的完整性，即可扩展到互联网范围的应用程序，则无法构建可靠的分布式授权。共享引用监视器(Shamon)项目利用先进的完整性度量和虚拟机来构建分布式应用程序的一致性授权系统。Shamon由多个物理机上的一组引用监视器组成，这些物理机经过完整性验证，以在定义应用程序的虚拟机上实施一致的安全策略。虚拟机的使用提供了粗粒度的隔离，简化了大规模分布式系统的安全策略，完整性度量确保了Shamon的每个成员都可以验证其他成员是否正在执行该策略。Shamon项目专注于构建服务来组成和维护这样的共享引用监视器。首先，定义了基于算法的方法，该方法允许在由Shamon引用监控器执行一致的策略时进行信任组合。这样的信任组合在系统动态存在的情况下将是稳健的，包括虚拟机的加入、离开和迁移。其次，Xen管理程序系统使用这些信任组合服务进行了扩展。这样，受监控的应用程序将只与其监管与其Shamon策略一致的系统进行通信。

Existing distributed authorization systems focus on the formulation ofpolicy, but enforcement remains a per-host issue. Failure of anycomponent to faithfully enforce policy can lead to vulnerabilities,and in the extreme, renders authorization impotent. Without greaterassurance in the integrity of authorization enforcement, that scalesto Internet-wide applications, reliable, distributed authorizationcannot be built.The Shared Reference Monitor (Shamon) project leverages advances inintegrity measurement and virtual machines to compose a coherentauthorization system for distributed applications. A Shamon consistsof a set of reference monitors on multiple, physical machines that areintegrity-verified to enforce a consistent security policy acrossvirtual machines that define an application. The use of virtualmachines provides coarse-grained isolation that simplifies securitypolicy for large-scale distributed systems, and the integritymeasurement ensures that each member of the Shamon can verify that theothers are enforcing this policy.The Shamon project focuses on building the services tocompose and maintain such shared reference monitors. First, alogic-based approach is defined that enables composition of trust inthe enforcement of a consistent policy by the Shamon referencemonitors. Such trust composition will be robust in the presence ofsystem dynamics including the joining, leaving and migration ofvirtual machines. Second, the Xen hypervisor system is augmented withthese trust composition services. In this way, monitored applicationswill only communicate with systems whose regulation is consistent withits Shamon policy.