Trust establishment in mobile distributed computing platforms

移动分布式计算平台中的信任建立

• 批准号: EP/D053269/1
• 负责人: Christopher Mitchell
• 金额: $ 24.99万
• 依托单位: Royal Holloway University of London
• 依托单位国家: 英国
• 项目类别: Research Grant
• 财政年份: 2006
• 资助国家: 英国
• 起止时间: 2006 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=EP%2FD053269%2F1
• 关键词: Trust; establishment; mobile; distributed; computing

The aim of the proposed research is to provide mechanims that can be used to establish trust in mobile distributed computing platforms. The initial task will be to allow mobile terminals to authenticate themselves to the existing fixed network of distributed computers. However, while authentication may establish the identity of an any two connected parties, this is not enough to establish trust that each computer in the network will behave as expected. Mechanisms have been proposed to establish trust based on an entitiy's reputation. This reputation, however, should be bound to a specific identity that cannot be easilly changed, otherwise an entity that had gained a poor reputation could change its identity and esablish a good reputation. There are other problem that may arise too, if stable identities are not established.The trusted computing group is a major research consortium who are developing standards that allow identity to be bound to specific computing platforms. Moreover, trusted computing technology allows the platform to attest to its state. In other words, the stable id can be used to sign a message stating what operating system the platform is running and what other software applications are running at any moment in time. This attestation can be verified by a challenger. Another security mechanism provided by trusted computing technology is the idea of 'sealing' data. Data may be sealed, or encrypted in such a way that it can only be accessed when the trusted platform is in a particular state. This mechanism can therefore be used to make sure data is released only when known trusted applications are running on the trusted platform.The research proposed will investigate how the mechanisms of trusted computing may be applied to the e-Science network to support reputation based trust mechanisms by providing stable platform identities. Furthermore, once the stable identity and reputation of a platform has been established, this research will investigate how techniques like sealing and attestation may be used to provide a challenger with a degree of confidence that a the platform is running software that can be trusted to maintain data security.In conjunction with this, the proposed research will investigate how the techniques of digital rights management (DRM) may be used to protect data in the e-Science grid. DRM is currently used to protect multimedia content by scrambling the content so that it can only be accessed by authorized viewers. The access requirements associated with the content are broadcast with the content itself. The authorization rights that allow the content to be viewed, however, are bound to each receiver. Only if the rights match the access requirements will the content be descrambled.If platform in the e-Science grid can support the trusted computing mechanisms then it may be used with DRM techniques to control access to sensitive data. The proposed research will investigate how the sealing and attestation mechanisms of trusted computing may be used to define the authorization rights required by DRM. In this way sensitive data may be securely released to the grid, and given to any platform, with confidence that it will only be accessed by those platforms that can be trusted to protect the data.The consequence of this proposed research is that the e-Science grid will be able to provide greater assurance that it can be trusted to protect sensitive data. Thus allowing wider access to its resources. The obvious beneficiary of this will be the health care community. The e-Healthcare initiative is a major European project to provide an electronic infrastructure for health care. The trust mechanisms to be investigated by the proposed research could form the basis of providing security for the exchange and processing of sensitive patient records and diagnostic data.

所提出的研究的目的是提供机制，可用于建立信任的移动的分布式计算平台。最初的任务将是允许移动的终端向分布式计算机的现有固定网络认证它们自己。然而，虽然身份验证可以建立任何两个连接方的身份，但这不足以建立信任，即网络中的每台计算机都将按预期运行。已经提出了基于实体的声誉来建立信任的机制。然而，这种声誉应该与一个特定的身份绑定，不能轻易改变，否则，一个获得了坏声誉的实体可以改变它的身份，建立一个好的声誉。如果没有建立稳定的身份，还可能出现其他问题。可信计算组织是一个主要的研究联盟，他们正在开发允许身份绑定到特定计算平台的标准。此外，可信计算技术允许平台证明其状态。换句话说，稳定id可以用来签署一条消息，声明平台正在运行什么操作系统，以及在任何时刻正在运行什么其他软件应用程序。这个证明可以由挑战者验证。可信计算技术提供的另一种安全机制是“密封”数据的想法。数据可以以这样的方式被密封或加密，即只有当可信平台处于特定状态时才能访问数据。因此，这种机制可以用来确保数据被释放时，只有已知的可信应用程序运行在可信platform.The研究建议将调查如何可信计算的机制可能会被应用到e-Science网络，以支持信誉为基础的信任机制，通过提供稳定的平台身份。此外，一旦建立了平台的稳定身份和声誉，本研究将调查如何使用密封和证明等技术来为挑战者提供一定程度的信心，即平台正在运行可以信任的软件来维护数据安全。本研究将探讨如何利用数位权利管理（DRM）技术来保护e-Science网格中的资料。DRM当前用于通过对内容进行加扰来保护多媒体内容，使得其只能由授权的观看者访问。与内容相关联的访问要求与内容本身一起广播。然而，允许内容被查看的授权权限被绑定到每个接收者。如果e-Science网格中的平台能够支持可信计算机制，那么它可以与DRM技术一起使用来控制对敏感数据的访问。建议的研究将调查如何密封和可信计算的证明机制可能被用来定义DRM所需的授权权限。通过这种方式，敏感数据可以安全地发布到网格，并提供给任何平台，相信它只会被那些可以信任的平台访问，以保护数据。这项拟议研究的结果是，e-Science网格将能够提供更大的保证，可以信任它来保护敏感数据。从而使更多的人能够利用其资源。这将是医疗保健行业的明显受益者。电子医疗保健计划是欧洲的一个主要项目，旨在为医疗保健提供电子基础设施。拟议研究所调查的信任机制可以为敏感患者记录和诊断数据的交换和处理提供安全性的基础。