請用此 Handle URI 來引用此文件：
http://tdr.lib.ntu.edu.tw/jspui/handle/123456789/93445完整後設資料紀錄
| DC 欄位 | 值 | 語言 |
|---|---|---|
| dc.contributor.advisor | 陳銘憲 | zh_TW |
| dc.contributor.advisor | Ming-Syan Chen | en |
| dc.contributor.author | 李依庭 | zh_TW |
| dc.contributor.author | Yi-Ting Lee | en |
| dc.date.accessioned | 2024-08-01T16:09:34Z | - |
| dc.date.available | 2024-08-02 | - |
| dc.date.copyright | 2024-08-01 | - |
| dc.date.issued | 2024 | - |
| dc.date.submitted | 2024-07-29 | - |
| dc.identifier.citation | Bibliography
[1] Julien Amacher and Valerio Schiavoni. On the performance of arm trustzone: (practical experience report). In Distributed Applications and Interoperable Systems: 19th IFIP WG 6.1 International Conference, DAIS 2019, Held as Part of the 14th International Federated Conference on Distributed Computing Techniques, DisCoTec 2019, Kongens Lyngby, Denmark, June 17–21, 2019, Proceedings 19, pages 133–151. Springer, 2019. [2] Amazon. AWS CloudHSM. https://aws.amazon.com/cloudhsm/, 2021. Accessed: May 2021. [3] Albert Anthony. AWS: Security Best Practices on AWS: Learn to secure your data, servers, and applications with AWS. Packt Publishing Ltd, 2018. [4] Christoph Böhm and Maximilian Hofer. Physical unclonable functions in theory and practice. Springer Science & Business Media, 2012. [5] Ferdinand Brasser, David Gens, Patrick Jauernig, Ahmad-Reza Sadeghi, and Emmanuel Stapf. Sanctuary: Arming trustzone with user-space enclaves. In NDSS, 2019. [6] Karen H Brown. Security requirements for cryptographic modules. Fed. Inf. Process. Stand. Publ, pages 1–53, 1994.31 doi:10.6342/NTU202402151 [7] David Cerdeira, José Martins, Nuno Santos, and Sandro Pinto. {ReZone}: Disarming {TrustZone} with {TEE} privilege reduction. In 31st USENIX Security Symposium (USENIX Security 22), pages 2261–2279, 2022. [8] David Cerdeira, Nuno Santos, Pedro Fonseca, and Sandro Pinto. Sok: Understanding the prevailing security vulnerabilities in trustzone-assisted tee systems. In 2020 IEEE Symposium on Security and Privacy (SP), pages 1416–1432. IEEE, 2020. [9] Kent Kai-Hsin Chuang, Hsin-Ming Chen, Meng-Yi Wu, Evans Ching-Sung Yang, and Charles Ching-Hsiang Hsu. Quantum tunneling puf: A chip fingerprint for hardware security. In 2021 International Symposium on VLSI Technology, Systems and Applications (VLSI-TSA), pages 1–2. IEEE, 2021. [10] Jolyon Clulow. On the security of pkcs# 11. In International Workshop on Cryptographic Hardware and Embedded Systems, pages 411–425. Springer, 2003. [11] Victor Costan and Srinivas Devadas. Intel sgx explained. Cryptology ePrint Archive, 2016. [12] Alexander Dax, Robert Künnemann, Sven Tangermann, and Michael Backes. How to wrap it up - a formally verified proposal for the use of authenticated wrapping in pkcs#11. In 2019 IEEE 32nd Computer Security Foundations Symposium (CSF), pages 62–6215, 2019. [13] Jeroen Delvaux, Dawu Gu, Dries Schellekens, and Ingrid Verbauwhede. Helper data algorithms for puf-based key generation: Overview and analysis. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 34(6):889–902, 2014. [14] Yunjie Deng, Chenxu Wang, Shunchang Yu, Shiqing Liu, Zhenyu Ning, Kevin Leach, Jin Li, Shoumeng Yan, Zhengyu He, Jiannong Cao, et al. Strongbox: A gpu tee on arm endpoints. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 769–783, 2022. [15] J. Divya and S. Shivagami. A study of secure cryptographic based hardware security module in a cloud environment. In 2020 Fourth International Conference on I-SMAC (IoT in Social, Mobile, Analytics and Cloud) (I-SMAC), pages 1273–1279, 2020. [16] Mohammad Ebrahimabadi, Mohamed Younis, Wassila Lalouani, and Naghmeh Karimi. A novel modeling-attack resilient arbiter-puf design. In 2021 34th International Conference on VLSI Design and 2021 20th International Conference on Embedded Systems (VLSID), pages 123–128. IEEE, 2021. [17] Entrust. Entrust HSM. https://www.entrust.com/products/hsm. [18] Fabian Fleischer, Marcel Busch, and Phillip Kuhrt. Memory corruption attacks within android tees: A case study based on op-tee. In Proceedings of the 15th International Conference on Availability, Reliability and Security, pages 1–9, 2020. [19] Riccardo Focardi and Flaminia L Luccio. A formally verified configuration for hardware security modules in the cloud. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 412–428, 2021. [20] Quentin Forcioli, Sumanta Chaudhuri, and Jean-Luc Danger. Tee-time: A dynamic cache timing analysis tool for trusted execution environments. In 2024 25th International Symposium on Quality Electronic Design (ISQED), pages 1–8. IEEE, 2024. [21] Yansong Gao, Said F Al-Sarawi, and Derek Abbott. Physical unclonable functions. Nature Electronics, 3(2):81–91, 2020. [22] Xinyang Ge, Hayawardh Vijayakumar, and Trent Jaeger. Sprobes: Enforcing kernel code integrity on the trustzone architecture. arXiv preprint arXiv:1410.7747, 2014. [23] John J JJ Geewax. Google Cloud platform in action. Simon and Schuster, 2018. [24] Christian Göttel, Pascal Felber, and Valerio Schiavoni. Developing secure services for iot with op-tee: a first look at performance and usability. In Distributed Applications and Interoperable Systems: 19th IFIP WG 6.1 International Conference, DAIS 2019, Held as Part of the 14th International Federated Conference on Distributed Computing Techniques, DisCoTec 2019, Kongens Lyngby, Denmark, June 17–21, 2019, Proceedings 19, pages 170–178. Springer, 2019. [25] Le Guan, Peng Liu, Xinyu Xing, Xinyang Ge, Shengzhi Zhang, Meng Yu, and Trent Jaeger. Trustshadow: Secure execution of unmodified applications with arm trustzone. In Proceedings of the 15th Annual International Conference on Mobile Systems, Applications, and Services, pages 488–501, 2017. [26] ALARM HA and USB CONSOLE USB MGMT. Fips 140-2 security policy. 2015. [27] Juhyeng Han, Seongmin Kim, Taesoo Kim, and Dongsu Han. Toward scaling hardware security module for emerging cloud services. In Proceedings of the 4th Workshop on System Software for Trusted Execution, SysTEX ’19, New York, NY, USA, 2019. Association for Computing Machinery. [28] Juhyeng Han, Insu Yun, Seongmin Kim, Taesoo Kim, Sooel Son, and Dongsu Han. Scalable and secure virtualization of hsm with scaletrust. IEEE/ACM Transactions on Networking, 31(4):1595–1610, 2023. [29] Timo Hinterleitner. Towards a scalable secure element cluster: a recommendation on hardware configuration. PhD thesis, Wien, 2020. [30] David Kaplan, Jeremy Powell, and Tom Woller. Amd memory encryption. White paper, 13, 2016. [31] Dmitriy Kartashov and Kirill Krinkin. Virtual hsm implementation in openvz containers. In Proceedings of 15th Conference of Open Innovations Association FRUCT, pages 184–188. vol, 2014. [32] Nane Kratzke. Cloud-native applications and services, 2022. [33] Dayeol Lee, David Kohlbrenner, Shweta Shinde, Krste Asanović, and Dawn Song. Keystone: An open framework for architecting trusted execution environments. In Proceedings of the Fifteenth European Conference on Computer Systems, pages 1–16, 2020. [34] Wenhao Li, Yubin Xia, and Haibo Chen. Research on arm trustzone. GetMobile: Mobile Computing and Communications, 22(3):17–22, 2019. [35] Stathis Mavrovouniotis and Mick Ganley. Hardware security modules. In Secure Smart Embedded Devices, Platforms and Applications, pages 383–405. Springer, 2013. [36] Nitrokey. Nitrokey NetHSM. https://www.nitrokey.com/products/nethsm. [37] Cloud Key Management of Cloud Security Alliance. HSM-as-a-Service Use Cases, Considerations, and Best Practices. Cloud Security Alliance, April 2024. [38] OpenDNSSEC. OpenDNSSEC SoftHSM. http://www.opendnssec.org/softhsm. [39] Yinlu Peng, Jun Shen, and Xiaojian Zhu. An hsm-based scalable network service model. In 2014 Eleventh International Conference on Wireless and Optical Communications Networks (WOCN), pages 1–6, 2014. [40] Gliqiri Riza. The study of the hsm as a solution to file encryption and security. In RTA-CSIT, pages 80–88, 2023. [41] Miguel Gomes Rosa. Virtual HSM: Building a Hardware-backed Dependable Cryptographic Store. PhD thesis, Faculdade de Ciências e Tecnologia, Universidade Novade Lisboa, 2019. [42] Mohamed Sabt, Mohammed Achemlal, and Abdelmadjid Bouabdallah. Trusted execution environment: What it is, and what it is not. In 2015 IEEE Trustcom/BigDataSE/Ispa, volume 1, pages 57–64. IEEE, 2015. [43] Ronaldo Serrano, Ckristian Duran, Marco Sarmiento, Tuan-Kiet Dang, Trong-Thuc Hoang, and Cong-Kha Pham. A unified puf and crypto core exploiting the metastability in latches. Future Internet, 14(10):298, 2022. [44] Sean Smith. Hardware security modules. In Handbook of Financial Cryptography and Security, pages 283–304. Chapman and Hall/CRC, 2010. [45] Maria Sommerhalder. Hardware security module. Trends in Data Protection and Encryption Technologies, pages 83–87, 2023. [46] Thales. Thales HSM. https://cpl.thalesgroup.com/encryption/hardware-security-modules. [47] TrustedFirmware.org. OPTEE documentations. https://optee.readthedocs.io/en/latest, 2014. Accessed: May 2024. [48] Utimaco. Utimaco HSM. https://utimaco.com/hardware-security-modules-hsm. [49] T. Visegrady, S. Dragone, and M. Osborne. Stateless cryptography for virtual environments. IBM Journal of Research and Development, 58(1):5:1–5:10, 2014. [50] Jinwen Wang, Ao Li, Haoran Li, Chenyang Lu, and Ning Zhang. Rt-tee: Real-time system availability for cyber-physical systems using arm trustzone. In 2022 IEEE Symposium on Security and Privacy (SP), pages 352–369. IEEE, 2022. [51] Steve H Weingart. Physical security devices for computer subsystems: A survey of attacks and defenses. In International Workshop on Cryptographic Hardware and Embedded Systems, pages 302–317. Springer, 2000. | - |
| dc.identifier.uri | http://tdr.lib.ntu.edu.tw/jspui/handle/123456789/93445 | - |
| dc.description.abstract | 本文提出了一個用於管理安全 CloudHSM（雲端硬體安全模組）管理的框架，目的是為了優化工作負載平衡並透過實體不可複製功能（PUF）技術確保防篡改。此框架整合了 OP-TEE 作業系統、PUF電路和多個HSM集群，以增強安全性並提高系統效能。此框架擁有來自於硬體的根信任(ROT)，利用 PUF 電路所設計的對應功能可將使用者與每個 HSM 叢集安全地關聯起來。這種整合加強了安全措施，防止未經授權的存取和操縱加密資產。透過採用高效的資源分配和防篡改設計原則，該框架引入了一種新穎的方法來增強雲端環境中加密操作的安全性和可靠性。 | zh_TW |
| dc.description.abstract | This thesis proposes a framework designed for the management of Secure CloudHSM (Cloud Hardware Security Module) systems. The framework aims to optimize workload balance and ensure tamper resistant with Physically Unclonable Function (PUF) technology. The framework integrates the OP-TEE os, PUF circuit, and multiple HSM clusters to enhance security and to improve the system performance. Rooted in hardware-based security, a mapping function utilizing PUF circuits securely associates users with each HSM cluster. This integration fortifies security measures against unauthorized access and manipulation of cryptographic assets. By employing efficient resource allocation and tamper-resistant design principles, the framework introduces a novel approach to enhancing the security and reliability of cryptographic operations in cloud environments. | en |
| dc.description.provenance | Submitted by admin ntu (admin@lib.ntu.edu.tw) on 2024-08-01T16:09:34Z No. of bitstreams: 0 | en |
| dc.description.provenance | Made available in DSpace on 2024-08-01T16:09:34Z (GMT). No. of bitstreams: 0 | en |
| dc.description.tableofcontents | Contents
Page 口試委員會審定書 i Acknowledgement ii 摘要 iii Abstract iv Contents v List of Figures viii List of Tables ix 1 Introduction 1 1.1 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.2.1 Hardware Security Module (HSM) . . . . . . . . . . . . . . . 4 1.2.2 Physical Unclonable Function (PUF) . . . . . . . . . . . . . 7 1.2.3 Trusted Execution Environment (TEE) . . . . . . . . . . . . 8 2 Motivation and Related Works 10 2.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.2 Related Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.2.1 Physical HSM . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.2.2 Cloud HSM or Virtual HSM . . . . . . . . . . . . . . . . . . 12 2.2.3 Trusted Execution Environment (TEE) . . . . . . . . . . . . 13 3 Design and Implementation of a CloudHSM 15 3.1 System Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.2 The Design of Workload Balancing . . . . . . . . . . . . . . . . . . 17 3.3 Tamper Resistant . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 4 Evaluation 19 4.1 Implementation Details . . . . . . . . . . . . . . . . . . . . . . . . . 19 4.1.1 Experiment Settings . . . . . . . . . . . . . . . . . . . . . . 19 4.1.2 Evaluation Metrics . . . . . . . . . . . . . . . . . . . . . . . 21 4.1.3 Design of Workload . . . . . . . . . . . . . . . . . . . . . . 21 4.2 Overall Comparisons . . . . . . . . . . . . . . . . . . . . . . . . . . 22 4.2.1 Latency and Throughput . . . . . . . . . . . . . . . . . . . . 22 4.2.2 Multi-tenant Scenarios . . . . . . . . . . . . . . . . . . . . . 22 4.2.3 Size of Files . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 5 Security Analysis 25 5.1 Threat Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 5.2 Breaking CloudHSM Properties . . . . . . . . . . . . . . . . . . . . 26 5.2.1 Booting Protection and CPU State Protection . . . . . . . . . 26 5.2.2 Memory Protection . . . . . . . . . . . . . . . . . . . . . . . 26 5.3 Breaking PUF Security . . . . . . . . . . . . . . . . . . . . . . . . . 27 5.3.1 Side-Channel Attacks . . . . . . . . . . . . . . . . . . . . . . 27 5.3.2 Environmental Stability . . . . . . . . . . . . . . . . . . . . 27 5.4 Security Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . 28 5.4.1 Memory Corruption Attacks . . . . . . . . . . . . . . . . . . 28 5.4.2 DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . 29 5.4.3 Newer Attacks . . . . . . . . . . . . . . . . . . . . . . . . . 29 6 Conclusion 30 Bibliography 31 | - |
| dc.language.iso | en | - |
| dc.subject | 硬體安全 | zh_TW |
| dc.subject | 硬體安全模組 | zh_TW |
| dc.subject | 雲端安全 | zh_TW |
| dc.subject | 物理不可複製功能 | zh_TW |
| dc.subject | Secure CloudHSM Management | en |
| dc.subject | Workload Balance Optimization | en |
| dc.subject | Tamper Resistance | en |
| dc.subject | Physically Unclonable Function (PUF) Technology | en |
| dc.subject | Cloud Security | en |
| dc.title | 雲端環境中的HSM安全：從防竄改到工作量平衡 | zh_TW |
| dc.title | Secure CloudHSM Management: Optimizing Workload Balance and Ensuring Tamper Resistant with PUF Technology | en |
| dc.type | Thesis | - |
| dc.date.schoolyear | 112-2 | - |
| dc.description.degree | 碩士 | - |
| dc.contributor.oralexamcommittee | 王凡;楊得年;陳怡伶 | zh_TW |
| dc.contributor.oralexamcommittee | Farn Wang;De-Nian Yang;Yi-Ling Chen | en |
| dc.subject.keyword | 硬體安全,硬體安全模組,雲端安全,物理不可複製功能, | zh_TW |
| dc.subject.keyword | Secure CloudHSM Management,Workload Balance Optimization,Tamper Resistance,Physically Unclonable Function (PUF) Technology,Cloud Security, | en |
| dc.relation.page | 37 | - |
| dc.identifier.doi | 10.6342/NTU202402151 | - |
| dc.rights.note | 同意授權(限校園內公開) | - |
| dc.date.accepted | 2024-07-30 | - |
| dc.contributor.author-college | 電機資訊學院 | - |
| dc.contributor.author-dept | 電機工程學系 | - |
| dc.date.embargo-lift | 2027-07-23 | - |
| 顯示於系所單位： | 電機工程學系 | |
文件中的檔案：
| 檔案 | 大小 | 格式 | |
|---|---|---|---|
| ntu-112-2.pdf 未授權公開取用 | 2.17 MB | Adobe PDF | 檢視/開啟 |
系統中的文件，除了特別指名其著作權條款之外，均受到著作權保護，並且保留所有的權利。