Abstract:Trust is arguably the most important challenge for critical services both deployed as well as accessed remotely over the network. These systems are exposed to a wide diversity of threats, ranging from bugs to exploits, active attacks, rogue operators, or simply careless administrators. To protect such applications, one needs to guarantee that they are properly configured and securely provisioned with the "secrets" (e.g., encryption keys) necessary to preserve not only the confidentiality, integrity and freshness of their data but also their code. Furthermore, these secrets should not be kept under the control of a single stakeholder - which might be compromised and would represent a single point of failure - and they must be protected across software versions in the sense that attackers cannot get access to them via malicious updates. Traditional approaches for solving these challenges often use ad hoc techniques and ultimately rely on a hardware security module (HSM) as root of trust. We propose a more powerful and generic approach to trust management that instead relies on trusted execution environments (TEEs) and a set of stakeholders as root of trust. Our system, PALAEMON, can operate as a managed service deployed in an untrusted environment, i.e., one can delegate its operations to an untrusted cloud provider with the guarantee that data will remain confidential despite not trusting any individual human (even with root access) nor system software. PALAEMON addresses in a secure, efficient and cost-effective way five main challenges faced when developing trusted networked applications and services. Our evaluation on a range of benchmarks and real applications shows that PALAEMON performs efficiently and can protect secrets of services without any change to their source code.

Tprov: Towards A Trusted Provenance-Aware Service Based On Trusted Computing

Development of the Transitive Trusted Chain Based on TPM

Privacy Protection in Trust Management

Use Trust Management Module to Achieve Effective Security Mechanisms in Cloud Environment

Provenance Cloud Security Auditing System Based on Log Analysis

Provenance based data integrity checking and verification in cloud environments

Proactive Provenance Policies for Automatic Cryptographic Data Centric Security

Toward security as a service: A trusted cloud service architecture with policy customization

Provable Data Possession Supporting Secure Data Transfer for Cloud Storage

CloudCoT: A Blockchain-Based Cloud Service Dependency Attestation Framework

Partial Attestation: Towards Cost-Effective and Privacy-Preserving Remote Attestations

Secure and Efficient Distributed Network Provenance for IoT: A Blockchain-Based Approach.

Enhancing the Privacy of Network Services Through Trusted Computing

Towards Trust Proof for Secure Confidential Virtual Machines

Trust Management as a Service: Enabling Trusted Execution in the Face of Byzantine Stakeholders

Provable Data Possession with Outsourced Data Transfer

Trusted Provenance of Automated, Collaborative and Adaptive Data Processing Pipelines

Automated verification of dynamic root of trust protocols (long version)

Threat detection and investigation with system-level provenance graphs: A survey

SciChain: Trustworthy Scientific Data Provenance

A Succinct Provable Data Possession Mechanism for Lightweight Clients in Network Computing.