Securing cryptographic keys in the IaaS cloud model

摘要: Infrastructure-as-a-Service (IaaS) is a widespread cloud computing provisioning model where ICT infrastructure, including servers, storage and networking, supplied on-demand, in pay-as-you-go fashion. IaaS providers give their clients virtual machines (VMs) that are controlled by administrators who can run, stop, restore migrate the VMs. A typical threat to unauthorized access of untrustworthy users' sensitive information residing VMs' memory. In this paper we focus on cryptographic keys being stolen from RAM VM they provision. We propose decrypt-scatter/gather-decrypt technique allows users carry our encryption/decryption while protecting peeks part administrators. Our does not require modification current architecture, but only availability Trusted Platform Module (TPM) capable creating holding TPM-protected public/private key pair. It lends itself security-as-a-service scenarios third parties perform behalf data owners.