CN102202046B - Network-operating-system-oriented trusted virtual operating platform - Google Patents
Network-operating-system-oriented trusted virtual operating platform Download PDFInfo
- Publication number
- CN102202046B CN102202046B CN201110061265A CN201110061265A CN102202046B CN 102202046 B CN102202046 B CN 102202046B CN 201110061265 A CN201110061265 A CN 201110061265A CN 201110061265 A CN201110061265 A CN 201110061265A CN 102202046 B CN102202046 B CN 102202046B
- Authority
- CN
- China
- Prior art keywords
- physical node
- tcc
- challenge
- label
- signature
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Landscapes
- Storage Device Security (AREA)
Abstract
The invention discloses a network-operating-system-oriented trusted virtual operating platform technology, which belongs to the technical field of computer infrastructure software. In the technology, trusted registration and starting mechanisms are designed for each node in a network operating system by setting a third-party trusted authentication mechanism which is a trusted cloud controller for main threats to the main service range and main operations of the network operating system in a typical novel network application mode; and after passing through an authentication protocol of the trusted cloud controller, the nodes can become trusted nodes to provide a trusted host operating environment for virtual machines, ensure that damages to the integrity and accuracy of the virtual machines can be detected in a starting process and interrupt the starting and registration processes of damaged machines. Moreover, corresponding trusted ensuring mechanisms are designed for the main operations of the virtual machines, namely starting and migration processes.
Description
Technical field
The invention belongs to the Basis of Computer Engineering software technology field, mainly solve and how to design and make up a networked operating system virtual operation platform trusty.The main operation and the scope of application to networked operating system virtual operation platform; Comprise: physical server management and credible wilful authentication; Virtual image and Virtual Machine Manager and credible wilful authentication, the credible wilful authentication of virtual machine (vm) migration etc. have designed corresponding authentication protocol and algorithm.
Abbreviation and Key Term definition
TCC (Trusted Cloud Controller): credible cloud controller
CM (Cloud Manager): cloud management system
BIOS (Basic Input Output System): basic input output system
OS (Operating System): operating system
VMM (Virtual Machine Monitor): virtual machine monitor
TPM (Trusted Platform Module): reliable platform module
PCR (Platform Configuration registers): platform configuration register
Bootloader: system bootstrap routine
The outside trusted entity of ETE (External Trusted Entity)
Background technology
Networking operating system is through carrying out unified management and scheduling to the large-scale calculations resource that connects with network, and constituting a computational resource pond provides the service of charge as required to the user.It has that data security is reliable, client demand is low, light advantage such as shared data.As a kind of novel computation model, networked operating system has received the extensive concern of industrial quarters and academia, and increasing mechanism and personal choice are built distributed I T platform with it as infrastructure.
Yet, use networked operating system also to have certain risk.From user and two angles of supplier of networked operating-system resources, above-mentioned risk may be summarized as follows:
1. user's angle: the user is deployed in computational process or data portion on the far-end server, thereby has lost the direct control to them.Under non-networked operating system schema, calculate the location that the user is depended in the position on server, move, the user can the physical access machine, can directly monitor machine state, can make people's handle machine of trust; And in networked operating system; Come the managing physical machine by networked operating system supplier; The user only can utilize network to connect remote managing virtual machines, does not therefore have the ability of above-mentioned handle machine, and promptly the user has lost the direct control to computational process and data.
2. supplier's angle: the detail of user's service that the supplier maybe and not know in its system, to move.User's usage platform resource or in the application of platform deploy oneself, these behaviors are changeable and do not have a predictability.With Facebook is example; It allows the third party to be applied in freely issuing on its platform; It is not carried out detailed checking, if the user has added a certain malicious application, then platform or other users' sensitive data may suffer stealing and destroying of malicious application.
To sum up; In networked operating system; Between the different objects possibly be responsive changeable alternately, lacks each other effective trust, lacks reliable fault detect and arbitration mechanism can be lost potential user, needs therefore to make up that trust management framework is set up, the trust behavior in negotiation and the maintenance system between the different entities; Guarantee that each side can both be according to the good situation operation of agreement, and when not meeting the agreement situation and occur, can effectively detect and report to the related side.
Specifically; The physical node that comprises many registrations in the networking operating system; Virtual machine can be assigned to and move on a certain physical node and move to when needed on other nodes; How to verify the integrality and the credible wilfulness of each entity in these processes, how to guarantee that virtual machine operates under the environment trusty all the time, all has crucial meaning.
In said process, the threat that may run into mainly comprises the following aspects:
1. the change of physical node before startup or in the start-up course needs and can detect: the hardware of physical node, BIOS, bootloader or VMM have suffered malicious modification before startup or in the start-up course;
2. the configuration change when physical node moves after startup needs and can detect: the hardware of physical node, BIOS, bootloader or VMM have suffered malicious modification when operation;
3. the process of each inter-node communication in the system might meet with Replay Attack, distort and threat such as personation.
This patent is to the threat of above 3 each side, and through setting up third party's authentic authentication mechanism, promptly credible cloud controller to the node in each networked operating system, designs its credible registration and Initiated Mechanism; Through behind the authentication protocol of credible cloud controller; Can become a trusted node; Provide virtual machine believable host's running environment, guarantee that the destruction that its integrality and correctness are suffered can be detected in start-up course, and the startup and the registration process of the machine that interrupts being damaged.And to the main operation of virtual machine, promptly start-up course and transition process have designed corresponding trusted and have guaranteed mechanism.
Summary of the invention
According to above analysis, this patent proposes the trusted virtual operation platform architecture of network-oriented operating system, and is as shown in Figure 1.Trusted virtual operation platform comprises networked operating system platform and outside trusted entity two large divisions.Outside trusted entity provides TCC to be used for the credible wilfulness of physical node in the networked operating system platform is verified.Each physical node orlop is a hardware platform, has wherein comprised TPM, is used for guaranteeing the credible wilfulness in the physical node start-up course; The software stack on physical node upper strata comprises BIOS, Bootloader, operating system nucleus and VMM from down to up successively, and the virtual machine of various different demands just operates on the VMM.
Dominant role and variable-definition to are wherein explained as follows:
EK
PU TCC: the signature PKI of TCC (open in advance)
EK
PR TCC: the signature private key of TCC
TK
PU TCC: the PKI of TCC (open in advance)
TK
PR TCC: the private key of TCC
EK
PU N: the signature PKI of physical node (open in advance)
EK
PR N: the signature private key of physical node
TK
PU N: the PKI of physical node
TK
PR N: the private key of physical node
ECL
TCC: the expection configured list of TCC (open in advance)
CL
TCC: the configured list of TCC sends to physical node by TCC and at physical node end and ECL when physical node is registered
TCCContrast
CL
N: the configured list of physical node,, physical node sends to TCC when registering by physical node, and TCC is kept at local directory with it
K
S: the symmetric key that uses in the session
Challenge: challenge: send to the other side, show that the other side can decipher the information of oneself if comprise this challenge in the information that the other side returns
Wm_stat: the state information of virtual machine
H (wm_stat): the hash value of wm_stat
N: the label of physical node in trusted virtual operation platform
This patent is to 4 critical process and the credible algorithm of operational design of the trusted virtual operation platform of network-oriented operating system; Be respectively: (1) physical node registration process; This process need physical node and TCC verify each other; The configuration information that guarantees physical node at last is saved in the TCC local directory, is used for the later checking to the physical node authenticity of TCC; (2) virtual machine activation process, this process is initiated by the user, distributes a physical node through CM, and this node is accomplished the startup to virtual machine under the control of TCC then; (3) virtual machine is striden the physical node transition process, and this process is specified the destination node of migration by CM, and by the credible wilfulness of TCC checking source node and destination node, virtual machine is moved to destination node by source node at last; (4) physical node secure launch process, this process are used for guaranteeing the credible wilfulness of physical node in start-up course.In all processes, in transmission course, do not revealed for guarantee information with public key encryption, with the private key signature person's that is used for the certifying signature identity.
The arthmetic statement of physical node registration process is as shown in Figure 2.Concrete steps are following:
1) physical node sends a request challenge to TCC
NIdentity with checking TCC;
2) TCC is with the configured list CL of oneself
TCCJust now the challenge that received
NSignature private key EK with own TPM module
PR TCCSignature, and bind a request challenge
TCCReply to physical node, wait for the log-on message of physical node then;
3) physical node is with the signature PKI EK of the TPM module of TCC
PU TCCParse CL
TCC, with the TCC expection configured list ECL that receives in advance
TCCIf contrast is the consistent i.e. true identity of the TCC of checking.Physical node is with the configured list CL of oneself then
NWith firm challenge from receiving
TCCWith the signature private key signature of oneself, use this signature of public key encryption of TCC and the PKI TK of physical node subsequently
PU N, guaranteed the confidentiality in the transmission course like this, at last this information encrypted is sent to TCC;
4) TCC is with the signature PKI EK of physical node TPM module
PR NParse CL
NSimultaneous verification the authenticity of physical node, TCC is saved in the PKI of physical node and configured list in the local catalogue then, uses the private key TK of oneself then
PR TCCACK signs to confirmation, sends to physical node then and succeeds in registration to notify it.
The arthmetic statement of virtual machine activation process is as shown in Figure 3.Step is following:
1) User is to virtual machine of CM request.User comprises two parts to the request that CM sends:
{ vm_stat, h (vm_stat) } K
Vm{ challenge
U, K
VmTK
PU TCCThe former uses the local session key K who creates of User
VmEncrypt the init state vm_stat of virtual machine and the hash value h (vm_stat) of this state; The latter uses the PKI TK of TCC
PU TCCEncrypt the label challenge of this request
USession key K with the User establishment
Vm, this enciphered message is finally deciphered by TCC and is obtained session key K
Vm, send it to physical node then;
2) after CM receives information, in trusted virtual operation platform, select a physical node then this information to be transmitted to physical node;
3) physical node retains { vm_stat, h (vm_stat) } K
Vm, and with { challenge
U, K
VmTK
PU TCTogether with the sign challenge of TCC session
NWith the private key signature of oneself, the result that will sign then and oneself the label N in trusted virtual operation platform is with the public key encryption of TCC, and the result that will encrypt at last sends to TCC, with the session key K of acquisition with User
VM
4) TCC deciphers with the private key of oneself after receiving message; Obtain the information of physical node signature and the label in trusted virtual operation platform of this physical node; TCC passes through this label is searched for this physical node in local directory PKI then, and obtains { challenge with its checking
U, K
VmTK
PU TCCWith this session sign challenge
N, TCC deciphers the former with the private key of oneself and obtains challenge then
UAnd the session key K between User and the physical node
VM, last TCC is with challenge
N, challenge
UAnd session key K
VMSend to physical node with the public key encryption of physical node and with after the private key signature of oneself;
5) after physical node receives the information that TCC returns, decipher with the public key verifications of TCC and with own private key and to obtain challenge
UWith session key K
VM, use K then
VMEncrypt challenge
UWith own label in trusted virtual operation platform, and the result after will encrypting sends to User.
It is as shown in Figure 4 that virtual machine is striden the arthmetic statement of physical node transition process.Step is following:
1) CM is with the label N of physical node d
dSend to physical node s, the destination node of moving with VM on this machine of notice physical node s is physical node d;
2) private key of physical node s usefulness oneself is to the label Nd of migration destination node physical node d and the label challenge of this session
S1Sign, the result that will sign then and own label Ns are with the public key encryption of TCC and send to TCC, with the PKI of acquisition physical node d;
3) TCC receives the request of physical node s, after the deciphering with this session label challenge
S1With the PKI of physical node d with own private key signature also with the public key encryption of physical node s, and the result that will encrypt returns to physical node s;
4) physical node s receives the PKI that decrypts physical node d after the answer of TCC, then with own private key to this locality production with session key and new session label challenge physical node d
S2Sign, and result that will sign and the label N of oneself
SWith the public key encryption of physical node d, send to physical node d then;
5) physical node d receives the label N that decrypts physical node s after the information of physical node s
SWith the information with physical node s private key signature, the PKI that next step physical node d need ask physical node s to TCC is to verify this signature, so physical node d is with the new session label challenge of private key signature of oneself
dLabel N with physical node s
s, then together with oneself label N
dWith the public key encryption of TCC and send TCC to;
6) TCC uses the private key signature of oneself also to send to physical node d with the public key encryption of physical node d the PKI of challenged and physical node s;
7) physical node d receives the information of TCC and decrypts the PKI N of physical node s
S, use N then
SChecking draws the session key K with physical node s
SAnd with this session key challenge
S2And send to physical node s;
8) after physical node s receives the information of physical node d, decrypt challenge
S2And learn that physical node d can carry out the preparation that receives VM, uses session key K with the state of own local VM and the hash value of this state then
SEncryption sends to physical node d;
9) physical node d receives the state information of the VM that physical node s sent and through the hash value contrast, if consistent, just at this VM of local runtime.
The arthmetic statement of physical node secure launch process is as shown in Figure 5.Use TPM to be used as believable basis; It is the system safety chip that a slice contains memory unit and independent crypto-operation parts in essence; Can cryptographic service function, trusted storage function be provided for platform; Access interface shielded, system, standard externally is provided, and the TPM standard of TCG tissue issue realizes that to it principle, functional interface made specified in more detail.We use its integrity measurement mechanism to realize clean boot, and its method is for through carrying out integrity verification to BIOS, bootloader, operating system, VMM successively in the information equipment start-up course, thus the clean boot of guarantee information treatment facility.Fig. 5 is applied to the flow process of clean boot for the TPM safety chip.Concrete steps are following:
1) under the environment of guaranteeing physical node safety, as: on the production line, or during first Application, generate the completeness check code of BIOS, bootloader, operating system, VMM, be stored in the TPM safety chip;
2) when physical node powers up, its inner TPM chip carries out basic initialization;
3) the TPM safety chip is read bios code, calculates its completeness check code, deposits to the PCR of TPM;
4) the TPM safety chip is read the bootloader code, calculates its completeness check code, deposits to the PCR of TPM;
5) the TPM safety chip is read operating system code to be loaded, calculates its completeness check code, deposits to the PCR of TPM;
6) the TPM safety chip is read the VMM code, calculates its completeness check code, deposits to the PCR of TPM;
7) from memory unit, read the completeness check code of preserving in advance, judge whether it is consistent respectively with each completeness check code that calculates, if all consistent, then CPU progressively moves bios code, bootloader code, operating system and the VMM that reads; Otherwise, the bios code that forbidding is read, and send the prompting that inconsistent part codes has been illegally modified.
Description of drawings
Fig. 1 is the trusted virtual operation platform architecture of network-oriented operating system
Fig. 2 is the physical node registration process
Fig. 3 is the virtual machine activation process
Fig. 4 strides the physical node transition process for virtual machine
Fig. 5 is the physical node secure launch process
Embodiment
The technology of this patent should be noted that following item in the specific implementation:
1) provide credible cloud manager to come networked operating system platform is verified by outside trusted entity.TCC deposits the signature PKI EK of trusted physical node in the networked operating system in catalogue of local management in this catalogue
PU N, PKI TK
PU NAnd configured list CL
NEtc. information, it also is responsible for the external signature PKI EK that announces oneself of the channel of safety in addition
PU TCC, PKI TK
PU TCCTCC configured list CL with expection
TCC
2) this patent is supposed following condition establishment in addition:
A) the credible wilfulness of outside trusted entity does not need checking;
B) the signature PKI of TCC, PKI and expection configured list, the signature PKI of physical node and the announcement before system's operation of expection configured list, their credibility guarantees by outside trusted entity, not in the limit of consideration of this patent;
A) the credible wilfulness of TPM is guaranteed by the TPM manufacturer, also not as the content of this patent.
3) can implement in actual deployment for the technology that guarantees this patent, need more auxiliary necessary physical containment means and control measures.As:
A) room entry/exit management: unrelated person forbids to get into machine room without administrative staff's approval, gets into the machine room personnel and must not carry the article that any inflammable and explosive and strong magnetic article and other and machine room work have nothing to do;
B) safety management: computer floor will keep clean, health; And be in charge of and safeguard (comprising temperature, humidity, electric power system, the network equipment etc.) by special messenger 7*24; The operator on duty should scrupulously abide by security system, must not reveal various information materials in center and data without authorization;
C) operational administrative: the operator on duty must pay close attention to central apparatus operation conditions and each site ruuning situation, guarantees safety, efficient operation.Strict carry out the back-up job of various data, file by rules and regulations requirements, the central server database will regularly carry out double copies, and strictly carries out that deposit in the strange land, special messenger's keeping, and all important documents are regularly put bookbinding in order, and the special messenger takes care of, and looks into after preparing against;
D) operational management: the change of the maintenance of all kinds of software systems, additions and deletions, configuration; The interpolation of various types of hardware equipment, replacing must can be carried out after director's written authorization; Must register in detail and record by regulation, all kinds of softwares, in-situ data, archive arrangement are filed.
Claims (1)
1. the trusted ensuring method of the trusted virtual operation platform of a network-oriented operating system; It is characterized in that: trusted virtual operation platform comprises networked operating system platform and outside trusted entity two large divisions; Outside trusted entity provides credible cloud controller TCC to be used for the credible wilfulness of physical node in the networked operating system platform is verified; Each physical node orlop is a hardware platform; Wherein comprise responsible console module TPM, be used for guaranteeing the credible wilfulness in the physical node start-up course; The software stack on physical node upper strata comprises BIOS, Bootloader, operating system nucleus and virtual machine monitor VMM from down to up successively, and the virtual machine of various different demands just operates on the VMM, and this method comprises: (1) physical node registration process; (2) virtual machine activation process; (3) virtual machine is striden the physical node transition process; (4) physical node secure launch process;
The physical node registration process may further comprise the steps:
1) physical node sends a request challenge to TCC
NIdentity with checking TCC;
2) TCC is with the configured list CL of oneself
TCCJust now the challenge that received
NSignature private key EK with own TPM module
PR TCCSignature, and bind a request challenge
TCCReply to physical node, wait for the log-on message of physical node then;
3) physical node is with the signature PKI EK of the TPM module of TCC
PU TCCParse CL
TCC, with the TCC expection configured list ECL that receives in advance
TCCContrast, if the consistent i.e. true identity of the TCC of checking, physical node is with the configured list CL of oneself then
NWith firm challenge from receiving
TCCWith the signature private key signature of oneself, use this signature of public key encryption of TCC and the PKI TK of physical node subsequently
PU N, guaranteed the confidentiality in the transmission course like this, at last this information encrypted is sent to TCC;
4) TCC is with the signature PKI EK of physical node TPM module
PR NParse CL
NSimultaneous verification the authenticity of physical node, TCC is saved in the PKI of physical node and configured list in the local catalogue then, uses the private key TK of oneself then
PR TCCACK signs to confirmation, sends to physical node then and succeeds in registration to notify it;
The virtual machine activation process may further comprise the steps:
1) User is to virtual machine of CM request, and User comprises two parts to the request that CM sends: { vm_stat, h (vm_stat}K
Vm{ challenge
U, K
VmTK
PU TCCThe former uses the local session key K who creates of User
VmEncrypt the init state vm_stat of virtual machine and the hash value h (vm_stat) of this state; The latter uses the PKI TK of TCC
PU TCCEncrypt the label challenge of this request
USession key K with the User establishment
Vm, this enciphered message is finally deciphered by TCC and is obtained session key K
Vm, send it to physical node then;
2) after CM receives information, in trusted virtual operation platform, select a physical node then this information to be transmitted to physical node; 3) physical node retains { vm_stat, h (vm_stat) } K
Vm, and with { challenge
U, K
VmTK
PU TCTogether with the sign challenge of TCC session
NWith the private key signature of oneself, the result that will sign then and oneself the label N in trusted virtual operation platform is with the public key encryption of TCC, and the result that will encrypt at last sends to TCC, with the session key K of acquisition with User
VM
4) TCC deciphers with the private key of oneself after receiving message; Obtain the information of physical node signature and the label in trusted virtual operation platform of this physical node; TCC passes through this label is searched for this physical node in local directory PKI then, and obtains { challenge with its checking
U, K
VmTK
PU TCCWith this session sign challenge
N, TCC deciphers the former with the private key of oneself and obtains challenge then
UAnd the session key K between User and the physical node
VM, last TCC is with challenge
N, challenge
UAnd session key K
VMSend to physical node with the public key encryption of physical node and with after the private key signature of oneself;
5) after physical node receives the information that TCC returns, decipher with the public key verifications of TCC and with own private key and to obtain challenge
UWith session key K
VM, use K then
VMEncrypt challenge
UWith own label in trusted virtual operation platform, and the result after will encrypting sends to User.
Virtual machine is striden the physical node transition process and may further comprise the steps:
1) CM is with the label N of physical node d
dSend to physical node s, the destination node of moving with VM on this machine of notice physical node s is physical node d;
2) private key of physical node s usefulness oneself is to the label Nd of migration destination node physical node d and the label challenge of this session
S1Sign, the result that will sign then and own label Ns are with the public key encryption of TCC and send to TCC, with the PKI of acquisition physical node d;
3) TCC receives the request of physical node s, after the deciphering with this session label challenge
S1With the PKI of physical node d with own private key signature also with the public key encryption of physical node s, and the result that will encrypt returns to physical node s;
4) physical node s receives the PKI that decrypts physical node d after the answer of TCC, then with own private key to this locality production with session key and new session label challenge physical node d
S2Sign, and result that will sign and the label N of oneself
SWith the public key encryption of physical node d, send to physical node d then;
5) physical node d receives the label N that decrypts physical node s after the information of physical node s
SWith the information with physical node s private key signature, the PKI that next step physical node d need ask physical node s to TCC is to verify this signature, so physical node d is with the new session label challenge of private key signature of oneself
dLabel N with physical node s
s, then together with oneself label N
dWith the public key encryption of TCC and send TCC to;
6) TCC is with challenge
dUse the private key signature of oneself also to send to physical node d with the PKI of physical node s with the public key encryption of physical node d;
7) physical node d receives the information of TCC and decrypts the PKI N of physical node s
S, use N then
SChecking draws the session key K with physical node s
SAnd with this session key challenge
S2And send to physical node s;
8) after physical node s receives the information of physical node d, decrypt challenge
S2And learn that physical node d can carry out the preparation that receives VM, uses session key K with the state of own local VM and the hash value of this state then
SEncryption sends to physical node d;
9) physical node d receives the state information of the VM that physical node s sent and through the hash value contrast, if consistent, just at this VM of local runtime;
The physical node secure launch process may further comprise the steps:
1) under the environment of guaranteeing physical node safety, generate the completeness check code of BIOS, bootloader, operating system, VMM, be stored in the TPM safety chip;
2) when physical node powers up, its inner TPM chip carries out basic initialization;
3) the TPM safety chip is read bios code, calculates its completeness check code, deposits to the PCR of TPM;
4) the TPM safety chip is read the bootloader code, calculates its completeness check code, deposits to the PCR of TPM;
5) the TPM safety chip is read operating system code to be loaded, calculates its completeness check code, deposits to the PCR of TPM;
6) the TPM safety chip is read the VMM code, calculates its completeness check code, deposits to the PCR of TPM;
7) from memory unit, read the completeness check code of preserving in advance, judge whether it is consistent respectively with each completeness check code that calculates, if all consistent, then CPU progressively moves bios code, bootloader code, operating system and the VMM that reads; Otherwise, the bios code that forbidding is read, and send the prompting that inconsistent part codes has been illegally modified.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110061265A CN102202046B (en) | 2011-03-15 | 2011-03-15 | Network-operating-system-oriented trusted virtual operating platform |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110061265A CN102202046B (en) | 2011-03-15 | 2011-03-15 | Network-operating-system-oriented trusted virtual operating platform |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102202046A CN102202046A (en) | 2011-09-28 |
| CN102202046B true CN102202046B (en) | 2012-10-17 |
Family
ID=44662445
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201110061265A Active CN102202046B (en) | 2011-03-15 | 2011-03-15 | Network-operating-system-oriented trusted virtual operating platform |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102202046B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10068092B2 (en) | 2015-01-21 | 2018-09-04 | Microsoft Technology Licensing, Llc | Upgrading a secure boot policy on a virtual machine |
Families Citing this family (21)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103036919B (en) * | 2011-09-30 | 2015-12-09 | 上海贝尔股份有限公司 | For realizing the method and apparatus of the migration of virtual machine in virtual privately owned cloud |
| CN102523259B (en) * | 2011-12-02 | 2014-07-16 | 浪潮集团有限公司 | Method for accessing personal computer (PC) to universal serial bus (USB) interface cloud terminal |
| CN102932459B (en) * | 2012-11-05 | 2016-02-10 | 广州杰赛科技股份有限公司 | A kind of method of controlling security of virtual machine |
| JP6114832B2 (en) * | 2012-11-22 | 2017-04-12 | 華為技術有限公司Ｈｕａｗｅｉ Ｔｅｃｈｎｏｌｏｇｉｅｓ Ｃｏ．，Ｌｔｄ． | Management control method, apparatus and system for virtual machine |
| CN103888429B (en) * | 2012-12-21 | 2017-11-03 | 华为技术有限公司 | Virtual machine starts method, relevant device and system |
| CN103136026A (en) * | 2013-02-22 | 2013-06-05 | 浪潮电子信息产业股份有限公司 | Method for achieving secure shell (ssh) connecting identification of virtualized software library libvirt |
| CN104052775B (en) * | 2013-03-14 | 2016-11-23 | 腾讯科技（深圳）有限公司 | Right management method, device and the system of a kind of cloud platform service |
| CN103309973B (en) * | 2013-06-08 | 2016-08-10 | 上海交通大学 | Can verify that the method and system of outsourcing data query |
| CN103559436A (en) * | 2013-10-28 | 2014-02-05 | 曙光云计算技术有限公司 | Authentication method and device for virtualization startup |
| CN104717235B (en) * | 2013-12-11 | 2018-01-02 | 铁道部信息技术中心 | A kind of resources of virtual machine detection method |
| CN104715183B (en) * | 2013-12-13 | 2018-06-01 | 中国移动通信集团公司 | A kind of trust authentication method and apparatus during virtual machine operation |
| EP3114602B1 (en) | 2014-03-07 | 2022-01-12 | Nokia Technologies Oy | Method and apparatus for verifying processed data |
| CN103841198B (en) * | 2014-03-07 | 2017-03-29 | 中南大学 | A kind of clean room cloud computing data processing method and system |
| CN104735069A (en) * | 2015-03-26 | 2015-06-24 | 浪潮集团有限公司 | High-availability computer cluster based on safety and reliability |
| EP3403432B1 (en) * | 2016-01-15 | 2020-11-18 | Microsoft Technology Licensing, LLC | Database based redundancy in a telecommunications network |
| CN105760271A (en) * | 2016-01-28 | 2016-07-13 | 浪潮电子信息产业股份有限公司 | Method for computational node credible state monitoring under cluster mode |
| CN105897427A (en) * | 2016-04-01 | 2016-08-24 | 浪潮电子信息产业股份有限公司 | Method, device and system for protecting safety of equipment |
| CN106169054A (en) * | 2016-07-13 | 2016-11-30 | 浪潮电子信息产业股份有限公司 | A kind of access control method based on trusted status |
| CN113396393A (en) | 2019-01-15 | 2021-09-14 | 微软技术许可有限责任公司 | Dynamic auto-configuration of multi-tenant PAAS components |
| CN111222165B (en) | 2020-01-10 | 2022-09-23 | 北京百度网讯科技有限公司 | Multi-party computing method, device, equipment and medium based on block chain |
| CN115296938B (en) * | 2022-10-09 | 2022-12-27 | 湖南警云智慧信息科技有限公司 | Cloud computing management system and cloud computing management method |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101621377A (en) * | 2009-03-26 | 2010-01-06 | 常熟理工学院 | Trusted access method under virtual computing environment |
| CN101957900A (en) * | 2010-10-26 | 2011-01-26 | 中国航天科工集团第二研究院七○六所 | Credible virtual machine platform |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090210456A1 (en) * | 2008-02-18 | 2009-08-20 | Dell Products L.P. | Methods, Systems and Media for TPM Recovery Key Backup and Restoration |
-
2011
- 2011-03-15 CN CN201110061265A patent/CN102202046B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101621377A (en) * | 2009-03-26 | 2010-01-06 | 常熟理工学院 | Trusted access method under virtual computing environment |
| CN101957900A (en) * | 2010-10-26 | 2011-01-26 | 中国航天科工集团第二研究院七○六所 | Credible virtual machine platform |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10068092B2 (en) | 2015-01-21 | 2018-09-04 | Microsoft Technology Licensing, Llc | Upgrading a secure boot policy on a virtual machine |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102202046A (en) | 2011-09-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102202046B (en) | Network-operating-system-oriented trusted virtual operating platform | |
| JP6484255B2 (en) | Host attestation, including trusted execution environment | |
| EP2278514B1 (en) | System and method for providing secure virtual machines | |
| US8588422B2 (en) | Key management to protect encrypted data of an endpoint computing device | |
| CN102624699B (en) | Method and system for protecting data | |
| KR101712784B1 (en) | System and method for key management for issuer security domain using global platform specifications | |
| CN202795383U (en) | Device and system for protecting data | |
| Chen et al. | An infrastructure framework for privacy protection of community medical internet of things: Transmission protection, storage protection and access control | |
| Ling et al. | Secure boot, trusted boot and remote attestation for ARM TrustZone-based IoT Nodes | |
| CN101983375A (en) | Binding a cryptographic module to a platform | |
| CN105027096A (en) | Securing results of privileged computing operations | |
| CN104756127A (en) | Secure data handling by a virtual machine | |
| CN101930508A (en) | Safety treatment system | |
| US10579830B1 (en) | Just-in-time and secure activation of software | |
| Khalil et al. | TPM-based authentication mechanism for apache hadoop | |
| Cooijmans et al. | Secure key storage and secure computation in Android | |
| CN101118639A (en) | Safety electric national census system | |
| Rathi et al. | Secure cloud data computing with third party auditor control | |
| Hanaoui et al. | Security requirements and model for mobile agent authentication | |
| Zhao et al. | SOMR: Towards a security-oriented MapReduce infrastructure | |
| Wu et al. | The mobile agent security enhanced by trusted computing technology | |
| Fournaris | Trust ensuring crisis management hardware module | |
| Shafqat et al. | Identity matrix: architecture framework for trusted cloud computing through cloud intellect | |
| Dhondge | Lifecycle IoT Security for Engineers | |
| Falk et al. | Enhancing integrity protection for industrial cyber physical systems |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C53 | Correction of patent for invention or patent application | ||
| CB03 | Change of inventor or designer information |
Inventor after: Liu Chuanyi Inventor after: Yuan Yuyu Inventor after: Yang Jincui Inventor after: Zhang Yangyang Inventor after: Han Qiang Inventor before: Yuan Yuyu Inventor before: Liu Chuanyi Inventor before: Yang Jincui Inventor before: Zhang Yangyang Inventor before: Han Qiang |
|
| COR | Change of bibliographic data |
Free format text: CORRECT: INVENTOR; FROM: YUAN YUYU LIU CHUANYI YANG JINCUI ZHANG YANGYANG HAN QIANG TO: LIU CHUANYIYUAN YUYU YANG JINCUI ZHANG YANGYANG HAN QIANG |
|
| DD01 | Delivery of document by public notice |
Addressee: Yuan Yuyu Document name: Notification to Pay the Fees |
|
| ASS | Succession or assignment of patent right |
Owner name: SHENZHEN YUN ANBAO TECHNOLOGY CO., LTD. Free format text: FORMER OWNER: BEIJING POSTAL AND TELECOMMUNICATIONS UNIV. Effective date: 20150323 |
|
| C41 | Transfer of patent application or patent right or utility model | ||
| COR | Change of bibliographic data |
Free format text: CORRECT: ADDRESS; FROM: 100876 HAIDIAN, BEIJING TO: 518000 SHENZHEN, GUANGDONG PROVINCE |
|
| TR01 | Transfer of patent right |
Effective date of registration: 20150323 Address after: 518000 T building 4B, two Swan Castle, overseas Chinese city, Shenzhen, Guangdong, Nanshan District Patentee after: SHENZHEN YUN AN BAO TECHNOLOGY CO., LTD. Address before: 100876 Beijing city Haidian District Xitucheng Road No. 10, No. 90. Patentee before: Beijing University of Posts and Telecommunications |
|
| DD01 | Delivery of document by public notice |
Addressee: Yuan Yuyu Document name: Notification of Passing Examination on Formalities |