CN101957900B - Credible virtual machine platform - Google Patents
Credible virtual machine platform Download PDFInfo
- Publication number
- CN101957900B CN101957900B CN 201010518992 CN201010518992A CN101957900B CN 101957900 B CN101957900 B CN 101957900B CN 201010518992 CN201010518992 CN 201010518992 CN 201010518992 A CN201010518992 A CN 201010518992A CN 101957900 B CN101957900 B CN 101957900B
- Authority
- CN
- China
- Prior art keywords
- virtual machine
- module
- communication
- virtual
- credible
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Landscapes
- Computer And Data Communications (AREA)
Abstract
The invention discloses a credible virtual machine platform, which comprises a hard disk (11), a USB Key (10) and a nonprivileged virtual machine (6), and also comprises credible hardware (1), a security enhancement virtual machine monitor (2), a management virtual machine (3), a communication virtual machine (4) and a driving virtual machine (5). The security enhancement virtual machine monitor (2) is bidirectionally connected with the credible hardware (1) and the management virtual machine (3) respectively; the management virtual machine (3), the driving virtual machine (5) and the communication virtual machine (4) are privileged virtual machines; the management virtual machine (3) creates, manages, destroys and transfers other virtual machines; the driving virtual machine (5) provides driving needed by the operation of the virtual machine and management of a virtual credible password module; and the communication virtual machine (4) takes charge of communication between inner virtual machines and a virtual machine platform. The credible virtual machine platform has the advantages of effectively guaranteeing the safety and credibility of an operating environment of the virtual machine platform and realizing effective management and control of communication between virtual domains.
Description
Technical field
The present invention relates to a kind of virtual machine platform, particularly a kind of credible virtual machine platform.
Background technology
The current virtual machine platform comprises: common hardware platform, virtual machine monitor, a franchise virtual machine (or host operating system) and some non-franchise virtual machines.Consideration is less aspect security but the current virtual machine platform is absorbed in function more, brings very big potential safety hazard for the application on upper strata.The first, current virtual machine platform lacks the security protection of hardware level based on the common hardware Platform Implementation, and the physics root is insincere, can't guarantee the credible of virtual Domain.The second, current virtual machine platform is not mostly taked safety prevention measure, though have done the consideration on the safety, all security means all are based on software and realize that protective capability is limited.The 3rd, the safety that depends on virtual machine monitor and franchise virtual machine that the safety of whole virtual machine platform is too much, and obviously not enough to the security mechanism of virtual machine monitor and franchise virtual machine.The 4th, lack the authentication and the control of authority of virtual machine monitor level, the privilege of franchise virtual machine is too concentrated.The 5th, the communication between the virtual machine lacks effective management and control, and a virtual machine is attacked also possibly influenced to other virtual machines.
Summary of the invention
The object of the present invention is to provide a kind of credible virtual machine platform, solve the problem that current virtual machine platform security mechanism deficiency and virtual inter-domain communication lack effective management and control.
A kind of credible virtual machine platform comprises: hard disk, USBKey and non-franchise virtual machine also comprise: reliable hardware, safety strengthen virtual machine monitor, managing virtual machines, communication virtual machine and drive virtual machine; Wherein, reliable hardware comprises: credible mainboard, credible password module and credible BIOS; Safety strengthens virtual machine monitor and comprises: authentication module, control of authority module, communication control module and virtual machine integrity measurement module; Managing virtual machines comprises: non-franchise Virtual Machine Manager module, real-time encryption and decryption module and integrity measurement module; The driving virtual machine comprises: Hardware drive module and virtual credible Password Management module; The communication virtual machine comprises: communication management module, two-way authentication module and Packet Filtering module; Non-franchise virtual machine comprises communication customer end module and virtual credible crypto module.Managing virtual machines, driving virtual machine are franchise virtual machine with the virtual machine of communicating by letter, and managing virtual machines is responsible for creating, manage, destroy and moving other virtual machines; Drive virtual machine and be responsible for providing the required driving of virtual machine operation and the management of virtual credible crypto module; The communication virtual machine is responsible for the communication between internal virtual machine and the virtual machine platform.
Safety strengthen virtual machine monitor respectively with reliable hardware, managing virtual machines, communication virtual machine, drive that virtual machine is two-way to be connected; Credible mainboard in the reliable hardware is respectively with credible password module, credible BIOS, USBKey with hard disk is two-way is connected managing virtual machines and one or more non-two-way connections of franchise virtual machine; Safety strengthens in the virtual machine monitor, and authentication module, control of authority module, communication control module and virtual machine integrity measurement module are in sequential series; In the managing virtual machines, non-franchise Virtual Machine Manager module, real-time encryption and decryption module and integrity measurement module are in sequential series; In the communication virtual machine, communication management module, two-way authentication module and Packet Filtering module are in sequential series; Drive in the virtual machine, Hardware drive module is connected with virtual credible Password Management module; In the non-franchise virtual machine, the communication customer end module is connected with the virtual credible crypto module.
Computing machine powers up, and the credible password module in the reliable hardware at first starts as root of trust, and credible BIOS is carried out integrity measurement, if the tolerance failure recovers credible BIOS and measures again.After credible BIOS measured successfully, system loads BIOS normally started.Credible BIOS at first strengthens virtual machine monitor to safety and measures, tolerance through after give safety with control and strengthen virtual machine monitor.Safety enhancing virtual machine monitor at first calls authentication module the active user is carried out authentication based on USBKey; The identification user right; Call the control of authority module then and carry out control of authority, communication control module communicates control according to authority, calls virtual machine integrity measurement module at last; Respectively to managing virtual machines, drive virtual machine and measure, if measure successfully then start managing virtual machines, the driving virtual machine and the virtual machine of communicating by letter with the virtual machine of communicate by letter.When non-franchise virtual machine activation, the integrity measurement module in the managing virtual machines is measured non-franchise virtual machine, if measure successfully then start non-franchise virtual machine.So far, the credible virtual machine Platform Implementation credible startup.
After the credible virtual machine platform started, managing virtual machines, driving virtual machine, communication virtual machine and non-franchise virtual machine were realized through the Hardware drive module that drives virtual machine the visit of hardware resource.When restarting automatically when unusual appears in the Hardware drive module that drives virtual machine, can not have influence on the normal operation of other non-franchise virtual machines of not visiting this hardware device.Drive the virtual credible Password Management module in the virtual machine; Be responsible for management to the virtual credible crypto module in each non-franchise virtual machine; Realize that a plurality of non-franchise virtual machines share a real physics credible password module; To transmit in virtual Domain based on the trust chain of physics root of trust, guarantee the credible of virtual environment.
When managing virtual machines is managed non-franchise virtual machine, at first need discern current authority, user right can only open or close the operation of non-franchise virtual machine down, directly refusal establishment, the request of destroying or moving non-franchise virtual machine; Create, manage, destroy and move non-franchise virtual machine under the administrator right.When current authority is administrator right; After managing virtual machines is received establishment, destroys and moves the order of non-franchise virtual machine; At first calling the integrity measurement module measures safety enhancing virtual machine monitor; After measuring successfully, managing virtual machines strengthens virtual machine monitor to safety and sends the request of creating, destroying or move.Safety strengthens virtual machine monitor after receiving above-mentioned request, calls virtual machine integrity measurement module managing virtual machines is measured, and measures the successfully above-mentioned request of back execution.In the process of tolerance, the failure of either party tolerance shows that all virtual machine platform is distorted, and is no longer credible, the request of refusing to obey orders, and the credible virtual machine platform is initiatively closed.In the process of managing virtual machines work, non-franchise Virtual Machine Manager module invokes real-time encryption and decryption module is carried out transparent encryption and decryption to the image file and the critical data of non-franchise virtual machine, has guaranteed that image file all the time with the ciphertext storage, has strengthened security.
Communication between each virtual machine is controlled completion by the communication control module that safety strengthens in the virtual machine monitor with the virtual machine of communicating by letter jointly.Communication control module is in charge of virtual machine, is driven the communication between virtual machine and the communication virtual machine; And the communication between the non-franchise virtual machine of strict control; Can't communicate between the non-franchise virtual machine under the user right, realize the communication between the non-franchise virtual machine through the communication virtual machine under the administrator right.Under the administrator right, when any two needs in the non-franchise virtual machine are communicated by letter, suppose that communicating pair is A side and B side; The communication customer end module that at first call wherein A side is sent the request that communicates with B side to the communication virtual machine, after the communication management module in the communication virtual machine is received communication request, calls the two-way authentication module communication virtual machine and A side are carried out two-way authentication; After the authentication success, the two-way authentication module is carried out two-way authentication to communication virtual machine and B side, and authentication result is returned to A side; Under communication virtual machine, all believable situation in A side and B side, A side sends Content of Communication to the communication virtual machine, and the Packet Filtering module in the communication virtual machine detects packet; Detection through after Content of Communication is sent to B side; After Content of Communication is received in B side, return success, so far complete successfully communicating by letter of A side and B side.In the process of authentication,, stop communication at once, and authentification failure side restarts automatically if authentification failure shows that authentification failure side is no longer credible.
The present invention is root of trust with the reliable hardware, guarantees the credible startup of virtual platform; To guarantee the credible of virtual environment based on the trust chain of hardware root of trust in the virtual Domain safe transfer through virtual credible crypto module administration module; The privilege of franchise virtual machine is separated, and the stability that improves whole virtual platform is with anti-aggressive; Critical data and image file are all stored with ciphertext; Create, destroy and the migration virtual machine, under administrator right, carry out, virtual machine monitor and managing virtual machines carry out two-way authentication, improve the security of virtual machine platform; Communication between the virtual machine is carried out by means of the communication virtual machine, carries out two-way authentication before the communication, and Content of Communication is monitored, and prevents information leakage and malicious code transmission.
Description of drawings
The structural representation of a kind of credible virtual machine platform of Fig. 1.
1 trusted hardware? 2 security enhancements virtual machine monitor? 3. Managing virtual machines? 4. Communication virtual machine? 5. Driven virtual machine 6. Unprivileged virtual machine? 7. Trusted cryptographic module? 8. Credible Motherboard? 9. credible BIOS? 10.USBKey? 11. hard 12. authentication module? 13. authority control module? 14. communication control module? 15 virtual machine integrity measurement module 16. unprivileged virtual machine management module? 17 real-time encryption and decryption modules? 18. integrity measurement module? 19. communication management module 20. Mutual authentication module? 21 packet filtering module? 22. hardware driver module? 23 Virtual Trusted password management module 24. communication client end module? 25 Virtual Trusted Cryptography Module
Embodiment
A kind of credible virtual machine platform comprises: hard disk 11, USBKey10 and non-franchise virtual machine 6 also comprise: reliable hardware 1, safety strengthen virtual machine monitor 2, managing virtual machines 3, communication virtual machine 4 and drive virtual machine 5; Wherein, reliable hardware 1 comprises: credible mainboard 8, credible password module 7 and credible BIOS 9; Safety strengthens virtual machine monitor 2 and comprises: authentication module 12, control of authority module 13, communication control module 14 and virtual Domain integrity measurement module 15; Managing virtual machines 3 comprises: non-franchise Virtual Machine Manager module 16, real-time encryption and decryption module 17 and integrity measurement module 18; Driving virtual machine 5 comprises: Hardware drive module 22 and virtual credible Password Management module 23; Communication virtual machine 4 comprises: communication management module 19, two-way authentication module 20 and Packet Filtering module 21; Each non-franchise virtual machine 6 comprises communication customer end module 24 and virtual credible crypto module 25.Managing virtual machines 3, driving virtual machine 5 are franchise virtual machine with the virtual machine 4 of communicating by letter, and managing virtual machines 3 is responsible for creating, manage, destroy and moving other virtual machines; Drive virtual machine 5 and be responsible for providing the required driving of virtual machine operation and the management of virtual credible crypto module; The communication that communication virtual machine 4 is responsible between internal virtual machine and the virtual machine platform.
Safety strengthen virtual machine monitor 2 respectively with reliable hardware 1, managing virtual machines 3, communication virtual machine 4, drive 5 two-way connections of virtual machine; Credible mainboard 8 in the reliable hardware 1 respectively with credible password module 7, credible BIOS 9, USBKey 10,11 two-way connections of hard disk, managing virtual machines 3 and one or more non-franchise 6 two-way connections of virtual machine; Safety strengthens in the virtual machine monitor 2, and authentication module 12, control of authority module 13, communication control module 14, virtual machine integrity measurement module 15 are in sequential series; In the managing virtual machines 3, non-franchise Virtual Machine Manager module 16, real-time encryption and decryption module 17 and integrity measurement module 18 are in sequential series; 4 communication management module 19, two-way authentication module 20 and Packet Filtering module 21 are in sequential series in the communication virtual machine; The Hardware drive module 22 that drives in the virtual machine 5 is connected with virtual credible Password Management module 23; Communication customer end module 24 is connected with virtual credible crypto module 25 in the non-franchise virtual machine 6.
Computing machine powers up, and credible password module in the reliable hardware 17 at first starts as root of trust, and credible BIOS 9 is carried out integrity measurement, if the tolerance failure recovers credible BIOS 9 and measures again.After credible BIOS 9 measured successfully, system loads is credible, and BIOS 9 normally started.Credible BIOS 9 at first strengthens virtual machine monitor 2 to safety and measures, tolerance through after give safety with control and strengthen virtual machine monitor 2.Safety enhancing virtual machine monitor 2 at first calls 12 couples of active users of authentication module and carries out authentication based on USBKey 11; The identification user right; Call control of authority module 13 then and carry out control of authority; Communication control module 14 communicates control according to authority; Call virtual machine integrity measurement module 15 at last, respectively to managing virtual machines 3, drive virtual machine 4 and measure, if measure successfully then start managing virtual machines 3, the driving virtual machine 4 and the virtual machine 5 of communicating by letter with the virtual machine 5 of communicate by letter.When non-franchise virtual machine 6 started, 18 pairs of non-franchise virtual machines 6 of the integrity measurement module in the managing virtual machines 3 were measured, if measure successfully then start non-franchise virtual machine 6.So far, the credible virtual machine Platform Implementation credible startup.
After the credible virtual machine platform started, the visit of managing virtual machines 3, driving virtual machine 4, communication virtual machine 5 and 6 pairs of hardware resources of non-franchise virtual machine realized through the Hardware drive module 22 that drives virtual machine 5.When the Hardware drive module that drives virtual machine 5 22 appearance are unusual, restart automatically, can not have influence on the normal operation that other do not visit the non-franchise virtual machine 6 of this hardware device.Drive the virtual credible Password Management module 23 in the virtual machine 5; Be responsible for management to the virtual credible crypto module 25 in each non-franchise virtual machine 6; Realize a plurality of non-franchise virtual machines 6 shared real physics credible password modules 7; To transmit in virtual Domain based on the trust chain of physics root of trust, guarantee the credible of virtual environment.
When 3 pairs of non-franchise virtual machines 6 of managing virtual machines are managed, at first need discern current authority, user right can only carry out the operation of opening and closing to non-franchise virtual machine 6 down, directly refusal establishment, the request of destroying or moving non-franchise virtual machine 6; Create, manage, destroy and move non-franchise virtual machine 6 under the administrator right.When current authority is administrator right; Managing virtual machines 3 is after the order of receiving establishment, destroy and moving non-franchise virtual machine; At first calling 18 pairs of safety enhancings of integrity measurement module virtual machine monitor 2 measures; After measuring successfully, managing virtual machines 3 strengthens virtual machine monitor 2 to safety and sends the request of creating, destroying or move.Safety strengthens virtual machine monitor 2 after receiving above-mentioned request, calls 15 pairs of managing virtual machines 3 of virtual machine integrity measurement module and measures, and measures the successfully above-mentioned request of back execution.In the process of tolerance, the failure of either party tolerance shows that all virtual machine platform is distorted, and is no longer credible, the request of refusing to obey orders, and the credible virtual machine platform is initiatively closed.In the process of managing virtual machines 3 work; Non-franchise Virtual Machine Manager module 16 is called real-time encryption and decryption module 17; Image file and critical data to non-franchise virtual machine 6 are carried out transparent encryption and decryption, have guaranteed that image file and critical data all the time with the ciphertext storage, have strengthened security.
Communication between each virtual machine is controlled completion by the communication control module 14 that safety strengthens in the virtual machine monitor 2 with the virtual machine 4 of communicating by letter jointly.Communication control module 14 is in charge of virtual machine 3, is driven the communication between virtual machine 5 and the communication virtual machine 4; And the communication between the non-franchise virtual machine 6 of strict control; Can't communicate between the non-franchise virtual machine 6 under the user right, can be under the administrator right through the communication between the non-franchise virtual machine 6 of communication virtual machine 4 realizations.Under the administrator right, when any two needs in the non-franchise virtual machine 6 are communicated by letter, suppose that communicating pair is A side and B side; The communication customer end module 24 that at first call wherein A side is sent the request that communicates with B side to communication virtual machine 4, after the communication management module 19 in the communication virtual machine 4 is received communication request, calls 20 pairs of communication of two-way authentication module virtual machine 4 and carries out two-way authentication with A side; After the authentication success; 20 pairs of communication of two-way authentication module virtual machine 4 carries out two-way authentication with B side, and authentication result is returned to A side, under communication virtual machine 4, all believable situation in A side and B side; A side sends Content of Communication to communication virtual machine 4; Communication 21 pairs of packets of Packet Filtering module in the virtual machine 4 detect, detect through after Content of Communication is sent to B side, after Content of Communication is received in B side; Return success, so far complete successfully communicating by letter of A side and B side.In the process of authentication,, stop communication at once, and authentification failure side restarts automatically if authentification failure shows that authentification failure side is no longer credible.
Claims (1)
1. credible virtual machine platform; Comprise: hard disk (11), USBKey (10) and non-franchise virtual machine (6) is characterized in that also comprising: reliable hardware (1), safety strengthen virtual machine monitor (2), managing virtual machines (3), communication virtual machine (4) and drive virtual machine (5); Wherein, reliable hardware (1) comprising: credible mainboard (8), credible password module (7) and credible BIOS (9); Safety strengthens virtual machine monitor (2) and comprising: authentication module (12), control of authority module (13), communication control module (14) and virtual Domain integrity measurement module (15); Managing virtual machines (3) comprising: non-franchise Virtual Machine Manager module (16), real-time encryption and decryption module (17) and integrity measurement module (18); Driving virtual machine (5) comprising: Hardware drive module (22) and virtual credible Password Management module (23); Communication virtual machine (4) comprising: communication management module (19), two-way authentication module (20) and Packet Filtering module (21); Non-franchise virtual machine (6) comprises communication customer end module (24) and virtual credible crypto module (25); Managing virtual machines (3), driving virtual machine (5) are franchise virtual machine with the virtual machine of communicating by letter (4), and managing virtual machines (3) is responsible for creating, manage, destroy and moving other virtual machines; Drive virtual machine (5) and be responsible for providing the required driving of virtual machine operation and the management of virtual credible crypto module; Communication virtual machine (4) is responsible for the communication between internal virtual machine and the virtual machine platform;
Safety strengthen virtual machine monitor (2) respectively with reliable hardware (1), managing virtual machines (3), communication virtual machine (4), drive two-way connection of virtual machine (5); Credible mainboard (8) in the reliable hardware (1) respectively with credible password module (7), credible BIOS (9), USBKey (10), the two-way connection of hard disk (11), managing virtual machines (3) and two-way connection of one or more non-franchise virtual machines (6); Safety strengthens in the virtual machine monitor (2), and authentication module (12), control of authority module (13), communication control module (14), virtual machine integrity measurement module (15) are in sequential series; In the managing virtual machines (3), non-franchise Virtual Machine Manager module (16), real-time encryption and decryption module (17) and integrity measurement module (18) are in sequential series; Communication management module (19), two-way authentication module (20) and the Packet Filtering module (21) of (4) are in sequential series in the communication virtual machine; The Hardware drive module (22) that drives in the virtual machine (5) is connected with virtual credible Password Management module (23); Communication customer end module (24) is connected with virtual credible crypto module (25) in the non-franchise virtual machine (6);
Computing machine powers up, and the credible password module (7) in the reliable hardware (1) at first starts as root of trust, and credible BIOS (9) is carried out integrity measurement, if the tolerance failure recovers credible BIOS (9) and measures again; After credible BIOS (9) measured successfully, the credible BIOS of system loads (9) is normal to be started; Credible BIOS (9) at first strengthens virtual machine monitor (2) to safety and measures, tolerance through after give safety with control and strengthen virtual machine monitor (2); Safety enhancing virtual machine monitor (2) at first calls authentication module (12) active user is carried out authentication based on USBKey (11); The identification user right; Call control of authority module (13) then and carry out control of authority; Communication control module (14) communicates control according to authority; Call virtual machine integrity measurement module (15) at last, respectively to managing virtual machines (3), drive virtual machine (4) and measure, if measure successfully then start managing virtual machines (3), driving virtual machine (4) and the virtual machine of communicating by letter (5) with the virtual machine of communicating by letter (5); When non-franchise virtual machine (6) started, the integrity measurement module (18) in the managing virtual machines (3) was measured non-franchise virtual machine (6), if measure successfully then start non-franchise virtual machine (6); So far, the credible virtual machine Platform Implementation credible startup;
After the credible virtual machine platform started, managing virtual machines (3), driving virtual machine (4), communication virtual machine (5) and non-franchise virtual machine (6) were realized through the Hardware drive module (22) that drives virtual machine (5) the visit of hardware resource; When restarting automatically when unusual appears in the Hardware drive module (22) that drives virtual machine (5), can not have influence on the normal operation that other do not visit the non-franchise virtual machine (6) of this hardware device; Drive the virtual credible Password Management module (23) in the virtual machine (5); Be responsible for management to the virtual credible crypto module (25) in each non-franchise virtual machine (6); Realize that a plurality of non-franchise virtual machines (6) share a real physics credible password module (7); To transmit in virtual Domain based on the trust chain of physics root of trust, guarantee the credible of virtual environment;
Managing virtual machines (3) is to non-franchise virtual machine (6) when managing; At first need discern current authority; User right can only carry out the operation of opening and closing to non-franchise virtual machine (6) down, directly refusal establishment, the request of destroying or moving non-franchise virtual machine (6); Create, manage, destroy and move non-franchise virtual machine (6) under the administrator right; When current authority is administrator right; Managing virtual machines (3) is after the order of receiving establishment, destroy and moving non-franchise virtual machine; At first calling integrity measurement module (18) measures safety enhancing virtual machine monitor (2); After measuring successfully, managing virtual machines (3) strengthens virtual machine monitor (2) to safety and sends the request of creating, destroying or move; Safety strengthens virtual machine monitor (2) after receiving above-mentioned request, calls virtual machine integrity measurement module (15) managing virtual machines (3) is measured, and measures the successfully above-mentioned request of back execution; In the process of tolerance, the failure of either party tolerance shows that all virtual machine platform is distorted, and is no longer credible, the request of refusing to obey orders, and the credible virtual machine platform is initiatively closed; In the process of managing virtual machines (3) work; Non-franchise Virtual Machine Manager module (16) is called real-time encryption and decryption module (17); Image file and critical data to non-franchise virtual machine (6) are carried out transparent encryption and decryption; Guaranteed that image file and critical data all the time with the ciphertext storage, have strengthened security;
Communication between each virtual machine is controlled completion by the communication control module (14) that safety strengthens in the virtual machine monitor (2) with the virtual machine of communicating by letter (4) jointly; Communication control module (14) is in charge of virtual machine (3), is driven the communication between virtual machine (5) and the communication virtual machine (4); And the communication between the strict non-franchise virtual machine of control (6); Can't communicate between the non-franchise virtual machine (6) under the user right, can realize the communication between the non-franchise virtual machine (6) through communication virtual machine (4) under the administrator right; Under the administrator right, when any two needs in the non-franchise virtual machine (6) are communicated by letter, suppose that communicating pair is A side and B side; The communication customer end module (24) that at first call wherein A side is sent the request that communicates with B side to communication virtual machine (4), after the communication management module (19) in the communication virtual machine (4) is received communication request, calls two-way authentication module (20) communication virtual machine (4) and A side are carried out two-way authentication; After the authentication success; Two-way authentication module (20) is carried out two-way authentication to communication virtual machine (4) and B side, and authentication result is returned to A side, under communication virtual machine (4), all believable situation in A side and B side; A side sends Content of Communication to communication virtual machine (4); Packet Filtering module (21) in communication virtual machine (4) detects packet, detect through after Content of Communication is sent to B side, after Content of Communication is received in B side; Return success, so far complete successfully communicating by letter of A side and B side; In the process of authentication,, stop communication at once, and authentification failure side restarts automatically if authentification failure shows that authentification failure side is no longer credible.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 201010518992 CN101957900B (en) | 2010-10-26 | 2010-10-26 | Credible virtual machine platform |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 201010518992 CN101957900B (en) | 2010-10-26 | 2010-10-26 | Credible virtual machine platform |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101957900A CN101957900A (en) | 2011-01-26 |
| CN101957900B true CN101957900B (en) | 2012-02-15 |
Family
ID=43485225
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 201010518992 Expired - Fee Related CN101957900B (en) | 2010-10-26 | 2010-10-26 | Credible virtual machine platform |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101957900B (en) |
Families Citing this family (22)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102202046B (en) * | 2011-03-15 | 2012-10-17 | 北京邮电大学 | Network-operating-system-oriented trusted virtual operating platform |
| CN102811239B (en) * | 2011-06-03 | 2017-09-12 | 中兴通讯股份有限公司 | A kind of dummy machine system and its method of controlling security |
| CN102270287B (en) * | 2011-07-13 | 2013-07-24 | 中国人民解放军海军计算技术研究所 | Trusted software base providing active security service |
| CN102332069B (en) * | 2011-08-05 | 2014-02-26 | 道里云信息技术(北京)有限公司 | Method and system for full life cycle security management of virtual machine |
| WO2013032495A1 (en) | 2011-08-30 | 2013-03-07 | Hewlett-Packard Development Company , L.P. | Communication with a virtual trusted runtime bios |
| US20130074064A1 (en) * | 2011-09-15 | 2013-03-21 | Microsoft Corporation | Automated infrastructure provisioning |
| CN103186408A (en) * | 2011-12-29 | 2013-07-03 | 英业达股份有限公司 | Management method of operated virtual machine, system and device thereof |
| CN102930213A (en) * | 2012-10-25 | 2013-02-13 | 中国航天科工集团第二研究院七〇六所 | Security monitoring system and security monitoring method based on virtual machine |
| CN102999357B (en) * | 2012-11-16 | 2015-11-25 | 北京奇虎科技有限公司 | A kind of collocation method and system of trusting machine |
| CN102984229B (en) * | 2012-11-16 | 2015-08-19 | 北京奇虎科技有限公司 | For configuring the method and system of trust machine |
| CN103279703B (en) * | 2013-06-07 | 2018-02-02 | 国网江西省电力公司信息通信分公司 | A kind of method for building desktop cloud virtual trust safety wall |
| CN104252375B (en) | 2013-06-25 | 2017-07-28 | 国际商业机器公司 | Method and system for sharing USB Key positioned at multiple virtual machines of different main frames |
| CN103455373A (en) * | 2013-09-18 | 2013-12-18 | 浪潮电子信息产业股份有限公司 | Dynamic migration security framework of virtual machine |
| CN103532985B (en) * | 2013-11-01 | 2016-08-24 | 中国联合网络通信集团有限公司 | Communication means, equipment and system between virtual machine |
| CN103747036B (en) * | 2013-12-23 | 2017-05-24 | 中国航天科工集团第二研究院七〇六所 | Trusted security enhancement method in desktop virtualization environment |
| CN103810422B (en) * | 2014-02-20 | 2017-05-17 | 东莞中国科学院云计算产业技术创新与育成中心 | Safety virtualization isolation method based on mirror image intelligent management |
| CN105656842A (en) * | 2014-11-12 | 2016-06-08 | 江苏威盾网络科技有限公司 | Method for ensuring secure intranet environment |
| CN104991809A (en) * | 2015-06-18 | 2015-10-21 | 浪潮电子信息产业股份有限公司 | Virtual machine admission method and apparatus based on trusted computing |
| CN105184164B (en) * | 2015-09-08 | 2017-11-24 | 成都博元科技有限公司 | A kind of data processing method |
| CN105574415A (en) * | 2015-12-08 | 2016-05-11 | 中电科华云信息技术有限公司 | Security management method of virtual machine based on trust root |
| CN108009423B (en) * | 2017-12-04 | 2021-06-22 | 浪潮通用软件有限公司 | Virtual machine password processing method and system and password generation tool |
| CN111967010B (en) * | 2019-05-20 | 2024-05-24 | 阿里巴巴集团控股有限公司 | Trusted service method, trusted service device, trusted service equipment and storage medium |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7424709B2 (en) * | 2003-09-15 | 2008-09-09 | Intel Corporation | Use of multiple virtual machine monitors to handle privileged events |
| CN101216777B (en) * | 2008-01-11 | 2010-11-03 | 华中科技大学 | Rapid deployment system under multi-dummy machine environment |
| CN101493781B (en) * | 2008-01-24 | 2012-02-15 | 中国长城计算机深圳股份有限公司 | Virtual machine system and start-up method thereof |
| CN101226577A (en) * | 2008-01-28 | 2008-07-23 | 南京大学 | Method for protecting microkernel OS integrality based on reliable hardware and virtual machine |
| CN101430674B (en) * | 2008-12-23 | 2010-10-20 | 北京航空航天大学 | Intraconnection communication method of distributed virtual machine monitoring apparatus |
| CN101866408B (en) * | 2010-06-30 | 2011-11-30 | 华中科技大学 | Transparent trust chain constructing system based on virtual machine architecture |
-
2010
- 2010-10-26 CN CN 201010518992 patent/CN101957900B/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| CN101957900A (en) | 2011-01-26 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101957900B (en) | Credible virtual machine platform | |
| Santos et al. | Towards Trusted Cloud Computing. | |
| US8352740B2 (en) | Secure execution environment on external device | |
| Gou et al. | Analysis of various security issues and challenges in cloud computing environment: a survey | |
| CN103747036B (en) | Trusted security enhancement method in desktop virtualization environment | |
| Grobauer et al. | Understanding cloud computing vulnerabilities | |
| Vaquero et al. | Locking the sky: a survey on IaaS cloud security | |
| England et al. | A trusted open platform | |
| Ying et al. | Truz-droid: Integrating trustzone with mobile operating system | |
| Doelitzscher et al. | Designing cloud services adhering to government privacy laws | |
| US20120198514A1 (en) | Methods and Apparatuses for User-Verifiable Trusted Path in the Presence of Malware | |
| Nguyen et al. | Cloud-based secure logger for medical devices | |
| AU2018201934B2 (en) | Network based management of protected data sets | |
| WO2009154705A1 (en) | Interconnectable personal computer architectures that provide secure, portable and persistent computing environments | |
| WO2012111018A1 (en) | Secure tamper proof usb device and the computer implemented method of its operation | |
| Sadeghi | Trusted computing—special aspects and challenges | |
| Celesti et al. | A remote attestation approach for a secure virtual machine migration in federated cloud environments | |
| CN101833620A (en) | Custom security JDBC driver-based database protective method | |
| Mayrhofer | An architecture for secure mobile devices | |
| CN101196968A (en) | Security protection method for single machine information | |
| Pop et al. | Secure migration of WebAssembly-based mobile agents between secure enclaves | |
| Will et al. | Using a shared SGX enclave in the UNIX PAM authentication service | |
| Rajasekar et al. | Exploitation of Vulnerabilities in Cloud-Storage | |
| Fera et al. | Enhancing security in Cloud using trusted monitoring framework | |
| Brasser et al. | Softer Smartcards: Usable Cryptographic Tokens with Secure Execution |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20120215 Termination date: 20191026 |