TWI734379B - 用於使用初始程式載入機制啟動安全客體之電腦實施方法、電腦系統及電腦程式產品 - Google Patents

用於使用初始程式載入機制啟動安全客體之電腦實施方法、電腦系統及電腦程式產品 Download PDF

Info

Publication number
TWI734379B
TWI734379B TW109104345A TW109104345A TWI734379B TW I734379 B TWI734379 B TW I734379B TW 109104345 A TW109104345 A TW 109104345A TW 109104345 A TW109104345 A TW 109104345A TW I734379 B TWI734379 B TW I734379B
Authority
TW
Taiwan
Prior art keywords
hypervisor
computer
host server
restart
memory
Prior art date
Application number
TW109104345A
Other languages
English (en)
Chinese (zh)
Other versions
TW202101207A (zh
Inventor
維克多 米海爾洛斯基
克勞迪亞 尹布蘭達
Original Assignee
美商萬國商業機器公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 美商萬國商業機器公司 filed Critical 美商萬國商業機器公司
Publication of TW202101207A publication Critical patent/TW202101207A/zh
Application granted granted Critical
Publication of TWI734379B publication Critical patent/TWI734379B/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45545—Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45562—Creating, deleting, cloning virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45575—Starting, stopping, suspending or resuming virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)
  • Hardware Redundancy (AREA)
TW109104345A 2019-03-08 2020-02-12 用於使用初始程式載入機制啟動安全客體之電腦實施方法、電腦系統及電腦程式產品 TWI734379B (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US16/296,304 US10970100B2 (en) 2019-03-08 2019-03-08 Starting a secure guest using an initial program load mechanism
US16/296,304 2019-03-08

Publications (2)

Publication Number Publication Date
TW202101207A TW202101207A (zh) 2021-01-01
TWI734379B true TWI734379B (zh) 2021-07-21

Family

ID=70189895

Family Applications (1)

Application Number Title Priority Date Filing Date
TW109104345A TWI734379B (zh) 2019-03-08 2020-02-12 用於使用初始程式載入機制啟動安全客體之電腦實施方法、電腦系統及電腦程式產品

Country Status (14)

Country Link
US (1) US10970100B2 (US07342112-20080311-C00072.png)
EP (1) EP3935498A1 (US07342112-20080311-C00072.png)
JP (1) JP7418093B2 (US07342112-20080311-C00072.png)
KR (1) KR102672577B1 (US07342112-20080311-C00072.png)
CN (1) CN113544643A (US07342112-20080311-C00072.png)
AU (1) AU2020235010B2 (US07342112-20080311-C00072.png)
BR (1) BR112021017782B1 (US07342112-20080311-C00072.png)
CA (1) CA3132756A1 (US07342112-20080311-C00072.png)
IL (1) IL285225B2 (US07342112-20080311-C00072.png)
MX (1) MX2021010584A (US07342112-20080311-C00072.png)
SG (1) SG11202105430SA (US07342112-20080311-C00072.png)
TW (1) TWI734379B (US07342112-20080311-C00072.png)
WO (1) WO2020182642A1 (US07342112-20080311-C00072.png)
ZA (1) ZA202106314B (US07342112-20080311-C00072.png)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11308215B2 (en) * 2019-03-08 2022-04-19 International Business Machines Corporation Secure interface control high-level instruction interception for interruption enablement
US11205003B2 (en) * 2020-03-27 2021-12-21 Intel Corporation Platform security mechanism
CN113434372B (zh) * 2021-06-10 2023-07-18 浙江大华技术股份有限公司 一种定位指示的方法、设备、系统及存储介质
US11874776B2 (en) 2021-06-25 2024-01-16 Intel Corporation Cryptographic protection of memory attached over interconnects
JP7412835B1 (ja) 2022-06-29 2024-01-15 セーラ・ネットワークス株式会社 演算処理装置、演算処理システム、演算処理方法、及び演算処理プログラム

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110302400A1 (en) * 2010-06-07 2011-12-08 Maino Fabio R Secure virtual machine bootstrap in untrusted cloud infrastructures
TW201535145A (zh) * 2013-12-04 2015-09-16 Insyde Software Corp 使用保護讀取儲存器安全地儲存韌體數據之系統及方法
TW201617957A (zh) * 2014-06-27 2016-05-16 英特爾公司 鑑別變數之管理技術

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4245302A (en) 1978-10-10 1981-01-13 Magnuson Computer Systems, Inc. Computer and method for executing target instructions
US5155809A (en) * 1989-05-17 1992-10-13 International Business Machines Corp. Uncoupling a central processing unit from its associated hardware for interaction with data handling apparatus alien to the operating system controlling said unit and hardware
US6138236A (en) 1996-07-01 2000-10-24 Sun Microsystems, Inc. Method and apparatus for firmware authentication
US6658562B1 (en) * 2000-08-25 2003-12-02 International Business Machines Corporation Method, system, and program for customizing a basic input/output system (“BIOS”) configuration according to the type of user
US7356677B1 (en) * 2001-10-19 2008-04-08 Flash Vos, Inc. Computer system capable of fast switching between multiple operating systems and applications
US20080177994A1 (en) * 2003-01-12 2008-07-24 Yaron Mayer System and method for improving the efficiency, comfort, and/or reliability in Operating Systems, such as for example Windows
WO2005036367A2 (en) * 2003-10-08 2005-04-21 Unisys Corporation Virtual data center that allocates and manages system resources across multiple nodes
US9086913B2 (en) 2008-12-31 2015-07-21 Intel Corporation Processor extensions for execution of secure embedded containers
US8387114B2 (en) 2009-01-02 2013-02-26 International Business Machines Corporation Secure workload partitioning in a server environment
JP2011048661A (ja) 2009-08-27 2011-03-10 Nomura Research Institute Ltd 仮想サーバ暗号化システム
US8639783B1 (en) 2009-08-28 2014-01-28 Cisco Technology, Inc. Policy based configuration of interfaces in a virtual machine environment
WO2012076266A1 (en) 2010-12-09 2012-06-14 International Business Machines Corporation Computer-readable storage mediums for encrypting and decrypting a virtual disc
US20120179904A1 (en) 2011-01-11 2012-07-12 Safenet, Inc. Remote Pre-Boot Authentication
US10599458B2 (en) 2015-01-23 2020-03-24 Unisys Corporation Fabric computing system having an embedded software defined network
US20190095357A1 (en) * 2017-09-28 2019-03-28 Intel Corporation Hardware support for static mode of protected memory management on flexibly-convertible enclave platform

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110302400A1 (en) * 2010-06-07 2011-12-08 Maino Fabio R Secure virtual machine bootstrap in untrusted cloud infrastructures
TW201535145A (zh) * 2013-12-04 2015-09-16 Insyde Software Corp 使用保護讀取儲存器安全地儲存韌體數據之系統及方法
TW201617957A (zh) * 2014-06-27 2016-05-16 英特爾公司 鑑別變數之管理技術

Also Published As

Publication number Publication date
CA3132756A1 (en) 2020-09-17
ZA202106314B (en) 2022-07-27
WO2020182642A1 (en) 2020-09-17
BR112021017782B1 (pt) 2022-08-30
US20200285492A1 (en) 2020-09-10
IL285225B2 (en) 2024-03-01
AU2020235010A1 (en) 2021-06-17
JP2022522643A (ja) 2022-04-20
AU2020235010B2 (en) 2022-12-01
BR112021017782A2 (US07342112-20080311-C00072.png) 2021-11-23
IL285225A (en) 2021-09-30
IL285225B1 (en) 2023-11-01
US10970100B2 (en) 2021-04-06
MX2021010584A (es) 2022-03-31
KR20210118130A (ko) 2021-09-29
SG11202105430SA (en) 2021-06-29
JP7418093B2 (ja) 2024-01-19
TW202101207A (zh) 2021-01-01
KR102672577B1 (ko) 2024-06-07
CN113544643A (zh) 2021-10-22
EP3935498A1 (en) 2022-01-12

Similar Documents

Publication Publication Date Title
TWI734379B (zh) 用於使用初始程式載入機制啟動安全客體之電腦實施方法、電腦系統及電腦程式產品
JP7386882B2 (ja) セキュア仮想マシン環境におけるゲスト命令の透過的解釈
TWI772747B (zh) 用於將中斷及例外注入安全虛擬機器之電腦實施方法、電腦系統及電腦程式產品
AU2020234887B2 (en) Dispatch of a secure virtual machine
JP7436495B2 (ja) セキュア・ストレージの分離
JP2022523522A (ja) セキュア・インターフェイス制御の高レベルのページ管理
JP2022522664A (ja) ページ変更検出によるセキュアなページング
JP7525234B2 (ja) セキュア・インターフェース・コントロールの通信インターフェース