WO2021174655A1

WO2021174655A1 - Method and apparatus for determining trusted state of virtual data center, device and storage medium

Info

Publication number: WO2021174655A1
Application number: PCT/CN2020/087107
Authority: WO
Inventors: 刘海伟
Original assignee: 苏州浪潮智能科技有限公司
Priority date: 2020-03-06
Filing date: 2020-04-27
Publication date: 2021-09-10
Also published as: CN111352702A

Abstract

A method and apparatus for determining a trusted state of a virtual data center, a device, and a computer-readable storage medium. The method for determining the trusted state is based on a trusted management and control component of a computing pool, and comprises: by means of a basic input and output system, acquiring an operating feature value of a host to be tested in a virtual data center when resources are started; acquiring a reference value corresponding to the host, wherein the reference value has the same data type as the operating feature value; and comparing the operating feature value to the reference value, and determining the trusted state of the host according to the comparison result. It may be seen that in the present application, by means of comparing the operating feature value of a server/virtual host of the virtual data center to the reference value, the trusted state of the server/virtual host may be determined, thereby ensuring the security of physical resources and virtual resources of the virtual data center.

Description

Method, device, equipment and storage medium for determining trusted state of virtual data center

This application claims the priority of the Chinese patent application filed with the Chinese Patent Office on March 6, 2020, the application number is 202010152749.3, and the invention title is "the method, device, equipment and storage medium for determining the credibility of a virtual data center", all of which The content is incorporated in this application by reference.

Technical field

The present invention relates to the technical field of data security, and more specifically, to a method, device, equipment and computer-readable storage medium for determining the trusted state of a virtual data center.

Background technique

At present, more and more enterprises and scientific research institutions adopt the private cloud model in cloud computing to deploy their own virtual data centers. A virtual data center deployed in a private cloud can bring advantages such as cost savings and flexible deployment, but it also brings new security risks compared to traditional data centers. Traditional data centers usually use firewalls, intrusion detection, access control and other mechanisms to protect computing, storage, and network resources. At the same time, physical security measures such as lockable cabinets can also be used to protect the physical hardware of the data center. However, the virtual data center deployment unit is a virtual machine, and the entire life cycle (computing, storage, and network) is managed and monitored by corresponding virtualization management software. In order to ensure business convenience, continuity, and stability, the private cloud environment also has features such as migration, backup, and snapshots. Therefore, the aforementioned security solutions are not applicable to virtual data centers.

Summary of the invention

The purpose of the present invention is to provide a method, device, equipment and computer-readable storage medium for determining the trusted state of a virtual data center to determine the trusted state of the virtual data center and improve the security of the resources of the virtual data center.

To achieve the above objective, the present invention provides a method for determining the trusted state of a virtual data center. The method for determining the trusted state is based on a computing pool trusted management and control component, and the determination of the trusted state includes:

Obtain the operating characteristic value of the host under test in the virtual data center when the resource is started through the basic input output system; wherein, the under test host is a server or a virtual host deployed on the server, and the basic input output system is the server or the virtual host. The trusted basic input and output system of the host;

Acquire a reference value corresponding to the host to be tested; the reference value is the initial operating characteristic value of the host to be tested that is pre-stored by the basic input output system when the resource is first created; the reference value is the same as the The data types of running characteristic values are the same;

The operating characteristic value is compared with the reference value, and the trusted state of the host to be tested is determined according to the comparison result.

Wherein, before acquiring the operating characteristic value of the host under test in the virtual data center through the basic input output system when the resource is started, the method further includes:

Judging whether the host to be tested is a newly-built host;

If not, continue to perform the step of obtaining the operating characteristic value of the host to be tested in the virtual data center when the resource is started through the basic input output system;

If so, call the basic input output system to obtain the initial operating characteristic value of the host under test when the resource is started, and store the initial operating characteristic value as the reference value of the host under test.

Wherein, said obtaining the operating characteristic value of the host under test of the virtual data center when the resource is started includes: initializing the TPM trusted platform module; obtaining the characteristic value of the Boot Block of the basic input output system, and the characteristic value of the basic input output system. At least one of the feature value of the Option ROM, the feature value of the OS Loader, and the feature value of the OS Kernel is recorded in the PCR register of the TPM trusted platform module.

Wherein, the comparing the operating characteristic value with the reference value, and determining the trusted state of the host under test according to the comparison result includes:

The feature value of the Boot Block of the basic input output system is compared with the Boot Block reference value to obtain the first comparison result; the feature value of the Option ROM of the basic input output system is compared with the Option ROM reference value to obtain the first comparison result. 2. Comparison result: Compare the characteristic value of OS Loader with the reference value of OS Loader to obtain the third comparison result; compare the characteristic value of OS Kernel with the reference value of OS Kernel to obtain the fourth comparison result;

If the first comparison result, the second comparison result, the third comparison result, and the fourth comparison result are all the same, the host to be tested is determined to be a trusted host; if any one of them exists If the comparison result is not the same, it is determined that the host to be tested is an untrusted host.

To achieve the above objective, the present invention further provides a device for determining a trusted state of a virtual data center, the device for determining a trusted state is based on a computing pool trusted management and control component, and the device for determining a trusted state includes:

The characteristic value acquisition module is used to acquire the operating characteristic value of the host under test of the virtual data center when the resource is started through the basic input output system; wherein, the host under test is a server or a virtual host deployed on the server, and the basic The input and output system is a trusted basic input and output system of the server or the virtual host;

The reference value acquisition module is configured to acquire a reference value corresponding to the host to be tested; the reference value is the initial operating characteristic value of the host to be tested that is pre-stored through the basic input output system when the resource is first created; The reference value is the same as the data type of the operating characteristic value;

The comparison module is used to compare the operating characteristic value with the reference value, and determine the trusted state of the host under test according to the comparison result.

Among them, this program also includes:

The judging module is used to judge whether the host to be tested is a newly-built host;

The characteristic value obtaining module is specifically configured to obtain the operating characteristic value of the host under test in the virtual data center when the resource is started through the basic input output system when the host under test is not a newly-built host;

The initial operating characteristic value obtaining module is used to obtain the initial operating characteristic value of the host under test when the resource is started through the basic input output system when the host under test is a new host;

The storage module is configured to store the initial operating characteristic value as the reference value of the host to be tested.

Wherein, the characteristic value acquisition module includes:

The initialization unit is used to initialize the TPM trusted platform module;

The feature value obtaining unit is used to obtain at least one of the feature value of the Boot Block of the basic input output system, the feature value of the Option ROM of the basic input output system, the feature value of the OS Loader, and the feature value of the OS Kernel , And record it in the PCR register of the TPM trusted platform module.

Wherein, the comparison module includes:

The comparison unit is used to compare the feature value of the Boot Block of the basic input output system with the reference value of the Boot Block to obtain a first comparison result; compare the feature value of the Option ROM of the basic input output system with the reference value of Option ROM Make a comparison to obtain the second comparison result; compare the characteristic value of the OS Loader with the OS Loader reference value to obtain the third comparison result; compare the characteristic value of the OS Kernel with the reference value of the OS Kernel to obtain the fourth comparison result;

A determining unit, configured to determine that the host to be tested is a trusted host when the first comparison result, the second comparison result, the third comparison result, and the fourth comparison result are all the same; If the comparison result of any one is different, it is determined that the host to be tested is an untrusted host.

In order to achieve the above objective, the present invention further provides a device for determining the trusted state of a virtual data center, including: a memory, used to store a computer program; a processor, used to implement the above-mentioned trusted state determination when the computer program is executed Method steps.

In order to achieve the above object, the present invention further provides a computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the method for determining a trusted state as described above are implemented .

It can be seen from the above solution that a method for determining the trusted state of a virtual data center provided by an embodiment of the present invention is based on a computing pool trusted management and control component, and the determination of the trusted state includes: through basic input and output The system obtains the operating characteristic value of the host under test in the virtual data center when the resource is started; wherein, the host under test is a server or a virtual host deployed on the server, and the basic input output system is the server or the virtual host. The trusted basic input output system of the host, the reference value is the same as the data type of the operating characteristic value; the reference value corresponding to the host to be tested is obtained; the reference value is pre-stored through the basic input output system The initial operating characteristic value of the host under test when the resource is first created; the operating characteristic value is compared with the reference value, and the trusted state of the host under test is determined according to the comparison result.

It can be seen that in this application, by comparing the operating characteristic value of the server/virtual host of the virtual data center with the reference value, the trusted state of the server/virtual host can be determined, thereby ensuring the physical resources and virtual host of the virtual data center. Security of resources; the present invention also discloses a device, equipment and computer-readable storage medium for determining the trusted state of a virtual data center, which can also achieve the above technical effects.

Description of the drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

FIG. 1 is a schematic flowchart of a method for determining the trusted state of a virtual data center disclosed in an embodiment of the present invention;

2 is a flow chart of building a trust chain based on the trusted BIOS of a TPM trusted platform module disclosed in an embodiment of the present invention;

3 is a flowchart of determining the trusted state of the host under test disclosed in the embodiment of the present invention;

Figure 4 is a schematic diagram of the system structure disclosed in an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an apparatus for determining a trusted state of a virtual data center disclosed in an embodiment of the present invention;

Fig. 6 is a schematic structural diagram of a device for determining a trusted state of a virtual data center disclosed in an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by a person of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

The embodiment of the invention discloses a method, device, equipment and computer-readable storage medium for determining the trusted state of a virtual data center to determine the trusted state of the virtual data center and improve the security of the resources of the virtual data center.

Referring to Figure 1, an embodiment of the present invention provides a method for determining the trusted state of a virtual data center. The method for determining a trusted state is based on a computing pool trusted management and control component and includes:

S101. Obtain the operating characteristic value of the host under test in the virtual data center when the resource is started through the basic input output system; where the host under test is a server or a virtual host deployed on the server, and the basic input output system is a server or a virtual host Trusted basic input output system;

It should be noted that in this application, a trusted server cluster needs to be deployed first. The trusted server cluster is composed of several trusted servers and can provide basic and physical computing resources. In addition, each server in this application is a high-security technology based on TPM (Trusted Platform Module, security chip in trusted computing) trusted platform module, trusted BIOS (Basic Input Output System, basic input output system) firmware and other technologies. The server has the characteristics of high security, high performance, and high reliability; this trusted BIOS provides the lowest and most direct hardware settings and control for the computer. On this physical computing resource, a trusted virtualization component and a computing pool trusted management and control component are deployed.

In this application, the trusted virtualization component is a physical resource based on a trusted server cluster, which can virtualize multiple VMs (Virtual Machine, virtual machine: computing resources virtualized under cloud computing) virtualization management software. Through this virtualization component, a real, single physical server can be virtualized into multiple, virtual virtual hosts. Compared with ordinary virtualization management software, the virtualization management software can create a vTPM (Virtual Trusted Platform Module) for each VM virtual machine, and at the same time, provides a virtual trusted BIOS.

The trusted management and control component of the computing pool is mainly based on the trusted server cluster and the trusted virtualization component to manage and control the trusted state of each trusted server in the trusted server cluster, and each VM virtual machine virtualized by the virtualization management software In order to create a logical trusted computing pool. The cloud hosts in the trusted computing pool all have trusted hardware and trusted software, and provide safe and reliable computing resources to the outside world. It is understandable that cloud hosts include server clusters and virtual machines virtualized in the clusters. The hardware refers to the server physical hardware (such as network card, RAID, graphics card), physical firmware (such as BIOS, OptionROM) in the server cluster, and the virtual hardware and virtual firmware of the virtual machines in the cluster. Software refers to the virtualization software under the servers in the server cluster, system software (such as OS Loader and OS Kernel running on the server) and system software of the virtual machines in the cluster (such as OS Loader and OS Kernel running on the virtual machines) .

S102. Obtain a reference value corresponding to the host to be tested; the reference value is the initial operating characteristic value of the host to be tested stored in advance through the basic input output system when the resource is first created; the reference value is the same as the data type of the operating characteristic value;

In this application, in order to determine the trusted state of the host under test, it is necessary to pre-store the reference value for comparison through the basic input output system. The reference value is the initial operating characteristic value of the host under test when the resource is first created; the reference value The type is the same as the operating characteristic value type in S102, that is, if the operating characteristic value includes: the characteristic value of the Boot Block of the basic input output system, the characteristic value of the Option ROM of the basic input output system, the characteristic value of the OS Loader, and the OS The characteristic value of the kernel, the reference value also includes the reference value of the Boot Block of the basic input output system, the reference value of the Option ROM of the basic input output system, the reference value of the OS Loader, and the reference value of the OS Kernel.

It should be noted that the host to be tested in this application can be a trusted server in a trusted server cluster, or a virtual machine created by a trusted virtualization component on a trusted server cluster. Therefore, if the host to be tested is For a trusted server, the basic input output system BIOS is the trusted BIOS of the trusted server, and if the host to be tested is a virtual machine, the basic input output system BIOS is the trusted BIOS of the virtual machine. Correspondingly, the operating characteristic value when the resource is started in this application can be the operating characteristic value when the physical resource of the server is started, or the operating characteristic value when the virtual resource of the virtual machine is started. It varies from host to host, and the operating feature value in this application can be the feature value of the Boot Block of the basic input output system, the feature value of the Option ROM of the basic input output system, the feature value of the OS Loader, and the feature of the OS Kernel. The value and so on are not specifically limited here.

It is understandable that the basic input output system BIOS is the unit that performs boot measurement during the process of initializing and booting the hardware of the server or virtual machine. It is the first unit to start the server or virtual machine and can measure the integrity of the current boot object. . For ordinary servers or virtual machines, it completes hardware initialization. In this solution, in addition to this function, it also measures hardware (when it is determined that the hardware at the current moment is credible, the current measurement value can be used as the reference value. The server or virtual machine also executes the subsequent startup process. The measurement operation, the measurement value is obtained, as the running characteristic value). It just completes the function of initialization and measurement.

The trusted management and control component of the computing pool is a determination unit that determines whether the trusted hardware and trusted software are trusted. Simply put, it has three functions: 1. When a new virtual machine or a new server is added to the cluster, it issues a command to let the BIOS extract the measurement value at the current moment and put it in the database as a reference value; 2. Monitor the server or During the restart process of the virtual machine, obtain the BIOS measurement value during the startup process, and use the measurement value as the operating characteristic value, and then compare the operating characteristic value with the benchmark value to determine whether it is credible, and if it is equal, it is credible; 3. External Provide trusted status.

That is to say, the basic input output system BIOS in this solution only boots the hardware and system software, and measures the role of the boot hardware and system software. The trusted management and control component of the computing pool determines the measurement value at which time is used as the reference value and the measurement value at which time is used as the operating characteristic value, and provides the role of the trusted state of the hardware and system software at a certain time.

S103: Compare the operating characteristic value with the reference value, and determine the trusted state of the host to be tested according to the comparison result.

In this application, when comparing the operating characteristic value with the reference value, and determining the trustworthy status of the host to be tested according to the comparison result, it may include: comparing the operating characteristic value with the reference value, and judging whether the operating characteristic value and the reference value are Same; if they are the same, the host to be tested is determined to be a trusted host; if they are not the same, the host to be tested is determined to be an untrusted host.

It can be seen that the trusted management and control component of the computing pool in this application can be based on the real physical resources of the trusted server cluster and the virtual resources of the trusted virtualization component, and use the physical resources and virtual resources saved in advance during the startup process of the physical resources and the virtual resources. The baseline value of the resource at the first creation is used as the baseline, and then the operating characteristic values of the physical resources and virtual resources at subsequent startups are obtained, and the baseline values and operating characteristic values are compared to accurately determine the physical servers and trusted virtualization components of the trusted server cluster The trusted state of the virtual host is used in this way to build a trusted computing pool and improve the security of virtual data center resources.

Based on the foregoing embodiment, in this embodiment, before acquiring the operating characteristic value of the host under test of the virtual data center at resource startup through the basic input output system, the method further includes: determining whether the host under test is a new host; if not , Continue to perform the step of obtaining the operating characteristic value of the host under test in the virtual data center through the basic input output system when the resource is started; if so, obtain the initial operating characteristic value of the host under test when the resource is started through the basic input output system And store the initial operating characteristic value as the reference value of the host to be tested.

In addition, when obtaining the operating characteristic value of the host under test of the virtual data center when the resource is started, this application may specifically include: initializing the TPM trusted platform module; obtaining the characteristic value of the Boot Block of the basic input output system and the basic input output system At least one of the feature value of the Option ROM, the feature value of the OS Loader, and the feature value of the OS Kernel is recorded in the PCR register of the TPM trusted platform module.

It is understandable that since the operating system is not started during the BIOS boot process, the feature value record of the hardware cannot depend on the operating system, and the feature value cannot be tampered with, ensuring that the computing pool trusted management and control component determines the trusted state The characteristic value of is the characteristic value recorded during the BIOS boot process. The PCR (Platform Configuration Register) register of the TPM trusted platform module just meets this requirement. After the PCR platform configuration register is fully recorded, after the boot completion status is set by the BIOS, the operating system can only read the value in the PCR register, but cannot modify the value in the PCR register. in. The PCR register is composed of a total of 24 registers PCR0-PCR23. Usually PCR0-PCR7 is used for the storage of the characteristic value of the measurement object of the hardware, and PCR8-PCR23 is used for the storage of the characteristic value of the software. In this application, it is used to obtain the basic input output system. The feature value of Boot Block, the feature value of Option ROM of the basic input output system, the feature value of OS Loader, and the feature value of OS Kernel are examples for illustration. Therefore, PCR0, PCR2, PCR4, and PCR4 are used in this application. PCR8.

It should be noted that whether it is to obtain the operating characteristic value or the reference value, the acquisition process is the same. Here, the characteristic value of the Boot Block of the basic input output system, the characteristic value of the Option ROM of the basic input output system, and the OS are obtained. The four characteristic values of Loader's characteristic value and OS Kernel's characteristic value are examples to explain the acquisition process in detail:

First, the host to be tested is powered on, and the trusted BIOS initializes the TPM trusted platform module to ensure that the internal TPM is in the initial state;

Then, the trusted BIOS measures the Boot Block in the BIOS and records it in the PCR 0 register of the TPM Trusted Platform Module; among them, the Boot Block is the first boot code in the BIOS, and the purpose of measuring the Boot Block is to ensure that the BIOS is complete of. The measurement refers to the Sha256 hash operation of the target object to obtain the characteristic value of the object. The characteristic value represents the integrity of the measured object. When the Boot Block is measured, the target object is the Boot Block.

The trusted BIOS measures the Option ROM in the BIOS, and then records it in the PCR 2 register of the TPM trusted platform module; among them, Option ROM is a code segment used for device initialization and system startup, and is a very important boot object for system hardware. The measurement of this object can reflect the integrity of the system's PCI hardware devices. The trusted BIOS measures the OS Loader, and then records it in the PCR 4 register of the TPM trusted platform module; among them, OS Loader refers to the boot loader (currently Grub on ICS), which can reflect the boot process of the system by measuring this object Whether it meets expectations. The trusted BIOS measures the OS Kernel, and then records it in the PCR 8 register of the TPM Trusted Platform Module; among them, OS kernel refers to the operating system kernel, which is the core of the operating system's startup, loading, and operation, and the object can be measured to reflect operations Whether the system starts normally, the meaning of the measurement is consistent with the above-mentioned record.

Further, the trusted BIOS sets the state of the TPM trusted platform module to mark the end of the boot phase and the OS is running normally. The PCR register of the TPM trusted platform module is read-only and cannot be written, so as to prevent the characteristic value of the PCR register from being illegally tampered with; the above-mentioned trusted BIOS obtains the BIOS Boot Block, Option ROM, OS Loader, OS Kernel reference value process can be called construction The process of the chain of trust, see FIG. 2, is a flow chart of constructing a chain of trust based on the trusted BIOS of the TPM trusted platform module disclosed in the embodiment of the present invention. Through this process, the operating characteristic values of the resources can be obtained in sequence.

Among them, if the operating characteristic value obtained by this application includes the characteristic value of Boot Block, the characteristic value of Option ROM, the characteristic value of OS Loader, and the characteristic value of OS Kernel, then this application determines the reliability of the host under test. The process specifically includes the following steps:

The feature value of the Boot Block of the basic input output system is compared with the Boot Block reference value to obtain the first comparison result; the feature value of the Option ROM of the basic input output system is compared with the Option ROM reference value to obtain the first comparison result. 2. Comparison result; compare the characteristic value of OS Loader with the OS Loader reference value to obtain the third comparison result; compare the characteristic value of OS Kernel with the reference value of OS Kernel to obtain the fourth comparison result; if said first If the comparison result, the second comparison result, the third comparison result, and the fourth comparison result are all the same, the host to be tested is determined to be a trusted host; if there is any one, the comparison result is different , It is determined that the host to be tested is an untrusted host.

It should be noted that in this application, the trusted management and control component of the computing pool can first determine whether the current host to be tested is a new host, that is, whether the real physical host of the trusted server cluster and the virtual host of the trusted virtualization component are determined It is a new host; if it is a new host, you need to obtain the initial operating characteristic value of the host to be tested when the resource is first created. When the host to be tested is started, extract the values of PCR0, PCR2, PCR4, PCR8 and save them to In the whitelist database, they are used as the reference values of BIOS Boot Block, Option ROM, OS Loader, and OS Kernel.

If the host to be tested is not a new host, you need to obtain the values of PCR0, PCR2, PCR4, PCR8 as the current operating characteristic values, and read the BIOS Boot Block, Option ROM, OS Loader, and OS Kernel benchmarks from the whitelist database The values are compared one by one, if they are all the same, it means that the host under test is trustworthy, and if one of them is different, it means that the host under test is not trustworthy; see Figure 3, which is the host under test disclosed in the embodiment of the present invention The flow chart for determining the trusted state shows that through this process, the trusted state of the server/virtual host can be determined by comparing the operating characteristic value of the server/virtual host in the virtual data center with the reference value, so as to ensure The security of the physical resources and virtual resources of the virtual data center.

Participate in Figure 4, which is a schematic diagram of the system structure disclosed in this application; it can be seen from this figure that the trusted server cluster in the trusted computing pool includes trusted BIOS and TPM2.0, and the trusted virtualization components include virtual trusted BIOS And vTPM2.0, the trusted management and control component of the computing pool determines the trusted state of the server through the trusted BIOS and TPM2.0, and the trusted state of the virtual machine can be determined through the virtual trusted BIOS and vTPM2.0, the trusted management and control component of the computing pool It can monitor the trusted status of the CPU pool, memory pool, and storage pool, specifically: when the hardware in the computing pool, such as the RAID card in the server or the virtual disk in the virtual machine, changes, such as external attacks or malicious tampering by the administrator, When the measurement value changes during the BIOS boot process, which is different from the baseline value (for example, when a new virtual machine is created or a server is newly added to a cluster), the computing pool trusted management software will monitor this change and provide an untrusted state. A trusted cloud host can be determined through the trusted computing pool. The trusted cloud host is a server in a trusted server cluster. A trusted virtual machine is deployed on the trusted cloud host. Hardware and trusted software.

The following describes the trusted state determining device provided by the embodiment of the present invention. The trusted state determining device described below and the trusted state determining method described above can be cross-referenced.

Referring to FIG. 5, an embodiment of the present invention provides a device for determining a trusted state of a virtual data center. The device for determining a trusted state is based on a computing pool trusted management and control component, and the device for determining a trusted state includes:

The characteristic value obtaining module 100 is used to obtain the operating characteristic value of the host under test of the virtual data center when the resource is started through the basic input output system; the host under test is a server or a virtual host deployed on the server, and the basic input output system Trusted basic input output system for server or virtual host;

The reference value obtaining module 200 is configured to obtain a reference value corresponding to the host to be tested; the reference value is the initial operating characteristic value of the host to be tested stored in advance through the basic input output system when the resource is first created;

The comparison module 300 is configured to compare the operating characteristic value with the reference value, and determine the trusted state of the host to be tested according to the comparison result.

Among them, this application also includes:

The characteristic value obtaining module is specifically configured to obtain, through the basic input output system, the operating characteristic value of the host to be tested in the virtual data center when the resource is started when the host to be tested is not a newly-built host;

An initial operating characteristic value obtaining module, configured to obtain the initial operating characteristic value of the host under test when the resource is started through the basic input output system when the host under test is a newly-built host;

Wherein, the comparison module includes:

Wherein, the characteristic value acquisition module includes:

The initialization unit is used to initialize the TPM trusted platform module;

The embodiment of the invention also discloses a device for determining the trusted state of a virtual data center, including:

Memory, used to store computer programs;

The processor is configured to implement the steps of the trusted state determination method described in any of the foregoing method embodiments when the computer program is executed.

In this embodiment, the device may be a server, or a terminal device such as a PC (Personal Computer), a smart phone, a tablet computer, a palmtop computer, and a portable computer.

Refer to FIG. 6, which is a schematic structural diagram of a device for determining a trusted state of a virtual data center disclosed in an embodiment of the present invention. It can be seen that the device may include a memory 11, a processor 12 and a bus 13.

The memory 11 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), magnetic memory, magnetic disk, optical disk, and the like. The memory 11 may be an internal storage unit of the device in some embodiments, such as the hard disk of the device. In other embodiments, the memory 11 may also be an external storage device of the device, such as a plug-in hard disk equipped on the device, a Smart Media Card (SMC), a Secure Digital (SD) card, and a flash memory card. (Flash Card) and so on. Further, the memory 11 may also include both an internal storage unit of the device and an external storage device. The memory 11 can be used not only to store application software and various types of data installed in the device, such as program code for executing the trusted state determination method, etc., but also to temporarily store data that has been output or will be output.

In some embodiments, the processor 12 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip, for running program codes or processing stored in the memory 11 Data, such as program code that executes the trusted state determination method, etc.

The bus 13 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 6, but it does not mean that there is only one bus or one type of bus.

Further, the device may also include a network interface 14. The network interface 14 may optionally include a wired interface and/or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is usually used to communicate between the device and other electronic devices. Establish a communication connection.

Optionally, the device may further include a user interface. The user interface may include a display (Display) and an input unit such as a keyboard (Keyboard). The optional user interface may also include a standard wired interface and a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode, organic light-emitting diode) touch device, etc. Among them, the display can also be appropriately called a display screen or a display unit, which is used to display the information processed in the device and to display a visualized user interface.

Figure 6 only shows a device with components 11-14. Those skilled in the art will understand that the structure shown in Figure 6 does not constitute a limitation on the device, and may include fewer or more components than shown. Or some parts are combined, or different parts are arranged.

The embodiment of the present invention also discloses a computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the trusted state as described in any of the above-mentioned method embodiments is realized Determine the steps of the method.

Among them, the storage medium may include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, etc., which can store program code medium.

The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other.

The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown in this document, but should conform to the widest scope consistent with the principles and novel features disclosed in this document.

Claims

A method for determining the trusted state of a virtual data center is characterized in that the method for determining the trusted state is based on a computing pool trusted management and control component, and the determination of the trusted state includes:

Obtain the operating characteristic value of the host under test in the virtual data center when the resource is started through the basic input output system; wherein, the under test host is a server or a virtual host deployed on the server, and the basic input output system is the server Or the trusted basic input output system of the virtual host;

Acquire a reference value corresponding to the host to be tested; the reference value is the initial operating characteristic value of the host to be tested that is pre-stored by the basic input output system when the resource is first created; the reference value is the same as the The data types of running characteristic values are the same;

The operating characteristic value is compared with the reference value, and the trusted state of the host to be tested is determined according to the comparison result.
The method for determining a trusted state according to claim 1, characterized in that, before acquiring the operating characteristic value of the host under test in the virtual data center through the basic input output system when the resource is started, the method further comprises:

Judging whether the host to be tested is a newly-built host;

If not, continue to perform the step of obtaining the operating characteristic value of the host to be tested in the virtual data center when the resource is started through the basic input output system;

If so, obtain the initial operating characteristic value of the host under test when the resource is started through the basic input output system, and store the initial operating characteristic value as the reference value of the host under test.
The method for determining a trusted state according to claim 1 or 2, wherein said obtaining the operating characteristic value of the host under test of the virtual data center when the resource is started comprises:

Initialize the TPM trusted platform module;

Obtain at least one of the feature value of the Boot Block of the basic input output system, the feature value of the Option ROM of the basic input output system, the feature value of the OS Loader, and the feature value of the OS Kernel, and record it to the TPM The PCR register of the Trusted Platform Module.
The method for determining the trusted state of claim 3, wherein the comparing the operating characteristic value with the reference value, and determining the trusted state of the host under test according to the comparison result, comprises:

The feature value of the Boot Block of the basic input output system is compared with the Boot Block reference value to obtain the first comparison result; the feature value of the Option ROM of the basic input output system is compared with the Option ROM reference value to obtain the first comparison result. 2. Comparison result: Compare the characteristic value of OS Loader with the reference value of OS Loader to obtain the third comparison result; compare the characteristic value of OS Kernel with the reference value of OS Kernel to obtain the fourth comparison result;

If the first comparison result, the second comparison result, the third comparison result, and the fourth comparison result are all the same, the host to be tested is determined to be a trusted host; if any one of them exists If the comparison result is not the same, it is determined that the host to be tested is an untrusted host.
A device for determining a trusted state of a virtual data center is characterized in that the device for determining a trusted state is based on a computing pool trusted management and control component, and the device for determining a trusted state includes:

The characteristic value acquisition module is used to acquire the operating characteristic value of the host under test of the virtual data center when the resource is started through the basic input output system; wherein, the host under test is a server or a virtual host deployed on the server, and the basic The input and output system is a trusted basic input and output system of the server or the virtual host;

The reference value acquisition module is configured to acquire a reference value corresponding to the host to be tested; the reference value is the initial operating characteristic value of the host to be tested that is pre-stored through the basic input output system when the resource is first created; The reference value is the same as the data type of the operating characteristic value;

The comparison module is used to compare the operating characteristic value with the reference value, and determine the trusted state of the host under test according to the comparison result.
The device for determining a trusted state according to claim 5, further comprising:

The judging module is used to judge whether the host to be tested is a newly-built host;

The characteristic value obtaining module is specifically configured to obtain the operating characteristic value of the host under test in the virtual data center when the resource is started through the basic input output system when the host under test is not a newly-built host;

An initial operating characteristic value obtaining module, configured to obtain the initial operating characteristic value of the host under test when the resource is started through the basic input output system when the host under test is a newly-built host;

The storage module is configured to store the initial operating characteristic value as the reference value of the host to be tested.
The trusted state determining device according to claim 5 or 6, wherein the characteristic value obtaining module comprises:

The initialization unit is used to initialize the TPM trusted platform module;

The feature value obtaining unit is used to obtain at least one of the feature value of the Boot Block of the basic input output system, the feature value of the Option ROM of the basic input output system, the feature value of the OS Loader, and the feature value of the OS Kernel , And record it in the PCR register of the TPM trusted platform module.
The device for determining a trusted state according to claim 7, wherein the comparison module comprises:

The comparison unit is used to compare the feature value of the Boot Block of the basic input output system with the reference value of the Boot Block to obtain a first comparison result; compare the feature value of the Option ROM of the basic input output system with the reference value of Option ROM Make a comparison to obtain the second comparison result; compare the characteristic value of the OS Loader with the OS Loader reference value to obtain the third comparison result; compare the characteristic value of the OS Kernel with the reference value of the OS Kernel to obtain the fourth comparison result;

A determining unit, configured to determine that the host to be tested is a trusted host when the first comparison result, the second comparison result, the third comparison result, and the fourth comparison result are all the same; If the comparison result of any one is different, it is determined that the host to be tested is an untrusted host.
A device for determining the trusted state of a virtual data center is characterized in that it includes:

Memory, used to store computer programs;

The processor is configured to implement the steps of the trusted state determination method according to any one of claims 1 to 4 when the computer program is executed.
A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the trusted state according to any one of claims 1 to 4 is realized Determine the steps of the method.