WO2022088615A1 - 一种虚拟可信平台模块的实现方法及相关装置 - Google Patents

一种虚拟可信平台模块的实现方法及相关装置 Download PDF

Info

Publication number
WO2022088615A1
WO2022088615A1 PCT/CN2021/086100 CN2021086100W WO2022088615A1 WO 2022088615 A1 WO2022088615 A1 WO 2022088615A1 CN 2021086100 W CN2021086100 W CN 2021086100W WO 2022088615 A1 WO2022088615 A1 WO 2022088615A1
Authority
WO
WIPO (PCT)
Prior art keywords
vtpm
request information
storage space
identifier
component
Prior art date
Application number
PCT/CN2021/086100
Other languages
English (en)
French (fr)
Inventor
张立肖
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202011353009.2A external-priority patent/CN114491544A/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21884358.9A priority Critical patent/EP4216087A4/en
Publication of WO2022088615A1 publication Critical patent/WO2022088615A1/zh
Priority to US18/307,041 priority patent/US20230267214A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms

Definitions

  • the present application relates to the field of computer technology, and in particular, to a method for implementing a virtual Trusted Platform Module (vTPM) and a related device.
  • vTPM virtual Trusted Platform Module
  • TPM Trusted Platform Module
  • a TPM chip is a small chip system that contains cryptographic computing components and storage components, and is used to securely store information used to verify the security of platforms (such as network devices such as personal computers), such as passwords, certificates, or encryption keys. By storing this information by the TPM chip, it can effectively prevent illegal users from changing sensitive information.
  • the logic of the TPM chip is simple, it cannot support the virtualization feature, that is, it cannot provide TPM services for multiple virtual machines (VMs) at the same time. Therefore, in the related art, multiple functional modules are virtualized by software, and each functional module has the function of a TPM chip, so as to ensure that TPM services can be provided for multiple VMs at the same time.
  • the above-mentioned functional modules virtualized by software are called virtual Trusted Platform Module (vTPM) chips, also referred to as vTPM for short.
  • vTPM virtual Trusted Platform Module
  • the vTPM chip is obtained through software virtualization, its security is poorer than that of the TPM chip in the form of hardware, and it is difficult to ensure the security of data.
  • the present application provides a method for implementing vTPM, which is used to ensure data security on the basis of providing TPM services for multiple VMs.
  • a first aspect of the present application provides a method for implementing vTPM, which is applied in a computer.
  • a trusted execution environment of the computer runs a vTPM service component, and a rich execution environment of the computer runs a first VM and a vTPM agent component.
  • the method includes: the vTPM service component obtains first request information from the vTPM proxy component, where the first request information includes an identifier of the first VM, and the first request information is used to request to perform a TPM operation.
  • the vTPM service component obtains the first request information transmitted by the TrustZone Driver component in the monitoring mode.
  • the first request information is used to request to perform TPM operations such as generating a key, encrypting data, or decrypting data.
  • the vTPM service component can determine the first storage space corresponding to the identifier of the first VM.
  • the vTPM service component processes the first request information based on the data in the first storage space, where the first storage space is the storage space corresponding to the identifier of the first VM in the trusted execution environment, and the first storage space is used to store the first storage space.
  • TPM data of a VM is the storage space corresponding to the identifier of the first VM in the trusted execution environment.
  • the vTPM service component running in the trusted execution environment determines the corresponding storage space according to the VM identifier in the obtained request information, and the data in the storage space corresponding to the VM identifier is the data in the request information.
  • the VM corresponding to the ID of the VM provides TPM services, so that the vTPM service component can provide TPM services for different VMs based on different storage spaces. Therefore, the security of the data in the vTPM can be ensured on the basis of providing TPM services for multiple VMs.
  • the trusted execution environment of the computer further includes a second storage space, wherein the second storage space is used to store the TPM data of the second VM in the computer, and the first storage space and the first storage space are used to store TPM data of the second VM in the computer.
  • the two storage spaces are non-overlapping storage spaces. That is to say, the trusted execution environment of the computer includes multiple mutually isolated storage spaces, and different storage spaces are used to store the TPM data of different VMs, so that the vTPM service component can be based on the unique storage space of each VM. TPM data to provide TPM services for VMs.
  • the first request information further includes a command identifier and a parameter to be processed, where the command identifier is used to indicate the type of the TPM operation to be performed.
  • the vTPM service component processes the first request information based on the data in the first storage space, and specifically includes: the vTPM service component obtains target data based on the command identifier in the first request information and the data processing parameters to be processed in the first storage space.
  • the vTPM service component delivers target data to the TrustZone Driver component, and the destination of the target data is the vTPM proxy component.
  • the parameters to be processed include a key handle and data to be encrypted.
  • the vTPM service component invokes the command invocation interface function to parse the first request information to obtain the command identifier and to-be-processed parameters in the first request information.
  • the vTPM service component uses the key to encrypt the data to be encrypted according to the command identifier obtained by parsing, and the key is determined by the vTPM according to the key handle.
  • the first request information includes a command identifier, a key handle, and data to be encrypted, and the command identifier is used to instruct to perform an RSA encryption operation.
  • the vTPM service component searches the first storage space for a key corresponding to the key handle.
  • the vTPM service component uses the key obtained from the first storage space to encrypt the data to be encrypted to obtain the target data.
  • the parameters to be processed include a key handle and data to be decrypted.
  • the vTPM service component invokes the command invocation interface function to parse the first request information to obtain the command identifier and to-be-processed parameters in the first request information.
  • the vTPM service component uses the key to decrypt the data to be decrypted according to the command identifier, and the key is determined by the vTPM according to the key handle.
  • the method further includes: if there is no identifier corresponding to the first VM in the trusted execution environment Storage space, the vTPM service component allocates storage space for the identifier of the first VM in the trusted execution environment.
  • the vTPM service component performs a TPM initialization operation on the data in the allocated storage space, so that the data in the allocated storage space is updated to the TPM initialization data, and uses the allocated storage space as the first storage space corresponding to the identifier of the first VM .
  • the vTPM service component performs TPM initialization operations on the data in the storage space, including: the vTPM service component divides the storage space to obtain multiple storage blocks, and the multiple storage blocks are respectively used to store platform seeds, endorsement seeds, storage seeds, encryption key or PCR data.
  • the vTPM service component updates the data in the storage block to obtain TPM initialization data. For example, the vTPM service component updates the data in the storage space for storing the PCR, thereby assigning an initialized value to the PCR, and this initialized value is the initial value of the PCR.
  • the TPM data provides TPM services for multiple VMs.
  • the vTPM service component allocates storage space for the identifier of the first VM in the trusted execution environment, which specifically includes: the vTPM service component searches the volatile memory of the computer for an identifier related to the first VM. Identifies the corresponding storage space. If the storage space corresponding to the identifier of the first VM does not exist in the volatile memory, the vTPM service component allocates the storage space corresponding to the identifier of the first VM in the volatile memory.
  • the first request information obtained by the vTPM service component is transmitted in a first session, and the first session is used for transmission between the vTPM service component and the vTPM proxy component for requesting execution.
  • Information and/or target data of the TPM operation where the target data is the data obtained after the vTPM service component performs the TPM operation.
  • the method further includes: after the first VM is started, the vTPM service component obtains second request information from the vTPM proxy component, the second request information includes the identifier of the first VM, and the second request information is used to request establishment of the first session.
  • the vTPM service component establishes a session according to the identifier of the first VM, allocates storage space in the volatile memory of the computer, and uses the allocated storage space as the first storage space. That is to say, after the VM is started, the vTPM service component is triggered to allocate storage space for the identifier of the VM through the session establishment request transmitted by the vTPM proxy component. Therefore, before the vTPM proxy component obtains the TPM operation request, the corresponding storage space can be allocated for the identifier of the VM in advance, thereby improving the efficiency of executing the TPM operation.
  • the first session is a session corresponding to the identifier of the first VM
  • the method further includes: the vTPM service component invokes the session open according to the identifier of the first VM included in the second request information.
  • the interface (TA_OpenSessionEntryPoint) function is used to establish a first session corresponding to the identifier of the first VM and obtain the identifier of the first session.
  • the vTPM service component transmits the identifier of the first session to the TrustZone Driver component in the rich execution environment of the computer, and the destination of the identifier of the first session is the vTPM proxy component. That is, the vTPM service component establishes the first session by calling the TA_OpenSessionEntryPoint function, and returns the obtained identifier of the first session to the vTPM proxy component.
  • the vTPM service component allocates storage space in the volatile memory, which specifically includes: the vTPM service component searches the non-volatile memory of the computer for the storage space corresponding to the identifier of the first VM. .
  • the vTPM service component allocates the storage space in the volatile memory, and allocates the storage space corresponding to the identifier of the first VM in the non-volatile memory Copy the data in to the allocated storage space. That is to say, after the vTPM service component allocates storage space for the identifier of the first VM in the volatile memory, it does not need to perform a TPM initialization operation on the data in the allocated storage space, but instead uses the non-volatile memory with the The data in the storage space corresponding to the identifier of the first VM is copied to the allocated storage space. In this way, in the scenario of restarting the first VM, the TPM data used by the first VM before the restart can be restored in the volatile memory, so as to ensure the normal operation of the first VM.
  • the vTPM service component allocates storage space in the volatile memory and performs TPM initialization operations on the data in the allocated storage space.
  • the method further includes: the vTPM service component marks the allocated storage space based on the identifier of the first VM, so as to facilitate subsequent vTPM The service component can determine its corresponding storage space based on the identifier of the first VM.
  • the method further includes: when the first VM is shut down, the vTPM service component obtains the third request information from the vTPM proxy component.
  • the third request information is transmitted in the first session, the third request information includes the identifier of the first VM, and the third request information is used to request to close the first session.
  • the vTPM service component determines the first storage space according to the identifier of the first VM contained in the third request message.
  • the vTPM service component copies the data of the first storage space to the third storage space, and the third storage space is located in the non-volatile memory.
  • the vTPM service component discards the data in the storage space in the volatile memory, thereby realizing the recovery of the storage space in the volatile memory and improving the ease of use. Utilization of storage space in volatile memory.
  • the first request information is transmitted by the TrustZone Driver component to the vTPM service component in the monitoring mode, and the TrustZone Driver component runs in the rich execution environment of the computer.
  • a second aspect of the present application provides a method for implementing vTPM, including: a vTPM proxy component obtains first request information from a first VM, where the first request information is used to request a vTPM service component to perform a TPM operation.
  • the vTPM service component runs in the trusted execution environment of the computer, and the first VM runs in the rich execution environment of the computer.
  • the vTPM proxy component obtains the identity of the first VM.
  • the vTPM proxy component adds the identifier of the first VM to the first request information, thereby obtaining second request information, where the second request information includes the identifier of the first VM.
  • the vTPM proxy component transmits the second request information to the TrustZone Driver component running in the trusted execution environment of the computer, and the destination of the second request information is the vTPM service component.
  • the vTPM service component can determine the corresponding storage space based on the identifier of the VM included in the TPM operation request, and provide the VM with the TPM data in the storage space corresponding to the identifier of the VM. TPM service.
  • the vTPM proxy component adding the identifier of the first VM in the first request information includes: the vTPM proxy component invokes a function by calling a command, and adds the identifier of the first VM in the first request information, Thus, the second request information is obtained.
  • the method further includes: the vTPM proxy component obtains third request information from the second VM, where the third request information is used to request to perform a TPM operation.
  • the vTPM proxy component obtains the identity of the second VM.
  • the vTPM proxy component adds the identifier of the second VM to the third request information, thereby obtaining fourth request information, where the fourth request information includes the identifier of the second VM.
  • the vTPM proxy component transmits fourth request information to the TrustZone Driver component, and the destination of the fourth request information is the vTPM service component.
  • the method further includes: the vTPM proxy component obtains target data from the vTPM service component through the TrustZone Driver component, and the target data is obtained after the vTPM service component performs a TPM operation based on the second request information. data.
  • the vTPM proxy component delivers target data to the first VM.
  • the method further includes: when the first VM is started, the vTPM proxy component obtains the identifier of the first VM.
  • the vTPM proxy component generates fifth request information, where the fifth request information is used to request to establish a session with the vTPM service component, and the fifth request information includes the identifier of the first VM.
  • the vTPM proxy component transmits fifth request information to the TrustZone Driver component, and the destination of the fifth request information is the vTPM service component.
  • the method further includes: the vTPM proxy component obtains sixth request information from the first VM, where the sixth request information is used to request to close the session with the vTPM service component.
  • the vTPM proxy component obtains the identity of the first VM.
  • the vTPM proxy component adds the identifier of the first VM to the sixth request information, thereby obtaining seventh request information, where the seventh request information includes the identifier of the first VM.
  • the vTPM proxy component transmits the seventh request information to the TrustZone Driver component, and the destination of the seventh request information is the vTPM service component.
  • a third aspect of the present application provides a computer system, where a trusted execution environment and a rich execution environment run on the computer system, the trusted execution environment runs a vTPM service component, and the rich execution environment runs a first VM and a vTPM agent component.
  • the vTPM proxy component is used to obtain the first request information from the first VM, obtain the identifier of the first VM, add the identifier of the first VM to the first request information, obtain the second request information, and transmit the first request information to the TrustZone Driver component.
  • the first request information is used to request the vTPM service component to perform a TPM operation
  • the second request information includes the identifier of the first VM
  • the destination of the second request information is the vTPM service component.
  • the vTPM service component is used to obtain the second request information through the TrustZone Driver component, and process the second request information based on the data in the first storage space, where the first storage space is the storage corresponding to the identifier of the first VM in the trusted execution environment space, the first storage space is used to store TPM data of the first VM.
  • the trusted execution environment further includes a second storage space, the second storage space is used to store TPM data of the second VM, and the first storage space and the second storage space are mutually independent. Coincident storage spaces.
  • the second request information further includes a command identifier and a parameter to be processed, where the command identifier is used to indicate the type of the TPM operation to be performed.
  • the vTPM service component is also used to process the to-be-processed parameters based on the command identifier in the second request information and the data in the first storage space to obtain target data, and transmit the target data to the TrustZone Driver, and the destination of the target data is the vTPM proxy component.
  • the vTPM proxy component is also used to obtain target data and deliver the target data to the first VM.
  • the parameters to be processed include a key handle and data to be encrypted.
  • the vTPM service component is further configured to invoke the command invocation interface function to obtain the command identifier and to-be-processed parameters in the second request information.
  • the vTPM service component is further configured to encrypt the data to be encrypted by using the key according to the command identifier, and the key is determined by the vTPM according to the key handle.
  • the parameters to be processed include a key handle and data to be decrypted.
  • the vTPM service component is further configured to invoke the command invocation interface function to obtain the command identifier and to-be-processed parameters in the second request information.
  • the vTPM service component is also used for decrypting the data to be decrypted by using the key according to the command identifier, and the key is determined by the vTPM according to the key handle.
  • the vTPM proxy component is further configured to acquire third request information from the second VM, where the third request information is used to request to perform a TPM operation.
  • the vTPM proxy component is further configured to acquire the identifier of the second VM, and add the identifier of the second VM to the third request information to obtain fourth request information, where the fourth request information includes the identifier of the second VM.
  • the vTPM proxy component is further configured to transmit fourth request information to the TrustZone Driver component, and the destination of the fourth request information is the vTPM service component.
  • the vTPM service component is configured to obtain the fourth request information through the TrustZone Driver component, and process the fourth request information based on the data in the second storage space, where the second storage space is the storage corresponding to the identifier of the second VM in the trusted execution environment space, the second storage space is used to store TPM data of the second VM.
  • the vTPM service component is further configured to allocate storage space for the identifier of the first VM in the trusted execution environment. , and perform a TPM initialization operation on the data in the allocated storage space, so that the data in the allocated storage space is updated to TPM initialization data, and the allocated storage space is used as the first storage space.
  • the vTPM service component is further configured to search the volatile memory of the computer for a storage space corresponding to the identifier of the first VM, if there is no storage space corresponding to the identifier of the first VM in the volatile memory. If the corresponding storage space is identified, the storage space is allocated in the volatile memory.
  • the second request information is transmitted in a first session, and the first session is used to transmit information for requesting to perform a TPM operation and/or between the vTPM service component and the vTPM proxy component.
  • target data which is the data obtained after performing the TPM operation.
  • the vTPM proxy component is further configured to obtain the identifier of the first VM when the first VM is started, generate fifth request information, where the fifth request information includes the identifier of the first VM, and transmit fifth request information to the TrustZone Driver component, the fifth request information
  • the request information is used to request the establishment of the first session, and the destination of the fifth request information is the vTPM service component.
  • the vTPM service component is further configured to obtain the fifth request information through the TrustZone Driver component, and the vTPM service component allocates storage space in the volatile memory of the computer, and uses the allocated storage space as the first storage space.
  • the first session is a session corresponding to the identifier of the first VM
  • the vTPM service component is further configured to call the session open interface function according to the identifier of the first VM included in the fifth request information. , to establish a first session corresponding to the identifier of the first VM and obtain the identifier of the first session.
  • the vTPM service component is further configured to transmit the identifier of the first session to the TrustZone Driver component, and the destination of the identifier of the first session is the vTPM proxy component.
  • the vTPM proxy component is further configured to obtain sixth request information from the first VM, where the sixth request information is used to request to close the first session, obtain the identifier of the first VM, and in the first The identifier of the first VM is added to the sixth request information, thereby obtaining the seventh request information, the seventh request information includes the identifier of the first VM, and the seventh request information is transmitted to the TrustZone Driver component, and the destination of the seventh request information is the vTPM service component; the vTPM service component is also used to obtain the sixth request information, determine the first storage space according to the identifier of the first VM included in the sixth request message, copy the data of the first storage space to the third storage space, and the third storage space.
  • the storage space is located in non-volatile memory.
  • the second request information is transmitted by the TrustZone Driver component to the vTPM service component in the monitoring mode, and the TrustZone Driver component runs in a rich execution environment of the computer.
  • a fourth aspect of the present application provides a computer, where the computer includes: a processor, a nonvolatile memory, and a volatile memory; wherein, the nonvolatile memory or the volatile memory stores computer-readable instructions; the processor reads Computer readable instructions are fetched to cause a computer to implement a method according to any one of the embodiments of the first aspect or the second aspect.
  • a fifth aspect of the present application provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, which, when executed on a computer, causes the computer to execute any one of the embodiments of the first aspect or the second aspect Methods.
  • a sixth aspect of the present application provides a computer program product which, when run on a computer, causes the computer to perform the method of any one of the embodiments of the first aspect or the second aspect.
  • a seventh aspect of the present application provides a chip including one or more processors. Part or all of the processor is used to read and execute the computer program stored in the memory to perform the method in any possible implementation manner of any of the above aspects.
  • the chip further includes a memory, and the memory and the processor are connected to the memory through a circuit or a wire.
  • the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used to receive data and/or information to be processed, and the processor obtains the data and/or information from the communication interface, processes the data and/or information, and outputs the processing result through the communication interface.
  • the communication interface is an input and output interface.
  • the method provided in this application is implemented by one chip, or implemented by multiple chips cooperatively.
  • FIG. 1 is a schematic structural diagram of a TPM according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a system software level related to the TrustZone technology provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a computer system according to an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a method 500 for implementing a vTPM according to an embodiment of the present application
  • FIG. 6 is a schematic flowchart of a method for allocating storage space for a vTPM service component according to an embodiment of the present application
  • FIG. 7 is a schematic flowchart of another method for allocating storage space for a vTPM service component provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of a session closure of a vTPM service component provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a computer system according to an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a computer according to an embodiment of the present application.
  • a TPM chip is a small system-on-a-chip with cryptographic computing and storage components used to securely store information used to verify the security of a platform (eg, a network device such as a personal computer), such as information such as passwords, certificates, or encryption keys.
  • a platform eg, a network device such as a personal computer
  • the TPM chip generates a trusted key, and guarantees the root key through non-volatile random access memory (Non-Volatile Random Access Memory, NVRAM) and storage root key (Storage Root Key, SRK). and the confidentiality and integrity of other sensitive data.
  • NVRAM non-Volatile Random Access Memory
  • SRK Storage Root Key
  • FIG. 1 is a schematic structural diagram of a TPM chip according to an embodiment of the present application.
  • a TPM chip usually includes but is not limited to the following modules: key generator, asymmetric key engine, symmetric key engine, hash engine, random number generator, authorization module, non-volatile memory and volatile memory.
  • key generator asymmetric key engine
  • symmetric key engine asymmetric key engine
  • hash engine random number generator
  • authorization module non-volatile memory and volatile memory.
  • Key generator used to generate keys within the hardware boundary of the TPM chip and protect the security of the keys.
  • Asymmetric Key Engine Used to perform encryption and decryption of asymmetric keys.
  • Symmetric Key Engine Used to perform encryption and decryption of symmetric keys.
  • Hash engine used to perform secure hash operations on input data and output summary information.
  • Random number generator A true random number generator based on hardware.
  • Authorization module used to control access to entities in the TPM chip, and provide access security guarantees for the TPM chip when the TPM chip is accessed.
  • Non-volatile memory memory that is not volatile after power failure, and can store data that needs to be persisted, such as keys, random number seeds, or certificates.
  • Volatile memory The memory that is volatile when power is turned off, can store temporary data such as the Platform Configuration Register (PCR) or the runtime session.
  • PCR Platform Configuration Register
  • TPM chips Due to the simple logic of TPM chips, they cannot support virtualization features, that is, they cannot provide TPM services for multiple VMs at the same time, which makes it difficult for TPM chips to be widely used in some cloud scenarios.
  • a VM is a tightly isolated software container containing an operating system and applications, and each VM is completely independent. Through virtualization technology, multiple VMs can be run based on the hardware resources of a physical server.
  • multiple functional modules are virtualized through software, and each functional module has the function of a TPM chip, so as to ensure that TPM services can be provided for multiple VMs at the same time.
  • vTPM chips The above-mentioned functional modules virtualized by software are called vTPM chips, and are also referred to as vTPMs for short.
  • vTPM chip Since the vTPM chip is obtained through software virtualization, its security is poorer than that of the TPM chip in the form of hardware, and it is difficult to ensure the security of data.
  • embodiments of the present application provide a method for implementing vTPM.
  • the vTPM service component running in the trusted execution environment determines the corresponding storage space according to the identity of the VM, and provides TPM services for the VM based on the data in the storage space corresponding to the VM, so that the vTPM service component can be based on different storage spaces.
  • the VM provides TPM service. Therefore, the security of the data in the vTPM can be ensured on the basis of providing TPM services for multiple VMs.
  • the ARM processor in order to provide a safe running environment for applications or components in the computer, the ARM processor introduces the TrustZone technology.
  • the ARM processor that supports TrustZone technology divides the working state into two kinds during operation: safe state and non-safety state, also known as safe world state and normal world state.
  • safe state and non-safety state also known as safe world state and normal world state.
  • General operating systems and most applications run in the normal world state, and the development resources in the normal world state are richer than the safe world state, so the normal world state is usually called the Rich Execution Environment (REE).
  • the trusted operating system runs in the secure world state, which is usually called the Trusted Execution Environment (TEE).
  • TEE Trusted Execution Environment
  • the processor When the processor is in a safe state, it can only run the code on the trusted execution environment side, and has access rights to enrich the address space of the execution environment side.
  • the processing core When the processing core is in a non-secure state, it can only run the code on the rich execution environment side, and can only obtain specific data in the trusted execution environment side and call specific functions through the predefined client interface.
  • FIG. 2 is a schematic diagram of a system software level related to the TrustZone technology according to an embodiment of the present application.
  • processors have different execution levels (Execution Level, EL) at runtime.
  • EL execution Level
  • the user mode is represented by EL0; the privileged mode is represented by EL1; the Hyp mode is represented by EL2, the mode used to implement virtualization technology; the monitor mode is represented by EL3.
  • the system can switch between the safe state and the non-safety state only in the Monitor mode.
  • FIG. 3 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • the system architecture includes a trusted execution environment and a rich execution environment.
  • the trusted execution environment is specially provided for high security-sensitive applications, which can ensure the confidentiality and integrity of application resources and data.
  • Generic rich execution environments are provided for legacy operating systems as well as generics.
  • Applications executed on the rich execution environment side are called client applications (CAs), such as third-party payment applications such as banking applications.
  • An application executed on the trusted execution environment side is called a trusted application (TA), such as an application that performs key services such as signature and encryption and decryption calculations.
  • CAs client applications
  • TA trusted application
  • an application that performs key services such as signature and encryption and decryption calculations.
  • the trusted execution environment includes trusted execution environment internal application programming interface (trusted execution environment internal application programming interface, TEE Internal API) and trusted operating system components.
  • TEE Internal API trusted execution environment internal application programming interface
  • the main functions of the TEE Internal API are: to provide the functions of trusted operating system components upward, to communicate with the client application CA, to realize the communication between TA and TA, and to provide functions such as secure storage, cryptographic functions and time.
  • the trusted operating system components mainly include trusted core framework, trusted function, trusted kernel and trusted execution environment TEE communication agent.
  • the trusted core framework provides TA with functions similar to the operating system.
  • the trusted function provides support capabilities for application developers.
  • the trusted kernel is used to interact with trusted devices in the platform hardware.
  • TEE communication agent provides a secure communication channel for TA and CA.
  • the trusted execution environment communication agent transmits messages to the rich execution environment communication agent through the platform hardware to realize the interaction between the TA and the CA.
  • the rich execution environment includes trusted execution environment client application programming interface (trusted execution environment client application programming interface, TEE Client API), trusted execution environment functional application programming interface (trusted execution environment functional application programming interface, TEE Functional API) ) and multimedia operating systems.
  • the multimedia operating system components mainly include common device drivers and rich execution environment communication agents. Among them, the rich execution environment communication agent is used to communicate with the trusted execution environment, providing a secure communication channel for CA and TA. Common device drivers are used to drive common devices in the platform hardware.
  • CA uses TEE Client API and TEE Functional API to access the security services provided by TA.
  • FIG. 4 is a schematic structural diagram of a computer system according to an embodiment of the present application.
  • the computer system includes a rich execution environment and a trusted execution environment.
  • a VM In this rich execution environment, a VM, a vTPM driver (vTPM Driver), a vTPM proxy (vTPM Proxy), a trusted space driver (TrustZone Driver) and a host operating system (HOST OS) run.
  • vTPM Driver vTPM Driver
  • vTPM Proxy vTPM proxy
  • TrustZone Driver trusted space driver
  • HOST OS host operating system
  • one or more VMs are run in the rich execution environment, each VM runs a vTPM driver component, and the vTPM driver component in each VM communicates with the vTPM proxy component corresponding to the VM.
  • each VM runs one vTPM driver component, and only one vTPM proxy component runs in the rich execution environment, and this vTPM proxy component communicates with multiple vTPM driver components.
  • a trusted execution environment operating system TEE OS
  • vTPM service component vTPM Service
  • components refer to self-contained, programmable, reusable and language-independent software units.
  • the vTPM driver component, the vTPM proxy component, and the trusted space driver component are all software units.
  • FIG. 5 is a schematic flowchart of a method 500 for implementing a vTPM according to an embodiment of the present application. As shown in FIG. 5 , the method 500 includes the following steps 501 to 510 .
  • Step 501 the VM transmits first request information to the vTPM driver component, and the destination of the first request information is the vTPM service component.
  • an application runs in the VM.
  • the APP is, for example, a key management component or a payment component.
  • the APP needs to access the vTPM service component to request the vTPM service component to perform TPM operations such as encrypting data or decrypting data.
  • the VM When the APP needs to access the vTPM, the VM generates first request information for requesting the vTPM service component to perform a TPM operation, and transmits the first request information to the vTPM driver component.
  • the destination of the first request information is the vTPM service component.
  • the TPM operation that the first request information is used to request to perform includes, but is not limited to, operations such as generating a key, encrypting data, decrypting data, or performing a hash operation on data.
  • the TPM operation to be performed is specifically limited.
  • the VM calls the key generation function and inputs the type of the key to be generated and other parameters.
  • the key generation function combines the parameters input by the VM into a TPM command byte stream.
  • the TPM command byte stream includes a first command identifier, where the first command identifier is used to instruct to perform a key generation operation.
  • the VM calls the RSA encryption (Tss2_Sys_RSA_Encrypt) function, and inputs the command identifier of the encryption operation and parameters such as the data to be encrypted.
  • the RSA algorithm is an asymmetric encryption algorithm.
  • the Tss2_Sys_RSA_Encrypt function combines the parameters input by the VM into a TPM command byte stream, where the TPM command byte stream includes the second command identifier, the first key handle, and the data to be encrypted.
  • the second command identifier is used to instruct to perform the RSA encryption operation
  • the first key handle is the identifier of the key, used to instruct the key to perform data encryption
  • the data to be encrypted is the data that needs to be encrypted.
  • the VM calls the RSA decryption function, and inputs parameters such as the command identifier of the decryption operation and the data to be decrypted.
  • the RSA decryption function combines the parameters input by the VM into a TPM command byte stream, where the TPM command byte stream includes a third command identifier, a second key handle, and data to be decrypted.
  • the third command identifier is used to instruct to perform the RSA decryption operation;
  • the second key handle is the identifier of the key, used to instruct the key to perform data decryption;
  • the data to be decrypted is the data to be decrypted.
  • the TPM command byte stream in the above example is the above-mentioned first request information.
  • the VM transfers the TPM command byte stream to the vTPM driver component by calling a write function.
  • a representation of the first request information is ⁇ TPM command identifier (Command Indentifier, CMD ID), parameters (Parameters) ⁇ .
  • TPM CMD ID is used to identify the specific TPM operation type, such as encrypted data or decrypted data.
  • Parameters are used to identify parameters to be processed, such as plaintext to be encrypted or ciphertext to be decrypted.
  • Step 502 the vTPM driver component transmits the first request information to the vTPM proxy component.
  • the vTPM driver component is used to implement the input/output (I/O) operations of TPM data related to the VM, that is, the vTPM driver component is responsible for passing the TPM request information generated by the VM to the components outside the VM, as well as transferring the information outside the VM.
  • the TPM response information returned by the component is passed to the VM.
  • the VM runs a guest operating system (guest OS).
  • guest OS provides a unified device file for the APP running on the VM.
  • the device file refers to simulating a device into a file so that the APP can access the device through the interface of the file, for example, simulating a hard disk, an input device, an output device and other devices into a file. That is to say, when the APP on the VM is running, it implements operations on the vTPM service components by performing read and write operations on the device files provided by the operating system.
  • the VM calls the write function of the system to perform a write operation on the device file to write the above-mentioned first request information. Since the vTPM driver component is used to implement specific I/O operations, after the VM writes the first request information, the vTPM driver component is triggered to transmit the first request information to the vTPM proxy component.
  • the manner in which the vTPM driver component transmits the first request information includes, but is not limited to: by calling an application programming interface (Application Programming Interface, API) to transmit the first request information to the vTPM proxy component, or a method based on inter-process communication to deliver the first request information to the vTPM proxy component.
  • the methods of inter-process communication include, but are not limited to, communication based on pipes, communication based on message queues, communication based on shared memory, or communication based on sockets. This embodiment of the present application does not specifically limit the manner in which the vTPM driving component transmits the first request information.
  • Step 503 the vTPM proxy component adds the identifier of the VM to the first request information, so as to obtain the second request information.
  • the vTPM proxy component After acquiring the first request information, acquires the identifier of the VM based on the source of the first request information. Then, the vTPM proxy component adds the acquired identifier of the VM to the first request information to identify the source of the first request information.
  • the identifier of the VM is, for example, a Universally Unique Identifier (UUID).
  • UUID is a 128-bit value, which is calculated and generated from data such as current time, counter, and hardware identification.
  • a representation of the second request information is ⁇ VM UUID, TPM CMD ID, Parameters ⁇ .
  • vTPM proxy component There are various ways for the vTPM proxy component to obtain the identifier of the VM.
  • VMM Virtual Machine Monitor
  • the vTPM proxy component stores the acquired identifier of the VM in a specific storage space, where only the identifier of one VM is stored in the specific storage space. Since the vTPM proxy component corresponds to only one VM, after acquiring the first request information, the vTPM proxy component can acquire the identifier of the VM from the specific storage space. The identity of this VM can be used to identify the source of the first requested information.
  • one vTPM proxy component corresponds to multiple VMs
  • the vTPM proxy component establishes a connection with multiple vTPM driver components
  • the vTPM proxy component obtains the identifier of the VM based on the connection with the vTPM driver component.
  • the VMM assigns an identifier to the newly created VM and transmits the identifier assigned to the newly created VM to the vTPM component
  • the vTPM proxy component establishes a connection with the vTPM driver component corresponding to the newly created VM
  • the vTPM proxy component obtains a connection with the vTPM driver component.
  • the vTPM proxy component In addition to saving the acquired ID of the VM, the vTPM proxy component also saves the mapping relationship between the ID of the VM and the connected ID. In this way, after the vTPM proxy component obtains the first request information, the vTPM proxy component determines the identification of the connection (ie, the identification of the connection between the vTPM proxy component and the vTPM driver component) according to the connection that transmits the first request information.
  • the connection for transmitting the first request information refers to the connection between the vTPM driver component and the vTPM proxy component, and the connection is used for transmitting the first request information.
  • the vTPM proxy component determines the identifier of the VM according to the identifier of the connection and the mapping relationship, so as to obtain the identifier of the VM corresponding to the first request information.
  • Step 504 the vTPM proxy component transmits the second request information to the TrustZone Driver component, and the destination of the second request information is the vTPM service component.
  • the vTPM proxy component Since the vTPM proxy component is located in the rich execution environment, and the vTPM service component is located in the trusted execution environment, the vTPM proxy component cannot directly transmit the second request information to the vTPM service component. Therefore, the vTPM proxy component implements the vTPM proxy component and vTPM through the TrustZone Driver component. Information transfer between service components. Specifically, the vTPM proxy component transmits the second request information to the TrustZone Driver component, and the TrustZone Driver component transmits the second request information to the vTPM service component. Optionally, the vTPM proxy component transmits the second request information to the TrustZone Driver component by calling the command invocation (TEEC_InvokeCommand) function.
  • TEEC_InvokeCommand command invocation
  • Step 505 the TrustZone Driver component transmits the second request information to the vTPM service component.
  • the TrustZone Driver component After acquiring the second request information, the TrustZone Driver component parses the second request information, and re-integrates the second request information, so that the format of the integrated second request information is a format that can be recognized by the vTPM service component.
  • the TrustZone Driver component loads the integrated second request information into the shared memory, and triggers a Secure Monitor Call (SMC) to enter the monitor mode.
  • SMC Secure Monitor Call
  • the TrustZone Driver component transmits an instruction to the vTPM service component, so that the vTPM service component can obtain the second request information in the shared memory based on the instruction, thereby realizing the transmission of the second request information.
  • Step 506 the vTPM service component processes the second request information based on the data in the first storage space, thereby obtaining target data.
  • the vTPM service component allocates an independent storage space for each VM, and different storage spaces do not overlap with each other. Based on the acquired identifier of the VM, the vTPM service component can uniquely determine the storage space corresponding to the identifier of the VM. For example, the vTPM service component allocates a first storage space to the above-mentioned VM, and allocates a second storage space to another VM. Therefore, based on the identifier of the VM included in the second request information, the vTPM service component can determine the first storage space corresponding to the identifier of the VM. The first storage space is located in a trusted execution environment, and the first storage space is used to store TPM data of the VM. In this way, the vTPM service component processes the second request information based on the data in the first storage space.
  • the vTPM service component implements the processing of the second request information by invoking a command invocation interface (TA_InvokeCommandEntryPoint) function. Specifically, the vTPM service component calls the TA_InvokeCommandEntryPoint function to parse the second request information, and obtains the identifier of the VM in the second request information and the above-mentioned TPM command byte stream. Then, the vTPM service component searches for the storage space corresponding to the identifier of the VM, determines to obtain the first storage space, and processes the TPM command byte stream based on the data in the first storage space.
  • TA_InvokeCommandEntryPoint command invocation interface
  • the TPM command byte stream includes a first command identifier, where the first command identifier is used to instruct to perform a key generation operation.
  • the vTPM service component Based on the first command identifier, the vTPM service component obtains a root key in the first storage space, and generates a key based on the root key. After generating the key, the vTPM service component stores the key in the first storage space, and generates a key handle corresponding to the key, thereby obtaining the target data.
  • the key handle is an identifier used to identify the key.
  • the TPM command byte stream includes a second command identifier, a first key handle, and data to be encrypted, and the second command identifier is used to instruct to perform an RSA encryption operation.
  • the vTPM service component searches the first storage space for a key corresponding to the first key handle.
  • the vTPM service component uses the key obtained from the first storage space to encrypt the data to be encrypted to obtain the target data.
  • the TPM command byte stream includes a third command identifier, a second key handle, and data to be decrypted, where the third command identifier is used to instruct to perform an RSA decryption operation.
  • the vTPM service component searches the first storage space for a key corresponding to the second key handle.
  • the vTPM service component uses the key obtained from the first storage space to decrypt the data to be decrypted to obtain the target data.
  • the data obtained after the vTPM service component performs the TPM operation based on the second request information needs to be returned to the VM that transmits the second request information, that is, the VM represented by the identifier of the VM included in the second request information. Therefore, after the vTPM service component performs the TPM operation (such as the above-mentioned key generation operation, RSA encryption operation or RSA decryption operation) and obtains the corresponding TPM data, the vTPM service component also adds the VM included in the second request information to the obtained TPM data. to obtain target data that also includes the identifier of the VM included in the second request information. During the transfer of the target data, other subsequent components can determine to transfer the target data to the VM represented by the VM identifier included in the target data according to the VM identifier included in the target data.
  • the TPM operation such as the above-mentioned key generation operation, RSA encryption operation or RSA decryption operation
  • Step 507 the vTPM service component transmits target data to the TrustZone Driver component, and the destination of the target data is the vTPM proxy component.
  • the vTPM service component After getting the target data, the vTPM service component loads the target data into the shared memory and transmits instructions to the TrustZone Driver component. In this way, the TrustZone Driver component can obtain the target data in the shared memory based on the obtained instructions, thereby realizing the transfer of the target data.
  • Step 508 the TrustZone Driver component transmits the target data to the vTPM proxy component.
  • the TrustZone Driver component transfers the target data to the vTPM proxy component by calling the command invocation (TEEC_InvokeCommand) function.
  • TEEC_InvokeCommand command invocation
  • Step 509 the vTPM proxy component transmits the target data to the vTPM driver component.
  • the vTPM proxy component transmits the target data to the vTPM proxy component by invoking a command invocation (TEEC_InvokeCommand) function, or the vTPM proxy component transmits the target data to the vTPM proxy component by sending a response message carrying the target data.
  • TEEC_InvokeCommand command invocation
  • the vTPM proxy component acquires the identifier of the VM included in the target data, and determines how to transmit the target data according to the acquired identifier of the VM. Since the vTPM proxy component saves the mapping relationship between the identifier of the VM and the identifier of the connection (that is, the identifier of the connection between the vTPM proxy component and the vTPM driver component), based on the mapping relationship, the vTPM proxy component can determine the identity of the VM. The identifier of the corresponding connection. Based on the determined identification of the connection, the vTPM proxy component can determine the connection with the vTPM driver component. The vTPM proxy component transmits the target data through the determined connection with the vTPM driver component, so as to realize the transmission of the target data to the vTPM driver component corresponding to the identifier of the VM.
  • Step 510 the vTPM driver component transmits the target data to the VM.
  • the APP in the VM can read the target data returned by the vTPM driving component by calling a read function, thereby realizing the transmission of the target data.
  • the vTPM service component running in the trusted execution environment allocates different storage spaces to different VMs, and the different storage spaces do not overlap with each other.
  • the vTPM service component obtains the request information for requesting to perform the TPM operation
  • the vTPM service component determines the corresponding storage space according to the identifier of the VM in the request information, and the data in the storage space corresponding to the identifier of the VM is in the request information.
  • the VM represented by the ID of the VM provides TPM services, so that the vTPM service component can provide TPM services for different VMs based on different storage spaces.
  • data security can be ensured on the basis of providing TPM services for multiple VMs.
  • the process in which the vTPM service component determines the corresponding storage space based on the VM identifier and performs the TPM operation is described above.
  • the manners of triggering the vTPM service component to allocate storage space to the VM include but are not limited to the following two manners.
  • the vTPM proxy component corresponding to the VM transmits request information for requesting to establish a session to the vTPM service component, so as to trigger the vTPM service component to allocate storage space for the VM. That is, the vTPM service component is triggered to allocate storage space for the VM through the request information for requesting to establish a session.
  • the VM After the VM is created, the VM first transmits request information for requesting execution of the TPM operation to the vTPM service component, and the request information for requesting execution of the TPM operation can trigger the vTPM service component to allocate storage space for the VM. That is, the vTPM service component is triggered to allocate storage space for the VM through the first-passed request information for requesting to perform the TPM operation.
  • FIG. 6 is a schematic flowchart of a method for allocating storage space for a vTPM service component according to an embodiment of the present application.
  • the method shown in FIG. 6 corresponds to the above-mentioned first mode.
  • the process of allocating storage space by the vTPM service component includes the following steps 601 to 606 .
  • Step 601 the vTPM service component is initialized.
  • the vTPM service component is a TA running in a trusted execution environment.
  • the integrity and authenticity of the TA file itself are guaranteed by means of secure startup.
  • the TA file of the vTPM service component is signed by the certificate authority (Certificate Authorit-y, CA) system of the software publisher.
  • CA Certificate Authority
  • the Basic Input Output System (BIOS) verifies the file signature of the vTPM service component to ensure the authenticity and integrity of the vTPM service component.
  • the vTPM service component is loaded into the secure memory of the trusted execution environment to initialize and run, so as to realize the initialization of the vTPM service component.
  • Step 602 the vTPM proxy component is initialized.
  • vTPM agent component corresponds to only one VM
  • the VMM will also start the vTPM agent component corresponding to the VM. That is, the vTPM agent component starts with the startup of the VM.
  • the vTPM proxy component acquires and saves the identifier of the currently started VM that has a corresponding relationship with the vTPM proxy component, thereby completing the initialization process.
  • VMM starts the vTPM agent component at the same time.
  • the vTPM proxy component obtains and saves the identifier of the first started VM, thereby completing the initialization process.
  • the vTPM proxy component continues to obtain and save the identifiers of the subsequently started VMs.
  • Step 603 the vTPM driver component establishes a connection with the vTPM proxy component.
  • the VM loads the vTPM driver component.
  • the vTPM driver component establishes a connection with the vTPM proxy component.
  • the vTPM proxy component obtains the identity of the connection, and establishes the identity of the connection with the above vTPM driver component
  • the mapping relationship between the IDs of the VMs where they are located For example, after the first VM is started, the vTPM driver component loaded by the first VM establishes a connection with the vTPM proxy component.
  • the first connection identifier is used to identify the connection established between the vTPM driver component loaded by the first VM and the vTPM proxy component.
  • the vTPM proxy component obtains the first connection identifier, and establishes a mapping relationship between the first connection identifier and the first VM.
  • Step 604 the vTPM proxy component transmits session establishment request information to the TrustZone Driver component, and the destination of the session establishment request information is the vTPM service component.
  • the vTPM proxy component transmits session establishment request information to the TrustZone Driver component, and the session establishment request information includes the VM identifier.
  • the destination of the session establishment request information is the vTPM service component, and the session establishment request information is used to request session establishment.
  • the session between the VM proxy component and the vTPM service component is used for subsequent transmission of various information and/or target data between the vTPM service component and the vTPM proxy component.
  • the target data is the data obtained after the vTPM service component performs the TPM operation.
  • the vTPM proxy component initializes the context between the VM and the executable environment by calling the initialization context (TEEC_InitializeContext) function to obtain the corresponding context (TEEC_context). Then, the vTPM proxy component calls the open session (TEEC_OpenSession) function, and specifies the identifier of the VM when calling the TEEC_OpenSession function, so as to transmit session establishment request information to the TrustZone Driver component.
  • TEEC_InitializeContext the initialization context
  • TEEC_context the vTPM proxy component calls the open session (TEEC_OpenSession) function, and specifies the identifier of the VM when calling the TEEC_OpenSession function, so as to transmit session establishment request information to the TrustZone Driver component.
  • Step 605 the TrustZone Driver component transmits the session establishment request information to the vTPM service component.
  • the TrustZone Driver component parses the acquired session establishment request information, and reintegrates the session establishment request information to adjust the format of the session establishment request information.
  • the TrustZone Driver component loads the integrated session establishment request information into the shared memory, and triggers the SMC to enter the monitoring mode. After entering the monitoring mode, the TrustZone Driver component transmits the instruction to the vTPM service component, so that the vTPM service component can obtain the session establishment request information in the shared memory based on the instruction, so as to realize the transmission of the session establishment request information.
  • Step 606 the vTPM service component establishes a session based on the session establishment request information, and allocates storage space for the VM.
  • the vTPM service component After acquiring the session establishment request information, the vTPM service component calls the session open interface (TA_OpenSessionEntryPoint) function. By executing the TA_OpenSessionEntryPoint function, the vTPM service component parses the session establishment request information, and obtains the identifier of the VM included in the session establishment request information. Based on the ID of the VM included in the session establishment request information, the vTPM service component establishes a session, and obtains a session ID corresponding to the ID of the VM included in the session establishment request information.
  • TA_OpenSessionEntryPoint session open interface
  • the vTPM service component transmits the session identifier to the TrustZone Driver component, and the destination of the session identifier is the vTPM proxy component, so that the vTPM proxy component can obtain the session identifier corresponding to the identifier of the VM included in the session establishment request information.
  • the vTPM proxy component only transmits the session establishment request information to the vTPM service component when the VM is first started. Therefore, before the vTPM service component obtains the session establishment request information, the vTPM service component does not allocate storage space for the identifier of the VM included in the session establishment request information. Based on this, after acquiring the session establishment request information, the vTPM service component allocates a storage space for the VM identifier in the trusted execution environment based on the VM identifier included in the session establishment request information. After allocating the storage space, the vTPM service component marks the allocated storage space based on the identification of the VM included in the session establishment request information.
  • the vTPM service component After allocating storage space for the VM identifier included in the session establishment request information, in order to ensure that the vTPM proxy component can subsequently perform TPM operations based on the data in the allocated storage space, the vTPM service component performs TPM on the data in the storage space Initialize operation. By performing a TPM initialization operation, the vTPM service component updates the data in the allocated storage space to TPM initialization data.
  • the vTPM service component performing the TPM initialization operation on the data in the storage space includes: the vTPM service component divides the storage space to obtain multiple storage blocks, and the multiple storage blocks are respectively used to store platform seeds, endorsement seeds, Store data such as seeds, keys or PCRs.
  • the vTPM service component updates the data in the storage block to obtain TPM initialization data.
  • the vTPM service component updates the data in the storage space for storing the PCR, thereby assigning an initialized value to the PCR, and the initialized value is the initial value of the PCR.
  • the non-volatile memory in the trusted execution environment may also have storage space corresponding to the identifier of the VM. Therefore, before the vTPM service component allocates storage space for the identifier of the VM, the vTPM service component searches the non-volatile memory whether there is a storage space corresponding to the identifier of the VM.
  • the vTPM service component allocates storage space for the identifier of the VM in the volatile memory, and assigns the storage space to the non-volatile memory
  • the data in the storage space corresponding to the ID of the VM is copied to the allocated storage space. That is to say, after the vTPM service component allocates storage space for the identifier of the VM in the volatile memory, it does not need to perform the TPM initialization operation on the data in the storage space, but assigns the identifier of the VM in the non-volatile memory corresponding to the identifier of the VM.
  • the data in the storage space is copied to the allocated storage space. In this way, in the scenario of VM restart, the TPM data used by the VM before the restart can be restored in the volatile memory, so as to ensure the normal operation of the VM.
  • the VM corresponding to the identifier of the VM included in the session establishment request information is created for the first time or the session establishment request information
  • the TPM data of the VM corresponding to the identifier of the VM included in the vTPM service component has been discarded, and the vTPM service component allocates storage space for the identifier of the VM in the volatile memory, and performs a TPM initialization operation on the data in the allocated storage space.
  • FIG. 7 is a schematic flowchart of another method for allocating storage space for a vTPM service component according to an embodiment of the present application.
  • the method shown in FIG. 7 corresponds to the above-mentioned second mode.
  • the process of allocating storage space by the vTPM service component includes the following steps.
  • Step 701 the vTPM service component is initialized.
  • Step 702 the vTPM proxy component is initialized.
  • Step 703 the vTPM proxy component establishes a connection with the vTPM driver component.
  • steps 701-703 are similar to the above-mentioned steps 601-603.
  • steps 601-603 please refer to the above-mentioned steps 601-603, which will not be repeated here.
  • Step 704 the VM transmits third request information to the vTPM driver component, and the destination of the third request information is the vTPM service component.
  • the third request information is used to request to perform a TPM operation, and the third request information is the request information first transmitted by the VM to the vTPM driver component after startup.
  • Step 705 the vTPM driver component transmits the third request information to the vTPM proxy component.
  • Step 706 the vTPM proxy component adds the identifier of the VM to the third request information, so as to obtain the fourth request information.
  • Step 707 the vTPM proxy component transmits fourth request information to the TrustZone Driver component, and the destination of the fourth request information is the vTPM service component.
  • Step 708 the TrustZone Driver component transmits the fourth request information to the vTPM service component.
  • steps 705-708 are similar to the above-mentioned steps 502-505.
  • steps 502-505 please refer to the above-mentioned steps 502-505, which will not be repeated here.
  • Step 709 the vTPM service component allocates storage space for the VM according to the fourth request information.
  • the vTPM service component After acquiring the fourth request information, the vTPM service component parses the fourth request information, and obtains the identifier of the VM included in the fourth request information. Based on the identifier of the VM included in the fourth request information, the vTPM service component searches the volatile memory of the trusted execution environment for a storage space corresponding to the identifier of the VM. Since the fourth request information is the request information first transmitted by the vTPM proxy component after the VM is started, there is no storage space corresponding to the VM identifier included in the fourth request information in the volatile memory of the trusted execution environment.
  • the vTPM service component When the vTPM service component cannot find the storage space corresponding to the identifier of the VM included in the fourth request information in the volatile memory, the vTPM service component continues to search the non-volatile memory for the storage space included in the fourth request information The storage space corresponding to the ID of the VM. If there is a storage space corresponding to the identifier of the VM included in the fourth request information in the non-volatile memory, the vTPM service component allocates storage in the volatile memory for the identifier of the VM included in the fourth request information space, and copy the data in the storage space corresponding to the identifier of the VM in the non-volatile memory to the allocated storage space.
  • the vTPM service component allocates storage in the volatile memory for the identifier of the VM included in the fourth request information space, and perform a TPM initialization operation on the data in the allocated storage space.
  • the vTPM service component searches for the corresponding storage space based on the identifier of the VM in the TPM operation request, and determines whether to allocate storage space for the identifier of the VM in the TPM operation request according to the search result, so as to allocate the corresponding storage space for the identifier of the VM. of storage space. Since the vTPM service component can realize the allocation of storage space based on the TPM operation request, the process of establishing a session connection in advance is omitted, and processing resources are saved.
  • the above describes the process by which the vTPM service component allocates storage space for the ID of the VM when the VM is started.
  • the following describes the process by which the vTPM service component reclaims the storage space allocated for the ID of the VM when the VM is shut down.
  • FIG. 8 is a schematic flowchart of a session closure by a vTPM service component according to an embodiment of the present application. As shown in Figure 8, this includes the following steps.
  • Step 801 the vTPM driver component transmits fifth request information to the vTPM proxy component, and the destination of the fifth request information is the vTPM service component.
  • the VM When the VM needs to be shut down, the VM triggers the corresponding vTPM driver component to transmit fifth request information to the vTPM proxy component, where the fifth request information is used to request to close the session with the vTPM service component.
  • Step 802 the vTPM proxy component adds the identifier of the VM to the fifth request information, so as to obtain the sixth request information.
  • the vTPM proxy component acquires the identifier of the VM based on the source of the fifth request information, and adds the acquired identifier of the VM to the fifth request information to identify the fifth request source of information.
  • the process for the vTPM proxy component to obtain the identifier of the VM is similar to that of step 503. For details, please refer to the description of step 503, which will not be repeated here.
  • Step 803 the vTPM proxy component transmits sixth request information to the TrustZone Driver component, and the destination of the sixth request information is the vTPM service component.
  • the vTPM proxy component transmits the sixth request information to the TrustZone Driver component by calling the close session (TEEC_CloseSession) function.
  • the vTPM proxy component terminates the context between the VM and the executable environment by calling the end context (TEEC_FinalizeContext) function to close the connection between the VM and the executable environment.
  • Step 804 the TrustZone Driver component transmits the sixth request information to the vTPM service component.
  • step 804 is similar to the above-mentioned step 505.
  • step 804 is similar to the above-mentioned step 505.
  • steps please refer to the relevant description of the above-mentioned step 505, and details are not repeated here.
  • Step 805 the vTPM service component closes the session based on the sixth request information.
  • the vTPM service component After acquiring the sixth request information, the vTPM service component acquires the identifier of the VM in the sixth request information, so as to determine the storage space corresponding to the identifier of the VM.
  • the vTPM service component is triggered to call a session close interface (TA_CloseSessionEntryPoint) function.
  • TA_CloseSessionEntryPoint session close interface
  • the vTPM service component parses the sixth request information, and obtains the identifier of the VM included in the sixth request information.
  • the vTPM service component searches the volatile memory for the storage space corresponding to the identifier of the VM included in the sixth request information, and obtains the identifier of the VM included in the sixth request information. Identifies the corresponding storage space in volatile memory. Then, the vTPM service component allocates storage space in the non-volatile memory for the identifier of the VM included in the sixth request information, and copies the found data in the storage space in the volatile memory to the non-volatile memory Allocated storage space in memory. After the data in the storage space in the volatile memory is copied, the vTPM service component discards the data in the storage space in the volatile memory, thereby realizing the recovery of the storage space in the volatile memory and improving the storage space in the volatile memory. utilization of storage space.
  • the TPM data corresponding to the identifier of the VM in the volatile memory By copying the TPM data corresponding to the identifier of the VM in the volatile memory to the non-volatile memory when the VM is shut down, the TPM data corresponding to the VM can be restored when the VM is restarted, thereby ensuring the normal operation of the VM.
  • FIG. 9 is a schematic structural diagram of a computer system according to an embodiment of the present application.
  • a trusted execution environment and a rich execution environment run on the computer system, the trusted execution environment runs a vTPM service component, and the rich execution environment runs a first VM and a vTPM agent component.
  • the vTPM proxy component is used to obtain the first request information from the first VM, obtain the identifier of the first VM, add the identifier of the first VM to the first request information, obtain the second request information, and transmit the first request information to the TrustZone Driver component. 2.
  • Request information is used to obtain the first request information from the first VM, obtain the identifier of the first VM, add the identifier of the first VM to the first request information, obtain the second request information, and transmit the first request information to the TrustZone Driver component.
  • the first request information is used to request the vTPM service component to perform a TPM operation
  • the second request information includes the identifier of the first VM
  • the destination of the second request information is the vTPM service component.
  • the vTPM service component is used to obtain the second request information through the TrustZone Driver component, and process the second request information based on the data in the first storage space, where the first storage space is the storage corresponding to the identifier of the first VM in the trusted execution environment space, the first storage space is used to store TPM data of the first VM.
  • the trusted execution environment further includes a second storage space, where the second storage space is used to store TPM data of the second VM, and the first storage space and the second storage space are non-overlapping storage spaces.
  • the second request information further includes a command identifier and a parameter to be processed, where the command identifier is used to indicate the type of the TPM operation to be performed.
  • the vTPM service component is also used to obtain target data based on the identifier of the second VM and the data processing parameters to be processed in the first storage space, and transmit the target data to the TrustZone Driver, and the destination of the target data is the vTPM proxy component.
  • the vTPM proxy component is also used to obtain target data and deliver the target data to the first VM.
  • the parameters to be processed include a key handle and data to be encrypted.
  • the vTPM service component is further configured to invoke the command invocation interface function to obtain the command identifier and to-be-processed parameters in the second request information.
  • the vTPM service component is further configured to encrypt the data to be encrypted by using a key determined by the vTPM according to the key handle according to the command identifier.
  • the parameters to be processed include a key handle and data to be decrypted.
  • the vTPM service component is further configured to invoke the command invocation interface function to obtain the command identifier and to-be-processed parameters in the second request information.
  • the vTPM service component is further configured to decrypt the data to be decrypted by using a key determined by the vTPM according to the key handle according to the command identifier.
  • the vTPM proxy component is also used to obtain third request information from the second VM, where the third request information is used to request to perform a TPM operation, obtain the identifier of the second VM, and add the second VM to the third request information.
  • obtain the fourth request information the fourth request information includes the identification of the second VM, transmit the fourth request information to the TrustZone Driver component, and the destination of the fourth request information is the vTPM service component.
  • the vTPM service component is configured to obtain the fourth request information through the TrustZone Driver component, and process the fourth request information based on the data in the second storage space, where the second storage space is the storage corresponding to the identifier of the second VM in the trusted execution environment space, the second storage space is used to store TPM data of the second VM.
  • the vTPM service component is further configured to allocate storage space for the identifier of the first VM in the trusted execution environment, and to allocate storage space for the allocated storage space.
  • the TPM initialization operation is performed on the data in the TPM, so that the data in the allocated storage space is updated to the TPM initialization data, and the allocated storage space is used as the first storage space.
  • the vTPM service component is also used to search the volatile memory of the computer for the storage space corresponding to the identification of the first VM, if there is no storage space corresponding to the identification of the first VM in the volatile memory, then Allocate storage space in volatile memory.
  • the second request information is transmitted in a first session, and the first session is used to transmit information and/or target data for requesting to perform a TPM operation between the vTPM service component and the vTPM proxy component, and the target data is The data obtained after performing the TPM operation.
  • the vTPM proxy component is further configured to obtain the identifier of the first VM when the first VM is started, generate fifth request information, where the fifth request information includes the identifier of the first VM, and transmit fifth request information to the TrustZone Driver component, the fifth request information The request information is used to request the establishment of the first session, and the destination of the fifth request information is the vTPM service component.
  • the vTPM service component is further configured to obtain the fifth request information through the TrustZone Driver component, and the vTPM service component allocates storage space in the volatile memory of the computer, and uses the allocated storage space as the first storage space.
  • the first session is a session corresponding to the identifier of the first VM
  • the vTPM service component is further configured to call the session open interface function according to the identifier of the first VM included in the fifth request information to establish a connection with the first VM. Identify the corresponding first session and obtain the identification of the first session; the vTPM service component is also used to transmit the identification of the first session to the TrustZone Driver component, and the destination of the identification of the first session is the vTPM proxy component.
  • the vTPM service component is further configured to search the non-volatile memory of the computer for a storage space corresponding to the identifier of the first VM. If there is a storage space corresponding to the identifier of the first VM in the non-volatile memory, the storage space is allocated in the volatile memory, and the data in the storage space corresponding to the identifier of the first VM in the non-volatile memory Copy to allocated storage space. If the storage space corresponding to the identifier of the first VM does not exist in the non-volatile memory, the storage space is allocated in the volatile memory.
  • the vTPM service component is further configured to mark the allocated storage space based on the identifier of the first VM.
  • the vTPM proxy component is further configured to obtain sixth request information from the first VM, where the sixth request information is used to request to close the first session, obtain the identifier of the first VM, and add the first request to the sixth request information.
  • the identifier of the VM thereby obtaining the seventh request information, the seventh request information includes the identifier of the first VM, and the seventh request information is transmitted to the TrustZone Driver component, and the destination of the seventh request information is the vTPM service component; the vTPM service component also uses In obtaining the sixth request information, the first storage space is determined according to the identifier of the first VM contained in the sixth request message, and the data of the first storage space is copied to the third storage space, and the third storage space is located in the non-volatile storage space. memory.
  • the second request information is transmitted by the TrustZone Driver component to the vTPM service component in the monitoring mode, and the TrustZone Driver component runs in a rich execution environment of the computer.
  • each component in the computer system implements the various steps and methods implemented by the vTPM driver component, the vTPM proxy component, the TrusZone driver component, and the vTPM service component in the method embodiments, and the specific details can be found in the above method embodiments. , and are not repeated here for brevity.
  • FIG. 10 is a schematic structural diagram of a computer according to an embodiment of the present application.
  • the computer 1000 is equipped with the above-described computer system.
  • Computer 1000 is implemented by a general bus architecture.
  • Computer 1000 includes at least one processor 1001, a communication bus 1002, memory 1003, and at least one communication interface 1004.
  • the processor 1001 is a general-purpose CPU, NP, microprocessor, or one or more integrated circuits for implementing the solution of the present application, such as an application-specific integrated circuit (ASIC), which can be Programmable logic device (PLD) or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD Programmable logic device
  • the above-mentioned PLD is a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (generic array logic, GAL) or any combination thereof.
  • the communication bus 1002 is used to transfer information between the aforementioned components.
  • the communication bus 1002 is divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.
  • the memory 1003 is a read-only memory (ROM) or other types of static storage devices that can store static information and instructions.
  • memory 1003 is random access memory (RAM) or other type of dynamic storage device that can store information and instructions.
  • the memory 1003 is an electrically erasable programmable read-only memory (electrically erasable programmable read-only Memory, EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, optical disk storage (including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or that can be used to carry or store desired program code in the form of instructions or data structures and can be used by a computer Access any other medium without limitation.
  • the memory 1003 exists independently and is connected to the processor 1001 through the communication bus 1002 .
  • the memory 1003 and the processor 1001 are integrated together.
  • Communication interface 1004 uses any transceiver-like device for communicating with other devices or a communication network.
  • Communication interface 1004 includes a wired communication interface.
  • the communication interface 1004 further includes a wireless communication interface.
  • the wired communication interface is, for example, an Ethernet interface.
  • An Ethernet interface is an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface is a wireless local area network (wireless local area network, WLAN) interface, a cellular network communication interface or a combination thereof.
  • the processor 1001 includes one or more CPUs, such as CPU0 and CPU1 as shown in FIG. 10 .
  • the computer 1000 includes multiple processors, such as the processor 1001 and the processor 1005 shown in FIG. 10 .
  • processors are a single-core processor (single-CPU), or a multi-core processor (multi-CPU).
  • a processor herein refers to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the memory 1003 is used to store the program code 1010 for executing the solutions of the present application, and the processor 1001 executes the program code 1010 stored in the memory 1003 . That is, the computer 1000 implements the above method embodiments through the processor 1001 and the program code 1010 in the memory 1003 .
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: a U disk, a removable hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk and other media that can store program codes.

Abstract

一种虚拟可信平台模块vTPM的实现方法，该方法应用于计算机中。该计算机的可信执行环境中运行有vTPM服务组件，该计算机的丰富执行环境中运行有第一虚拟机VM和vTPM代理组件。该方法包括：vTPM服务组件获取来自于vTPM代理组件的第一请求信息，该第一请求信息包括第一VM的标识，且该第一请求信息用于请求执行TPM操作。vTPM服务组件基于第一存储空间中的数据处理第一请求信息，其中，该第一存储空间是在可信执行环境中与第一VM的标识对应的存储空间，第一存储空间用于存储第一VM的TPM数据。通过该方法，能够在为多个VM提供TPM服务的基础上，保证数据的安全性。

Description

一种虚拟可信平台模块的实现方法及相关装置
本申请要求于2020年10月27日提交中国专利局、申请号为202011159996.2、发明名称为“一种可信平台模块的实现方法和相关装置”的中国专利申请的优先权，和要求于2020年11月26日提交中国专利局、申请号为202011353009.2、发明名称为“一种虚拟可信平台模块的实现方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，尤其涉及一种虚拟可信平台模块(virtual Trusted Platform Module，vTPM)的实现方法及相关装置。
背景技术
可信平台模块(Trusted Platform Module，TPM)是一项安全密码处理器的国际标准。这项标准规定使用设备中集成的专用微控制器(安全硬件)处理设备中的加密密钥。符合TPM标准的专用微控制器被称为TPM芯片。TPM芯片是一种含有密码运算部件和存储部件的小型芯片系统，用于安全地存储用于验证平台(例如个人电脑等网络设备)安全性的信息，比如密码、证书或加密密钥等信息。通过由TPM芯片存储这些信息，能够有效防止非法用户对敏感信息进行更改。
由于TPM芯片逻辑简单，无法支持虚拟化特性，即无法同时为多个虚拟机(virtual Machine，VM)提供TPM服务。因此，相关技术中，通过软件虚拟出多个功能模块，每个功能模块具有TPM芯片的功能，以保证能够同时为多个VM提供TPM服务。通过软件虚拟实现的上述功能模块被称为虚拟可信平台模块(virtual Trusted Platform Module，vTPM)芯片，也被简称为vTPM。
然而，由于vTPM芯片通过软件虚拟得到，相对于硬件形态的TPM芯片，其安全性较差，难以保证数据的安全性。
发明内容
本申请提供了一种vTPM的实现方法，用于在为多个VM提供TPM服务的基础上，保证数据的安全性。
本申请第一方面提供一种vTPM的实现方法，该方法应用于计算机中。该计算机的可信执行环境中运行有vTPM服务组件，该计算机的丰富执行环境中运行有第一VM和vTPM代理组件。该方法包括：vTPM服务组件获取来自于vTPM代理组件的第一请求信息，该第一请求信息包括第一VM的标识，且该第一请求信息用于请求执行TPM操作。vTPM服务组件例如是获取可信空间驱动(TrustZone Driver)组件在监控模式下传递的第一请求信息。例如，该第一请求信息用于请求执行生成密钥、加密数据或解密数据等TPM操作。基于该第一请求信息中的第一VM的标识，vTPM服务组件能够确定第一VM的标识对应的第一存储空间。vTPM服务组件基于第一存储空间中的数据处理第一请求信息，其中，该 第一存储空间是在可信执行环境中与第一VM的标识对应的存储空间，第一存储空间用于存储第一VM的TPM数据。
本方案中，通过运行于可信执行环境中的vTPM服务组件根据获取到的请求信息中的VM的标识确定对应的存储空间，并且基于VM的标识对应的存储空间中的数据为该请求信息中的VM的标识对应的VM提供TPM服务，使得vTPM服务组件能够基于不同的存储空间为不同的VM提供TPM服务。从而能够在为多个VM提供TPM服务的基础上，保证vTPM中数据的安全性。
可选的，在一种实施方式中，该计算机的可信执行环境中还包括第二存储空间，其中第二存储空间用于存储计算机中第二VM的TPM数据，且第一存储空间和第二存储空间为互不重合的存储空间。也就是说，在计算机的可信执行环境中包括多个相互隔离的存储空间，不同的存储空间用于存储不同VM的TPM数据，从而使得vTPM服务组件能够基于各个VM唯一对应的存储空间中的TPM数据，来为VM提供TPM服务。
可选的，在一种实施方式中，第一请求信息还包括命令标识和待处理参数，命令标识用于指示待执行的TPM操作的类型。vTPM服务组件基于第一存储空间中的数据处理第一请求信息，具体包括：vTPM服务组件基于第一请求信息中的命令标识和第一存储空间中的数据处理待处理参数，得到目标数据。vTPM服务组件向TrustZone Driver组件传递目标数据，该目标数据的目的方为vTPM代理组件。
可选的，在一种实施方式中，待处理参数包括密钥句柄以及待加密数据。vTPM服务组件调用命令调用接口函数解析第一请求信息，以得到第一请求信息中的命令标识和待处理参数。vTPM服务组件根据解析得到的命令标识，采用密钥对待加密数据进行加密处理，密钥为vTPM根据密钥句柄确定的。例如，第一请求信息中包括了命令标识、密钥句柄和待加密数据，命令标识用于指示执行RSA加密操作。基于密钥句柄，vTPM服务组件在第一存储空间中查找密钥句柄对应的密钥。最后，vTPM服务组件基于命令标识，采用从第一存储空间中获取到的密钥对待加密数据进行加密处理，得到目标数据。
可选的，在一种实施方式中，待处理参数包括密钥句柄以及待解密数据。vTPM服务组件调用命令调用接口函数解析第一请求信息，以得到第一请求信息中的命令标识和待处理参数。vTPM服务组件根据命令标识，采用密钥对待解密数据进行解密处理，密钥为vTPM根据密钥句柄确定的。
可选的，在一种实施方式中，在vTPM服务组件基于第一存储空间中的数据处理第一请求信息之前，该方法还包括：如果可信执行环境中不存在第一VM的标识对应的存储空间，vTPM服务组件在可信执行环境中为第一VM的标识分配存储空间。vTPM服务组件对分配的存储空间中的数据执行TPM初始化操作，以使得分配的存储空间中的数据更新为TPM初始化数据，并将分配的存储空间作为第一VM的标识所对应的第一存储空间。其中，vTPM服务组件对存储空间中的数据执行TPM初始化操作包括：vTPM服务组件对存储空间进行划分，得到多个存储块，多个存储块分别用于存储平台种子、背书种子、存储种子、密钥或PCR等数据。vTPM服务组件对存储块中的数据进行更新，得到TPM初始化数据。例如，vTPM服务组件对存储PCR的存储空间中的数据进行更新，从而给PCR赋予一个初 始化的值，这个初始化的值即为PCR的初值。
通过由vTPM服务组件为VM的标识在可信执行环境中分配对应的存储空间，可以保证每个VM在可信执行环境中均有对应的存储空间，保证vTPM服务组件能够基于不同的存储空间中的TPM数据为多个VM提供TPM服务。
可选的，在一种实施方式中，vTPM服务组件在可信执行环境中为第一VM的标识分配存储空间，具体包括：vTPM服务组件在计算机的易失性存储器中查找与第一VM的标识对应的存储空间。如果易失性存储器中不存在与第一VM的标识对应的存储空间，vTPM服务组件在易失性存储器中为第一VM的标识分配对应的存储空间。
可选的，在一种实施方式中，vTPM服务组件获取到的第一请求信息是在第一会话中传输的，第一会话用于在vTPM服务组件与vTPM代理组件之间传输用于请求执行TPM操作的信息和/或目标数据，目标数据是vTPM服务组件执行TPM操作后得到的数据。该方法还包括：在第一VM启动之后，vTPM服务组件获取来自于vTPM代理组件的第二请求信息，第二请求信息包括第一VM的标识，第二请求信息用于请求建立第一会话。vTPM服务组件根据第一VM的标识建立会话，并在计算机的易失性存储器中分配存储空间，将分配的存储空间作为第一存储空间。也就是说，在VM启动之后，通过vTPM代理组件所传递的会话建立请求，来触发vTPM服务组件为VM的标识分配存储空间。从而能够在vTPM代理组件获取到TPM操作请求之前，提前为VM的标识分配好对应的存储空间，提高执行TPM操作的效率。
可选的，在一种实施方式中，第一会话是与第一VM的标识对应的会话，该方法还包括：vTPM服务组件根据第二请求信息中包括的第一VM的标识，调用会话打开接口(TA_OpenSessionEntryPoint)函数，以建立与第一VM的标识对应的第一会话并得到第一会话的标识。vTPM服务组件向计算机的丰富执行环境中的TrustZone Driver组件传递第一会话的标识，第一会话的标识的目的方为vTPM代理组件。即vTPM服务组件通过调用TA_OpenSessionEntryPoint函数来建立第一会话，并将得到的第一会话的标识返回给vTPM代理组件。
可选的，在一种实施方式中，vTPM服务组件在易失性存储器中分配存储空间，具体包括：vTPM服务组件在计算机的非易失性存储器中查找与第一VM的标识对应的存储空间。
若非易失性存储器中存在与第一VM的标识对应的存储空间，则vTPM服务组件在易失性存储器中分配存储空间，以及将非易失性存储器中与第一VM的标识对应的存储空间中的数据复制到分配的存储空间。也就是说，vTPM服务组件在易失性存储器中为第一VM的标识分配存储空间之后，不需要对所分配的存储空间中的数据执行TPM初始化操作，而是将非易失性存储器中与第一VM的标识对应的存储空间中的数据复制到所分配的存储空间。这样，在第一VM重启动的场景下，可以在易失性存储器中恢复第一VM在重启动之前所使用的TPM数据，保证第一VM的正常运行。
若非易失性存储器中不存在与第一VM的标识对应的存储空间，则可以认为第一VM是首次创建或者第一VM对应的TPM数据已被丢弃。vTPM服务组件在易失性存储器中分 配存储空间，并对所分配的存储空间中的数据执行TPM初始化操作。
可选的，在一种实施方式中，在vTPM服务组件在易失性存储器中分配存储空间之后，该方法还包括：vTPM服务组件基于第一VM的标识标记分配的存储空间，以便于后续vTPM服务组件能够基于第一VM的标识确定其对应的存储空间。
可选的，在一种实施方式中，该方法还包括：当第一VM关闭时，vTPM服务组件获取来自于vTPM代理组件的第三请求信息。其中，第三请求信息是在第一会话中传输的，第三请求信息包括第一VM的标识，第三请求信息用于请求关闭第一会话。vTPM服务组件根据第三请求消息中包含的第一VM的标识，确定第一存储空间。vTPM服务组件将第一存储空间的数据复制到第三存储空间，第三存储空间位于非易失性存储器。可选的，在易失性存储器中的存储空间中的数据拷贝完毕之后，vTPM服务组件丢弃易失性存储器的存储空间中的数据，从而实现易失性存储器中的存储空间的回收，提高易失性存储器中的存储空间的利用率。通过在第一VM关闭时，将第一VM的标识对应的TPM数据被复制到非易失性存储器中，能够在第一VM重启动时，恢复第一VM对应的TPM数据，保证第一VM的正常运行。
可选的，在一种实施方式中，第一请求信息是TrustZone Driver组件在监控模式下向vTPM服务组件传递的，TrustZone Driver组件运行于计算机的丰富执行环境中。
本申请第二方面提供一种vTPM的实现方法，包括：vTPM代理组件获取来自于第一VM的第一请求信息，第一请求信息用于请求vTPM服务组件执行TPM操作。其中，vTPM服务组件运行于计算机的可信执行环境中，第一VM运行于计算机的丰富执行环境中。vTPM代理组件获取第一VM的标识。vTPM代理组件在第一请求信息中添加第一VM的标识，从而得到第二请求信息，第二请求信息包括第一VM的标识。vTPM代理组件向运行于计算机的可信执行环境中的TrustZone Driver组件传递第二请求信息，第二请求信息的目的方为vTPM服务组件。通过在TPM操作请求中添加VM的标识，可以使得vTPM服务组件能够基于TPM操作请求中所包括的VM的标识确定对应的存储空间，并基于VM的标识对应的存储空间中的TPM数据为VM提供TPM服务。
可选的，在一种实施方式中，vTPM代理组件在第一请求信息中添加第一VM的标识包括：vTPM代理组件通过调用命令调用函数，在第一请求信息中添加第一VM的标识，从而得到第二请求信息。
可选的，在一种实施方式中，该方法还包括：vTPM代理组件获取来自于第二VM的第三请求信息，第三请求信息用于请求执行TPM操作。vTPM代理组件获取第二VM的标识。vTPM代理组件在第三请求信息中添加第二VM的标识，从而得到第四请求信息，第四请求信息包括第二VM的标识。vTPM代理组件向TrustZone Driver组件传递第四请求信息，第四请求信息的目的方为vTPM服务组件。
可选的，在一种实施方式中，该方法还包括：vTPM代理组件通过TrustZone Driver组件获取来自于vTPM服务组件的目标数据，目标数据为vTPM服务组件基于第二请求信息执行TPM操作后得到的数据。vTPM代理组件向第一VM传递目标数据。
可选的，在一种实施方式中，该方法还包括：当第一VM启动时，vTPM代理组件获 取第一VM的标识。vTPM代理组件生成第五请求信息，第五请求信息用于请求建立与vTPM服务组件的会话，第五请求信息包括第一VM的标识。vTPM代理组件向TrustZone Driver组件传递第五请求信息，第五请求信息的目的方为vTPM服务组件。
可选的，在一种实施方式中，该方法还包括：vTPM代理组件获取来自于第一VM的第六请求信息，第六请求信息用于请求关闭与vTPM服务组件的会话。vTPM代理组件获取第一VM的标识。vTPM代理组件在第六请求信息中添加第一VM的标识，从而得到第七请求信息，第七请求信息包括第一VM的标识。vTPM代理组件向TrustZone Driver组件传递第七请求信息，第七请求信息的目的方为vTPM服务组件。
本申请第三方面提供一种计算机系统，计算机系统上运行有可信执行环境和丰富执行环境，可信执行环境运行有vTPM服务组件，丰富执行环境运行有第一VM和vTPM代理组件。vTPM代理组件用于获取来自于第一VM的第一请求信息，获取第一VM的标识，在第一请求信息中添加第一VM的标识，得到第二请求信息，并向TrustZone Driver组件传递第二请求信息，第一请求信息用于请求vTPM服务组件执行TPM操作，第二请求信息包括第一VM的标识，第二请求信息的目的方为vTPM服务组件。vTPM服务组件用于通过TrustZone Driver组件获取第二请求信息，并基于第一存储空间中的数据处理第二请求信息，第一存储空间是在可信执行环境中与第一VM的标识对应的存储空间，第一存储空间用于存储第一VM的TPM数据。
可选的，在一种实施方式中，可信执行环境中还包括第二存储空间，第二存储空间用于存储第二VM的TPM数据，且第一存储空间和第二存储空间为互不重合的存储空间。
可选的，在一种实施方式中，第二请求信息还包括命令标识和待处理参数，命令标识用于指示待执行的TPM操作的类型。vTPM服务组件还用于基于第二请求信息中的命令标识和第一存储空间中的数据处理待处理参数，得到目标数据，并向TrustZone Driver传递目标数据，目标数据的目的方为vTPM代理组件。vTPM代理组件还用于获取目标数据，并向第一VM传递目标数据。
可选的，在一种实施方式中，待处理参数包括密钥句柄以及待加密数据。vTPM服务组件还用于调用命令调用接口函数，以得到第二请求信息中的命令标识和待处理参数。vTPM服务组件还用于根据命令标识，采用密钥对待加密数据进行加密处理，密钥为vTPM根据密钥句柄确定的。
可选的，在一种实施方式中，待处理参数包括密钥句柄以及待解密数据。vTPM服务组件还用于调用命令调用接口函数，以得到第二请求信息中的命令标识和待处理参数。vTPM服务组件还用于根据命令标识，采用密钥对待解密数据进行解密处理，密钥为vTPM根据密钥句柄确定的。
可选的，在一种实施方式中，vTPM代理组件还用于获取来自于第二VM的第三请求信息，第三请求信息用于请求执行TPM操作。vTPM代理组件还用于获取第二VM的标识，在第三请求信息中添加第二VM的标识，得到第四请求信息，第四请求信息包括第二VM的标识。vTPM代理组件还用于向TrustZone Driver组件传递第四请求信息，第四请求信息的目的方为vTPM服务组件。vTPM服务组件用于通过TrustZone Driver组件获取第四请求 信息，并基于第二存储空间中的数据处理第四请求信息，第二存储空间是在可信执行环境中与第二VM的标识对应的存储空间，第二存储空间用于存储第二VM的TPM数据。
可选的，在一种实施方式中，如果可信执行环境中不存在第一VM的标识对应的存储空间，vTPM服务组件还用于在可信执行环境中为第一VM的标识分配存储空间，以及对分配的存储空间中的数据执行TPM初始化操作，以使得分配的存储空间中的数据更新为TPM初始化数据，并将分配的存储空间作为第一存储空间。
可选的，在一种实施方式中，vTPM服务组件还用于在计算机的易失性存储器中查找与第一VM的标识对应的存储空间，如果易失性存储器中不存在与第一VM的标识对应的存储空间，则在易失性存储器中分配存储空间。
可选的，在一种实施方式中，第二请求信息是在第一会话中传输的，第一会话用于在vTPM服务组件与vTPM代理组件之间传输用于请求执行TPM操作的信息和/或目标数据，目标数据是执行TPM操作后得到的数据。vTPM代理组件还用于当第一VM启动时，获取第一VM的标识，生成第五请求信息，第五请求信息包括第一VM的标识，以及向TrustZone Driver组件传递第五请求信息，第五请求信息用于请求建立第一会话，第五请求信息的目的方为vTPM服务组件。vTPM服务组件还用于通过TrustZone Driver组件获取第五请求信息，vTPM服务组件在计算机的易失性存储器中分配存储空间，将分配的存储空间作为第一存储空间。
可选的，在一种实施方式中，第一会话是与第一VM的标识对应的会话，vTPM服务组件还用于根据第五请求信息中包括的第一VM的标识，调用会话打开接口函数，以建立与第一VM的标识对应的第一会话并得到第一会话的标识。vTPM服务组件还用于向TrustZone Driver组件传递第一会话的标识，第一会话的标识的目的方为vTPM代理组件。
可选的，在一种实施方式中，vTPM代理组件还用于获取来自于第一VM的第六请求信息，第六请求信息用于请求关闭第一会话，获取第一VM的标识，在第六请求信息中添加第一VM的标识，从而得到第七请求信息，第七请求信息包括第一VM的标识，以及向TrustZone Driver组件传递第七请求信息，第七请求信息的目的方为vTPM服务组件；vTPM服务组件还用于获取第六请求信息，根据第六请求消息中包含的第一VM的标识，确定第一存储空间，将第一存储空间的数据复制到第三存储空间，第三存储空间位于非易失性存储器。
可选的，在一种实施方式中，第二请求信息是TrustZone Driver组件在监控模式下向vTPM服务组件传递的，TrustZone Driver组件运行于计算机的丰富执行环境中。
本申请第四方面提供一种计算机，计算机包括：处理器、非易失性存储器和易失性存储器；其中，非易失性存储器或易失性存储器中存储有计算机可读指令；处理器读取计算机可读指令以使计算机实现如第一方面或第二方面的任意一种实施方式的方法。
本申请第五方面提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如第一方面或第二方面的任意一种实施方式的方法。
本申请第六方面提供一种计算机程序产品，当其在计算机上运行时，使得计算机执行 如第一方面或第二方面的任意一种实施方式的方法。
本申请第七方面提供一种芯片，包括一个或多个处理器。处理器中的部分或全部用于读取并执行存储器中存储的计算机程序，以执行上述任一方面任意可能的实施方式中的方法。可选的，芯片还包括存储器，存储器与处理器通过电路或电线与存储器连接。可选的，芯片还包括通信接口，处理器与通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从通信接口获取数据和/或信息，并对数据和/或信息进行处理，并通过通信接口输出处理结果。可选的，通信接口是输入输出接口。本申请提供的方法由一个芯片实现，或者由多个芯片协同实现。
附图说明
图1为本申请实施例提供的一种TPM的结构示意图；
图2为本申请实施例提供的TrustZone技术相关的系统软件层面的示意图；
图3为本申请实施例提供的一种系统架构的示意图；
图4为本申请实施例提供的一种计算机系统的结构示意图；
图5为本申请实施例提供的一种vTPM的实现方法500的流程示意图；
图6为本申请实施例提供的一种vTPM服务组件分配存储空间的方法的流程示意图；
图7为本申请实施例提供的另一种vTPM服务组件分配存储空间的方法的流程示意图；
图8为本申请实施例提供的一种vTPM服务组件关闭会话的流程示意图；
图9为本申请实施例提供的一种计算机系统的结构示意图；
图10为本申请实施例提供的一种计算机的结构示意图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着新应用场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
TPM芯片是一种含有密码运算和存储部件的小型芯片系统，用于安全地存储用于验证平台(例如个人电脑等网络设备)安全性的信息，比如密码、证书或加密密钥等信息。通过内置的算法，TPM芯片生成可信的密钥，并通过非易失随机读写存储器(Non-Volatile Random Access Memory，NVRAM)及存储根密钥(Storage Root Key，SRK)保证了根密钥以及其他敏感数据的机密性与完整性。
可以参阅图1，图1为本申请实施例提供的一种TPM芯片的结构示意图。如图1所示，TPM芯片通常包括但不限于以下几个模块：密钥生成器、非对称密钥引擎、对称密钥引擎、哈希引擎、随机数生成器、授权模块、非易失性存储器以及易失性存储器。上述各个模块的介绍可以如下文所示。
密钥生成器：用于在TPM芯片硬件边界内产生密钥，并保护密钥的安全性。
非对称密钥引擎：用于执行非对称密钥的加密和解密。
对称密钥引擎：用于执行对称密钥的加密和解密。
哈希引擎：用于对输入数据执行安全的哈希运算，并输出摘要信息。
随机数生成器：基于硬件来实现的真随机数发生器。
授权模块：用于控制对TPM芯片中实体的访问，在TPM芯片被访问时，为TPM芯片提供访问安全保证。
非易失性存储器：掉电不易失的存储器，可以存储密钥、随机数种子或证书等需要持久保存的数据。
易失性存储器：掉电易失的存储器，可以存储平台配置寄存器(Platform Configuration Register，PCR)或运行时的会话等临时数据。
由于TPM芯片逻辑简单，无法支持虚拟化特性，即无法同时为多个VM提供TPM服务，导致TPM芯片难以在一些云化场景广泛应用。其中，VM是一种严密隔离且内含操作系统和应用的软件容器，每个VM都是完全独立的。通过虚拟化技术，能够基于一台物理服务器的硬件资源运行多个VM。相关技术中，通过软件虚拟出多个功能模块，每个功能模块具有TPM芯片的功能，以保证能够同时为多个VM提供TPM服务。通过软件虚拟实现的上述功能模块被称为vTPM芯片，也被简称为vTPM。然而，由于vTPM芯片通过软件虚拟得到，相对于硬件形态的TPM芯片，其安全性较差，难以保证数据的安全性。
有鉴于此，本申请实施例提供一种vTPM的实现方法。运行于可信执行环境中的vTPM服务组件根据VM的标识确定对应的存储空间，并且基于VM对应的存储空间中的数据为该VM提供TPM服务，使得vTPM服务组件能够基于不同的存储空间为不同的VM提供TPM服务。从而能够在为多个VM提供TPM服务的基础上，保证vTPM中数据的安全性。
为了便于理解，以下将介绍本申请实施例所涉及的一些技术术语。
相关技术中，为了给计算机中的应用或组件提供一个安全的运行环境，ARM处理器引入了可信空间(TrustZone)技术。支持TrustZone技术的ARM处理器在运行时将工作状态划分为两种：安全状态和非安全状态，也称为安全世界态和正常世界态。一般的操作系统以及大部分的应用运行在正常世界状态中，正常世界状态内的开发资源相对于安全世界状态较为丰富，因此通常称正常世界状态为丰富执行环境(Rich Execution Environment，REE)。而可信任的操作系统运行于安全世界状态，通常称安全世界状态为可信执行环境(Trusted Execution Environment，TEE)。
当处理器处于安全状态时只能运行可信执行环境侧的代码，且具有丰富执行环境侧地址空间的访问权限。当处理核处于非安全状态时只能运行丰富执行环境侧的代码，且只能通过预先定义好的客户端接口来获取可信执行环境侧中特定的数据和调用特定的功能。
可以参阅图2，图2为本申请实施例提供的TrustZone技术相关的系统软件层面的示意图。如图2所示，处理器在运行时具有不同的执行等级(Execution Level，EL)。其中，用户模式用EL0表示；特权模式用EL1表示；Hyp模式用EL2表示，用于实现虚拟化技术 的模式；监控(Monitor)模式用EL3表示。系统只有在Monitor模式下，才能实现安全状态和非安全状态的切换。
可以参阅图3，图3为本申请实施例提供的一种系统架构的示意图。如图3所示，在该系统架构中，包括可信执行环境和丰富执行环境。可信执行环境是专门为高安全敏感的应用提供的，能够保证应用的资源和数据的保密性、和完整性。通用的丰富执行环境是为传统操作系统以及通用提供的。在丰富执行环境侧执行的应用称为客户端应用程序(client application，CA)，比如银行类应用等第三方支付应用。在可信执行环境侧执行的应用称为可信应用程序(trusted application，TA)，比如执行签名、加解密计算等关键服务的应用。
由于TA运行在可信执行环境中，TA的部署/升级操作需要严格遵循可信执行环境发行方的安全验证规范，比如使用数字签名等措施，以确保可信执行环境各个环节是真正可信的。可信执行环境中包括可信执行环境内部应用程序编程接口(trusted execution environment internal application programming interface，TEE Internal API)和可信操作系统部件。TEE Internal API的主要作用为：向上提供可信操作系统部件的功能、与客户端应用程序CA通信、实现TA与TA通信以及提供安全存储、密码学功能和时间等功能。可信操作系统部件主要包括可信核心框架、可信功能、可信内核和可信执行环境TEE通信代理。其中，可信核心框架为TA提供类似操作系统的功能。可信功能为应用开发者提供支持能力。可信内核用于与平台硬件中的可信设备进行交互。可信执行环境通信代理为TA和CA提供一个安全的通信通道。例如，可信执行环境通信代理通过平台硬件将消息传递至丰富执行环境通信代理，实现TA和CA的交互。
丰富执行环境中包括可信执行环境客户端应用程序编程接口(trusted execution environment client application programming interface，TEE Client API)、可信执行环境功能应用程序编程接口(trusted execution environment functional application programming interface，TEE Functional API)和多媒体操作系统。多媒体操作系统部件主要包括公共设备驱动和丰富执行环境通信代理。其中，丰富执行环境通信代理用于与可信执行环境进行通信，为CA和TA提供一个安全的通信通道。公共设备驱动用于驱动平台硬件中的公共设备。CA使用TEE Client API、TEE Functional API接入到由TA提供的安全服务。
以上介绍了本申请实施例所涉及的一些技术术语，以下将介绍本申请实施例所提供的计算机系统以及vTPM的实现方法。
图4为本申请实施例提供的一种计算机系统的结构示意图。如图4所示，在该计算机系统中包括丰富执行环境和可信执行环境。在该丰富执行环境中，运行有VM、vTPM驱动组件(vTPM Driver)、vTPM代理组件(vTPM Proxy)、可信空间驱动组件(TrustZone Driver)以及主机操作系统(HOST OS)。可选地，丰富执行环境中运行一个或多个VM，每个VM运行一个vTPM驱动组件，每个VM中的vTPM驱动组件与这个VM对应的vTPM代理组件进行通信。可替换地，每个VM运行一个vTPM驱动组件，丰富执行环境中只运行有一个vTPM代理组件，这个vTPM代理组件与多个vTPM驱动组件通信。在可信执行环境中， 运行有可信执行环境操作系统(TEE OS)和vTPM服务组件(vTPM Service)。其中，组件是指自包含的、可编程的、可重用的以及与语言无关的软件单元。vTPM驱动组件、vTPM代理组件以及可信空间驱动组件均为软件单元。
基于图4所示的计算机系统，本申请实施例提供了一种vTPM的实现方法，如图5所示。图5为本申请实施例提供的一种vTPM的实现方法500的流程示意图。如图5所示，该方法500包括以下的步骤501至步骤510。
步骤501，VM向vTPM驱动组件传递第一请求信息，第一请求信息的目的方为vTPM服务组件。
本实施例中，VM中运行有应用(APP)。APP例如为密钥管理组件或支付组件。在APP的运行过程中，APP需要访问vTPM服务组件，以请求vTPM服务组件执行加密数据或解密数据等TPM操作。当APP需要访问vTPM时，VM生成用于请求vTPM服务组件执行TPM操作的第一请求信息，并向vTPM驱动组件传递第一请求信息。第一请求信息的目的方为vTPM服务组件。
可选的，第一请求信息用于请求执行的TPM操作包括但不限于生成密钥、加密数据、解密数据或对数据执行哈希运算等操作，本申请实施例并不对第一请求信息所请求执行的TPM操作做具体限定。
在一个可能的示例中，当APP需要请求vTPM服务组件生成密钥，以便于APP后续能够基于所生成的密钥加密或解密数据时，VM调用密钥生成函数，并且输入需要生成的密钥类型等参数。密钥生成函数将VM所输入的参数组合成TPM命令字节流。TPM命令字节流包括第一命令标识，第一命令标识用于指示执行密钥生成操作。
在另一个可能的示例中，当APP需要请求vTPM服务组件以RSA算法加密数据时，VM调用RSA加密(Tss2_Sys_RSA_Encrypt)函数，并且输入加密操作的命令标识以及需要加密的数据等参数。其中RSA算法为一种非对称加密算法。Tss2_Sys_RSA_Encrypt函数将VM所输入的参数组合成TPM命令字节流，TPM命令字节流包括第二命令标识、第一密钥句柄以及待加密数据。其中，第二命令标识用于指示执行RSA加密操作；第一密钥句柄为密钥的标识，用于指示执行数据加密的密钥；待加密数据为需要进行加密的数据。
在又一个可能的示例中，当APP需要请求vTPM服务组件以RSA算法解密数据时，VM调用RSA解密函数，并且输入解密操作的命令标识以及需要解密的数据等参数。RSA解密函数将VM所输入的参数组合成TPM命令字节流，TPM命令字节流包括第三命令标识、第二密钥句柄以及待解密数据。其中，第三命令标识用于指示执行RSA解密操作；第二密钥句柄为密钥的标识，用于指示执行数据解密的密钥；待解密数据即为需要进行解密的数据。
可以理解的是，上述示例中的TPM命令字节流即为上述的第一请求信息。在得到TPM命令字节流之后，VM通过调用写入(write)函数，向vTPM驱动组件传递该TPM命令字节流。
可选的，第一请求信息的一种表示方式为{TPM命令标识符(Command Indentifier，CMD ID),参数(Parameters)}。其中，TPM CMD ID用于标识具体的TPM操作类型，例如加 密数据或解密数据。Parameters用于标识待处理的参数，例如待加密的明文或待解密的密文。
步骤502，vTPM驱动组件向vTPM代理组件传递第一请求信息。
vTPM驱动组件用于实现与VM相关的TPM数据的输入输出(Input/Output，I/O)操作，即vTPM驱动组件负责将VM所生成的TPM请求信息传递给VM外部的组件，以及将VM外部的组件返回的TPM响应信息传递给VM。
可选的，VM运行有客户机操作系统(guest operating system，guest OS)。Guest OS对VM上所运行的APP提供了统一的设备文件。其中，设备文件是指将一个设备模拟成文件，以使得APP能够通过该文件的接口来实现对设备的访问，例如将硬盘、输入设备、输出设备等设备模拟成一个文件。也就是说，VM上的APP在运行时，通过对操作系统所提供的设备文件执行读写操作，实现对vTPM服务组件的操作。
例如，假设vTPM服务组件对应的设备文件的路径为/dev/tpm0。基于设备文件的路径，VM调用系统的write函数，对设备文件执行写操作，以写入上述的第一请求信息。由于vTPM驱动组件用于实现具体的I/O操作，因此在VM写入第一请求信息之后，触发vTPM驱动组件向vTPM代理组件传递该第一请求信息。
可选的，vTPM驱动组件传递第一请求信息的方式包括但不限于：通过调用应用程序编程接口(Application Programming Interface，API)来向vTPM代理组件传递第一请求信息，或基于进程间通信的方式来向vTPM代理组件传递第一请求信息。其中，进程间通信的方式包括但不限于基于管道进行通信、基于消息队列进行通信、基于共享内存进行通信或者基于套接字进行通信等方式。本申请实施例不对vTPM驱动组件传递第一请求信息的方式做具体限定。
步骤503，vTPM代理组件在第一请求信息中添加VM的标识，从而得到第二请求信息。
在获取到第一请求信息之后，vTPM代理组件基于第一请求信息的来源，获取VM的标识。然后，vTPM代理组件在第一请求信息中添加所获取到的VM的标识，以标识该第一请求信息的来源。可选的，VM的标识例如为通用唯一识别码(Universally Unique Identifier，UUID)。其中，UUID为一个128比特的数值，由当前时间、计数器和硬件标识等数据计算生成。
可选的，第二请求信息的一种表示方式为{VM UUID，TPM CMD ID,Parameters}。
其中，vTPM代理组件获取VM的标识的方式有多种。
在一个vTPM代理组件只对应一个VM的情况下，即vTPM代理组件只与一个vTPM驱动组件建立连接，vTPM代理组件从存储VM的标识的存储空间中获取该VM的标识。在虚拟机监控器(Virtual Machine Monitor，VMM)创建VM之后，VMM为VM分配一个唯一的标识作为该VM的标识，并向vTPM代理组件传递该VM的标识。其中，VMM也被称为hypervisor。vTPM代理组件将获取到的VM的标识存储在特定的存储空间中，该特定的存储空间中只存储有一个VM的标识。由于vTPM代理组件只对应一个VM，因此在获取到第一请求信息之后，vTPM代理组件能够从该特定的存储空间中获取到VM的标识。这个VM的标识能够用于标识第一请求信息的来源。
在一个vTPM代理组件对应多个VM的情况下，即vTPM代理组件与多个vTPM驱动 组件建立连接，vTPM代理组件基于与vTPM驱动组件之间的连接获取该VM的标识。在VMM为新创建的VM分配标识，并向vTPM组件传递为新创建的VM所分配的标识之后，vTPM代理组件与新创建的VM对应的vTPM驱动组件建立连接，vTPM代理组件获得与vTPM驱动组件之间的连接的标识。vTPM代理组件除了保存获取到的VM的标识之外，还保存VM的标识与连接的标识之间的映射关系。这样，在vTPM代理组件获取到第一请求信息之后，vTPM代理组件根据传递第一请求信息的连接确定连接的标识(即vTPM代理组件与该vTPM驱动组件之间的连接的标识)。其中，传递第一请求信息的连接是指vTPM驱动组件与vTPM代理组件之间的连接，该连接用于传递第一请求信息。vTPM代理组件再根据连接的标识以及映射关系确定VM的标识，从而获取到第一请求信息所对应的VM的标识。
步骤504，vTPM代理组件向TrustZone Driver组件传递第二请求信息，该第二请求信息的目的方为vTPM服务组件。
由于vTPM代理组件位于丰富执行环境中，而vTPM服务组件位于可信执行环境中，vTPM代理组件无法直接向vTPM服务组件传递第二请求信息，因此vTPM代理组件通过TrustZone Driver组件实现vTPM代理组件与vTPM服务组件之间的信息传递。具体地，vTPM代理组件向TrustZone Driver组件传递第二请求信息，由TrustZone Driver组件将第二请求信息传递给vTPM服务组件。可选的，vTPM代理组件通过调用命令调用(TEEC_InvokeCommand)函数向TrustZone Driver组件传递第二请求信息。
步骤505，TrustZone Driver组件向vTPM服务组件传递第二请求信息。
获取到第二请求信息之后，TrustZone Driver组件解析第二请求信息，并重新整合第二请求信息，以使得整合后的第二请求信息的格式为vTPM服务组件能够识别的格式。TrustZone Driver组件将整合后的第二请求信息载入到共享内存中，并触发安全监控调用(Secure Monitor Call，SMC)，以进入到监控模式。在TrustZone Driver组件进入到监控模式之后，TrustZone Driver组件向vTPM服务组件传递指令，以使得vTPM服务组件能够基于该指令在共享内存中获取该第二请求信息，从而实现第二请求信息的传递。
步骤506，vTPM服务组件基于第一存储空间中的数据处理第二请求信息，从而得到目标数据。
本实施例中，vTPM服务组件为每个VM都分配了独立的存储空间，不同的存储空间之间互不重合。vTPM服务组件基于获取到的VM的标识，能够唯一确定与该VM的标识对应的存储空间。例如，vTPM服务组件为上述的VM分配了第一存储空间，以及为另一个VM分配了第二存储空间。因此，基于第二请求信息中所包括的VM的标识，vTPM服务组件能够确定与VM的标识对应的第一存储空间。其中，第一存储空间位于可信执行环境中，且第一存储空间用于存储VM的TPM数据。这样，vTPM服务组件则基于第一存储空间中的数据处理第二请求信息。
可选的，vTPM服务组件获取到第二请求信息之后，通过调用命令调用接口(TA_InvokeCommandEntryPoint)函数，来实现第二请求信息的处理。具体地，vTPM服务组件调用该TA_InvokeCommandEntryPoint函数对第二请求信息进行解析，获得第二请求 信息中的VM的标识和上述的TPM命令字节流。然后，vTPM服务组件查找与VM的标识对应的存储空间，确定得到第一存储空间，并基于第一存储空间中的数据处理该TPM命令字节流。
在一个可能的示例中，该TPM命令字节流中包括了第一命令标识，第一命令标识用于指示执行密钥生成操作。基于该第一命令标识，vTPM服务组件在第一存储空间中获取根密钥，并基于根密钥生成密钥。在生成密钥后，vTPM服务组件将密钥存储于第一存储空间中，并且生成密钥对应的密钥句柄，从而得到目标数据。其中，密钥句柄为一个标识符，用于标识密钥。
在另一个可能的示例中，该TPM命令字节流中包括了第二命令标识、第一密钥句柄和待加密数据，第二命令标识用于指示执行RSA加密操作。基于TPM命令字节流中的第一密钥句柄，vTPM服务组件在第一存储空间中查找第一密钥句柄对应的密钥。最后，vTPM服务组件基于TPM命令字节流中的第二命令标识，采用从第一存储空间中获取到的密钥对待加密数据进行加密处理，得到目标数据。
在又一个可能的示例中，该TPM命令字节流中包括了第三命令标识、第二密钥句柄和待解密数据，第三命令标识用于指示执行RSA解密操作。基于TPM命令字节流中的第二密钥句柄，vTPM服务组件在第一存储空间中查找该第二密钥句柄对应的密钥。最后，vTPM服务组件基于TPM命令字节流中的第三命令标识，采用从第一存储空间中获取到的密钥对待解密数据进行解密处理，得到目标数据。
可选的，由于vTPM服务组件基于第二请求信息执行TPM操作后所得到的数据需要返回给传递第二请求信息的VM，即第二请求信息所包括的VM的标识所代表的VM。因此vTPM服务组件在执行TPM操作(例如上述的密钥生成操作、RSA加密操作或RSA解密操作)并得到相应的TPM数据之后，还在得到的TPM数据中添加第二请求信息中所包括的VM的标识，以得到还包括有第二请求信息中所包括的VM的标识的目标数据。在目标数据的传递过程中，后续的其他组件能够根据目标数据中所包括的VM的标识，确定向目标数据中所包括的VM的标识所代表的VM传递目标数据。
步骤507，vTPM服务组件向TrustZone Driver组件传递目标数据，目标数据的目的方为vTPM代理组件。
在得到目标数据之后，vTPM服务组件将目标数据载入共享内存中，并向TrustZone Driver组件传递指令。这样，TrustZone Driver组件能够基于获取到的指令在共享内存中获取目标数据，从而实现目标数据的传递。
步骤508，TrustZone Driver组件向vTPM代理组件传递目标数据。
可选的，在获取到目标数据之后，TrustZone Driver组件通过调用命令调用(TEEC_InvokeCommand)函数向vTPM代理组件传递目标数据。
步骤509，vTPM代理组件向vTPM驱动组件传递目标数据。
可选的，vTPM代理组件通过调用命令调用(TEEC_InvokeCommand)函数向vTPM代理组件传递目标数据，或者vTPM代理组件通过发送携带有目标数据的应答消息来向vTPM代理组件传递目标数据。
可选的，在vTPM代理组件连接多个vTPM驱动组件的情况下，vTPM代理组件获取目标数据中所包括的VM的标识，并根据获取到的VM的标识确定如何传递目标数据。由于vTPM代理组件保存有VM的标识与连接的标识(即vTPM代理组件与vTPM驱动组件之间的连接的标识)之间的映射关系，因此基于该映射关系，vTPM代理组件能够确定VM的标识所对应的连接的标识。基于所确定的连接的标识，vTPM代理组件能够确定与vTPM驱动组件之间的连接。vTPM代理组件通过所确定的与vTPM驱动组件之间的连接，传递目标数据从而实现向VM的标识所对应的vTPM驱动组件传递目标数据。
步骤510，vTPM驱动组件向VM传递目标数据。
在vTPM驱动组件获取到目标数据之后，VM中的APP能够通过调用读(read)函数来读取vTPM驱动组件所返回的目标数据，从而实现目标数据的传递。
由以上实施例的介绍可知，运行于可信执行环境中的vTPM服务组件为不同的VM分配了不同的存储空间，且不同的存储空间之间互不重合。在vTPM服务组件获取到用于请求执行TPM操作的请求信息时，vTPM服务组件根据请求信息中的VM的标识确定对应的存储空间，并且基于VM的标识对应的存储空间中的数据为请求信息中的VM的标识所代表的VM提供TPM服务，使得vTPM服务组件能够基于不同的存储空间为不同的VM提供TPM服务。从而能够在为多个VM提供TPM服务的基础上，保证了数据的安全性。
上文介绍了vTPM服务组件基于VM的标识确定对应的存储空间并执行TPM操作的过程，以下将介绍vTPM服务组件为VM分配存储空间的过程。
其中，触发vTPM服务组件为VM分配存储空间的方式包括但不限于以下的两种方式。
方式一，在VM创建后，VM对应的vTPM代理组件向vTPM服务组件传递用于请求建立会话的请求信息，以触发vTPM服务组件为VM分配存储空间。即，通过用于请求建立会话的请求信息来触发vTPM服务组件为VM分配存储空间。
方式二，在VM创建后，VM首次向vTPM服务组件传递用于请求执行TPM操作的请求信息，用于请求执行TPM操作的请求信息能够触发vTPM服务组件为VM分配存储空间。即，通过首次传递的用于请求执行TPM操作的请求信息来触发vTPM服务组件为VM分配存储空间。
为便于理解，以下将结合附图对上述的两种方式进行介绍。
图6为本申请实施例提供的一种vTPM服务组件分配存储空间的方法的流程示意图。其中，图6所示的方法对应于上述的方式一。如图6所示，vTPM服务组件分配存储空间的过程包括以下的步骤601至步骤606。
步骤601，vTPM服务组件初始化。
本实施例中，vTPM服务组件为可信执行环境中运行的TA。在vTPM服务组件的启动阶段，通过安全启动的方式来保证TA文件自身的完整性和真实性。具体地，vTPM服务组件的TA文件由软件发布商的证书权威机构(Certificate Authorit-y，CA)系统签名。在物理服务器的启动阶段，由基本输入输出系统(Basic Input Output System，BIOS)验证vTPM服务组件的文件签名，确保vTPM服务组件的真实性和完整性。在vTPM服务组件的文件 签名验证通过之后，将vTPM服务组件加载到可信执行环境的安全内存中初始化运行，以实现vTPM服务组件的初始化。
步骤602，vTPM代理组件初始化。
在一个vTPM代理组件只对应一个VM的情况下，由于vTPM代理组件属于VMM的一部分，VMM在启动VM时，VMM同时会启动这个VM对应的vTPM代理组件。即vTPM代理组件随着VM的启动而一起启动。在vTPM代理组件启动后，vTPM代理组件获取并且保存当前所启动的、与该vTPM代理组件有对应关系的VM的标识，从而完成初始化过程。
在一个vTPM代理组件对应多个VM的情况下，VMM在启动第一个VM时，VMM同时会启动vTPM代理组件。在vTPM代理组件启动后，vTPM代理组件获取并且保存第一个启动的VM的标识，从而完成初始化过程。可选的，在VMM后续启动其他的VM时，vTPM代理组件继续获取并且保存后续所启动的VM的标识。
步骤603，vTPM驱动组件与vTPM代理组件建立连接。
在VM启动之后，VM加载vTPM驱动组件。该vTPM驱动组件与vTPM代理组件建立连接。在一个vTPM代理组件与多个vTPM驱动组件建立连接的情况下，在一个vTPM驱动组件与vTPM代理组件建立连接之后，vTPM代理组件获得该连接的标识，并建立该连接的标识与上述vTPM驱动组件所在的VM的标识之间的映射关系。例如第一VM启动后，第一VM所加载的vTPM驱动组件与vTPM代理组件建立连接。假定第一连接标识用于标识第一VM所加载的vTPM驱动组件与vTPM代理组件所建立的连接。vTPM代理组件获得第一连接标识，并建立第一连接标识与第一VM的映射关系。
步骤604，vTPM代理组件向TrustZone Driver组件传递会话建立请求信息，该会话建立请求信息的目的方为vTPM服务组件。
由于VM初次启动，VM代理组件与vTPM服务组件之间还没有建立会话，因此vTPM代理组件向TrustZone Driver组件传递会话建立请求信息，会话建立请求信息中包括VM的标识。会话建立请求信息的目的方为vTPM服务组件，且会话建立请求信息用于请求建立会话。在VM代理组件与vTPM服务组件建立会话后，VM代理组件与vTPM服务组件之间的会话用于后续在vTPM服务组件与vTPM代理组件之间传输各种信息和/或目标数据。目标数据是vTPM服务组件执行TPM操作后得到的数据。
可选的，vTPM代理组件通过调用初始化上下文(TEEC_InitializeContext)函数初始化VM与可执行环境之间的上下文，得到相应的上下文(TEEC_context)。然后，vTPM代理组件调用打开会话(TEEC_OpenSession)函数，并且在调用该TEEC_OpenSession函数时指定VM的标识，从而实现向TrustZone Driver组件传递会话建立请求信息。
步骤605，TrustZone Driver组件向vTPM服务组件传递会话建立请求信息。
TrustZone Driver组件解析获取到的会话建立请求信息，并重新整合会话建立请求信息，以调整会话建立请求信息的格式。TrustZone Driver组件将整合后的会话建立请求信息载入到共享内存中，并触发SMC，以进入到监控模式。在进入监控模式之后，TrustZone Driver组件向vTPM服务组件传递指令，以使得vTPM服务组件能够基于指令在共享内存中获取 会话建立请求信息，从而实现会话建立请求信息的传递。
步骤606，vTPM服务组件基于会话建立请求信息建立会话，并为VM分配存储空间。
在获取到会话建立请求信息之后，vTPM服务组件调用会话打开接口(TA_OpenSessionEntryPoint)函数。通过执行TA_OpenSessionEntryPoint函数，vTPM服务组件解析会话建立请求信息，并获得会话建立请求信息中所包括的VM的标识。基于会话建立请求信息中所包括的VM的标识，vTPM服务组件建立会话，并得到与会话建立请求信息中所包括的VM的标识对应的会话标识。vTPM服务组件向TrustZone Driver组件传递会话标识，会话标识的目的方为vTPM代理组件，以使得vTPM代理组件能够获取到会话建立请求信息中所包括的VM的标识对应的会话标识。
由于在VM初次启动时，vTPM代理组件才会向vTPM服务组件传递会话建立请求信息。因此在vTPM服务组件获取到会话建立请求信息之前，vTPM服务组件并没有为会话建立请求信息中所包括的VM的标识分配存储空间。基于此，在获取到会话建立请求信息之后，vTPM服务组件基于会话建立请求信息中所包括的VM的标识，在可信执行环境中为VM的标识分配一个存储空间。在分配了存储空间后，vTPM服务组件基于会话建立请求信息中所包括的VM的标识标记所分配的存储空间。
在为会话建立请求信息中所包括的VM的标识分配存储空间之后，为保证vTPM代理组件后续能够基于所分配的存储空间中的数据执行TPM操作，vTPM服务组件对该存储空间中的数据执行TPM初始化操作。通过执行TPM初始化操作vTPM服务组件将所分配的存储空间中的数据更新为TPM初始化数据。
示例性地，vTPM服务组件对该存储空间中的数据执行TPM初始化操作包括：vTPM服务组件对该存储空间进行划分，得到多个存储块，多个存储块分别用于存储平台种子、背书种子、存储种子、密钥或PCR等数据。vTPM服务组件对存储块中的数据进行更新，得到TPM初始化数据。例如，vTPM服务组件对存储PCR的存储空间中的数据进行更新，从而给PCR赋予一个初始化的值，这个初始化的值即为PCR的初值。
可选的，如果VM是在关闭后再次启动，则可信执行环境中的非易失性存储器中可能还具有VM的标识对应的存储空间。因此，vTPM服务组件在为VM的标识分配存储空间之前，vTPM服务组件查找非易失性存储器中是否存在与该VM的标识对应的存储空间。
如果非易失性存储器中存在与会话建立请求信息中所包括的VM的标识对应的存储空间，则vTPM服务组件在易失性存储器中为VM的标识分配存储空间，并将非易失性存储器中与VM的标识对应的存储空间中的数据复制到所分配的存储空间。也就是说，vTPM服务组件在易失性存储器中为VM的标识分配存储空间之后，不需要对该存储空间中的数据执行TPM初始化操作，而是将非易失性存储器中与VM的标识对应的存储空间中的数据复制到所分配的存储空间。这样，在VM重启动的场景下，能够在易失性存储器中恢复VM在重启动之前所使用的TPM数据，保证VM的正常运行。
如果非易失性存储器中不存在与会话建立请求信息中所包括的VM的标识对应的存储空间，则认为会话建立请求信息中所包括的VM的标识对应的VM是首次创建或者会话建立请求信息中所包括的VM的标识对应的VM的TPM数据已被丢弃，vTPM服务组件在易 失性存储器中为VM的标识分配存储空间，并且对所分配的存储空间中的数据执行TPM初始化操作。
图7为本申请实施例提供的另一种vTPM服务组件分配存储空间的方法的流程示意图。其中，图7所示的方法对应于上述的方式二。如图7所示，vTPM服务组件分配存储空间的过程包括以下的步骤。
步骤701，vTPM服务组件初始化。
步骤702，vTPM代理组件初始化。
步骤703，vTPM代理组件与vTPM驱动组件建立连接。
本实施例中，步骤701-703与上述的步骤601-603类似，具体请参考上述的步骤601-603，在此不再赘述。
步骤704，VM向vTPM驱动组件传递第三请求信息，该第三请求信息的目的方为vTPM服务组件。
本实施例中，该第三请求信息用于请求执行TPM操作，且第三请求信息是VM在启动后首次向vTPM驱动组件传递的请求信息。
步骤705，vTPM驱动组件向vTPM代理组件传递第三请求信息。
步骤706，vTPM代理组件在第三请求信息中添加VM的标识，从而得到第四请求信息。
步骤707，vTPM代理组件向TrustZone Driver组件传递第四请求信息，第四请求信息的目的方为vTPM服务组件。
步骤708，TrustZone Driver组件向vTPM服务组件传递第四请求信息。
本实施例中，步骤705-708与上述的步骤502-505类似，具体请参考上述的步骤502-505，在此不再赘述。
步骤709，vTPM服务组件根据第四请求信息为VM分配存储空间。
在获取到第四请求信息之后，vTPM服务组件解析该第四请求信息，并获得第四请求信息中所包括的VM的标识。vTPM服务组件基于第四请求信息中所包括的VM的标识，在可信执行环境的易失性存储器中查找与VM的标识对应的存储空间。由于该第四请求信息是VM启动后由vTPM代理组件首次传递的请求信息，因此可信执行环境的易失性存储器中并不存在第四请求信息中所包括的VM的标识对应的存储空间。
当vTPM服务组件在易失性存储器中查找不到第四请求信息中所包括的VM的标识对应的存储空间时，vTPM服务组件在非易失性存储器中继续查找第四请求信息中所包括的VM的标识对应的存储空间。如果该非易失性存储器中存在与第四请求信息中所包括的VM的标识对应的存储空间，则vTPM服务组件在易失性存储器中为第四请求信息中所包括的VM的标识分配存储空间，并将非易失性存储器中与VM的标识对应的存储空间中的数据复制到所分配的存储空间。如果非易失性存储器中不存在与第四请求信息中所包括的VM的标识对应的存储空间，则vTPM服务组件在易失性存储器中为第四请求信息中所包括的VM的标识分配存储空间，并且对所分配的存储空间中的数据执行TPM初始化操作。
本实施例中，vTPM服务组件基于TPM操作请求中的VM的标识查找对应的存储空间， 并根据查找结果确定是否为TPM操作请求中的VM的标识分配存储空间，以实现为VM的标识分配对应的存储空间。由于vTPM服务组件能够基于TPM操作请求来实现存储空间的分配，从而省去了预先建立会话连接的过程，节省处理资源。
上文介绍了VM启动时，vTPM服务组件为VM的标识分配存储空间的过程，以下将介绍VM关闭时，vTPM服务组件回收为VM的标识所分配的存储空间的过程。
图8为本申请实施例提供的一种vTPM服务组件关闭会话的流程示意图。如图8所示，该包括以下的步骤。
步骤801，vTPM驱动组件向vTPM代理组件传递第五请求信息，第五请求信息的目的方为vTPM服务组件。
在VM需要关闭的情况下，VM触发对应的vTPM驱动组件向vTPM代理组件传递第五请求信息，第五请求信息用于请求关闭与vTPM服务组件之间的会话。
步骤802，vTPM代理组件在第五请求信息中添加VM的标识，从而得到第六请求信息。
类似地，在获取到第五请求信息之后，vTPM代理组件基于第五请求信息的来源，获取VM的标识，并在第五请求信息中添加所获取到的VM的标识，以标识该第五请求信息的来源。其中，vTPM代理组件获取VM的标识的过程与步骤503类似，具体请参考步骤503的描述，此处不再赘述。
步骤803，vTPM代理组件向TrustZone Driver组件传递第六请求信息，第六请求信息的目的方为vTPM服务组件。
可选的，vTPM代理组件通过调用关闭会话(TEEC_CloseSession)函数来向TrustZone Driver组件传递第六请求信息。此外，在VM与vTPM服务组件之间的会话关闭后，vTPM代理组件通过调用结束上下文(TEEC_FinalizeContext)函数来终止VM与可执行环境之间的上下文，以关闭VM与可执行环境之间的连接。
步骤804，TrustZone Driver组件向vTPM服务组件传递第六请求信息。
在本实施例中，步骤804与上述的步骤505类似，具体请参考上述的步骤505的相关描述，在此不再赘述。
步骤805，vTPM服务组件基于第六请求信息关闭会话。
在获取到第六请求信息之后，vTPM服务组件获取第六请求信息中的VM的标识，以确定该VM的标识对应的存储空间。可选的，在获取到第六请求信息之后，触发vTPM服务组件调用会话关闭接口(TA_CloseSessionEntryPoint)函数。通过执行TA_CloseSessionEntryPoint函数，vTPM服务组件解析第六请求信息，并获得第六请求信息中所包括的VM的标识。
基于第六请求信息中所包括的VM的标识，vTPM服务组件在易失性存储器中查找第六请求信息中所包括的VM的标识对应的存储空间，得到第六请求信息中所包括的VM的标识在易失性存储器中对应的存储空间。然后，vTPM服务组件在非易失性存储器中为第六请求信息中所包括的VM的标识分配存储空间，并将查找到的易失性存储器中的存储空间中的数据复制到非易失性存储器中所分配的存储空间。在易失性存储器中的存储空间中 的数据拷贝完毕之后，vTPM服务组件丢弃易失性存储器的存储空间中的数据，从而实现易失性存储器中的存储空间的回收，提高易失性存储器中的存储空间的利用率。
通过在VM关闭时，将VM的标识在易失性存储器中对应的TPM数据复制到非易失性存储器中，能够在VM重启动时恢复VM对应的TPM数据，保证VM的正常运行。
图9为本申请实施例提供的一种计算机系统的结构示意图。如图9所示，在计算机系统上运行有可信执行环境和丰富执行环境，可信执行环境运行有vTPM服务组件，丰富执行环境运行有第一VM和vTPM代理组件。vTPM代理组件用于获取来自于第一VM的第一请求信息，获取第一VM的标识，在第一请求信息中添加第一VM的标识，得到第二请求信息，并向TrustZone Driver组件传递第二请求信息。第一请求信息用于请求vTPM服务组件执行TPM操作，第二请求信息包括第一VM的标识，第二请求信息的目的方为vTPM服务组件。vTPM服务组件用于通过TrustZone Driver组件获取第二请求信息，并基于第一存储空间中的数据处理第二请求信息，第一存储空间是在可信执行环境中与第一VM的标识对应的存储空间，第一存储空间用于存储第一VM的TPM数据。
可选的，可信执行环境中还包括第二存储空间，第二存储空间用于存储第二VM的TPM数据，且第一存储空间和第二存储空间为互不重合的存储空间。
可选的，第二请求信息还包括命令标识和待处理参数，命令标识用于指示待执行的TPM操作的类型。vTPM服务组件还用于基于第二VM的标识和第一存储空间中的数据处理待处理参数，得到目标数据，并向TrustZone Driver传递目标数据，目标数据的目的方为vTPM代理组件。vTPM代理组件还用于获取目标数据，并向第一VM传递目标数据。
可选的，待处理参数包括密钥句柄以及待加密数据。vTPM服务组件还用于调用命令调用接口函数，以得到第二请求信息中的命令标识和待处理参数。vTPM服务组件还用于根据命令标识，采用密钥对待加密数据进行加密处理，该密钥为vTPM根据密钥句柄确定的。
可选的，待处理参数包括密钥句柄以及待解密数据。vTPM服务组件还用于调用命令调用接口函数，以得到第二请求信息中的命令标识和待处理参数。vTPM服务组件还用于根据命令标识，采用密钥对待解密数据进行解密处理，该密钥为vTPM根据密钥句柄确定的。
可选的，vTPM代理组件还用于获取来自于第二VM的第三请求信息，第三请求信息用于请求执行TPM操作，获取第二VM的标识，在第三请求信息中添加第二VM的标识，得到第四请求信息，第四请求信息包括第二VM的标识，向TrustZone Driver组件传递第四请求信息，第四请求信息的目的方为vTPM服务组件。vTPM服务组件用于通过TrustZone Driver组件获取第四请求信息，并基于第二存储空间中的数据处理第四请求信息，第二存储空间是在可信执行环境中与第二VM的标识对应的存储空间，第二存储空间用于存储第二VM的TPM数据。
可选的，如果可信执行环境中不存在第一VM的标识对应的存储空间，vTPM服务组件还用于在可信执行环境中为第一VM的标识分配存储空间，以及对分配的存储空间中的 数据执行TPM初始化操作，以使得分配的存储空间中的数据更新为TPM初始化数据，将分配的存储空间作为第一存储空间。
可选的，vTPM服务组件还用于在计算机的易失性存储器中查找与第一VM的标识对应的存储空间，如果易失性存储器中不存在与第一VM的标识对应的存储空间，则在易失性存储器中分配存储空间。
可选的，第二请求信息是在第一会话中传输的，第一会话用于在vTPM服务组件与vTPM代理组件之间传输用于请求执行TPM操作的信息和/或目标数据，目标数据是执行TPM操作后得到的数据。vTPM代理组件还用于当第一VM启动时，获取第一VM的标识，生成第五请求信息，第五请求信息包括第一VM的标识，以及向TrustZone Driver组件传递第五请求信息，第五请求信息用于请求建立第一会话，第五请求信息的目的方为vTPM服务组件。vTPM服务组件还用于通过TrustZone Driver组件获取第五请求信息，vTPM服务组件在计算机的易失性存储器中分配存储空间，将分配的存储空间作为第一存储空间。
可选的，第一会话是与第一VM的标识对应的会话，vTPM服务组件还用于根据第五请求信息中包括的第一VM的标识调用会话打开接口函数，以建立与第一VM的标识对应的第一会话并得到第一会话的标识；vTPM服务组件还用于向TrustZone Driver组件传递第一会话的标识，第一会话的标识的目的方为vTPM代理组件。
可选的，vTPM服务组件还用于在计算机的非易失性存储器中查找与第一VM的标识对应的存储空间。若非易失性存储器中存在与第一VM的标识对应的存储空间，则在易失性存储器中分配存储空间，以及将非易失性存储器中与第一VM的标识对应的存储空间中的数据复制到分配的存储空间。若非易失性存储器中不存在与第一VM的标识对应的存储空间，则在易失性存储器中分配存储空间。
可选的，vTPM服务组件还用于基于第一VM的标识标记分配的存储空间。
可选的，vTPM代理组件还用于获取来自于第一VM的第六请求信息，第六请求信息用于请求关闭第一会话，获取第一VM的标识，在第六请求信息中添加第一VM的标识，从而得到第七请求信息，第七请求信息包括第一VM的标识，以及向TrustZone Driver组件传递第七请求信息，第七请求信息的目的方为vTPM服务组件；vTPM服务组件还用于获取第六请求信息，根据第六请求消息中包含的第一VM的标识，确定第一存储空间，将第一存储空间的数据复制到第三存储空间，第三存储空间位于非易失性存储器。
可选的，第二请求信息是TrustZone Driver组件在监控模式下向vTPM服务组件传递的，TrustZone Driver组件运行于计算机的丰富执行环境中。
应理解，计算机系统中的各个组件分别为了实现方法实施例中的vTPM驱动组件、vTPM代理组件、TrusZone驱动组件以及vTPM服务组件所实施的各种步骤和方法，具体细节可参见上述的方法实施例，为了简洁，在此不再赘述。
图10为本申请实施例提供的一种计算机的结构示意图。计算机1000搭载有上述的计算机系统。计算机1000由一般性的总线体系结构来实现。
计算机1000包括至少一个处理器1001、通信总线1002、存储器1003以及至少一个通 信接口1004。
可选的，处理器1001是一个通用CPU、NP、微处理器、或者是一个或多个用于实现本申请方案的集成电路，例如，专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。
通信总线1002用于在上述组件之间传送信息。通信总线1002分为地址总线、数据总线、控制总线等。为便于表示，图中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
可选的，存储器1003是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备。可替换的，存储器1003是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备。可替换的，存储器1003是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。可选的，存储器1003是独立存在的，并通过通信总线1002与处理器1001相连接。可选的，存储器1003和处理器1001集成在一起。
通信接口1004使用任何收发器一类的装置，用于与其它设备或通信网络通信。通信接口1004包括有线通信接口。可选的，通信接口1004还包括无线通信接口。其中，有线通信接口例如为以太网接口。以太网接口是光接口，电接口或其组合。无线通信接口为无线局域网(wireless local area networks，WLAN)接口，蜂窝网络通信接口或其组合等。
在具体实现中，作为一种实施例，处理器1001包括一个或多个CPU，如图10中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，计算机1000包括多个处理器，如图10中所示的处理器1001和处理器1005。这些处理器中的每一个是一个单核处理器(single-CPU)，或者是一个多核处理器(multi-CPU)。这里的处理器指一个或多个设备、电路、和/或用于处理数据(如计算机程序指令)的处理核。
在一些实施例中，存储器1003用于存储执行本申请方案的程序代码1010，处理器1001执行存储器1003中存储的程序代码1010。也就是说，计算机1000通过处理器1001以及存储器1003中的程序代码1010，来实现上述的方法实施例。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的 划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (37)

  1. 一种虚拟可信平台模块vTPM的实现方法，其特征在于，包括：
    vTPM服务组件获取来自于vTPM代理组件的第一请求信息，所述第一请求信息包括第一虚拟机VM的标识，所述第一请求信息用于请求执行TPM操作，其中，所述vTPM服务组件运行于计算机的可信执行环境中，所述第一VM和所述vTPM代理组件运行于所述计算机的丰富执行环境中；
    所述vTPM服务组件基于第一存储空间中的数据处理所述第一请求信息，其中所述第一存储空间是在所述可信执行环境中与所述第一VM的标识对应的存储空间，所述第一存储空间用于存储所述第一VM的TPM数据。
  2. 根据权利要求1所述的vTPM的实现方法，其特征在于，所述可信执行环境中还包括第二存储空间，其中所述第二存储空间用于存储所述计算机中第二VM的TPM数据，且所述第一存储空间和所述第二存储空间为互不重合的存储空间。
  3. 根据权利要求1或2所述的vTPM的实现方法，其特征在于，所述第一请求信息还包括命令标识和待处理参数，所述命令标识用于指示待执行的TPM操作的类型；
    所述vTPM服务组件基于所述第一存储空间中的数据处理所述第一请求信息，包括：
    所述vTPM服务组件基于所述命令标识和所述第一存储空间中的数据处理所述待处理参数，得到目标数据；
    所述vTPM服务组件向可信空间驱动TrustZone Driver组件传递所述目标数据，所述目标数据的目的方为所述vTPM代理组件。
  4. 根据权利要求3所述的vTPM的实现方法，其特征在于，所述待处理参数包括密钥句柄以及待加密数据；
    所述vTPM服务组件基于所述命令标识和所述第一存储空间中的数据处理所述待处理参数，得到目标数据，包括：
    所述vTPM服务组件调用命令调用接口函数，以得到所述第一请求信息中的所述命令标识和所述待处理参数；
    所述vTPM服务组件根据所述命令标识，采用密钥对所述待加密数据进行加密处理，所述密钥为所述vTPM根据所述密钥句柄确定的。
  5. 根据权利要求3所述的vTPM的实现方法，其特征在于，所述待处理参数包括密钥句柄以及待解密数据；
    所述vTPM服务组件基于所述命令标识和所述第一存储空间中的数据处理所述待处理参数，得到目标数据，包括：
    所述vTPM服务组件调用命令调用接口函数，以得到所述第一请求信息中的所述命令标识和所述待处理参数；
    所述vTPM服务组件根据所述命令标识，采用密钥对所述待解密数据进行解密处理，所述密钥为所述vTPM根据所述密钥句柄确定的。
  6. 根据权利要求1至5任一所述的vTPM的实现方法，其特征在于，所述vTPM服务组件基于所述第一存储空间中的数据处理所述第一请求信息之前，所述方法还包括：
    如果所述可信执行环境中不存在所述第一VM的标识对应的存储空间，所述vTPM服务组件在所述可信执行环境中为所述第一VM的标识分配存储空间；
    所述vTPM服务组件对分配的所述存储空间中的数据执行TPM初始化操作，以使得分配的所述存储空间中的数据更新为TPM初始化数据，将分配的所述存储空间作为所述第一存储空间。
  7. 根据权利要求6所述的vTPM的实现方法，其特征在于，所述vTPM服务组件在所述可信执行环境中为所述第一VM的标识分配存储空间，包括：
    所述vTPM服务组件在所述计算机的易失性存储器中查找与所述第一VM的标识对应的存储空间；
    如果所述易失性存储器中不存在与所述第一VM的标识对应的存储空间，所述vTPM服务组件在所述易失性存储器中分配存储空间。
  8. 根据权利要求1至7任一所述的vTPM的实现方法，其特征在于，所述第一请求信息是在第一会话中传输的，所述第一会话用于在所述vTPM服务组件与所述vTPM代理组件之间传输所述第一请求信息和/或所述目标数据；
    所述方法还包括：
    所述vTPM服务组件获取来自于所述vTPM代理组件的第二请求信息，所述第二请求信息包括第一VM的标识，所述第二请求信息用于请求建立所述第一会话；
    所述vTPM服务组件根据所述第二请求信息，在所述计算机的易失性存储器中分配存储空间，将分配的存储空间作为所述第一存储空间。
  9. 根据权利要求8所述的vTPM的实现方法，其特征在于，所述第一会话是与所述第一VM的标识对应的会话，所述方法还包括：
    所述vTPM服务组件根据所述第二请求信息中包括的所述第一VM的标识，调用会话打开接口函数，以建立与所述第一会话并得到所述第一会话的标识；
    所述vTPM服务组件向所述计算机的丰富执行环境中的TrustZone Driver组件传递所述第一会话的标识，所述第一会话的标识的目的方为所述vTPM代理组件。
  10. 根据权利要求7至9任一所述的vTPM的实现方法，其特征在于，所述vTPM服务组件在所述易失性存储器中分配存储空间，包括：
    所述vTPM服务组件在所述计算机的非易失性存储器中查找与所述第一VM的标识对 应的存储空间；
    若所述非易失性存储器中存在与所述第一VM的标识对应的存储空间，则所述vTPM服务组件在所述易失性存储器中分配存储空间，以及将所述非易失性存储器中与所述第一VM的标识对应的存储空间中的数据复制到分配的存储空间；
    若所述非易失性存储器中不存在与所述第一VM的标识对应的存储空间，则所述vTPM服务组件在易失性存储器中分配存储空间。
  11. 根据权利要求8至10任一所述的vTPM的实现方法，其特征在于，所述vTPM服务组件在易失性存储器中分配存储空间之后，所述方法还包括：
    所述vTPM服务组件基于所述第一VM的标识标记分配的存储空间。
  12. 根据权利要求8至11任一所述的vTPM的实现方法，其特征在于，所述方法还包括：
    所述vTPM服务组件获取第三请求信息，所述第三请求信息是在所述第一会话中传输的，第三请求信息包括所述第一VM的标识，所述第三请求信息用于请求关闭所述第一会话；
    所述vTPM服务组件根据所述第三请求消息中包含的所述第一VM的标识，确定所述第一存储空间；
    所述vTPM服务组件将所述第一存储空间的数据复制到第三存储空间，所述第三存储空间位于非易失性存储器。
  13. 根据权利要求1至12任一所述的vTPM的实现方法，其特征在于，所述第一请求信息是TrustZone Driver组件在监控模式下向所述vTPM服务组件传递的，所述TrustZone Driver组件运行于所述计算机的丰富执行环境中。
  14. 一种vTPM的实现方法，其特征在于，包括：
    vTPM代理组件获取来自于第一VM的第一请求信息，所述第一请求信息用于请求vTPM服务组件执行TPM操作，其中，所述第一VM和所述vTPM代理组件运行于计算机的丰富执行环境中，所述vTPM服务组件运行于所述计算机的可信执行环境中；
    所述vTPM代理组件获取所述第一VM的标识；
    所述vTPM代理组件在所述第一请求信息中添加所述第一VM的标识，从而得到第二请求信息，所述第二请求信息包括所述第一VM的标识；
    所述vTPM代理组件向运行于所述计算机的可信执行环境中的TrustZone Driver组件传递所述第二请求信息，所述第二请求信息的目的方为所述vTPM服务组件。
  15. 根据权利要求14所述的vTPM的实现方法，其特征在于，所述vTPM代理组件在所述第一请求信息中添加所述第一VM的标识，包括：
    所述vTPM代理组件通过调用命令调用函数，在所述第一请求信息中添加所述第一VM的标识，从而得到第二请求信息。
  16. 根据权利要求14或15所述的vTPM的实现方法，其特征在于，所述方法还包括：
    所述vTPM代理组件获取来自于第二VM的第三请求信息，所述第三请求信息用于请求执行TPM操作；
    所述vTPM代理组件获取所述第二VM的标识；
    所述vTPM代理组件在所述第三请求信息中添加所述第二VM的标识，从而得到第四请求信息，所述第四请求信息包括所述第二VM的标识；
    所述vTPM代理组件向所述TrustZone Driver组件传递所述第四请求信息，所述第四请求信息的目的方为所述vTPM服务组件。
  17. 根据权利要求14至16任一所述的vTPM的实现方法，其特征在于，所述方法还包括：
    所述vTPM代理组件通过所述TrustZone Driver组件获取来自于所述vTPM服务组件的目标数据，所述目标数据为所述vTPM服务组件基于所述第二请求信息执行TPM操作后得到的数据；
    所述vTPM代理组件向所述第一VM传递所述目标数据。
  18. 根据权利要求14至17任一所述的vTPM的实现方法，其特征在于，所述方法还包括：
    当所述第一VM启动时，所述vTPM代理组件获取所述第一VM的标识；
    所述vTPM代理组件生成第五请求信息，所述第五请求信息用于请求建立与vTPM服务组件之间的会话，所述第五请求信息包括所述第一VM的标识；
    所述vTPM代理组件向所述TrustZone Driver组件传递所述第五请求信息，所述第五请求信息的目的方为所述vTPM服务组件。
  19. 根据权利要求14至18任一所述的vTPM的实现方法，其特征在于，所述方法还包括：
    所述vTPM代理组件获取来自于第一VM的第六请求信息，所述第六请求信息用于请求关闭与vTPM服务组件的会话；
    所述vTPM代理组件获取所述第一VM的标识；
    所述vTPM代理组件在所述第六请求信息中添加所述第一VM的标识，从而得到第七请求信息，所述第七请求信息包括所述第一VM的标识；
    所述vTPM代理组件向所述TrustZone Driver组件传递所述第七请求信息，所述第七请求信息的目的方为所述vTPM服务组件。
  20. 一种电子设备，包括处理器；所述处理器和存储器耦合，所述存储器存储有程序指令，当所述存储器存储的程序指令被所述处理器执行时实现权利要求1-13任意一项的方法。
  21. 一种电子设备，包括处理器；所述处理器和存储器耦合，所述存储器存储有程序指令，当所述存储器存储的程序指令被所述处理器执行时实现权利要求14-19任意一项的方法。
  22. 一种计算机系统，其特征在于，所述计算机系统上运行有可信执行环境和丰富执行环境，所述可信执行环境运行有vTPM服务组件，所述丰富执行环境运行有第一VM和vTPM代理组件；
    所述vTPM代理组件用于获取来自于所述第一VM的第一请求信息，获取所述第一VM的标识，在所述第一请求信息中添加所述第一VM的标识，得到第二请求信息，并向TrustZone Driver组件传递所述第二请求信息，所述第一请求信息用于请求所述vTPM服务组件执行TPM操作，所述第二请求信息包括所述第一VM的标识，所述第二请求信息的目的方为所述vTPM服务组件；
    所述vTPM服务组件用于通过所述TrustZone Driver组件获取所述第二请求信息，并基于第一存储空间中的数据处理所述第二请求信息，所述第一存储空间是在所述可信执行环境中与所述第一VM的标识对应的存储空间，所述第一存储空间用于存储所述第一VM的TPM数据。
  23. 根据权利要求22所述的计算机系统，其特征在于，所述可信执行环境中还包括第二存储空间，所述第二存储空间用于存储第二VM的TPM数据，且所述第一存储空间和所述第二存储空间为互不重合的存储空间。
  24. 根据权利要求22或23所述的计算机系统，其特征在于，所述第二请求信息还包括命令标识和待处理参数，所述命令标识用于指示待执行的TPM操作的类型；
    所述vTPM服务组件还用于基于所述第二请求信息中的命令标识和所述第一存储空间中的数据处理所述待处理参数，得到目标数据，并向所述TrustZone Driver传递所述目标数据，所述目标数据的目的方为所述vTPM代理组件；
    所述vTPM代理组件还用于获取所述目标数据，并向所述第一VM传递所述目标数据。
  25. 根据权利要求24所述的计算机系统，其特征在于，所述待处理参数包括密钥句柄以及待加密数据；
    所述vTPM服务组件还用于调用命令调用接口函数，以得到所述第二请求信息中的所述命令标识和所述待处理参数；
    所述vTPM服务组件还用于根据所述命令标识，采用密钥对所述待加密数据进行加密处理，所述密钥为所述vTPM根据所述密钥句柄确定的。
  26. 根据权利要求24所述的计算机系统，其特征在于，所述待处理参数包括密钥句柄以及待解密数据；
    所述vTPM服务组件还用于调用命令调用接口函数，以得到所述第二请求信息中的所述命令标识和所述待处理参数；
    所述vTPM服务组件还用于根据所述命令标识，采用密钥对所述所述待解密数据进行解密处理，所述密钥为所述vTPM根据所述密钥句柄确定的。
  27. 根据权利要求22至26任一所述的计算机系统，其特征在于，所述vTPM代理组件还用于获取来自于第二VM的第三请求信息，所述第三请求信息用于请求执行TPM操作，获取所述第二VM的标识，在所述第三请求信息中添加所述第二VM的标识从而得到第四请求信息，所述第四请求信息包括所述第二VM的标识，向所述TrustZone Driver组件传递所述第四请求信息，所述第四请求信息的目的方为所述vTPM服务组件；
    所述vTPM服务组件用于通过所述TrustZone Driver组件获取所述第四请求信息，并基于所述第二存储空间中的数据处理所述第四请求信息，所述第二存储空间是与所述第二VM的标识对应的存储空间。
  28. 根据权利要求22至27任一所述的计算机系统，其特征在于，如果所述可信执行环境中不存在所述第一VM的标识对应的存储空间，所述vTPM服务组件还用于在所述可信执行环境中为所述第一VM的标识分配存储空间，以及对分配的所述存储空间中的数据执行TPM初始化操作，以使得分配的所述存储空间中的数据更新为TPM初始化数据，将分配的所述存储空间作为所述第一存储空间。
  29. 根据权利要求28所述的计算机系统，其特征在于，所述vTPM服务组件还用于在所述计算机的易失性存储器中查找与所述第一VM的标识对应的存储空间，如果所述易失性存储器中不存在与所述第一VM的标识对应的存储空间，则在所述易失性存储器中分配存储空间。
  30. 根据权利要求22至29任一所述的计算机系统，其特征在于，所述第二请求信息是在第一会话中传输的，所述第一会话用于在所述vTPM服务组件与所述vTPM代理组件之间传输用于请求执行TPM操作的信息和/或目标数据，所述目标数据是执行TPM操作后得到的数据；
    所述vTPM代理组件还用于当所述第一VM启动时，获取所述第一VM的标识，生成第五请求信息，所述第五请求信息包括所述第一VM的标识，以及向所述TrustZone Driver组件传递所述第五请求信息，所述第五请求信息用于请求建立所述第一会话，所述第五请求信息的目的方为所述vTPM服务组件；
    所述vTPM服务组件还用于通过所述TrustZone Driver组件获取所述第五请求信息，所 述vTPM服务组件在所述计算机的易失性存储器中分配存储空间，将分配的存储空间作为所述第一存储空间。
  31. 根据权利要求30所述的计算机系统，其特征在于，所述第一会话是与所述第一VM的标识对应的会话，
    所述vTPM服务组件还用于根据所述第五请求信息中包括的所述第一VM的标识，调用会话打开接口函数，以建立与所述第一VM的标识对应的第一会话并得到所述第一会话的标识；
    所述vTPM服务组件还用于向所述TrustZone Driver组件传递所述第一会话的标识，所述第一会话的标识的目的方为所述vTPM代理组件。
  32. 根据权利要求29至31任一所述的计算机系统，其特征在于，所述vTPM服务组件还用于在所述计算机的非易失性存储器中查找与所述第一VM的标识对应的存储空间；若所述非易失性存储器中存在与所述第一VM的标识对应的存储空间，则在所述易失性存储器中分配存储空间，以及将所述非易失性存储器中与所述第一VM的标识对应的存储空间中的数据复制到分配的存储空间；若所述非易失性存储器中不存在与所述第一VM的标识对应的存储空间，则在易失性存储器中分配存储空间。
  33. 根据权利要求30至32任一所述的计算机系统，其特征在于，所述vTPM服务组件还用于基于所述第一VM的标识标记分配的存储空间。
  34. 根据权利要求30至33所述的计算机系统，其特征在于，所述vTPM代理组件还用于获取来自于第一VM的第六请求信息，所述第六请求信息用于请求关闭所述第一会话，获取所述第一VM的标识，在所述第六请求信息中添加所述第一VM的标识从而得到第七请求信息，所述第七请求信息包括所述第一VM的标识，以及向所述TrustZone Driver组件传递所述第七请求信息，所述第七请求信息的目的方为所述vTPM服务组件；
    所述vTPM服务组件还用于获取第六请求信息，根据所述第六请求消息中包含的所述第一VM的标识，确定所述第一存储空间，将所述第一存储空间的数据复制到第三存储空间，所述第三存储空间位于非易失性存储器。
  35. 根据权利要求22至34任一所述的计算机系统，其特征在于，所述第二请求信息是所述TrustZone Driver组件在监控模式下向所述vTPM服务组件传递的，所述TrustZone Driver组件运行于所述计算机的丰富执行环境中。
  36. 一种计算机可读存储介质，其特征在于，包括计算机可读指令，当所述计算机可读指令在计算机上运行时，使得所述计算机执行如权利要求1至19中任一项所述的方法。
  37. 一种计算机程序产品，其特征在于，包括计算机可读指令，当所述计算机可读指令在计算机上运行时，使得所述计算机执行如权利要求1至19任一项所述的方法。
PCT/CN2021/086100 2020-10-27 2021-04-09 一种虚拟可信平台模块的实现方法及相关装置 WO2022088615A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21884358.9A EP4216087A4 (en) 2020-10-27 2021-04-09 METHOD FOR IMPLEMENTING A VIRTUAL TRUSTED PLATFORM MODULE AND ASSOCIATED APPARATUS
US18/307,041 US20230267214A1 (en) 2020-10-27 2023-04-26 Virtual trusted platform module implementation method and related apparatus

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202011159996 2020-10-27
CN202011159996.2 2020-10-27
CN202011353009.2A CN114491544A (zh) 2020-10-27 2020-11-26 一种虚拟可信平台模块的实现方法及相关装置
CN202011353009.2 2020-11-26

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/307,041 Continuation US20230267214A1 (en) 2020-10-27 2023-04-26 Virtual trusted platform module implementation method and related apparatus

Publications (1)

Publication Number Publication Date
WO2022088615A1 true WO2022088615A1 (zh) 2022-05-05

Family

ID=81383468

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/086100 WO2022088615A1 (zh) 2020-10-27 2021-04-09 一种虚拟可信平台模块的实现方法及相关装置

Country Status (3)

Country Link
US (1) US20230267214A1 (zh)
EP (1) EP4216087A4 (zh)
WO (1) WO2022088615A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170277869A1 (en) * 2016-03-25 2017-09-28 Mstar Semiconductor, Inc. Computing device and data processing method
CN109522754A (zh) * 2018-11-28 2019-03-26 中国科学院信息工程研究所 一种移动终端可信隔离环境核心控制方法
CN111353162A (zh) * 2020-03-26 2020-06-30 中国人民解放军国防科技大学 基于TrustZone分核异步执行的主动可信计算方法及系统
CN111382445A (zh) * 2020-03-03 2020-07-07 首都师范大学 利用可信执行环境系统提供可信服务的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170277869A1 (en) * 2016-03-25 2017-09-28 Mstar Semiconductor, Inc. Computing device and data processing method
CN109522754A (zh) * 2018-11-28 2019-03-26 中国科学院信息工程研究所 一种移动终端可信隔离环境核心控制方法
CN111382445A (zh) * 2020-03-03 2020-07-07 首都师范大学 利用可信执行环境系统提供可信服务的方法
CN111353162A (zh) * 2020-03-26 2020-06-30 中国人民解放军国防科技大学 基于TrustZone分核异步执行的主动可信计算方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4216087A4

Also Published As

Publication number Publication date
EP4216087A1 (en) 2023-07-26
US20230267214A1 (en) 2023-08-24
EP4216087A4 (en) 2024-03-06

Similar Documents

Publication Publication Date Title
JP7094292B2 (ja) クロスプラットフォームエンクレーブアイデンティティ
TWI483201B (zh) 虛擬化信任平台模組存取的系統、方法與設備
EP2577543B1 (en) Secure virtual machine bootstrap in untrusted cloud infrastructures
US9264220B2 (en) Secure virtual machine provisioning
US9536063B2 (en) Methods and apparatus for protecting software from unauthorized copying
US11537421B1 (en) Virtual machine monitor providing secure cryptographic operations
US8627414B1 (en) Methods and apparatuses for user-verifiable execution of security-sensitive code
JP2020505698A (ja) 密封エンクレーブを用いたデータ開封
US10505721B2 (en) Secure virtualized data volumes
JP2020505700A (ja) 密封エンクレーブを用いたデータ密封
JP2020505701A (ja) 抽象エンクレーブアイデンティティ
US11200300B2 (en) Secure sharing of license data in computing systems
WO2015100188A1 (en) Virtual machine assurances
US20220245255A1 (en) Systems and methods for processor virtualization
US20220374512A1 (en) Software-based hardware security module (hsm) for a virtualized computing environment
US20220070225A1 (en) Method for deploying workloads according to a declarative policy to maintain a secure computing infrastructure
CN114491544A (zh) 一种虚拟可信平台模块的实现方法及相关装置
WO2022088615A1 (zh) 一种虚拟可信平台模块的实现方法及相关装置
JP2022043279A (ja) 仮想化環境内の人工知能アクセラレータ・ステータス確認を用いる仮想マシン移行のための方法
Ushakov et al. Trusted hart for mobile RISC-V security
aw Ideler Cryptography as a service in a cloud computing environment
US20240037217A1 (en) Digital content management through on-die cryptography and remote attestation
Fitzek Development of an ARM TrustZone aware operating system ANDIX OS
Weiß et al. Integrity verification and secure loading of remote binaries for microkernel-based runtime environments
Quaresma TrustZone Based Attestation in Secure Runtime Verification for Embedded Systems

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21884358

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021884358

Country of ref document: EP

Effective date: 20230420

NENP Non-entry into the national phase

Ref country code: DE