WO2023273647A1 - 虚拟化可信平台模块实现方法、安全处理器及存储介质 - Google Patents

虚拟化可信平台模块实现方法、安全处理器及存储介质 Download PDF

Info

Publication number
WO2023273647A1
WO2023273647A1 PCT/CN2022/092981 CN2022092981W WO2023273647A1 WO 2023273647 A1 WO2023273647 A1 WO 2023273647A1 CN 2022092981 W CN2022092981 W CN 2022092981W WO 2023273647 A1 WO2023273647 A1 WO 2023273647A1
Authority
WO
WIPO (PCT)
Prior art keywords
platform module
trusted platform
virtual machine
virtualized trusted
security processor
Prior art date
Application number
PCT/CN2022/092981
Other languages
English (en)
French (fr)
Inventor
陈善
应志伟
Original Assignee
海光信息技术股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 海光信息技术股份有限公司 filed Critical 海光信息技术股份有限公司
Priority to EP22831474.6A priority Critical patent/EP4332810A1/en
Publication of WO2023273647A1 publication Critical patent/WO2023273647A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45562—Creating, deleting, cloning virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/4557—Distribution of virtual machine instances; Migration and load balancing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45583—Memory management, e.g. access or allocation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances

Definitions

  • Embodiments of the present disclosure relate to a method for realizing a virtualized trusted platform module, a security processor and a storage medium.
  • TPM Trusted Platform Module
  • TCG Trusted Computing Group
  • TPM Trusted Computing Group
  • TPM Trusted Computing Group
  • Common functions provided by the TPM include password generation and storage, cryptographic operations, identity authentication, and trusted reporting.
  • TPM is currently widely used on non-virtualized physical hosts, but rarely used on virtual machines (Virtual Machine, VM) on the cloud.
  • the TPM used by VM can be called virtualized TPM (Virtualized Trusted Platform Module, vTPM).
  • vTPM Virtualized Trusted Platform Module
  • VMs on a physical host in a cloud environment can be dynamically increased or decreased, and the number of vTPMs needs to be increased or decreased accordingly.
  • VM access to vTPM needs to ensure the security of the access path and the security of the vTPM itself;
  • a VM needs to be migrated.
  • the corresponding vTPM needs to be migrated, and security needs to be ensured during the entire migration process;
  • vTPM can be used for VM identity authentication. vTPM needs to be bound to VM, and this binding is best to rely on some kind of unchangeable security mechanism, rather than based on the trust of the platform above.
  • At least one embodiment of the present disclosure provides a method for implementing a virtualized trusted platform module, including: creating a virtualized trusted platform module inside a security processor and uniquely binding it to a virtual machine;
  • the trusted platform module communication interface receives an access request to the bound virtualized trusted platform module initiated by the virtual machine, and returns response data of the bound virtualized trusted platform module to the access request to the virtual machine.
  • creating a virtualized trusted platform module inside the security processor and uniquely binding it to the virtual machine includes: creating a virtualized trusted platform module instance inside the security processor, and allocate resources for the instance; bind the created virtualized trusted platform module instance with the uniquely corresponding virtual machine security block of the virtual machine.
  • creating a virtualized trusted platform module instance inside the security processor includes: when creating a virtual machine, creating a virtualized trusted platform module instance inside the security processor; The method also includes: when creating the virtual machine, creating a virtual machine security block uniquely corresponding to the virtual machine inside the security processor.
  • the method provided by an embodiment of the present disclosure further includes: receiving the user secret sent by the terminal through the secure communication channel; using the built-in security processor secret and the received user secret to generate a key for the virtualized trusted platform module Encryption and decryption when instance data is imported into the security processor and/or exported from the security processor.
  • the key and virtualized trusted platform module instance data are stored in a non-volatile memory of the virtualized trusted platform module.
  • the method further includes: receiving the virtualized trusted platform module instance data imported by the terminal through a secure communication channel ; Use the key to decrypt the received virtualized trusted platform module instance data; and/or use the key to encrypt the received virtualized trusted platform module instance data when the virtual machine is shut down or hibernated, or the host where the virtual machine is located is restarted , exporting the encrypted virtualized trusted platform module instance data to the terminal through the secure communication channel.
  • the method provided by an embodiment of the present disclosure further includes: generating an endorsement key for the virtualized trusted platform module; signing the generated endorsement key with the built-in chip endorsement key of the security processor to generate a virtualized trusted platform module.
  • the endorsement key certificate for the platform module is not limited to: generating an endorsement key for the virtualized trusted platform module; signing the generated endorsement key with the built-in chip endorsement key of the security processor to generate a virtualized trusted platform module.
  • the method further includes: when the virtual machine is migrated, the cryptographically bound virtualized trusted platform module instance data, sent to the destination security processor.
  • the access request to the bound virtualized trusted platform module initiated by the virtual machine is received, and the The virtual machine returns the response data of the bound virtualized trusted platform module to the access request, including: reading the access request from the virtual machine stored in the encrypted memory of the virtual machine to the bound virtualized trusted platform module;
  • the bound virtualized trusted platform module writes the response data to the access request into the encrypted memory of the virtual machine for the virtual machine to read; wherein, the access request and its response data conform to the virtualized trusted data provided by the security processor.
  • Platform module communication interface format is
  • At least one embodiment of the present disclosure further provides a security processor, the security processor includes a virtualized trusted platform module inside, and the virtualized trusted platform module is uniquely bound to a virtual machine; the security processor is used to pass The virtualized trusted platform module communication interface receives an access request initiated by the virtual machine to the bound virtualized trusted platform module, and returns response data of the bound virtualized trusted platform module to the access request to the virtual machine.
  • the security processor includes a virtualized trusted platform module inside, and the virtualized trusted platform module is uniquely bound to a virtual machine; the security processor is used to pass The virtualized trusted platform module communication interface receives an access request initiated by the virtual machine to the bound virtualized trusted platform module, and returns response data of the bound virtualized trusted platform module to the access request to the virtual machine.
  • the security processor is used to create a virtualized trusted platform module internally and uniquely bind it to a virtual machine, specifically including: creating a virtualized trusted platform internally module instance, and allocate resources for the instance; bind the created virtualized trusted platform module instance with the uniquely corresponding virtual machine security block of the virtual machine.
  • the security processor is configured to internally create a virtualized trusted platform module instance, including: when creating a virtual machine, internally create a virtualized trusted platform module instance;
  • the security processor is also used to internally create a virtual machine security block uniquely corresponding to the virtual machine when creating the virtual machine.
  • the security processor is further configured to: receive the user secret sent by the terminal through the secure communication channel; use the built-in security processor secret and the received user secret to generate The key is used for encryption and decryption when virtualized trusted platform module instance data is imported into the security processor and/or exported from the security processor.
  • the security processor further includes: a receiving unit, configured to receive the virtualized trusted platform module instance imported by the terminal through the secure communication channel after the virtualized trusted platform module instance is created inside the security processor data; using a key to decrypt received virtualized Trusted Platform Module instance data; and/or an export unit for when a virtualized Trusted Platform Module instance is created within the secure processor, when a virtual machine is shut down or hibernated, or when a virtualized After the host machine where the machine is located is restarted, the received virtualized trusted platform module instance data is encrypted with a key, and the encrypted virtualized trusted platform module instance data is exported to the terminal through a secure communication channel.
  • a receiving unit configured to receive the virtualized trusted platform module instance imported by the terminal through the secure communication channel after the virtualized trusted platform module instance is created inside the security processor data; using a key to decrypt received virtualized Trusted Platform Module instance data; and/or an export unit for when a virtualized Trusted Platform Module instance is created within the secure processor, when a virtual machine is shut down or
  • the security processor is further configured to: generate an endorsement key for the virtualized trusted platform module; use the built-in chip endorsement key to generate the endorsement key Sign and generate an endorsement key certificate for the virtualized trusted platform module.
  • the security processor provided by an embodiment of the present disclosure further includes a migration unit, configured to encrypt and bind the virtualized trusted platform module instance when the virtual machine migrates after the virtualized trusted platform module instance is created inside the security processor. data, sent to the destination security processor.
  • a migration unit configured to encrypt and bind the virtualized trusted platform module instance when the virtual machine migrates after the virtualized trusted platform module instance is created inside the security processor. data, sent to the destination security processor.
  • the security processor is configured to receive an access request to a bound virtualized trusted platform module initiated by a virtual machine through a virtualized trusted platform module communication interface, And, returning to the virtual machine the response data of the bound virtualized trusted platform module to the access request, including: reading the access to the bound virtualized trusted platform module from the virtual machine stored in the encrypted memory of the virtual machine request; write the response data of the bound virtualized trusted platform module to the access request into the encrypted memory of the virtual machine for the virtual machine to read; wherein, the access request and its response data conform to the virtual Standardized Trusted Platform Module communication interface format.
  • At least one embodiment of the present disclosure further provides a computer-readable storage medium, the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to realize The methods described in the examples of the present disclosure.
  • FIG. 1 is a schematic diagram of a network architecture applicable to at least one embodiment of the present disclosure
  • Fig. 2 is a flowchart of a method for implementing a virtualized trusted platform module provided by at least one embodiment of the present disclosure
  • FIG. 3 is a schematic diagram of a communication method between a virtual machine and a virtualized trusted platform module provided by at least one embodiment of the present disclosure
  • Fig. 4 is a flowchart of another virtualized trusted platform module implementation method provided by at least one embodiment of the present disclosure
  • FIG. 5 is a schematic diagram of a virtual machine-oriented virtualized trusted platform module architecture on the cloud service side provided by at least one embodiment of the present disclosure
  • FIG. 6 is a schematic diagram of interaction between a user, a cloud platform, and a security processor when a virtual machine is created according to at least one embodiment of the present disclosure
  • Fig. 7 is a schematic diagram of interaction between a user, a cloud platform, and a security processor when a virtual machine is shut down or hibernated according to at least one embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of interaction between a source, a destination security processor, and a cloud platform when a virtual machine is migrated according to at least one embodiment of the present disclosure.
  • the network architecture includes: multiple terminals, a cloud platform and a security processor (SecureProcessor, SP).
  • the terminal can be a user-side electronic device such as a desktop computer, a notebook computer, or a mobile phone, which is connected to the cloud platform through a wireless or wired network.
  • the user can use the terminal to log in to the cloud platform and request the cloud platform to provide services;
  • Each user creates his own VM, and deploys the user's corresponding application on the VM to provide services for the user;
  • the SP is connected to the cloud platform and is a specially set processor responsible for handling the security-related operations of the VM.
  • the SP and the cloud platform can be deployed on the same physical host or on different hosts.
  • At least one embodiment of the present disclosure provides a method for implementing a virtualized trusted platform module, the method may be executed by a device for implementing a virtualized trusted platform module implemented by software and/or hardware, and the device may be integrated in an SP.
  • the method specifically includes the following steps 200-201.
  • Step 200 create a vTPM inside the SP, and uniquely bind it to the VM.
  • the VM In practical applications, considering the security of the VM, the VM must accept the management of the SP.
  • the SP will create and maintain a unique virtual machine security block (VirtualMachineSecurityBlock, VMSB) for each VM.
  • VMSB is the VM in the SP.
  • the data structures created are used to manage and support the operation of the VM. Therefore, in this case, the unique binding between the vTPM and the VM can be indirectly completed through the binding between the vTPM and the VMSB uniquely corresponding to the VM. In this way, the binding between vTPM and VM will not depend on the cloud platform, which can prevent the cloud platform from migrating the vTPM instance of a certain VM to other VMs at any time.
  • creating a vTPM inside the SP and uniquely binding it to the VM may include: creating a vTPM instance inside the SP and allocating resources for the vTPM instance; binding the created vTPM instance to the uniquely corresponding VMSB of the VM.
  • the vTPM instance can initialize the default state, or import the vTPM instance data file from the terminal via the cloud platform, and restore the specific state according to the incoming file. Which method to use can be determined according to the configuration instruction sent by the terminal via the cloud platform.
  • resources allocated for the vTPM instance may include volatile storage space, non-volatile storage space, and the like.
  • creating a vTPM instance inside the SP includes: when creating a VM, creating a vTPM instance inside the SP.
  • the vTPM instance may also be created at other moments after the VM and its corresponding VMSB are created, which is not specifically limited.
  • Step 201 Receive the access request to the bound vTPM initiated by the VM through the vTPM communication interface provided by the SP, and return the response data of the bound vTPM to the access request to the VM.
  • the SP hardware design supports multiple vTPM communication interfaces.
  • the interface type can use the CRB (CommandResponseBuffer, command response buffer) in the two commonly used interface types of TPM. Types of.
  • the VM performs data interaction with the bound vTPM during the request-response process through the vTPM communication interface allocated by the SP for the bound vTPM.
  • step 201 may include: reading the access request from the VM to the bound vTPM stored in the encrypted memory of the VM; writing the response data of the bound vTPM to the access request into the encrypted memory of the VM to For the VM to read; wherein, the access request and its response data conform to the vTPM communication interface format provided by the SP.
  • VM1 sends an access request to the bound vTPM1, and the access request includes vTPM1 command data; the encryption engine (that is, the memory controller) encrypts the access request and caches it in the encrypted memory of VM1, and Return the cache address 1 of the access request to VM1; VM1 informs the vTPM1 in the SP of the control information carrying the cache address 1; vTPM1 responds by reading the access request from the corresponding location of the memory according to the received cache address 1, and then sends vTPM1 encrypts the response data and caches it in the encrypted memory of VM1, and returns the cache address 2 of the response data to VM1; VM1 reads the response data from the cache address 2 in the encrypted memory of VM1 through the encryption engine.
  • the encryption engine that is, the memory controller
  • the VM's memory is encrypted, only the VM itself and the SP can access it, and the SP always uses the VM's key to access the memory, so it can be ensured that only the specified VM can use its own vTPM.
  • the command data of the VM accessing the vTPM is encrypted and cannot be seen outside the VM, including the platform, ensuring the security of the access.
  • the VM directly accesses the vTPM in the SP through the designed vTPM communication interface, which eliminates the need for virtual machine manager routing, greatly reduces the attack surface, and realizes the binding of the vTPM and the VM, and non-VM users Even the platform administrator has no right to migrate the vTPM to other VMs, which effectively improves the security of the vTPM.
  • the import/export of vTPM instance data is further restricted, so as to better improve the security of the vTPM.
  • the method for implementing a virtualized trusted platform module provided by an embodiment of the present disclosure includes the following steps 400-403.
  • Step 400 create a vTPM inside the SP, and uniquely bind it to the VM.
  • This step is the same as the above-mentioned step 200 and will not be repeated here.
  • Step 401 Receive the access request to the bound vTPM initiated by the VM through the vTPM communication interface provided by the SP, and return the response data of the bound vTPM to the access request to the VM.
  • This step is the same as the above step 201, and will not be repeated here.
  • Step 402 receiving the user secret sent by the terminal through the secure communication channel.
  • a secure communication channel may be established in advance between the terminal, the cloud platform and the SP, and then a user secret of a user sent by the terminal is received based on the secure communication channel. Wherein, the establishment of the secure communication channel will not be repeated here.
  • Step 403 using the built-in SP secret and the received user secret to generate a key, which is used for encryption and decryption when the vTPM instance data is imported into the SP and/or exported from the SP.
  • creating a vTPM instance and importing vTPM instance data are embedded in the steps of creating a VM. After creating a vTPM instance, import the vTPM instance data as needed.
  • the terminal corresponds to the user side.
  • each user has its own VM on the cloud platform, and each VM has a uniquely bound vTPM.
  • the user secret sent by the user through the terminal is only used for encryption and decryption when the VTPM instance data bound to the user's own VM is imported into and/or exported from the SP.
  • there is only one SP secret built into the SP which is the same for all vTPMs.
  • the keys used for encryption and decryption of vTPM instance data between different users when they are imported into the SP and/or exported from the SP are different due to different user secrets.
  • the owner of the user secret is the user, and the owner of the SP secret is the SP, so ensure that the vTPM instance can only run inside the SP and be bound to the user's VM.
  • step 402 and step 403 only need to be executed after step 400, for example, they may also be executed after step 400 and before step 401.
  • FIG. 4 is only a specific example for convenience.
  • the exported vTPM instance data is encrypted using the key derived jointly from the user secret provided by the user and the SP secret built in the SP, so as to ensure that the vTPM instance can only be decrypted and restored within the SP, ensuring that the vTPM Security of confidential information within.
  • the key generated according to the user secret and the SP secret, and the vTPM instance data bound to the user's VM are all stored in the non-volatile memory of the vTPM bound to the user's VM.
  • the method provided by the embodiment of the present disclosure further includes: receiving the vTPM instance data imported by the terminal through the secure communication channel; using the key generated in step 403 to decrypt the received vTPM instance data;
  • the vTPM instance data is encrypted using the key generated in step 403, and the encrypted vTPM instance data is exported to the terminal through a secure communication channel.
  • the user can control the cloud platform to shut down or hibernate the VM through the terminal. What needs to be exported at this time is the instance data of the vTPM bound to the user's VM.
  • the encryption of the instance data is also based on the user's secret and the key generated by the SP secret.
  • the user can export the instance data of the vTPM bound to the user's VM stored in the non-volatile memory from the SP through the terminal through the cloud platform.
  • the method provided by the embodiment of the present disclosure further includes: when the VM migrates, encrypting and binding the vTPM instance data and sending it to the destination SP.
  • the encryption key is owned by the SP rather than the cloud platform O&M, which can prevent the cloud platform from being public security risks posed by the platform.
  • the encryption and decryption of vTPM instance data imported to the SP and/or the vTPM instance data exported from the SP the encryption and decryption of memory data when the VM interacts with the SP data, and the migration of the VM together
  • the three encryption and decryption processes are completely independent and unrelated to each other, so the encryption methods (such as keys) used may also be different.
  • the cloud service side (including cloud platform and SP) is a VM-oriented vTPM architecture, as shown in Figure 5, including: at least one VM (VM1 and VM2 are used as examples in the figure), encryption engine, VM memory, SP and Hypervisor.
  • the Hypervisor is a virtual machine manager, and is used to manage the SP through a virtual machine security management module in the SP.
  • the SP includes: a virtual machine security management module, a VMSB uniquely corresponding to each VM, a VTPM bound to each VMSB, a chip EK certificate, and an NV (Non-Volatile, non-volatile) memory.
  • the virtual machine security management module in the SP includes a vTPM manager, and the vTPM manager is used to provide functions such as creating a vTPM instance, importing vTPM instance data, exporting vTPM instance data, and destroying a vTPM instance.
  • this example includes:
  • the process of implementing vTPM based on creating a VM includes:
  • the user terminal obtains the SP chip EK (Endorsement Key, endorsement key) certificate information from the SP through the cloud platform for authentication to confirm the authenticity of the hardware.
  • the hardware supports secure virtualization and vTPM.
  • the user terminal and the SP determine the relevant keys needed for confidential communication between the two parties through key negotiation or asymmetric encryption and decryption through the cloud platform, and the two parties establish a secure confidential communication channel.
  • the cloud platform creates the user's VM; in addition to the existing relevant data needed to create the VM, the user terminal will also store the user's secret UserSecret and vTPM related configuration information (such as whether the vTPM instance data file and the characteristic value of the file are needed, etc.) Securely send to the SP through the cloud platform through a confidential communication channel; the SP internally creates a VMSB for managing and supporting VMs, and at the same time creates a vTPM instance and allocates the required resources; the SP binds the relevant information of the vTPM instance to the VMSB, so that Bind the vTPM with the VM, and the UserSecret will be stored in the vTPM's non-volatile memory to ensure that it will not be lost when the system is powered off; according to the vTPM-related configuration information sent by the user terminal, the SP can initialize the vTPM instance to the default state, or use The vTPM instance data file imported by the user terminal restores
  • the user terminal Before shutting down or dormant VM, the user terminal obtains the EK (Endorsement Key, endorsement key) certificate information of the SP chip from the SP through the cloud platform for authentication to confirm the authenticity of the hardware.
  • EK Endorsement Key, endorsement key
  • the hardware supports secure virtualization and vTPM.
  • the user terminal and the SP determine the relevant keys needed for confidential communication between the two parties through key negotiation or asymmetric encryption and decryption through the cloud platform, and the two parties establish a secure confidential communication channel.
  • the user terminal sends the user's own VM identification information to the cloud platform, and controls the cloud platform to shut down or sleep the corresponding VM.
  • the SP packs the vTPM instance data bound to the corresponding VM, and uses the key jointly derived from the user's UserSecret and the SP's built-in SpSecret to encrypt and protect the packaged data, and then exports the packaged data to the user terminal, which ensures that the exported
  • the vTPM instance data can only be restored in the user-specified SP.
  • SpSecret is known internally to all SPs, but unknown to the outside of the SP, so the outside world cannot decrypt the confidential information in the vTPM data files.
  • the SP destroys the user's VM information, including: the VMSB corresponding to the user's VM, the vTPM instance, and the user's UserSecret.
  • the SP provides a non-volatile memory for the vTPM, and stores the UserSecret information required for encrypting the vTPM instance data files in the non-volatile memory.
  • the VM is abnormally destroyed due to unexpected events such as power failure of the physical host during the running process, the same as when the VM is shut down or hibernated, the user can still export the vTPM instance data stored in the non-volatile memory from the SP after the host restarts.
  • Data encryption still uses the key derived jointly from UserSecret and SpSecret.
  • the exported vTPM instance data file is imported to the created vTPM instance again when the subsequent VM is created.
  • VM migration must be performed between platforms that also support VMs.
  • the source platform SP and the target platform SP will mutually authenticate each other, and after the authentication is passed, the relevant keys needed for secure communication will be created through key negotiation, and then the source platform SP will VM memory image, some information in VMSB, and bound vTPM instance information (including vTPM status, RAM volatile data, NV non-volatile data, and UserSecret, etc.) are encrypted and sent to the target platform SP securely, and then decrypted by the target platform SP fully recovered afterwards.
  • the encryption and decryption of vTPM instance information and the binding between vTPM and VM are guaranteed by the SP, and the cloud platform cannot be tampered with or destroyed.
  • the TPM's EK (Endorsement Key, endorsement key) certificate ensures the authenticity of the manufacturer or owner of the TPM device. Since the root of trust of the vTPM is in the hands of the cloud platform, the cloud platform is fully capable of migrating the vTPM instance to any form of vTPM implementation , or even a software simulator. Therefore, neither the owner nor the vendor of the vTPM can issue an EK certificate for it.
  • an endorsement key certificate generation scheme of the vTPM is added.
  • the vTPM implementation method provided by the embodiments of the present disclosure also includes: generating an endorsement key for the vTPM;
  • the vTPM instance information is bound to the VM and migrates with the VM together with the VMSB.
  • the VM can only be migrated between platforms that also support secure virtualization and have been mutually authenticated by SPs, so vTPM instances will only migrate between the same SPs;
  • the data is encrypted and decrypted by the SP, and the key is jointly derived from the UserSecret provided by the user and the built-in SpSecret of the SP. Therefore, the confidential information of the vTPM is completely invisible outside the SP and only Decrypt in the SP specified by the user. It can be seen that the vTPM instance can only run in the SP and is always bound to the user VM.
  • the confidential information inside the instance is not visible outside the SP, which meets the essential requirements of the EK to prove the authenticity of the user or manufacturer. Therefore, when the SP creates a vTPM instance, it can generate an EK for it and use the built-in chip EK (CEK for short) to sign the EK to generate an EK certificate.
  • EK built-in chip
  • the validity of the EK certificate can be proved by the CEK certificate; You can also call standard TPM commands to generate an EK and issue an EK certificate externally.
  • the basic conditions required for issuing the EK certificate are met.
  • the built-in chip EK in the SP realizes the built-in SP manufacturer EK in the vTPM, and also allows users to generate their own EK.
  • At least one embodiment of the present disclosure also provides a security processor.
  • the security processor includes a virtualized trusted platform module inside, and the virtualized trusted platform module is uniquely bound to a virtual machine.
  • the security processor is configured to receive an access request for the bound virtualized trusted platform module initiated by the virtual machine through the communication interface of the virtualized trusted platform module, and return the bound virtualized trusted platform module for the access request to the virtual machine.
  • the response data for the request is configured to receive an access request for the bound virtualized trusted platform module initiated by the virtual machine through the communication interface of the virtualized trusted platform module, and return the bound virtualized trusted platform module for the access request to the virtual machine. The response data for the request.
  • the security processor is used to create a virtualized trusted platform module internally and uniquely bind it to the virtual machine, specifically including: creating a virtualized trusted platform module instance internally and allocating resources to the instance; the virtualized trusted platform module to be created The virtualized trusted platform module instance is bound to the unique virtual machine security block corresponding to the virtual machine.
  • the security processor is used to internally create a virtualized trusted platform module instance, including: when creating a virtual machine, internally create a virtualized trusted platform module instance; when the security processor is also used to create a virtual machine, internally create A virtual machine security block that uniquely corresponds to a virtual machine.
  • the security processor is also used to: receive the user secret sent by the terminal through the secure communication channel; use the built-in security processor secret and the received user secret to generate a key for the virtualized trusted platform module instance Encryption and decryption when data is imported into and/or exported from the security processor.
  • the key and virtualized trusted platform module instance data are stored in a non-volatile memory of the virtualized trusted platform module.
  • the security processor also includes: a receiving unit, configured to receive the virtualized trusted platform module instance data imported by the terminal through the secure communication channel after the virtualized trusted platform module instance is created inside the security processor; use the key to decrypt The received virtualized trusted platform module instance data; and/or the export unit, used to close or hibernate the virtual machine after the virtualized trusted platform module instance is created inside the security processor, or after the host where the virtual machine is located is restarted,
  • the received virtualized trusted platform module instance data is encrypted using a key
  • the encrypted virtualized trusted platform module instance data is exported to the terminal through a secure communication channel.
  • the security processor is also used to: generate an endorsement key for the virtualized trusted platform module; use the built-in chip endorsement key to sign the generated endorsement key, and generate an endorsement key for the virtualized trusted platform module Certificate.
  • the security processor also includes a migration unit, which is used to encrypt and bind the virtualized trusted platform module instance data when the virtual machine is migrated after the virtualized trusted platform module instance is created inside the security processor, and send it to the destination security processor.
  • a migration unit which is used to encrypt and bind the virtualized trusted platform module instance data when the virtual machine is migrated after the virtualized trusted platform module instance is created inside the security processor, and send it to the destination security processor.
  • the security processor is configured to receive an access request to the bound virtualized trusted platform module initiated by the virtual machine through the virtualized trusted platform module communication interface, and return the bound virtualized trusted platform module to the virtual machine
  • the response data of the module to the access request including: reading the access request from the virtual machine stored in the encrypted memory of the virtual machine to the bound virtualized trusted platform module;
  • the requested response data is written into the encrypted memory of the virtual machine for the virtual machine to read; wherein, the access request and its response data conform to the communication interface format of the virtualized trusted platform module provided by the security processor.
  • the security processor provided by the embodiments of the present disclosure belongs to the same inventive concept as the aforementioned implementation method of the virtualized trusted platform module.
  • embodiments of the present disclosure also provide a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement A method for implementing a virtualized trusted platform module provided by any embodiment of the present disclosure.
  • the embodiments of the present disclosure fill a gap in the vTPM field, so that the vTPM under the VM has the same security as the physical TPM, and does not affect various requirements such as VM migration and hibernation in the cloud scenario.
  • each unit/module can be implemented in one or more pieces of software and/or hardware.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM) or a random access memory (Random Access Memory, RAM), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

本公开的实施例提供了一种虚拟化可信平台模块实现方法、安全处理器及存储介质。该方法包括：在安全处理器内部创建虚拟化可信平台模块，并与虚拟机唯一绑定；通过安全处理器提供的虚拟化可信平台模块通信接口，接收虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据。本公开的实施例可以对已知vTPM技术进行改进，适用于如何提高公有云环境下vTPM安全的场景。

Description

虚拟化可信平台模块实现方法、安全处理器及存储介质
本申请要求于2021年6月28日递交的中国专利申请第202110727073.0号的优先权，在此全文引用上述中国专利申请公开的内容以作为本申请的一部分。
技术领域
本公开的实施例涉及一种虚拟化可信平台模块实现方法、安全处理器及存储介质。
背景技术
TPM(Trusted Platform Module，可信平台模块)是国际可信计算组TCG(Trusted Computing Group，TCG)提出的可信计算标准，实现了可信计算所需的信任根。TPM通常为系统内的一个专用模块，本身具有很高的安全性，外部只能通过定义好的命令接口调用TPM提供的功能，而不能影响TPM内部的运行。TPM提供的常用功能有密码生成和存储，密码运算，身份认证和可信报告等。TPM目前在非虚拟化的物理主机上得到了广泛使用，但在云上虚拟机(VirtualMachine，VM)上应用的很少。供VM使用的TPM可以称为虚拟化TPM(Virtualized Trusted Platform Module，vTPM)，vTPM需要解决的几个关键问题包括：
(1)vTPM的扩展性需求与自身安全问题
云环境下一台物理主机上的VM是可以动态增加或减少的，相应的也需要增加或减少vTPM的数量，同时VM访问vTPM需要保证访问路径的安全以及vTPM自身的安全；
(2)与物理机不同，VM会有迁移的需求，迁移VM的同时需要迁移对应的vTPM，整个迁移过程需要确保安全；
(3)和TPM一样，vTPM可以用来做VM的身份认证，vTPM需要与VM绑定，且这种绑定最好是依赖某种不可更改的安全机制，而不是建立在对平台的信任基础之上。
发明内容
本公开的至少一实施例提供一种虚拟化可信平台模块实现方法，包括：在安全处理器内部创建虚拟化可信平台模块，并与虚拟机唯一绑定；通过安全处理器提供的虚拟化可信平台模块通信接口，接收虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据。
例如，在本公开一实施例提供的方法中，在安全处理器内部创建虚拟化可信平台模块，并与虚拟机唯一绑定，包括：在安全处理器内部创建虚拟化可信平台模块实例，并为该实例分配资源；将创建的虚拟化可信平台模块实例与虚拟机唯一对应的虚拟机安全块绑定。
例如，在本公开一实施例提供的方法中，在安全处理器内部创建虚拟化可信平台模块实例，包括：创建虚拟机时，在安全处理器内部创建虚拟化可信平台模块实例；所述方法还包括：创建虚拟机时，在安全处理器内部创建与虚拟机唯一对应的虚拟机安全块。
例如，本公开一实施例提供的方法还包括：接收终端通过保密通信通道发送的用户秘密；利用内置的安全处理器秘密与接收到的用户秘密，生成密钥，用于虚拟化可信平台模块实例数据导入安全处理器和/或从安全处理器导出时的加解密。
例如，在本公开一实施例提供的方法中，所述密钥和虚拟化可信平台模块实例数据存储在虚拟化可信平台模块的非易失存储器中。
例如，在本公开一实施例提供的方法中，在安全处理器内部创建虚拟化可信平台模块实例后，所述方法还包括：接收终端通过保密通信通道导入的虚拟化可信平台模块实例数据；使用密钥解密接收到的虚拟化可信平台模块实例数据；和/或关闭或休眠虚拟机时，或者虚拟机所在主机重启后，使用密钥加密接收到的虚拟化可信平台模块实例数据，通过保密通信通道向终端导出加密后的虚拟化可信平台模块实例数据。
例如，本公开一实施例提供的方法还包括：为虚拟化可信平台模块生成背书密钥；使用安全处理器内置的芯片背书密钥对所生成的背书密钥进行签名，生成虚拟化可信平台模块的背书密钥证书。
例如，在本公开一实施例提供的方法中，在安全处理器内部创建虚拟化可信平台模块实例后，所述方法还包括：虚拟机迁移时，加密绑定的虚 拟化可信平台模块实例数据，发送至目的安全处理器。
例如，在本公开一实施例提供的方法中，通过安全处理器提供的虚拟化可信平台模块通信接口，接收虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据，包括：读取虚拟机的加密内存中存储的来自虚拟机的对绑定的虚拟化可信平台模块的访问请求；将绑定的虚拟化可信平台模块对访问请求的响应数据写入虚拟机的加密内存中，以供虚拟机读取；其中，访问请求及其响应数据均符合安全处理器提供的虚拟化可信平台模块通信接口格式。
本公开至少一实施例还提供一种安全处理器，所述安全处理器内部包括虚拟化可信平台模块，所述虚拟化可信平台模块与虚拟机唯一绑定；所述安全处理器用于通过虚拟化可信平台模块通信接口，接收虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据。
例如，在本公开一实施例提供的安全处理器中，所述安全处理器用于在内部创建虚拟化可信平台模块，并与虚拟机唯一绑定，具体包括：在内部创建虚拟化可信平台模块实例，并为该实例分配资源；将创建的虚拟化可信平台模块实例与虚拟机唯一对应的虚拟机安全块绑定。
例如，在本公开一实施例提供的安全处理器中，所述安全处理器用于在内部创建虚拟化可信平台模块实例，包括：创建虚拟机时，在内部创建虚拟化可信平台模块实例；所述安全处理器还用于创建虚拟机时，在内部创建与虚拟机唯一对应的虚拟机安全块。
例如，在本公开一实施例提供的安全处理器中，所述安全处理器还用于：接收终端通过保密通信通道发送的用户秘密；利用内置的安全处理器秘密与接收到的用户秘密，生成密钥，用于虚拟化可信平台模块实例数据导入安全处理器和/或从安全处理器导出时的加解密。
例如，本公开一实施例提供的安全处理器还包括：接收单元，用于在安全处理器内部创建虚拟化可信平台模块实例后，接收终端通过保密通信通道导入的虚拟化可信平台模块实例数据；使用密钥解密接收到的虚拟化可信平台模块实例数据；和/或导出单元，用于在安全处理器内部创建虚拟化可信平台模块实例后，关闭或休眠虚拟机时，或者虚拟机所在主机重启 后，使用密钥加密接收到的虚拟化可信平台模块实例数据，通过保密通信通道向终端导出加密后的虚拟化可信平台模块实例数据。
例如，在本公开一实施例提供的安全处理器中，所述安全处理器还用于：为虚拟化可信平台模块生成背书密钥；使用内置的芯片背书密钥对所生成的背书密钥进行签名，生成虚拟化可信平台模块的背书密钥证书。
例如，本公开一实施例提供的安全处理器还包括迁移单元，用于在安全处理器内部创建虚拟化可信平台模块实例后，虚拟机迁移时，加密绑定的虚拟化可信平台模块实例数据，发送至目的安全处理器。
例如，在本公开一实施例提供的安全处理器中，所述安全处理器用于通过虚拟化可信平台模块通信接口，接收虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据，包括：读取虚拟机的加密内存中存储的来自虚拟机的对绑定的虚拟化可信平台模块的访问请求；将绑定的虚拟化可信平台模块对访问请求的响应数据写入虚拟机的加密内存中，以供虚拟机读取；其中，访问请求及其响应数据均符合安全处理器提供的虚拟化可信平台模块通信接口格式。
本公开至少一实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现本公开的实施例所述的方法。
附图说明
为了更清楚地说明本公开实施例，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1为本公开至少一实施例可应用的一种网络架构示意图；
图2为本公开至少一实施例提供的一种虚拟化可信平台模块实现方法的流程图；
图3为本公开至少一实施例提供的一个虚拟机与虚拟化可信平台模块之间的通信方法示意图；
图4为本公开至少一实施例提供的另一种虚拟化可信平台模块实现方 法的流程图；
图5为本公开至少一实施例提供的一种云服务侧面向虚拟机的虚拟化可信平台模块架构示意图；
图6为本公开至少一实施例提供的一种虚拟机创建时用户、云平台及安全处理器间的交互示意图；
图7为本公开至少一实施例提供的一种虚拟机关机或休眠时用户、云平台及安全处理器间的交互示意图；以及
图8为本公开至少一实施例提供的一种虚拟机迁移时源、目的安全处理器及云平台间的交互示意图。
具体实施方式
下面结合附图对本公开的实施例进行详细描述。
应当明确，所描述的实施例仅仅是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其它实施例，都属于本公开保护的范围。
首先，介绍下本公开实施例可应用的网络架构。参见图1，该网络架构包括：多个终端、云平台和安全处理器(SecureProcessor，SP)。其中，终端可以是台式电脑、笔记本电脑或者手机等用户侧电子设备，其通过无线或有线网络与云平台连接，用户可以使用终端登录云平台，请求云平台为其提供服务；云平台上可以为每个用户创建用户自己的VM，在VM上部署用户相应的应用来为用户提供服务；SP与云平台连接，为专门设置的负责处理与VM的安全相关操作的处理器。SP与云平台可部署在同一物理主机上，也可以位于不同主机。
下面，通过各实施例详细介绍本公开的技术方案，各实施例均可适用上面所述的网络架构。
本公开的至少一实施例提供了一种虚拟化可信平台模块实现方法，该方法可以由软件和/或硬件实现的虚拟化可信平台模块实现装置执行，装置可以被集成在SP中。参见图2，该方法具体包括如下步骤200-201。
步骤200、在SP内部创建vTPM，并与VM唯一绑定。
在本步骤中，可以在SP内部为云平台上的每个VM创建一个唯一的vTPM，也即有多少个VM就创建多少个vTPM，并将创建的vTPM与云 平台上唯一对应的VM绑定。
在实际应用当中，考虑到VM的安全性，VM都要接受SP的管理，SP会为每个VM都创建并维护一个唯一对应的虚拟机安全块(VirtualMachineSecurityBlock，VMSB)，VMSB是SP中为VM创建的数据结构，用来管理和支持VM的运行。所以在该种情况下，可以通过vTPM同与VM唯一对应的VMSB之间的绑定，间接的完成vTPM与VM的唯一绑定。如此，vTPM与VM的绑定不会依赖云平台，能够防止云平台随时把某个VM的vTPM实例迁移给别的VM使用。具体的，在SP内部创建vTPM，并与VM唯一绑定，可包括：在SP内部创建vTPM实例，并为该vTPM实例分配资源；将创建的vTPM实例与VM唯一对应的VMSB绑定。
其中，vTPM实例可以初始化默认状态，也可以从终端经云平台传入vTPM实例数据文件，根据该传入文件恢复具体的状态。具体采用哪种方式可以根据终端经云平台发送的配置指示确定。此外，为vTPM实例分配的资源可包括易失存储空间、非易失存储空间等。
通常情况下，在云平台上的VM创建时SP会在内部为VM创建VMSB，例如，在SP内部创建vTPM实例，包括：创建VM时，在SP内部创建vTPM实例。当然，也可以在创建完毕VM及其对应的VMSB之后的其它时刻创建vTPM实例，对此不作具体限定。
步骤201、通过SP提供的vTPM通信接口，接收VM发起的对绑定的vTPM的访问请求，以及，向VM返回绑定的vTPM对访问请求的响应数据。
在本步骤中，SP硬件设计上支持多个vTPM通信接口，在创建一个vTPM时为其分配一个vTPM通信接口，接口类型可使用TPM两种常用接口类型中的CRB(CommandResponseBuffer，命令响应缓冲区)类型。VM通过SP为绑定的vTPM所分配的vTPM通信接口，与绑定的vTPM进行请求-响应过程中的数据交互。具体实施时，步骤201可包括：读取VM的加密内存中存储的来自VM的对绑定的vTPM的访问请求；将绑定的vTPM对访问请求的响应数据写入VM的加密内存中，以供VM读取；其中，访问请求及其响应数据均符合SP提供的vTPM通信接口格式。
示例性的，参见图3，VM1发出对绑定的vTPM1的访问请求，该访 问请求包括vTPM1命令数据；加密引擎(即内存控制器)将该访问请求加密后缓存至VM1的加密内存中，并向VM1返回该访问请求的缓存地址1；VM1将携带该缓存地址1的控制信息告知SP中的vTPM1；vTPM1按照接收到的缓存地址1从内存的相应位置读取访问请求进行响应，之后再把vTPM1响应数据加密后缓存至VM1的加密内存中，并向VM1返回该响应数据的缓存地址2；VM1经加密引擎从VM1的加密内存中的缓存地址2读取响应数据。
由于VM的内存是加密的，只有VM自己和SP可以访问，SP始终使用该VM的密钥来访问该内存，因此可以确保只有指定的VM可以使用自己的vTPM。VM访问vTPM的命令数据是加密的，VM外包括平台不可见，保证了访问的安全。
在本公开的实施例中，VM直接通过设计的vTPM通信接口访问SP中的vTPM，不再需要虚拟机管理器路由，大大缩小了攻击平面，并且实现了vTPM与VM的绑定，非VM用户即使是平台管理员也无权将vTPM迁移给别的VM使用，有效提高了vTPM的安全性。
例如，在上述实施例的基础上，对vTPM实例数据的导入/导出作进一步限定，以更好的提升vTPM的安全性。参见图4，本公开的实施例提供的虚拟化可信平台模块实现方法包括如下步骤400-403。
步骤400、在SP内部创建vTPM，并与VM唯一绑定。
本步骤与上述步骤200相同，此处不再赘述。
步骤401、通过SP提供的vTPM通信接口，接收VM发起的对绑定的vTPM的访问请求，以及，向VM返回绑定的vTPM对访问请求的响应数据。
本步骤与上述步骤201相同，此处不再赘述。
步骤402、接收终端通过保密通信通道发送的用户秘密。
在本步骤中，可预先在终端、云平台以及SP之间建立一条保密通信信道，之后基于保密通信信道接收终端发送的一用户的用户秘密。其中，保密通信信道的建立在此不再赘述。
步骤403、利用内置的SP秘密与接收到的用户秘密，生成密钥，用于vTPM实例数据导入SP和/或从SP导出时的加解密。
通常创建vTPM实例与导入vTPM实例数据内嵌在创建VM的步骤 中，创建vTPM实例后根据需要再导入vTPM实例数据。
在上述步骤402与403中，终端对应用户侧，当存在多个用户时，每个用户在云平台有自己的VM，每个VM都有唯一绑定的vTPM。用户通过终端发送的用户秘密，只用于该用户自己的VM绑定的VTPM实例数据导入SP和/或从SP导出时的加解密。而SP内置的SP秘密只有一个，对于所有vTPM而言均相同。显然，不同用户间的vTPM实例数据导入SP和/或从SP导出时加解密所采用的密钥因用户秘密不同而不同。用户秘密的所有者为用户，SP秘密的所有者为SP，因此确保vTPM实例只能运行在SP内部并且与用户的VM绑定。
说明一点，上述步骤402与步骤403只需要在步骤400之后执行即可，例如还可以在步骤400之后步骤401之前执行，图4仅是为了方便而给出的一种具体示例。
在本公开的实施例中，使用用户提供的用户秘密与SP内置的SP秘密联合派生的密钥来对导出的vTPM实例数据进行加密，从而保证vTPM实例只能在SP内解密恢复，确保了vTPM内机密信息的安全。
作为一种实施方式，根据用户秘密和SP秘密所生成的密钥，以及，与用户的VM绑定的vTPM实例数据，均存储在用户的VM绑定的vTPM的非易失存储器中。
可选的，在SP内部创建vTPM实例后，本公开的实施例提供的方法还包括：接收终端通过保密通信通道导入的vTPM实例数据；使用步骤403生成的密钥解密接收到的vTPM实例数据；关闭或休眠VM时，或者VM所在主机重启后，使用步骤403生成的密钥加密vTPM实例数据，通过保密通信通道向终端导出加密后的vTPM实例数据。
具体实施时，用户可通过终端控制云平台关闭或休眠VM，此时需要导出的是该用户的VM所绑定的vTPM的实例数据，对该实例数据的加密也采用的是根据该用户的用户秘密和SP秘密生成的密钥。SP所在主机重启后，用户可通过终端经云平台从SP中导出存储在非易失存储器中的该用户的VM所绑定的vTPM的实例数据。
可选的，在SP内部创建vTPM实例后，本公开的实施例提供的方法还包括：VM迁移时，加密绑定的vTPM实例数据，发送至目的SP。
在上述可选方式中，VM关机、休眠或是迁移时需要将对应vTPM的 所有状态及实例数据加密后导出时，加密密钥均为SP而非云平台运维所有，可以防止云平台为公有平台时所带来的安全隐患。
需要说明的是，在上述实施例中，向SP导入vTPM实例数据和/或从SP导出vTPM实例数据时的加解密，VM与SP数据交互时内存数据的加解密，VM迁移时一并迁移的vTPM实例数据的加解密，这三个加解密过程彼此完全独立，并无关联，所以采用的加密方式(如密钥)也可以是不同的。
以下结合一示例，对本公开的实施例提供的技术方案加以详细说明。本示例中云服务侧(包括云平台和SP)一种面向VM的vTPM架构，如图5所示，包括：至少一个VM(图中以VM1和VM2为例)、加密引擎、VM内存、SP和Hypervisor。Hypervisor为虚拟机管理器，用于通过SP中的虚拟机安全管理模块来管理SP。SP包括：虚拟机安全管理模块、与每个VM唯一对应的VMSB及每个VMSB绑定的VTPM、芯片EK证书和NV(Non-Volatile，非易失)存储器。其中，SP中的虚拟机安全管理模块包括vTPM管理器，vTPM管理器用于提供创建vTPM实例、导入vTPM实例数据、导出vTPM实例数据、销毁vTPM实例等功能。具体的，该示例包括：
1、创建VM
如图6所示，基于创建VM实现vTPM的流程，包括：
首先，在VM创建前，用户终端经云平台从SP获取SP的芯片EK(Endorsement Key，背书密钥)证书信息进行认证，以确认硬件的真实性，硬件支持安全虚拟化及vTPM。
然后，用户终端经云平台与SP通过密钥协商或非对称加解密等方式确定双方之间保密通信需要的相关密钥，双方建立安全的保密通信通道。
接下来，云平台进行用户的VM创建；除了现有的创建VM需要的相关数据，用户终端还会将用户秘密UserSecret、vTPM相关配置信息(比如是否需要vTPM实例数据文件及文件的特征值等)通过保密通信通道经云平台安全地发送给SP；SP在内部创建用来管理和支持VM的VMSB，同时创建一个vTPM实例并分配需要的资源；SP将vTPM实例的相关信息与VMSB绑定，从而使vTPM与VM绑定，UserSecret会保存在vTPM的非易失存储器中，确保系统掉电时不会丢失；根据用户终端发送的vTPM相 关配置信息，SP可以将vTPM实例初始化成默认状态，或采用用户终端传入的vTPM实例数据文件恢复vTPM实例的具体状态，vTPM实例数据文件使用UserSecret和内置SP秘密SpSecret联合派生的密钥解密。
2、VM关机、休眠
VM关机或休眠后，SP内的VMSB会完全销毁掉，vTPM实例也会销毁掉，因此需要将vTPM实例数据导出成文件，以便后续VM在同一或不同物理主机上重启时导入，VM重启的流程同VM创建流程。如图7所示，和创建VM类似。
首先，关闭或休眠VM前，用户终端经云平台从SP获取SP的芯片EK(Endorsement Key，背书密钥)证书信息进行认证，以确认硬件的真实性，硬件支持安全虚拟化及vTPM。
然后，用户终端经云平台与SP通过密钥协商或非对称加解密等方式确定双方之间保密通信需要的相关密钥，双方建立安全的保密通信通道。
接下来，用户终端向云平台发送用户自己的VM标识信息，控制云平台关闭或休眠对应的VM。SP打包对应的VM绑定的vTPM实例数据，并使用该用户的UserSecret和SP内置的SpSecret联合派生的密钥对打包数据进行加密及一致性保护，之后导出打包数据至用户终端，这样可以确保导出的vTPM实例数据只能在用户指定的SP中被恢复。SpSecret对所有SP内部已知，但SP外部未知，因此外部无法解密vTPM数据文件中的机密信息。进而，SP销毁用户的VM信息，包括：用户的VM对应的VMSB、vTPM实例和用户的UserSecret。
3、物理主机断电后重启
和物理TPM芯片一样，SP为vTPM提供了非易失存储器，并且将vTPM实例数据文件加密所需的UserSecret信息保存在非易失存储器上。当VM在运行过程中因物理主机掉电等意外事件导致VM非正常销毁，和VM关闭和休眠时一样，主机重启后用户依然可以从SP中导出存储在非易失存储器中的vTPM实例数据，数据加密依然使用UserSecret和SpSecret联合派生出来的密钥。导出的vTPM实例数据文件在后续VM创建时再次导入给创建的vTPM实例。
4、VM迁移
VM的迁移时必须在同样支持VM的平台之间进行。如图8所示，首 先，源平台SP和目的平台SP(图中的目标SP)之间会相互认证，认证通过后通过密钥协商创建安全通信通信需要的相关密钥，然后源平台SP将VM内存镜像、VMSB中部分信息及绑定的vTPM实例信息(包括vTPM的状态、RAM易失数据、NV非易失数据及UserSecret等)加密后安全地发送到目的平台SP，由目的平台SP解密后完整恢复。vTPM实例信息的加解密及vTPM与VM的绑定由SP保证，云平台无法进行篡改和破坏。
TPM的EK(Endorsement Key，背书密钥)证书确保TPM设备所属厂商或所有者的真实性，由于vTPM的信任根掌握在云平台手中，云平台完全有能力将vTPM实例迁移至任意形式的vTPM实现中，甚至是软件模拟器。因此vTPM的所有者和厂商都无法为其颁发EK证书。
为此，在本公开的一些实施例中，增加了vTPM的背书密钥证书生成方案。具体的，本公开的实施例提供的vTPM实现方法除了包括上述步骤400-403之外，还包括：为vTPM生成背书密钥；
使用SP内置的芯片背书密钥对所生成的背书密钥进行签名，生成虚vTPM的背书密钥证书。
vTPM的实例信息与VM绑定，与VMSB一起随VM迁移，VM只能在同样支持安全虚拟化且经过SP相互认证的平台之间迁移，因此vTPM实例也只会在同样的SP之间迁移；另外vTPM的实例数据在导出导入的过程中，数据均由SP进行加解密，密钥由用户提供的UserSecret和SP内置的SpSecret联合派生，因此vTPM的机密信息在SP外部完全不可见，只能在用户指定的SP中解密。由此可见，vTPM实例只能运行在SP中，且始终与用户VM绑定，实例内部的机密信息在SP外部不可见，满足EK证明用户或厂商真实性的本质要求。因此，SP在创建vTPM实例时可以为其生成EK并使用内置的芯片EK(简称CEK)对该EK进行签名生成EK证书，该EK证书的有效性可以由CEK证书证明；另外，用户在使用vTPM时也可以调用标准TPM命令生成EK并在外部为其签发EK证书。
在本公开的实施例中，通过绑定vTPM与VM及确保vTPM实例数据只能在用户指定的SP硬件中解密，满足了签发EK证书的所需的基本条件。通过SP中内置的芯片EK实现在vTPM中内置SP厂商EK，同时也允许用户生成自己的EK。
此外，本公开的至少一实施例还提供了一种安全处理器，安全处理器 内部包括虚拟化可信平台模块，虚拟化可信平台模块与虚拟机唯一绑定。
安全处理器用于通过虚拟化可信平台模块通信接口，接收虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据。
进一步的，安全处理器用于在内部创建虚拟化可信平台模块，并与虚拟机唯一绑定，具体包括：在内部创建虚拟化可信平台模块实例，并为该实例分配资源；将创建的虚拟化可信平台模块实例与虚拟机唯一对应的虚拟机安全块绑定。
进一步的，安全处理器用于在内部创建虚拟化可信平台模块实例，包括：创建虚拟机时，在内部创建虚拟化可信平台模块实例；安全处理器还用于创建虚拟机时，在内部创建与虚拟机唯一对应的虚拟机安全块。
进一步的，所述安全处理器还用于：接收终端通过保密通信通道发送的用户秘密；利用内置的安全处理器秘密与接收到的用户秘密，生成密钥，用于虚拟化可信平台模块实例数据导入安全处理器和/或从安全处理器导出时的加解密。
进一步的，所述密钥和虚拟化可信平台模块实例数据存储在虚拟化可信平台模块的非易失存储器中。
进一步的，安全处理器还包括：接收单元，用于在安全处理器内部创建虚拟化可信平台模块实例后，接收终端通过保密通信通道导入的虚拟化可信平台模块实例数据；使用密钥解密接收到的虚拟化可信平台模块实例数据；和/或导出单元，用于在安全处理器内部创建虚拟化可信平台模块实例后，关闭或休眠虚拟机时，或者虚拟机所在主机重启后，使用密钥加密接收到的虚拟化可信平台模块实例数据，通过保密通信通道向终端导出加密后的虚拟化可信平台模块实例数据。
进一步的，安全处理器还用于：为虚拟化可信平台模块生成背书密钥；使用内置的芯片背书密钥对所生成的背书密钥进行签名，生成虚拟化可信平台模块的背书密钥证书。
进一步的，安全处理器还包括迁移单元，用于在安全处理器内部创建虚拟化可信平台模块实例后，虚拟机迁移时，加密绑定的虚拟化可信平台模块实例数据，发送至目的安全处理器。
进一步的，安全处理器用于通过虚拟化可信平台模块通信接口，接收 虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据，包括：读取虚拟机的加密内存中存储的来自虚拟机的对绑定的虚拟化可信平台模块的访问请求；将绑定的虚拟化可信平台模块对访问请求的响应数据写入虚拟机的加密内存中，以供虚拟机读取；其中，访问请求及其响应数据均符合安全处理器提供的虚拟化可信平台模块通信接口格式。
本公开的实施例提供的安全处理器与前述的虚拟化可信平台模块实现方法属于同一发明构思，未在安全处理器中描述的技术细节可参见前述的虚拟化可信平台模块实现方法中的相关描述，在此不再赘述。
此外，本公开的实施例还提供一种计算机可读存储介质，该计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现本公开任一实施例提供的虚拟化可信平台模块实现方法。
综上所述，本公开的实施例填补了vTPM领域的一项空白，使得在VM下vTPM拥有和物理TPM一样的安全性，且不影响云场景下的VM迁移、休眠等各种需求。
需要说明的是，在本公开中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
本公开的实施例中术语“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
本公开中的各个实施例均采用相关的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不 同之处。
尤其，对于装置实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
为了描述的方便，描述以上装置是以功能分为各种单元/模块分别描述。当然，在实施本公开时可以把各单元/模块的功能在同一个或多个软件和/或硬件中实现。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于一计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)或随机存储记忆体(Random Access Memory，RAM)等。
以上所述，仅为本公开的具体实施方式，但本公开的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本公开揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本公开的保护范围之内。因此，本公开的保护范围应以权利要求的保护范围为准。

Claims (18)

  1. 一种虚拟化可信平台模块实现方法，包括：
    在安全处理器内部创建虚拟化可信平台模块，并与虚拟机唯一绑定；
    通过安全处理器提供的虚拟化可信平台模块通信接口，接收虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据。
  2. 根据权利要求1所述的方法，其中，在安全处理器内部创建虚拟化可信平台模块，并与虚拟机唯一绑定，包括：
    在安全处理器内部创建虚拟化可信平台模块实例，并为该实例分配资源；
    将创建的虚拟化可信平台模块实例与虚拟机唯一对应的虚拟机安全块绑定。
  3. 根据权利要求2所述的方法，其中，在安全处理器内部创建虚拟化可信平台模块实例，包括：创建虚拟机时，在安全处理器内部创建虚拟化可信平台模块实例；
    所述方法还包括：创建虚拟机时，在安全处理器内部创建与虚拟机唯一对应的虚拟机安全块。
  4. 根据权利要求2或3所述的方法，还包括：
    接收终端通过保密通信通道发送的用户秘密；
    利用内置的安全处理器秘密与接收到的用户秘密，生成密钥，用于虚拟化可信平台模块实例数据导入安全处理器和/或从安全处理器导出时的加解密。
  5. 根据权利要求4所述的方法，其中，所述密钥和虚拟化可信平台模块实例数据存储在虚拟化可信平台模块的非易失存储器中。
  6. 根据权利要求4或5所述的方法，其中，在安全处理器内部创建虚拟化可信平台模块实例后，所述方法还包括：
    接收终端通过保密通信通道导入的虚拟化可信平台模块实例数据；使用密钥解密接收到的虚拟化可信平台模块实例数据；和/或
    关闭或休眠虚拟机时，或者虚拟机所在主机重启后，使用密钥加密接收到的虚拟化可信平台模块实例数据，通过保密通信通道向终端导出加密 后的虚拟化可信平台模块实例数据。
  7. 根据权利要求4-6任一所述的方法，还包括：
    为虚拟化可信平台模块生成背书密钥；
    使用安全处理器内置的芯片背书密钥对所生成的背书密钥进行签名，生成虚拟化可信平台模块的背书密钥证书。
  8. 根据权利要求2或3所述的方法，其中，在安全处理器内部创建虚拟化可信平台模块实例后，所述方法还包括：
    虚拟机迁移时，加密绑定的虚拟化可信平台模块实例数据，发送至目的安全处理器。
  9. 根据权利要求1-8任一所述的方法，其中，通过安全处理器提供的虚拟化可信平台模块通信接口，接收虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据，包括：
    读取虚拟机的加密内存中存储的来自虚拟机的对绑定的虚拟化可信平台模块的访问请求；
    将绑定的虚拟化可信平台模块对访问请求的响应数据写入虚拟机的加密内存中，以供虚拟机读取；
    其中，访问请求及其响应数据均符合安全处理器提供的虚拟化可信平台模块通信接口格式。
  10. 一种安全处理器，其中，所述安全处理器内部包括虚拟化可信平台模块，所述虚拟化可信平台模块与虚拟机唯一绑定；
    所述安全处理器用于通过虚拟化可信平台模块通信接口，接收虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据。
  11. 根据权利要求10所述的安全处理器，其中，所述安全处理器用于在内部创建虚拟化可信平台模块，并与虚拟机唯一绑定，具体包括：
    在内部创建虚拟化可信平台模块实例，并为该实例分配资源；
    将创建的虚拟化可信平台模块实例与虚拟机唯一对应的虚拟机安全块绑定。
  12. 根据权利要求11所述的安全处理器，其中，所述安全处理器用于在内部创建虚拟化可信平台模块实例，包括：创建虚拟机时，在内部创 建虚拟化可信平台模块实例；
    所述安全处理器还用于创建虚拟机时，在内部创建与虚拟机唯一对应的虚拟机安全块。
  13. 根据权利要求11或12所述的安全处理器，其中，所述安全处理器还用于：
    接收终端通过保密通信通道发送的用户秘密；
    利用内置的安全处理器秘密与接收到的用户秘密，生成密钥，用于虚拟化可信平台模块实例数据导入安全处理器和/或从安全处理器导出时的加解密。
  14. 根据权利要求13所述的安全处理器，还包括：
    接收单元，用于在安全处理器内部创建虚拟化可信平台模块实例后，接收终端通过保密通信通道导入的虚拟化可信平台模块实例数据；使用密钥解密接收到的虚拟化可信平台模块实例数据；和/或
    导出单元，用于在安全处理器内部创建虚拟化可信平台模块实例后，关闭或休眠虚拟机时，或者虚拟机所在主机重启后，使用密钥加密接收到的虚拟化可信平台模块实例数据，通过保密通信通道向终端导出加密后的虚拟化可信平台模块实例数据。
  15. 根据权利要求13或14所述的安全处理器，其中，所述安全处理器还用于：
    为虚拟化可信平台模块生成背书密钥；
    使用内置的芯片背书密钥对所生成的背书密钥进行签名，生成虚拟化可信平台模块的背书密钥证书。
  16. 根据权利要求11或12所述的安全处理器，还包括迁移单元，用于在安全处理器内部创建虚拟化可信平台模块实例后，虚拟机迁移时，加密绑定的虚拟化可信平台模块实例数据，发送至目的安全处理器。
  17. 根据权利要求10-16任一所述的安全处理器，其中，所述安全处理器用于通过虚拟化可信平台模块通信接口，接收虚拟机发起的对绑定的虚拟化可信平台模块的访问请求，以及，向虚拟机返回绑定的虚拟化可信平台模块对访问请求的响应数据，包括：
    读取虚拟机的加密内存中存储的来自虚拟机的对绑定的虚拟化可信平台模块的访问请求；
    将绑定的虚拟化可信平台模块对访问请求的响应数据写入虚拟机的加密内存中，以供虚拟机读取；
    其中，访问请求及其响应数据均符合安全处理器提供的虚拟化可信平台模块通信接口格式。
  18. 一种计算机可读存储介质，其中，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现所述1-9中任一权利要求所述的方法。
PCT/CN2022/092981 2021-06-28 2022-05-16 虚拟化可信平台模块实现方法、安全处理器及存储介质 WO2023273647A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP22831474.6A EP4332810A1 (en) 2021-06-28 2022-05-16 Method for realizing virtualized trusted platform module, and secure processor and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110727073.0 2021-06-28
CN202110727073.0A CN113485785B (zh) 2021-06-28 2021-06-28 一种虚拟化可信平台模块实现方法、安全处理器及存储介质

Publications (1)

Publication Number Publication Date
WO2023273647A1 true WO2023273647A1 (zh) 2023-01-05

Family

ID=77936586

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/092981 WO2023273647A1 (zh) 2021-06-28 2022-05-16 虚拟化可信平台模块实现方法、安全处理器及存储介质

Country Status (3)

Country Link
EP (1) EP4332810A1 (zh)
CN (1) CN113485785B (zh)
WO (1) WO2023273647A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113485785B (zh) * 2021-06-28 2023-10-27 海光信息技术股份有限公司 一种虚拟化可信平台模块实现方法、安全处理器及存储介质
CN114625484B (zh) * 2022-03-31 2024-06-21 苏州浪潮智能科技有限公司 虚拟化实现方法、装置、电子设备、介质及arm平台

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100115512A1 (en) * 2008-10-30 2010-05-06 Fujitsu Limited Virtual machine system, management method of virtual machine system, and recording medium
CN103995732A (zh) * 2014-05-26 2014-08-20 华为技术有限公司 一种虚拟可信平台模块功能实现方法和管理设备
CN109858265A (zh) * 2018-11-22 2019-06-07 海光信息技术有限公司 一种加密方法、装置及相关设备
CN112241306A (zh) * 2020-10-21 2021-01-19 海光信息技术股份有限公司 固件数据加载方法、装置、安全处理器、芯片及电子设备
CN113485785A (zh) * 2021-06-28 2021-10-08 海光信息技术股份有限公司 一种虚拟化可信平台模块实现方法、安全处理器及存储介质

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7571312B2 (en) * 2005-05-13 2009-08-04 Intel Corporation Methods and apparatus for generating endorsement credentials for software-based security coprocessors
CA2830846C (en) * 2011-03-21 2018-08-28 Irdeto B.V. System and method for securely binding and node-locking program execution to a trusted signature authority
US9275240B2 (en) * 2013-07-09 2016-03-01 Hua Zhong University Of Science Technology Synchronized virtual trusted platform modules (VTPM) and virtual machine (VM) rollbacks
CA2918596C (en) * 2013-08-02 2023-03-07 Ologn Technologies Ag A secure server on a system with virtual machines
CN105956465A (zh) * 2016-05-04 2016-09-21 浪潮电子信息产业股份有限公司 一种基于vtpm构建虚拟可信平台的方法
CN111683052A (zh) * 2020-05-13 2020-09-18 国网山东省电力公司 基于租户身份信息的可信虚拟机vTPM私密信息保护方法、系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100115512A1 (en) * 2008-10-30 2010-05-06 Fujitsu Limited Virtual machine system, management method of virtual machine system, and recording medium
CN103995732A (zh) * 2014-05-26 2014-08-20 华为技术有限公司 一种虚拟可信平台模块功能实现方法和管理设备
CN109858265A (zh) * 2018-11-22 2019-06-07 海光信息技术有限公司 一种加密方法、装置及相关设备
CN112241306A (zh) * 2020-10-21 2021-01-19 海光信息技术股份有限公司 固件数据加载方法、装置、安全处理器、芯片及电子设备
CN113485785A (zh) * 2021-06-28 2021-10-08 海光信息技术股份有限公司 一种虚拟化可信平台模块实现方法、安全处理器及存储介质

Also Published As

Publication number Publication date
EP4332810A1 (en) 2024-03-06
CN113485785A (zh) 2021-10-08
CN113485785B (zh) 2023-10-27

Similar Documents

Publication Publication Date Title
US9047468B2 (en) Migration of full-disk encrypted virtualized storage between blade servers
US9426147B2 (en) Protected device management
CA2939925C (en) Securing client-specified credentials at cryptographically attested resources
US8745386B2 (en) Single-use authentication methods for accessing encrypted data
EP2913956B1 (en) Management control method and device for virtual machines
US10262130B2 (en) System and method for providing cryptographic operation service in virtualization environment
WO2023273647A1 (zh) 虚拟化可信平台模块实现方法、安全处理器及存储介质
EP3087524A1 (en) Virtual machine assurances
KR20140099325A (ko) 글로벌 플랫폼 규격을 사용하는 발행자 보안 도메인에 대한 키 관리 시스템 및 방법
KR20160097892A (ko) 가상화 기반의 보안 서비스 제공 장치 및 제공 방법
EP3776223B1 (en) Secured computer system
WO2014059575A1 (zh) 输入输出操作的处理方法和装置
CN114402295A (zh) 安全运行时系统和方法
CN114238185A (zh) 直接存储访问及命令数据传输方法、装置及相关设备
WO2023133862A1 (zh) 数据处理方法及系统
US11748520B2 (en) Protection of a secured application in a cluster
US20230273808A1 (en) Confidential offloading of persistent storage operations in confidential computing environments
US20230066427A1 (en) Distributed trusted platform module key management protection for roaming data
US20230267214A1 (en) Virtual trusted platform module implementation method and related apparatus
AU2019245506B2 (en) Secured computer system
CN113485790A (zh) 一种虚拟机的重启方法、迁移方法和相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22831474

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18566517

Country of ref document: US

Ref document number: 2022831474

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022831474

Country of ref document: EP

Effective date: 20231201

NENP Non-entry into the national phase

Ref country code: DE