Method for constructing virtual environment trust

A construction method and technology of virtual environment, applied in the direction of instrument, digital data processing, platform integrity maintenance, etc., can solve problems such as difficulty in building a trust chain mechanism in virtual environment

CN101350044AActive Publication Date: 2009-01-21INST OF SOFTWARE - CHINESE ACAD OF SCI
0 Cites 48 Cited by

Patent Information

Authority / Receiving Office
CN · China
Current Assignee / Owner
Publication Date
2009-01-21

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention discloses a virtual environment trust building method, which belongs to the trusted computing field in information security. The invention uses a single TPM to realize the trust of one or a plurality of virtual domains and comprises the following steps: firstly, measuring hardware, a virtual layer, a management virtual domain and one or a plurality of application virtual domains in turn by the TPM, realizing the trust of the application virtual domains, secondly, receiving and processing TPM command requests from each virtual domain, and establishing and maintaining TPM context for each virtual domain. The invention has the advantages that firstly, the platform safety and credibility are intensified through a complete trusted isolating mechanism, the trusted application service is better supported, and secondly, the safe sharing of each virtual domain to a trusted hardware root TPM is realized.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The present invention relates to a method for building trust in a virtual environment. Specifically, the present invention relates to a security application solution that combines trusted computing with virtual technology and builds a trusted virtual platform through a perfect trust chain transmission mechanism, which belongs to information technology. The field of trusted computing in security. The method supports secure sharing of trusted hardware roots by each virtual domain, and provides reliable services for distributed security applications. Background technique

[0002] With the development of information technology, the environment in which computer systems live is further complicated and diversified. Traditional software-based security solutions (such as firewalls, intrusion detection, and anti-virus) are often difficult to resist hackers, viruses, and internal theft. the invasion of the In response to these problems, in order to enhance the...

Examples

Embodiment Construction

[0076] The present invention will be further described below through specific embodiments in conjunction with the accompanying drawings.

[0077] In this embodiment, the implementation and construction of the trust system in the virtual environment is mainly based on the Xen technology. Xen is based on the paravirtualization technology (Para Virtualization), and the system management program (XenHypervisor) in the virtual layer (VMM) ) implements virtualization on memory, CPU, and I / O, and on this basis, provides an address space isolation mechanism for each virtual domain to improve system performance. In order to better implement security applications, Xen implements the management virtual domain and application virtual domain as Domain0 and DomainU respectively, where Domain0 manages the operation and operation of DomainU. Currently, for the TPM command request sent by DomainU, Xen mainly adopts the Event Channel communication mechanism between Domain0 and DomainU. Domain0 ...