A method and system for providing cryptographic services in a virtualized environment

Abstract

The invention relates to a method and system for providing cryptographic services in a virtualized environment. Manage cryptographic computing resources available on the host machine through the virtual cryptographic device manager, and provide virtual cryptographic computing devices for client virtual machines to access; client virtual machines request cryptographic services to the virtual cryptographic computing devices, and the virtual cryptographic device manager uses them The virtual machine introspection method actively checks whether the password service request made by the client virtual machine is valid. If the check is passed, the cryptographic operation will be completed in the virtual password device manager and the operation result will be returned to the client virtual machine; if the check fails, it will not be completed. Cryptographic operation service. The present invention provides a scheme for providing cryptographic operation services for client virtual machines in a virtualized environment, and can allocate virtual cryptographic devices of each client virtual machine on demand on the virtual cryptographic device manager, and at the same time assign virtual cryptographic services to client virtual machines. Access to cryptographic devices is audited and proactively checked.

Description

technical field [0001] The invention belongs to the technical field of computer security, and in particular relates to a method and system for providing cryptographic services in a virtualized environment. Background technique [0002] In computer and communication systems, data confidentiality is usually achieved by encrypting data, that is, using public cryptographic algorithms and keys known only to authorized access objects to transform and calculate data, and its effectiveness depends on the secrecy of keys sex. In the application of public key cryptography, the sender uses the public key of the designated recipient to encrypt emails or other data, which can ensure that only users who have the corresponding private key can decrypt it. Moreover, users who have a private key can also use the private key to digitally sign data, and any recipient can use the public key to verify the correctness of the digital signature, ensuring the identity of the document sender and the ...

AI Technical Summary

Problems solved by technology

But additional hardware drives up the cost

Although the hardware cryptographic device can protect key data well, the hardware cryptographic device can only passively receive requests, calculate, and return results, and it is difficult to know the detailed information of the caller

Images