Security management method of virtual machine based on trust root

Abstract

The invention provides a security management method of a virtual machine based on a trust root. The security management method comprises the following steps: S1, loading a back-end drive of an application layer to generate simulative equipment vTPM; S2, starting a virtualization monitor; S3, establishing a monitoring thread of a virtual TPM; S4, establishing the virtual TPM for a QEMU; S5, loading a front-end drive; S6, starting a security management thread, and loading a security strategy; and S7, processing a TPM instruction from a Hypervisor. The security management method of the virtual machine based on the trust root provided by the invention realizes the virtualization capability on the traditional TPM; integrity protection and isolation on a client machine are carried out over a virtualization system; and security management of the virtual machine is realized over the hypervisor.

Description

technical field [0001] The invention relates to virtualization security technology in cloud computing environment, in particular to a virtual machine security management method based on root of trust. Background technique [0002] The root of trust is the origin of Trusted Computing, which is a technology recommended and developed by the Trusted Computing Group (TCG). At the heart of TCG is the Trusted Platform Module (TPM), a tiny cryptographic chip embedded on a computer's motherboard that provides hardware-based security for programs. TPM provides a hardware-based root of trust, which provides internal key storage space and registers for storing digest values. The TPM also provides cryptographic functions to implement functions such as encryption / decryption, signing / verification, and hardware-based random number generation. [0003] The security problems in the cloud computing environment are largely caused by the virtual sharing of resources in virtualization technolog...

AI Technical Summary

Problems solved by technology

At present, mainstream trusted devices such as TPM cannot effectively run on KVM virtual machines, and cannot be shared concurrently by virtual computing domains, which introduces potential security threats to the security isolation between multiple virtual computing domains and the construction of root of trust

[0004] At present, there is no description or report of the similar technology of the present invention, and no similar data at home and abroad have been collected yet.

Images