A virtual machine data protection method based on trusted boot

Abstract

The invention relates to a trusted booting based data protecting method of a virtual machine. The method comprises a part of encrypting the disk of the virtual machine and a part of decrypting the disk of the virtual machine, wherein the part of encrypting the disk of the virtual machine includes the steps: calculating a hash value of a system key component and writing into a trusted module; registering a callback mechanism for the stopping of a monitor, and encrypting the disk of the virtual machine when the monitor is stopped and writing a decrypting key into the trusted module; the part of decrypting the disk of the virtual machine includes the steps: checking a key component to be examined during booting, and calculating the hash value of the key component through the trusted module before the trusted module loads the key component of the monitor of the virtual machine; comparing the calculated hash value with the hash value which is previously stored in the trusted module, and determining that the booting is trusted if the calculated hash value is equal to the previously-stored hash value; writing the decrypting key, stored in the trusted module, of the disk of the virtual machine, into a platform configuration register of the trusted module. The method has the beneficial effects that the data in the disk of the virtual machine can be encrypted and stored; the decrypting key of the disk of the virtual machine can be prevented from being stolen by a RootKit in the monitor of the virtual machine.

Description

technical field [0001] The invention relates to a data protection method for encrypting and decrypting a virtual machine disk used by a virtual machine by using a trusted module, in particular to a virtual machine data protection method based on trusted startup, which belongs to the field of computer applications. Background technique [0002] Trusted boot technology refers to saving some key system configuration or key information and hash values ​​of key components in the system in a trusted module, and recalculating the hash values ​​of key system components when the system starts, if it is the same as before If the saved values ​​are equal, it is judged that the current system is in a trusted state, and then the previously saved system configuration information or key information is written into the platform configuration register for normal startup of the system; if it is not equal to the previously saved number, it is judged If unauthorized changes to key system compon...

AI Technical Summary

Problems solved by technology

This technology makes the disk of the virtual machine usually stored in the form of ciphertext, so that even if the attacker obtains the disk file, the data in it cannot be read