Virtual machine monitor and virtual trusted execution environment construction method

Abstract

The embodiment of the invention relates to the technical field of software, and discloses a virtual machine monitor and a virtual trusted execution environment construction method. The invention provides a virtual machine monitor which starts a client virtual machine based on trusted hardware and starts an application in the client virtual machine. The virtual machine monitor comprises a trusted extension page table management module and an instruction simulation module, the trusted extension page table management module used for establishing a trusted extension page table when the applicationis started, and the instruction simulation module used for establishing mapping for the protected physical memory in the trusted extension page table, loading codes and data of an application into the protected physical memory, and verifying the integrity of the codes and the data; the instruction simulation module completes the construction of the virtual trusted execution environment when the verification is passed. Therefore, a trusted execution environment is realized without using an SGX technology, the difficulty brought to wide deployment of security applications due to the fact that only a few servers support the SGX technology is avoided, and wide deployment of the security applications is realized.

Description

technical field [0001] The embodiment of the present invention relates to the field of software technology, in particular to a virtual machine monitor and a method for constructing a virtual trusted execution environment. Background technique [0002] A core concern of cloud services is the security and privacy of data and applications. In order to enable applications to run safely on the cloud, cloud service providers need to provide a trusted execution chain based on a trusted computing technology. environment. The SGX (Software Guard Extensions) technology released by Intel after the sixth-generation CPU Skylake processor can provide an enclave trusted execution environment through a part of independent secure memory, protect the security of cloud server data, and prevent data and code from being accessed or modified . Because Enclave can protect the security of applications and data from the hardware level, its application in cloud services has attracted extensive atte...

AI Technical Summary

Problems solved by technology

[0003] The inventors have found the following disadvantages in the prior art: most cloud servers do not provide hardware support for SGX technology, which makes only a small number of servers available for deployment when security applications based on the Enclave trusted execution environment are deployed in the cloud. Difficulty in broadly deploying enclave-based security applications

Images