A method for implementing a virtual trusted platform module and related apparatus

Abstract

The application discloses an implementation method of a virtual trusted platform module (vTPM), and the method is applied to a computer. A vTPM service component runs in a trusted execution environment of the computer, and a first virtual machine (VM) and a vTPM agent component run in a rich execution environment of the computer. The method comprises the following steps: the vTPM service component acquires first request information from the vTPM agent component, wherein the first request information comprises the identification of the first VM, and the first request information is used for requesting to execute a TPM operation; and the vTPM service component processes the first request information based on data in a first storage space, wherein the first storage space is a storage space corresponding to the identification of the first VM in the trusted execution environment, and the first storage space is used for storing TPM data of the first VM. Through the method, the safety of data can be ensured on the basis of providing TPM services for multiple VMs.

Description

[0001] This application claims priority from the Chinese patent application No. 202011159996.2 filed on October 27, 2020 and entitled "Implementation method of trusted platform module and related device", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the technical field of computer, in particular to an implementation method of a virtual trusted platform module (vTPM) and related device. BACKGROUND

[0003] A trusted platform module (TPM) is an international standard for a secure cryptographic processor. This standard specifies the use of a special microcontroller (secure hardware) integrated in a device to handle cryptographic keys in the device. The special microcontroller that meets the TPM standard is called a TPM chip. The TPM chip is a small chip system containing a cryptographic operation component and a storage component, which is used to securely store information such as passwords, certificates or encryption keys, etc. for verifying the security of a platform (such as a network device such as a personal computer). By storing these information by the TPM chip, it can effectively prevent unauthorized users from changing sensitive information.

[0004] Since the TPM chip is logically simple, it cannot support virtualization features, that is, it cannot provide TPM services for multiple virtual machines (VMs) at the same time. Therefore, in the related art, multiple functional modules are virtually created by software, each functional module has the function of a TPM chip, so as to ensure that multiple VMs can be provided with TPM services at the same time. The above-mentioned functional module virtually realized by software is called a virtual trusted platform module (vTPM) chip, which is also referred to as vTPM.

[0005] However, since the vTPM chip is virtually obtained by software, compared with the TPM chip in hardware form, its security is poor, and it is difficult to ensure the security of data. SUMMARY

[0006] The present application provides an implementation method of a vTPM, which is used to ensure the security of data on the basis of providing TPM services for multiple VMs.

[0007] The first aspect of the present application provides a method for implementing a vTPM, which is applied to a computer. A vTPM service component runs in a trusted execution environment of the computer, and a first VM and a vTPM agent component run in a rich execution environment of the computer. The method comprises: the vTPM service component acquires first request information from the vTPM agent component, the first request information comprising an identification of the first VM, and the first request information being used to request execution of a TPM operation. The vTPM service component acquires, for example, the first request information delivered by a TrustZone Driver component in a monitoring mode. The first request information is used to request execution of a TPM operation such as generation of a key, encryption of data, or decryption of data. Based on the identification of the first VM in the first request information, the vTPM service component can determine a first storage space corresponding to the identification of the first VM. The vTPM service component processes the first request information based on data in the first storage space, wherein the first storage space is a storage space corresponding to the identification of the first VM in the trusted execution environment, and the first storage space is used to store TPM data of the first VM.

[0008] In the present solution, the vTPM service component running in the trusted execution environment determines a corresponding storage space according to the identification of the VM in the acquired request information, and provides TPM service for the VM corresponding to the identification of the VM in the request information based on data in the storage space corresponding to the identification of the VM. Thus, the vTPM service component can provide TPM service for different VMs based on different storage spaces. Thus, the security of data in the vTPM can be ensured on the basis of providing TPM service for multiple VMs.

[0009] Optionally, in an embodiment, the trusted execution environment of the computer further comprises a second storage space, wherein the second storage space is used to store TPM data of a second VM in the computer, and the first storage space and the second storage space are mutually exclusive storage spaces. That is, the trusted execution environment of the computer comprises multiple mutually isolated storage spaces, and different storage spaces are used to store TPM data of different VMs, so that the vTPM service component can provide TPM service for the VM based on TPM data in the storage space corresponding to the VM.

[0010] Optionally, in an embodiment, the first request information further comprises a command identifier and a to-be-processed parameter, the command identifier being used to indicate a type of the TPM operation to be executed. The vTPM service component processes the first request information based on the data in the first storage space, specifically comprising: the vTPM service component processes the to-be-processed parameter based on the command identifier in the first request information and the data in the first storage space to obtain target data. The vTPM service component delivers the target data to the TrustZone Driver component, the target data being destined for the vTPM agent component.

[0011] Optionally, in an embodiment, the to-be-processed parameter comprises a key handle and to-be-encrypted data. The vTPM service component invokes a command invocation interface function to parse the first request information to obtain the command identifier and the to-be-processed parameter in the first request information. The vTPM service component encrypts the to-be-encrypted data according to the parsed command identifier, the key being determined by the vTPM according to the key handle. For example, the first request information comprises the command identifier, the key handle and the to-be-encrypted data, the command identifier being used to indicate the execution of the RSA encryption operation. Based on the key handle, the vTPM service component searches for the key corresponding to the key handle in the first storage space. Finally, the vTPM service component encrypts the to-be-encrypted data according to the command identifier and the key obtained from the first storage space to obtain the target data.

[0012] Optionally, in an embodiment, the to-be-processed parameter comprises a key handle and to-be-decrypted data. The vTPM service component invokes a command invocation interface function to parse the first request information to obtain the command identifier and the to-be-processed parameter in the first request information. The vTPM service component decrypts the to-be-decrypted data according to the command identifier, the key being determined by the vTPM according to the key handle.

[0013] Optionally, in an embodiment, before the vTPM service component processes the first request information based on the data in the first storage space, the method further comprises: if there is no storage space corresponding to the identity of the first VM in the trusted execution environment, the vTPM service component allocates a storage space for the identity of the first VM in the trusted execution environment. The vTPM service component performs a TPM initialization operation on the data in the allocated storage space, so that the data in the allocated storage space is updated to TPM initialization data, and the allocated storage space is taken as the first storage space corresponding to the identity of the first VM. Wherein, the vTPM service component performing the TPM initialization operation on the data in the storage space comprises: the vTPM service component divides the storage space to obtain a plurality of storage blocks, and the plurality of storage blocks are respectively used to store platform seed, endorsement seed, storage seed, key or PCR and the like. The vTPM service component updates the data in the storage block to obtain the TPM initialization data. For example, the vTPM service component updates the data in the storage space storing the PCR, so as to give the PCR an initialized value, and the initialized value is the initial value of the PCR.

[0014] By allocating the storage space corresponding to the identity of the VM in the trusted execution environment by the vTPM service component, it can be ensured that each VM has a corresponding storage space in the trusted execution environment, and it can be ensured that the vTPM service component can provide TPM services for a plurality of VMs based on the TPM data in different storage spaces.

[0015] Optionally, in an embodiment, the vTPM service component allocates a storage space for the identity of the first VM in the trusted execution environment, and specifically comprises: the vTPM service component searches for a storage space corresponding to the identity of the first VM in the volatile memory of the computer. If there is no storage space corresponding to the identity of the first VM in the volatile memory, the vTPM service component allocates a corresponding storage space for the identity of the first VM in the volatile memory.

[0016] Optionally, in an embodiment, the first request information acquired by the vTPM service component is transmitted in a first session, the first session is used to transmit information for requesting to perform a TPM operation and / or target data obtained after the vTPM service component performs the TPM operation between the vTPM service component and the vTPM agent component. The method further comprises: after the first VM is started, the vTPM service component acquires second request information from the vTPM agent component, the second request information comprises an identification of the first VM, and the second request information is used to request to establish the first session. The vTPM service component establishes the session according to the identification of the first VM, and allocates a storage space in the volatile memory of the computer, and the allocated storage space is used as the first storage space. That is, after the VM is started, the vTPM service component is triggered to allocate the storage space for the identification of the VM through the session establishment request transmitted by the vTPM agent component. Therefore, the corresponding storage space for the identification of the VM can be allocated in advance before the vTPM agent component acquires the TPM operation request, and the efficiency of performing the TPM operation is improved.

[0017] Optionally, in an embodiment, the first session is a session corresponding to the identification of the first VM, and the method further comprises: the vTPM service component invokes a session opening interface (TA_OpenSessionEntryPoint) function according to the identification of the first VM included in the second request information, to establish the first session corresponding to the identification of the first VM and obtain an identification of the first session. The vTPM service component transmits the identification of the first session to a TrustZone Driver component in a rich execution environment of the computer, and the destination of the identification of the first session is the vTPM agent component. That is, the vTPM service component establishes the first session by invoking the TA_OpenSessionEntryPoint function, and returns the obtained identification of the first session to the vTPM agent component.

[0018] Optionally, in an embodiment, the vTPM service component allocates the storage space in the volatile memory, and specifically comprises: the vTPM service component searches the non-volatile memory of the computer for the storage space corresponding to the identification of the first VM.

[0019] If the non-volatile memory does not have the storage space corresponding to the first VM's identity, it can be considered that the first VM is created for the first time or the first VM's corresponding TPM data has been discarded. The vTPM service component allocates storage space in the volatile memory and performs a TPM initialization operation on the data in the allocated storage space.

[0020] If the non-volatile memory does not have the storage space corresponding to the first VM's identity, it can be considered that the first VM is created for the first time or the first VM's corresponding TPM data has been discarded. The vTPM service component allocates storage space in the volatile memory and performs a TPM initialization operation on the data in the allocated storage space.

[0021] Optionally, in an embodiment, after the vTPM service component allocates storage space in the volatile memory, the method further includes: the vTPM service component labels the allocated storage space based on the first VM's identity, so that the vTPM service component can determine the corresponding storage space based on the first VM's identity in the future.

[0022] Optionally, in an embodiment, the method further includes: when the first VM is closed, the vTPM service component obtains third request information from the vTPM agent component. The third request information is transmitted in the first session, the third request information includes the first VM's identity, and the third request information is used to request the closing of the first session. The vTPM service component determines the first storage space based on the first VM's identity included in the third request information. The vTPM service component copies the data of the first storage space to a third storage space, and the third storage space is located in the non-volatile memory. Optionally, after the data in the storage space in the volatile memory is copied, the vTPM service component discards the data in the storage space in the volatile memory, thereby realizing the recycling of the storage space in the volatile memory and improving the utilization of the storage space in the volatile memory. By copying the first VM's corresponding TPM data to the non-volatile memory when the first VM is closed, the first VM's corresponding TPM data can be recovered when the first VM is restarted, thereby ensuring the normal operation of the first VM.

[0023] Optionally, in an embodiment, the first request information is delivered by a TrustZone Driver component in a monitoring mode to the vTPM service component, the TrustZone Driver component running in a rich execution environment of the computer.

[0024] The second aspect of the present application provides a method for implementing a vTPM, comprising: a vTPM proxy component obtaining first request information from a first VM, the first request information being used to request a vTPM service component to perform a TPM operation. The vTPM service component runs in a trusted execution environment of a computer, and the first VM runs in a rich execution environment of the computer. The vTPM proxy component obtains an identity of the first VM. The vTPM proxy component adds the identity of the first VM in the first request information, thereby obtaining second request information, the second request information comprising the identity of the first VM. The vTPM proxy component delivers the second request information to a TrustZone Driver component running in the trusted execution environment of the computer, the destination of the second request information being the vTPM service component. By adding the identity of the VM in the TPM operation request, the vTPM service component can determine the corresponding storage space based on the identity of the VM included in the TPM operation request, and provide TPM service for the VM based on the TPM data in the corresponding storage space of the identity of the VM.

[0025] Optionally, in an embodiment, the vTPM proxy component adding the identity of the first VM in the first request information comprises: the vTPM proxy component adding the identity of the first VM in the first request information by calling a command call function, thereby obtaining the second request information.

[0026] Optionally, in an embodiment, the method further comprises: the vTPM proxy component obtaining third request information from a second VM, the third request information being used to request to perform a TPM operation. The vTPM proxy component obtains an identity of the second VM. The vTPM proxy component adds the identity of the second VM in the third request information, thereby obtaining fourth request information, the fourth request information comprising the identity of the second VM. The vTPM proxy component delivers the fourth request information to the TrustZone Driver component, the destination of the fourth request information being the vTPM service component.

[0027] Optionally, in an embodiment, the method further comprises: the vTPM proxy component obtaining target data from the vTPM service component through the TrustZone Driver component, the target data being data obtained by the vTPM service component after performing the TPM operation based on the second request information. The vTPM proxy component delivers the target data to the first VM.

[0028] Optionally, in an embodiment, the method further comprises: when the first VM is started, the vTPM agent component obtaining the identity of the first VM. The vTPM agent component generates fifth request information, the fifth request information being used for requesting to establish a session with the vTPM service component, the fifth request information comprising the identity of the first VM. The vTPM agent component delivering the fifth request information to the TrustZone Driver component, the destination of the fifth request information being the vTPM service component.

[0029] Optionally, in an embodiment, the method further comprises: the vTPM agent component obtaining sixth request information from the first VM, the sixth request information being used for requesting to close the session with the vTPM service component. The vTPM agent component obtaining the identity of the first VM. The vTPM agent component adding the identity of the first VM in the sixth request information, thereby obtaining seventh request information, the seventh request information comprising the identity of the first VM. The vTPM agent component delivering the seventh request information to the TrustZone Driver component, the destination of the seventh request information being the vTPM service component.

[0030] The third aspect of the present application provides a computer system, the computer system running a trusted execution environment and a rich execution environment, the trusted execution environment running a vTPM service component, and the rich execution environment running a first VM and a vTPM agent component. The vTPM agent component is configured to obtain first request information from the first VM, obtain the identity of the first VM, add the identity of the first VM in the first request information, thereby obtaining second request information, and deliver the second request information to a TrustZone Driver component, the first request information being used for requesting the vTPM service component to perform a TPM operation, the second request information comprising the identity of the first VM, and the destination of the second request information being the vTPM service component. The vTPM service component is configured to obtain the second request information through the TrustZone Driver component, and process the second request information based on data in a first storage space, the first storage space being a storage space corresponding to the identity of the first VM in the trusted execution environment, and the first storage space being used for storing TPM data of the first VM.

[0031] Optionally, in an embodiment, the trusted execution environment further comprises a second storage space, the second storage space being used for storing TPM data of a second VM, and the first storage space and the second storage space being mutually non-overlapping storage spaces.

[0032] Optionally, in an embodiment, the second request information further comprises a command identifier and a to-be-processed parameter, the command identifier is used to indicate a type of the TPM operation to be executed. The vTPM service component is further configured to process the to-be-processed parameter based on the command identifier in the second request information and the data in the first storage space, to obtain target data, and transmit the target data to the TrustZone Driver, the target data is destined for the vTPM agent component. The vTPM agent component is further configured to obtain the target data, and transmit the target data to the first VM.

[0033] Optionally, in an embodiment, the to-be-processed parameter comprises a key handle and to-be-encrypted data. The vTPM service component is further configured to call the command invocation interface function to obtain the command identifier and the to-be-processed parameter in the second request information. The vTPM service component is further configured to encrypt the to-be-encrypted data according to the command identifier, the key being determined by the vTPM according to the key handle.

[0034] Optionally, in an embodiment, the to-be-processed parameter comprises a key handle and to-be-decrypted data. The vTPM service component is further configured to call the command invocation interface function to obtain the command identifier and the to-be-processed parameter in the second request information. The vTPM service component is further configured to decrypt the to-be-decrypted data according to the command identifier, the key being determined by the vTPM according to the key handle.

[0035] Optionally, in an embodiment, the vTPM agent component is further configured to obtain third request information from the second VM, the third request information being used to request execution of the TPM operation. The vTPM agent component is further configured to obtain an identifier of the second VM, add the identifier of the second VM in the third request information to obtain fourth request information, the fourth request information comprising the identifier of the second VM. The vTPM agent component is further configured to transmit the fourth request information to the TrustZone Driver component, the fourth request information being destined for the vTPM service component. The vTPM service component is configured to obtain the fourth request information through the TrustZone Driver component, and process the fourth request information based on data in a second storage space, the second storage space being a storage space corresponding to the identifier of the second VM in the trusted execution environment, the second storage space being used to store TPM data of the second VM.

[0036] Optionally, in an embodiment, if the storage space corresponding to the identifier of the first VM does not exist in the trusted execution environment, the vTPM service component is further configured to allocate a storage space for the identifier of the first VM in the trusted execution environment, and perform a TPM initialization operation on data in the allocated storage space, so that the data in the allocated storage space is updated to TPM initialization data, and the allocated storage space is used as the first storage space.

[0037] Optionally, in an embodiment, the vTPM service component is further configured to find a storage space corresponding to the first VM identifier in the volatile memory of the computer, and allocate the storage space in the volatile memory if the storage space corresponding to the first VM identifier does not exist in the volatile memory.

[0038] Optionally, in an embodiment, the second request information is transmitted in a first session, the first session is used to transmit information for requesting to perform a TPM operation and / or target data between the vTPM service component and the vTPM agent component, the target data is data obtained after performing the TPM operation. The vTPM agent component is further configured to obtain the first VM identifier when the first VM is started, generate fifth request information, the fifth request information including the first VM identifier, and transmit the fifth request information to the TrustZone Driver component, the fifth request information being used to request to establish the first session, the destination of the fifth request information being the vTPM service component. The vTPM service component is further configured to obtain the fifth request information through the TrustZone Driver component, and allocate a storage space in the volatile memory of the computer, the allocated storage space being the first storage space.

[0039] Optionally, in an embodiment, the first session is a session corresponding to the first VM identifier, and the vTPM service component is further configured to invoke a session opening interface function according to the first VM identifier included in the fifth request information, to establish the first session corresponding to the first VM identifier and obtain an identifier of the first session. The vTPM service component is further configured to transmit the identifier of the first session to the TrustZone Driver component, the destination of the identifier of the first session being the vTPM agent component.

[0040] Optionally, in an embodiment, the vTPM agent component is further configured to obtain sixth request information from the first VM, the sixth request information being used to request to close the first session, obtain the first VM identifier, add the first VM identifier in the sixth request information, thereby obtaining seventh request information, the seventh request information including the first VM identifier, and transmit the seventh request information to the TrustZone Driver component, the destination of the seventh request information being the vTPM service component. The vTPM service component is further configured to obtain the sixth request information, determine the first storage space according to the first VM identifier included in the sixth request information, and copy data of the first storage space to a third storage space, the third storage space being located in the non-volatile memory.

[0041] Optionally, in an embodiment, the second request information is delivered by the TrustZone Driver component in a monitoring mode to the vTPM service component, the TrustZone Driver component running in a rich execution environment of the computer.

[0042] The fourth aspect of the present application provides a computer, comprising: a processor, a non-volatile memory and a volatile memory; wherein the non-volatile memory or the volatile memory stores computer readable instructions; the processor reads the computer readable instructions to enable the computer to implement the method of any of the embodiments of the first aspect or the second aspect.

[0043] The fifth aspect of the present application provides a computer readable storage medium, which stores a computer program, and when the computer program is run on a computer, the computer program enables the computer to execute the method of any of the embodiments of the first aspect or the second aspect.

[0044] The sixth aspect of the present application provides a computer program product, which, when run on a computer, enables the computer to execute the method of any of the embodiments of the first aspect or the second aspect.

[0045] The seventh aspect of the present application provides a chip, comprising one or more processors. Part or all of the processors are used to read and execute the computer program stored in the memory, to execute the method in any possible embodiment of any of the aspects described above. Optionally, the chip further comprises a memory, and the memory is connected to the processor through a circuit or a wire. Optionally, the chip further comprises a communication interface, and the processor is connected to the communication interface. The communication interface is used to receive data and / or information to be processed, and the processor obtains the data and / or information from the communication interface, processes the data and / or information, and outputs the processing result through the communication interface. Optionally, the communication interface is an input / output interface. The method provided by the present application is realized by one chip, or is realized by multiple chips in cooperation. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 A structure diagram of a TPM provided by an embodiment of the present application;

[0047] Figure 2 A system software level diagram related to the TrustZone technology provided by an embodiment of the present application;

[0048] Figure 3 A system architecture diagram provided by an embodiment of the present application;

[0049] Figure 4 A structure diagram of a computer system provided by an embodiment of the present application;

[0050] Figure 5 A flowchart of a method for implementing a vTPM 500 is provided in an embodiment of the present application.

[0051] Figure 6 A flowchart of a method for allocating storage space for a vTPM service component is provided in an embodiment of the present application.

[0052] Figure 7 A flowchart of another method for allocating storage space for a vTPM service component is provided in an embodiment of the present application.

[0053] Figure 8 A flowchart of a method for closing a session for a vTPM service component is provided in an embodiment of the present application.

[0054] Figure 9 A structural diagram of a computer system is provided in an embodiment of the present application.

[0055] Figure 10 A structural diagram of a computer is provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to make the objectives, technical solutions and advantages of the present application clearer, the embodiments of the present application are described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Those skilled in the art can know that the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems as new application scenarios appear.

[0057] The terms “first”, “second”, and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence.

[0058] A TPM chip is a small chip system containing a cryptographic operation and a storage component, which is used to securely store information for verifying the security of a platform (such as a network device, e.g., a personal computer), such as password, certificate, or encryption key information. Through a built-in algorithm, the TPM chip generates a trusted key, and through a non-volatile random read-write memory (NVRAM) and a storage root key (SRK), the confidentiality and integrity of the root key and other sensitive data are ensured.

[0059] Reference can be made to Figure 1 , Figure 1 A structural diagram of a TPM chip is provided in an embodiment of the present application. As shown in Figure 1As shown, the TPM chip generally includes, but is not limited to, the following modules: a key generator, an asymmetric key engine, a symmetric key engine, a hash engine, a random number generator, an authorization module, a non-volatile memory, and a volatile memory. The above-mentioned modules are described as follows.

[0060] Key generator: used to generate keys within the hardware boundary of the TPM chip and protect the security of the keys.

[0061] Asymmetric key engine: used to perform encryption and decryption of asymmetric keys.

[0062] Symmetric key engine: used to perform encryption and decryption of symmetric keys.

[0063] Hash engine: used to perform secure hash operations on input data and output summary information.

[0064] Random number generator: a true random number generator implemented based on hardware.

[0065] Authorization module: used to control access to entities in the TPM chip and provide access security assurance for the TPM chip when the TPM chip is accessed.

[0066] Non-volatile memory: a non-volatile memory that can store data such as keys, random number seeds, or certificates that need to be persisted.

[0067] Volatile memory: a volatile memory that can store temporary data such as platform configuration registers (PCRs) or runtime sessions.

[0068] Due to the simple logic of the TPM chip, it cannot support virtualization features, that is, it cannot provide TPM services for multiple VMs at the same time, resulting in difficulty in widely applying the TPM chip in some cloud scenarios. Among them, the VM is a software container that is strictly isolated and contains an operating system and applications, and each VM is completely independent. Through virtualization technology, multiple VMs can be run based on the hardware resources of a physical server. In related technologies, multiple functional modules are virtually created by software, each functional module has the function of a TPM chip, so as to ensure that multiple VMs can be provided with TPM services at the same time. The above-mentioned functional modules virtually implemented by software are called vTPM chips, also simply referred to as vTPM. However, since the vTPM chip is obtained by software virtualization, compared with the hardware form of the TPM chip, its security is poor, and it is difficult to ensure the security of data.

[0069] In view of this, embodiments of this application provide a method for implementing vTPM. The vTPM service component running in a trusted execution environment determines the corresponding storage space based on the VM's identifier, and provides TPM services to the VM based on the data in that storage space. This enables the vTPM service component to provide TPM services to different VMs based on different storage spaces. Thus, while providing TPM services to multiple VMs, the security of data within the vTPM is guaranteed.

[0070] For ease of understanding, some technical terms involved in the embodiments of this application will be introduced below.

[0071] In related technologies, to provide a secure operating environment for applications or components in a computer, ARM processors have introduced TrustZone technology. ARM processors supporting TrustZone technology divide their operating states into two types during runtime: a secure state and a non-secure state, also known as the secure world state and the normal world state. Typical operating systems and most applications run in the normal world state, where development resources are relatively abundant compared to the secure world state; therefore, the normal world state is usually called the Rich Execution Environment (REE). Trusted operating systems run in the secure world state, which is usually called the Trusted Execution Environment (TEE).

[0072] When the processor is in a secure state, it can only run code from the trusted execution environment (TEA) and has access to the rich execution environment's address space. When the processor core is in an insecure state, it can only run code from the rich execution environment and can only obtain specific data and invoke specific functions from the TEA through predefined client interfaces.

[0073] Please refer to Figure 2 , Figure 2 This is a schematic diagram of the system software layer related to TrustZone technology provided in the embodiments of this application. For example... Figure 2 As shown, the processor operates at different execution levels (ELs). User mode is represented by EL0; privileged mode by EL1; Hyp mode by EL2 (used for virtualization); and monitor mode by EL3. The system can only switch between secure and insecure states in monitor mode.

[0074] Please refer to Figure 3 , Figure 3This is a schematic diagram of a system architecture provided for an embodiment of this application. (For example...) Figure 3 As shown, this system architecture includes a Trusted Execution Environment (TEE) and an Enriched Execution Environment (EME). The TEE is specifically designed for highly security-sensitive applications, ensuring the confidentiality and integrity of application resources and data. The general-purpose EME is designed for traditional operating systems and general applications. Applications running in the EME are called client applications (CAs), such as banking applications and other third-party payment applications. Applications running in the TEE are called trusted applications (TAs), such as applications performing critical services like signature verification and encryption / decryption calculations.

[0075] Because the Trusted Execution Environment (TA) runs within a Trusted Execution Environment (TEE), its deployment and upgrade operations must strictly adhere to the TEE issuer's security verification specifications, such as using digital signatures, to ensure the TEE's overall trustworthiness. The TEE comprises the TEE's Internal API and a Trusted Operating System (TEE) component. The TEE's Internal API primarily provides functionality to the TEE component, communicates with client applications (CAs), enables communication between TAs, and provides secure storage, cryptographic features, and timekeeping capabilities. The TEE component mainly includes a Trusted Core Framework, Trusted Functions, a Trusted Kernel, and a TEE Communication Agent. The Trusted Core Framework provides TAs with operating system-like functionality. Trusted Functions provide support capabilities for application developers. The Trusted Kernel interacts with trusted devices in the platform hardware. The TEE Communication Agent provides a secure communication channel between the TA and CA. For example, the TEE Communication Agent transmits messages to the TEE Communication Agent via the platform hardware, enabling interaction between the TA and CA.

[0076] The rich execution environment includes the Trusted Execution Environment Client Application Programming Interface (TEE ClientAPI), the Trusted Execution Environment Functional Application Programming Interface (TEE Functional API), and a multimedia operating system. The multimedia operating system components mainly include common device drivers and the rich execution environment communication agent. The rich execution environment communication agent is used to communicate with the Trusted Execution Environment, providing a secure communication channel for the CA and TA. The common device drivers are used to drive common devices in the platform hardware. The CA uses the TEE Client API and TEE Functional API to access the security services provided by the TA.

[0077] The above describes some technical terms involved in the embodiments of this application. The following will describe the computer system and vTPM implementation method provided in the embodiments of this application.

[0078] Figure 4 This is a schematic diagram of the structure of a computer system provided in an embodiment of this application. Figure 4 As shown, the computer system includes an enriched execution environment (EEA) and a trusted execution environment (TEE). Within the EEA, virtual machines (VMs), vTPM drivers, vTPM proxies, a TrustZone driver, and a host operating system (HOST OS) run. Optionally, one or more VMs run within the EEA, each VM running one vTPM driver, and the vTPM driver in each VM communicates with the corresponding vTPM proxy. Alternatively, each VM runs one vTPM driver, and the EEA runs only one vTPM proxy, which communicates with multiple vTPM drivers. Within the TEE, a Trusted Execution Environment (TEE) operating system and a vTPM service run. Here, a component refers to a self-contained, programmable, reusable, and language-independent software unit. The vTPM driver, vTPM proxy, and TrustZone driver are all software units.

[0079] based on Figure 4 The computer system shown in this application provides a method for implementing vTPM, as described in the embodiments.Figure 5 As shown. Figure 5 A flowchart of an implementation method 500 of a vTPM is provided in the embodiments of the present application. As shown, the method 500 includes the following steps 501 to 510. Figure 5

[0080] Step 501, the VM delivers first request information to the vTPM driver component, and the destination of the first request information is the vTPM service component.

[0081] In the embodiments, an application (APP) is running in the VM. The APP is, for example, a key management component or a payment component. In the running process of the APP, the APP needs to access the vTPM service component to request the vTPM service component to perform a TPM operation such as encrypting data or decrypting data. When the APP needs to access the vTPM, the VM generates first request information for requesting the vTPM service component to perform a TPM operation, and delivers the first request information to the vTPM driver component. The destination of the first request information is the vTPM service component.

[0082] Optionally, the TPM operation requested to be performed by the first request information includes, but is not limited to, operations such as generating a key, encrypting data, decrypting data, or performing a hash operation on data, and the embodiments of the present application do not make specific limitations on the TPM operation requested to be performed by the first request information.

[0083] In one possible example, when the APP needs to request the vTPM service component to generate a key so that the APP can subsequently encrypt or decrypt data based on the generated key, the VM calls a key generation function and inputs parameters such as the type of the key to be generated. The key generation function combines the parameters input by the VM into a TPM command byte stream. The TPM command byte stream includes a first command identifier, and the first command identifier is used to indicate the execution of the key generation operation.

[0084] In another possible example, when the APP needs to request the vTPM service component to encrypt data by using an RSA algorithm, the VM calls an RSA encryption (Tss2_Sys_RSA_Encrypt) function and inputs parameters such as the command identifier of the encryption operation and the data to be encrypted. The RSA algorithm is a kind of asymmetric encryption algorithm. The Tss2_Sys_RSA_Encrypt function combines the parameters input by the VM into a TPM command byte stream, and the TPM command byte stream includes a second command identifier, a first key handle, and data to be encrypted. The second command identifier is used to indicate the execution of the RSA encryption operation; the first key handle is an identifier of a key and is used to indicate the key used for the data encryption; and the data to be encrypted is the data to be encrypted.

[0085] ​In yet another possible example, when the APP needs to request the vTPM service component to decrypt data in an RSA algorithm, the VM invokes an RSA decryption function and inputs a command identifier of the decryption operation and data to be decrypted, etc. The RSA decryption function combines the parameters input by the VM into a TPM command byte stream, which includes a third command identifier, a second key handle and data to be decrypted. The third command identifier is used to indicate an RSA decryption operation; the second key handle is an identifier of a key and is used to indicate a key for performing data decryption; and the data to be decrypted is data to be decrypted.

[0086] It can be understood that the TPM command byte stream in the above example is the first request information described above. After obtaining the TPM command byte stream, the VM delivers the TPM command byte stream to the vTPM driver component by invoking a write function.

[0087] Optionally, a representation of the first request information is {TPM command identifier (CMD ID), parameter (Parameters)}. The TPM CMD ID is used to identify a specific TPM operation type, such as data encryption or data decryption. The Parameters are used to identify parameters to be processed, such as plaintext to be encrypted or ciphertext to be decrypted.

[0088] In step 502, the vTPM driver component delivers the first request information to the vTPM agent component.

[0089] The vTPM driver component is used to implement Input / Output (I / O) operations of TPM data related to the VM, that is, the vTPM driver component is responsible for delivering TPM request information generated by the VM to components outside the VM and delivering TPM response information returned by the components outside the VM to the VM.

[0090] Optionally, the VM runs a guest operating system (guest OS). The guest OS provides a unified device file for the APP running on the VM. The device file refers to simulating a device as a file so that the APP can access the device through an interface of the file, for example, simulating a hard disk, an input device, an output device and the like as a file. That is, when the APP on the VM is running, the APP performs read / write operations on the device file provided by the operating system to implement operations on the vTPM service component.

[0091] For example, assume that the path of the device file corresponding to the vTPM service component is / dev / tpm0. Based on the path of the device file, the VM invokes the write function of the system to perform a write operation on the device file to write the first request information described above. Since the vTPM driver component is used to implement specific I / O operations, after the VM writes the first request information, the vTPM driver component is triggered to deliver the first request information to the vTPM proxy component.

[0092] Optionally, the manner in which the vTPM driver component delivers the first request information includes, but is not limited to, invoking an application programming interface (API) to deliver the first request information to the vTPM proxy component, or delivering the first request information to the vTPM proxy component based on inter-process communication. The inter-process communication includes, but is not limited to, communication based on a pipe, communication based on a message queue, communication based on shared memory, or communication based on a socket, etc. The embodiments of the present application do not limit the manner in which the vTPM driver component delivers the first request information.

[0093] At step 503, the vTPM proxy component adds the identifier of the VM in the first request information, thereby obtaining second request information.

[0094] After obtaining the first request information, the vTPM proxy component obtains the identifier of the VM based on the source of the first request information. Then, the vTPM proxy component adds the obtained identifier of the VM in the first request information to identify the source of the first request information. Optionally, the identifier of the VM is, for example, a universally unique identifier (UUID). The UUID is a 128-bit value calculated from current time, counter, and hardware identifier, etc.

[0095] Optionally, one representation of the second request information is {VM UUID, TPM CMD ID, Parameters}.

[0096] The vTPM proxy component obtains the identifier of the VM in multiple ways.

[0097] In a case where one vTPM proxy component corresponds to one VM, i.e., the vTPM proxy component establishes connection with one vTPM driver component, the vTPM proxy component obtains the identification of the VM from the storage space storing the identification of the VM. After the Virtual Machine Monitor (VMM) creates the VM, the VMM allocates a unique identification to the VM as the identification of the VM, and delivers the identification of the VM to the vTPM proxy component. The VMM is also referred to as hypervisor. The vTPM proxy component stores the obtained identification of the VM in a specific storage space, and the specific storage space only stores the identification of one VM. Since the vTPM proxy component only corresponds to one VM, after obtaining the first request information, the vTPM proxy component can obtain the identification of the VM from the specific storage space. The identification of the VM can be used to identify the source of the first request information.

[0098] In a case where one vTPM proxy component corresponds to multiple VMs, i.e., the vTPM proxy component establishes connection with multiple vTPM driver components, the vTPM proxy component obtains the identification of the VM based on the connection between the vTPM proxy component and the vTPM driver component. After the VMM allocates an identification to a newly created VM, and delivers the identification allocated to the newly created VM to the vTPM component, the vTPM proxy component establishes connection with the vTPM driver component corresponding to the newly created VM, and the vTPM proxy component obtains the identification of the connection between the vTPM proxy component and the vTPM driver component. In addition to saving the obtained identification of the VM, the vTPM proxy component also saves the mapping relationship between the identification of the VM and the identification of the connection. In this way, after the vTPM proxy component obtains the first request information, the vTPM proxy component determines the identification of the connection (i.e., the identification of the connection between the vTPM proxy component and the vTPM driver component) according to the connection through which the first request information is delivered. The connection through which the first request information is delivered refers to the connection between the vTPM driver component and the vTPM proxy component, and the connection is used to deliver the first request information. The vTPM proxy component further determines the identification of the VM according to the identification of the connection and the mapping relationship, so as to obtain the identification of the VM corresponding to the first request information.

[0099] In step 504, the vTPM proxy component delivers second request information to the TrustZone Driver component, and the destination of the second request information is the vTPM service component.

[0100] Since the vTPM agent component is located in the rich execution environment and the vTPM service component is located in the trusted execution environment, the vTPM agent component cannot directly deliver the second request information to the vTPM service component, and therefore the vTPM agent component implements information delivery between the vTPM agent component and the vTPM service component through the TrustZone Driver component. Specifically, the vTPM agent component delivers the second request information to the TrustZone Driver component, and the TrustZone Driver component delivers the second request information to the vTPM service component. Optionally, the vTPM agent component delivers the second request information to the TrustZone Driver component by calling a TEEC_InvokeCommand function.

[0101] At step 505, the TrustZone Driver component delivers the second request information to the vTPM service component.

[0102] After obtaining the second request information, the TrustZone Driver component parses the second request information and re-integrates the second request information, so that the integrated second request information is in a format recognizable by the vTPM service component. The TrustZone Driver component loads the integrated second request information into a shared memory and triggers a Secure Monitor Call (SMC) to enter a monitor mode. After the TrustZone Driver component enters the monitor mode, the TrustZone Driver component delivers an instruction to the vTPM service component, so that the vTPM service component can obtain the second request information in the shared memory based on the instruction, thereby achieving delivery of the second request information.

[0103] At step 506, the vTPM service component processes the second request information based on the data in the first storage space, thereby obtaining target data.

[0104] In this embodiment, the vTPM service component allocates an independent storage space for each VM, and different storage spaces do not overlap. The vTPM service component can uniquely determine the storage space corresponding to the VM identifier based on the obtained VM identifier. For example, the vTPM service component allocates a first storage space for the above-mentioned VM and a second storage space for another VM. Therefore, based on the VM identifier included in the second request information, the vTPM service component can determine the first storage space corresponding to the VM identifier. The first storage space is located in the trusted execution environment, and the first storage space is used to store TPM data of the VM. In this way, the vTPM service component processes the second request information based on the data in the first storage space.

[0105] Optionally, after obtaining the second request information, the vTPM service component implements processing of the second request information by invoking a TA_InvokeCommandEntryPoint function. Specifically, the vTPM service component invokes the TA_InvokeCommandEntryPoint function to parse the second request information, and obtains the identification of the VM and the TPM command byte stream in the second request information. Then, the vTPM service component searches for the storage space corresponding to the identification of the VM, determines the first storage space, and processes the TPM command byte stream based on the data in the first storage space.

[0106] In one possible example, the TPM command byte stream includes a first command identification, and the first command identification is used to indicate execution of a key generation operation. Based on the first command identification, the vTPM service component obtains a root key in the first storage space, and generates a key based on the root key. After generating the key, the vTPM service component stores the key in the first storage space, and generates a key handle corresponding to the key, thereby obtaining the target data. The key handle is an identifier used to identify the key.

[0107] In another possible example, the TPM command byte stream includes a second command identification, a first key handle, and to-be-encrypted data, and the second command identification is used to indicate execution of an RSA encryption operation. Based on the first key handle in the TPM command byte stream, the vTPM service component searches for the key corresponding to the first key handle in the first storage space. Finally, the vTPM service component performs encryption processing on the to-be-encrypted data based on the second command identification in the TPM command byte stream and the key obtained from the first storage space, thereby obtaining the target data.

[0108] In yet another possible example, the TPM command byte stream includes a third command identification, a second key handle, and to-be-decrypted data, and the third command identification is used to indicate execution of an RSA decryption operation. Based on the second key handle in the TPM command byte stream, the vTPM service component searches for the key corresponding to the second key handle in the first storage space. Finally, the vTPM service component performs decryption processing on the to-be-decrypted data based on the third command identification in the TPM command byte stream and the key obtained from the first storage space, thereby obtaining the target data.

[0109] Optionally, the data obtained by the vTPM service component after performing the TPM operation based on the second request information needs to be returned to the VM which transmits the second request information, i.e. the VM represented by the identification of the VM included in the second request information. Therefore, after performing the TPM operation (e.g. the key generation operation, the RSA encryption operation or the RSA decryption operation mentioned above) and obtaining the corresponding TPM data, the vTPM service component further adds the identification of the VM included in the second request information into the obtained TPM data to obtain target data which further includes the identification of the VM included in the second request information. In the transmission of the target data, the subsequent other components can determine to transmit the target data to the VM represented by the identification of the VM included in the target data according to the identification of the VM included in the target data.

[0110] In step 507, the vTPM service component transmits the target data to the TrustZone Driver component, and the target data is destined for the vTPM agent component.

[0111] After obtaining the target data, the vTPM service component loads the target data into the shared memory and transmits an instruction to the TrustZone Driver component. In this way, the TrustZone Driver component can obtain the target data in the shared memory based on the obtained instruction, thereby realizing the transmission of the target data.

[0112] In step 508, the TrustZone Driver component transmits the target data to the vTPM agent component.

[0113] Optionally, after obtaining the target data, the TrustZone Driver component transmits the target data to the vTPM agent component by calling the TEEC_InvokeCommand function.

[0114] In step 509, the vTPM agent component transmits the target data to the vTPM driver component.

[0115] Optionally, the vTPM agent component transmits the target data to the vTPM agent component by calling the TEEC_InvokeCommand function, or the vTPM agent component transmits the target data to the vTPM agent component by sending a response message carrying the target data.

[0116] Optionally, in the case that the vTPM agent component is connected with multiple vTPM drive components, the vTPM agent component acquires the identification of the VM included in the target data, and determines how to deliver the target data according to the acquired identification of the VM. Since the vTPM agent component stores the mapping relationship between the identification of the VM and the identification of the connection (i.e. the identification of the connection between the vTPM agent component and the vTPM drive component), the vTPM agent component can determine the identification of the connection corresponding to the identification of the VM based on the mapping relationship. Based on the determined identification of the connection, the vTPM agent component can determine the connection with the vTPM drive component. The vTPM agent component delivers the target data through the determined connection with the vTPM drive component, thereby achieving delivery of the target data to the vTPM drive component corresponding to the identification of the VM.

[0117] At step 510, the vTPM drive component delivers the target data to the VM.

[0118] After the vTPM drive component acquires the target data, the APP in the VM can read the target data returned by the vTPM drive component by calling a read function, thereby achieving delivery of the target data.

[0119] As can be seen from the above embodiments, the vTPM service component running in the trusted execution environment allocates different storage spaces for different VMs, and the different storage spaces do not overlap with each other. When the vTPM service component acquires the request information for requesting execution of a TPM operation, the vTPM service component determines the corresponding storage space according to the identification of the VM in the request information, and provides TPM service for the VM represented by the identification of the VM in the request information based on the data in the storage space corresponding to the identification of the VM, so that the vTPM service component can provide TPM service for different VMs based on different storage spaces. Thus, on the basis of providing TPM service for multiple VMs, the security of data is ensured.

[0120] The above describes the process in which the vTPM service component determines the corresponding storage space based on the identification of the VM and executes a TPM operation, and the following describes the process in which the vTPM service component allocates a storage space for a VM.

[0121] The ways of triggering the vTPM service component to allocate a storage space for a VM include but are not limited to the following two ways.

[0122] In the first way, after the VM is created, the vTPM agent component corresponding to the VM delivers request information for requesting establishment of a session to the vTPM service component, to trigger the vTPM service component to allocate a storage space for the VM. That is, the request information for requesting establishment of a session is used to trigger the vTPM service component to allocate a storage space for the VM.

[0123] In the second way, the VM first transmits, after the VM is created, request information for requesting execution of a TPM operation to the vTPM service component, and the request information for requesting execution of the TPM operation can trigger the vTPM service component to allocate storage space for the VM. That is, the vTPM service component is triggered to allocate storage space for the VM by the first transmitted request information for requesting execution of the TPM operation.

[0124] For the convenience of understanding, the above two ways will be introduced below in combination with the accompanying drawings.

[0125] Figure 6 A flowchart of a method for allocating storage space by a vTPM service component according to an embodiment of the present application is shown in FIG. 6. In the method, the vTPM service component is initialized in step 601, and the vTPM proxy component is initialized in step 602. Then, the vTPM service component receives request information for requesting execution of a TPM operation in step 603, and the vTPM service component allocates storage space for the VM in step 604. Finally, the vTPM service component transmits the allocated storage space to the vTPM proxy component in step 605, and the vTPM proxy component stores the allocated storage space in step 606. Figure 6 The method shown in FIG. 6 corresponds to the first way described above. As shown in FIG. 6, the process of allocating storage space by the vTPM service component includes the following steps 601 to 606. Figure 6 The process of allocating storage space by the vTPM service component includes the following steps 601 to 606.

[0126] In step 601, the vTPM service component is initialized.

[0127] In the embodiment, the vTPM service component is a TA running in the trusted execution environment. In the startup phase of the vTPM service component, the integrity and authenticity of the TA file itself are ensured by a secure startup method. Specifically, the TA file of the vTPM service component is signed by a certificate authority (CA) system of a software publisher. In the startup phase of the physical server, the file signature of the vTPM service component is verified by a basic input output system (BIOS) to ensure the authenticity and integrity of the vTPM service component. After the file signature verification of the vTPM service component is passed, the vTPM service component is loaded into the secure memory of the trusted execution environment to be initialized and run, so as to realize the initialization of the vTPM service component.

[0128] In step 602, the vTPM proxy component is initialized.

[0129] In the case where one vTPM proxy component corresponds to one VM, since the vTPM proxy component belongs to the VMM, the VMM will start the vTPM proxy component corresponding to the VM when starting the VM. That is, the vTPM proxy component is started together with the VM. After the vTPM proxy component is started, the vTPM proxy component obtains and saves the identifier of the currently started VM corresponding to the vTPM proxy component, so as to complete the initialization process.

[0130] In the case that one vTPM agent component corresponds to multiple VMs, the VMM starts the vTPM agent component when starting the first VM. After the vTPM agent component is started, the vTPM agent component obtains and saves the identification of the first started VM, thereby completing the initialization process. Optionally, when the VMM subsequently starts other VMs, the vTPM agent component continues to obtain and save the identification of the subsequently started VMs.

[0131] Step 603, the vTPM driver component establishes connection with the vTPM agent component.

[0132] After the VM is started, the VM loads the vTPM driver component. The vTPM driver component establishes connection with the vTPM agent component. In the case that one vTPM agent component corresponds to multiple vTPM driver components, after one vTPM driver component establishes connection with the vTPM agent component, the vTPM agent component obtains the identification of the connection and establishes the mapping relationship between the identification of the connection and the identification of the VM where the vTPM driver component is located. For example, after the first VM is started, the vTPM driver component loaded by the first VM establishes connection with the vTPM agent component. Assume that the first connection identification is used to identify the connection established by the vTPM driver component loaded by the first VM and the vTPM agent component. The vTPM agent component obtains the first connection identification and establishes the mapping relationship between the first connection identification and the first VM.

[0133] Step 604, the vTPM agent component delivers session establishment request information to the TrustZone Driver component, and the destination of the session establishment request information is the vTPM service component.

[0134] Since the VM is started for the first time, the session between the VM agent component and the vTPM service component has not been established. Therefore, the vTPM agent component delivers session establishment request information to the TrustZone Driver component, and the session establishment request information includes the identification of the VM. The destination of the session establishment request information is the vTPM service component, and the session establishment request information is used to request to establish a session. After the session between the VM agent component and the vTPM service component is established, the session between the VM agent component and the vTPM service component is used to transmit various information and / or target data between the vTPM service component and the vTPM agent component. The target data is the data obtained after the vTPM service component performs TPM operation.

[0135] Optionally, the vTPM agent component initializes a context between the VM and the executable environment by calling an initialization context (TEEC_InitializeContext) function to obtain a corresponding context (TEEC_context). Then, the vTPM agent component calls an open session (TEEC_OpenSession) function, and specifies the identity of the VM when calling the TEEC_OpenSession function, so as to implement the delivery of the session establishment request information to the TrustZone Driver component.

[0136] In step 605, the TrustZone Driver component delivers the session establishment request information to the vTPM service component.

[0137] The TrustZone Driver component parses the obtained session establishment request information, and re-integrates the session establishment request information to adjust the format of the session establishment request information. The TrustZone Driver component loads the integrated session establishment request information into the shared memory, and triggers the SMC to enter the monitor mode. After entering the monitor mode, the TrustZone Driver component delivers an instruction to the vTPM service component, so that the vTPM service component can obtain the session establishment request information in the shared memory based on the instruction, thereby implementing the delivery of the session establishment request information.

[0138] In step 606, the vTPM service component establishes a session based on the session establishment request information, and allocates storage space for the VM.

[0139] After obtaining the session establishment request information, the vTPM service component calls a session open interface (TA_OpenSessionEntryPoint) function. By executing the TA_OpenSessionEntryPoint function, the vTPM service component parses the session establishment request information, and obtains the identity of the VM included in the session establishment request information. Based on the identity of the VM included in the session establishment request information, the vTPM service component establishes a session, and obtains a session identity corresponding to the identity of the VM included in the session establishment request information. The vTPM service component delivers the session identity to the TrustZone Driver component, and the destination of the session identity is the vTPM agent component, so that the vTPM agent component can obtain the session identity corresponding to the identity of the VM included in the session establishment request information.

[0140] Since the vTPM agent component transmits the session establishment request information to the vTPM service component only when the VM is started for the first time, the vTPM service component does not allocate a storage space for the identification of the VM included in the session establishment request information before the vTPM service component obtains the session establishment request information. Based on this, after obtaining the session establishment request information, the vTPM service component allocates a storage space for the identification of the VM in the trusted execution environment based on the identification of the VM included in the session establishment request information. After allocating the storage space, the vTPM service component marks the allocated storage space based on the identification of the VM included in the session establishment request information.

[0141] After allocating the storage space for the identification of the VM included in the session establishment request information, to ensure that the vTPM agent component can subsequently perform a TPM operation based on the data in the allocated storage space, the vTPM service component performs a TPM initialization operation on the data in the storage space. By performing the TPM initialization operation, the vTPM service component updates the data in the allocated storage space to TPM initialization data.

[0142] Illustratively, the vTPM service component performing the TPM initialization operation on the data in the storage space includes: the vTPM service component dividing the storage space to obtain a plurality of storage blocks, and the plurality of storage blocks being respectively used to store platform seed, endorsement seed, storage seed, key, or PCR, and the like. The vTPM service component updates the data in the storage blocks to obtain the TPM initialization data. For example, the vTPM service component updates the data in the storage space storing the PCR, thereby giving the PCR an initialized value, and the initialized value is the initial value of the PCR.

[0143] Optionally, if the VM is started again after being shut down, the non-volatile memory in the trusted execution environment can still have a storage space corresponding to the identification of the VM. Therefore, before allocating the storage space for the identification of the VM, the vTPM service component checks whether the non-volatile memory has a storage space corresponding to the identification of the VM.

[0144] If the non-volatile memory has the storage space corresponding to the VM's identity included in the session establishment request information, the vTPM service component allocates storage space for the VM's identity in the volatile memory and copies the data in the storage space corresponding to the VM's identity in the non-volatile memory to the allocated storage space. That is, after the vTPM service component allocates storage space for the VM's identity in the volatile memory, it does not need to perform the TPM initialization operation on the data in the storage space, but copies the data in the storage space corresponding to the VM's identity in the non-volatile memory to the allocated storage space. In this way, in the scenario of VM restart, the TPM data used by the VM before restart can be recovered in the volatile memory, ensuring the normal operation of the VM.

[0145] If the non-volatile memory does not have the storage space corresponding to the VM's identity included in the session establishment request information, it is considered that the VM corresponding to the VM's identity included in the session establishment request information is created for the first time or the TPM data of the VM corresponding to the VM's identity included in the session establishment request information has been discarded, the vTPM service component allocates storage space for the VM's identity in the volatile memory and performs the TPM initialization operation on the data in the allocated storage space.

[0146] Figure 7 Another flowchart of a method for allocating storage space by a vTPM service component is provided in the embodiments of the present application. In the method, Figure 7 The method shown corresponds to the second mode described above. As shown in Figure 7 The process of allocating storage space by the vTPM service component includes the following steps.

[0147] Step 701, the vTPM service component is initialized.

[0148] Step 702, the vTPM agent component is initialized.

[0149] Step 703, the vTPM agent component establishes a connection with the vTPM driver component.

[0150] In the embodiments, steps 701-703 are similar to steps 601-603 described above, and details are referred to steps 601-603 described above, which will not be repeated here.

[0151] Step 704, the VM transmits third request information to the vTPM driver component, and the destination of the third request information is the vTPM service component.

[0152] In the embodiments, the third request information is used to request to perform a TPM operation, and the third request information is the first request information transmitted by the VM to the vTPM driver component after startup.

[0153] Step 705, the vTPM driver component delivers third request information to the vTPM agent component.

[0154] Step 706, the vTPM agent component adds the identification of the VM in the third request information, thereby obtaining fourth request information.

[0155] Step 707, the vTPM agent component delivers the fourth request information to the TrustZone Driver component, and the destination of the fourth request information is the vTPM service component.

[0156] Step 708, the TrustZone Driver component delivers the fourth request information to the vTPM service component.

[0157] In this embodiment, steps 705-708 are similar to steps 502-505 described above, and details are referred to steps 502-505 described above, which will not be described here.

[0158] Step 709, the vTPM service component allocates storage space for the VM according to the fourth request information.

[0159] After obtaining the fourth request information, the vTPM service component parses the fourth request information and obtains the identification of the VM included in the fourth request information. The vTPM service component looks up the storage space corresponding to the identification of the VM in the volatile memory of the trusted execution environment based on the identification of the VM included in the fourth request information. Since the fourth request information is the request information delivered by the vTPM agent component for the first time after the VM is started, the storage space corresponding to the identification of the VM included in the fourth request information does not exist in the volatile memory of the trusted execution environment.

[0160] When the vTPM service component cannot find the storage space corresponding to the identification of the VM included in the fourth request information in the volatile memory, the vTPM service component continues to look up the storage space corresponding to the identification of the VM included in the fourth request information in the non-volatile memory. If the non-volatile memory has the storage space corresponding to the identification of the VM included in the fourth request information, the vTPM service component allocates storage space for the identification of the VM included in the fourth request information in the volatile memory, and copies the data in the storage space corresponding to the identification of the VM in the non-volatile memory to the allocated storage space. If the non-volatile memory does not have the storage space corresponding to the identification of the VM included in the fourth request information, the vTPM service component allocates storage space for the identification of the VM included in the fourth request information in the volatile memory, and performs TPM initialization operation on the data in the allocated storage space.

[0161] In this embodiment, the vTPM service component looks up the corresponding storage space based on the identification of the VM in the TPM operation request, and determines whether to allocate the storage space for the identification of the VM in the TPM operation request according to the lookup result, so as to allocate the corresponding storage space for the identification of the VM. Since the vTPM service component can allocate the storage space based on the TPM operation request, the process of establishing a session connection in advance is omitted, and processing resources are saved.

[0162] The above describes the process in which the vTPM service component allocates the storage space for the identification of the VM when the VM starts. The following describes the process in which the vTPM service component recovers the storage space allocated for the identification of the VM when the VM is closed.

[0163] Figure 8 A flowchart of a process in which the vTPM service component closes a session is provided in this embodiment. As shown in the figure, the process includes the following steps. Figure 8

[0164] In step 801, the vTPM driver component delivers fifth request information to the vTPM agent component, and the destination of the fifth request information is the vTPM service component.

[0165] In the case where the VM needs to be closed, the VM triggers the corresponding vTPM driver component to deliver fifth request information to the vTPM agent component, and the fifth request information is used to request to close the session with the vTPM service component.

[0166] In step 802, the vTPM agent component adds the identification of the VM in the fifth request information, so as to obtain sixth request information.

[0167] Similarly, after obtaining the fifth request information, the vTPM agent component obtains the identification of the VM based on the source of the fifth request information, and adds the obtained identification of the VM in the fifth request information to identify the source of the fifth request information. The process in which the vTPM agent component obtains the identification of the VM is similar to step 503, and details are referred to the description of step 503, which will not be repeated here.

[0168] In step 803, the vTPM agent component delivers the sixth request information to the TrustZone Driver component, and the destination of the sixth request information is the vTPM service component.

[0169] ​Optionally, the vTPM agent component delivers the sixth request information to the TrustZone Driver component by calling a close session (TEEC_CloseSession) function. Furthermore, after the session between the VM and the vTPM service component is closed, the vTPM agent component terminates the context between the VM and the executable environment by calling a finalize context (TEEC_FinalizeContext) function to close the connection between the VM and the executable environment.

[0170] At step 804, the TrustZone Driver component delivers the sixth request information to the vTPM service component.

[0171] In this embodiment, step 804 is similar to step 505 described above. For details, please refer to the description of step 505 above, which will not be repeated here.

[0172] At step 805, the vTPM service component closes the session based on the sixth request information.

[0173] After obtaining the sixth request information, the vTPM service component obtains the identifier of the VM in the sixth request information to determine the storage space corresponding to the identifier of the VM. Optionally, after obtaining the sixth request information, the vTPM service component triggers the calling of a session closing interface (TA_CloseSessionEntryPoint) function. By executing the TA_CloseSessionEntryPoint function, the vTPM service component parses the sixth request information and obtains the identifier of the VM included in the sixth request information.

[0174] Based on the identifier of the VM included in the sixth request information, the vTPM service component looks up the storage space corresponding to the identifier of the VM included in the sixth request information in the volatile memory to obtain the storage space corresponding to the identifier of the VM included in the sixth request information in the volatile memory. Then, the vTPM service component allocates storage space for the identifier of the VM included in the sixth request information in the non-volatile memory and copies the data in the storage space found in the volatile memory to the storage space allocated in the non-volatile memory. After the data in the storage space in the volatile memory is copied, the vTPM service component discards the data in the storage space in the volatile memory, thereby realizing the recycling of the storage space in the volatile memory and improving the utilization rate of the storage space in the volatile memory.

[0175] By copying the TPM data corresponding to the identifier of the VM in the volatile memory to the non-volatile memory when the VM is closed, the TPM data corresponding to the VM can be restored when the VM is restarted, thereby ensuring the normal operation of the VM.

[0176] Figure 9 This is a schematic diagram of the structure of a computer system provided in an embodiment of this application. Figure 9 As shown, a Trusted Execution Environment (TEE) and an Enriched Execution Environment (EME) run on the computer system. The TEE runs a vTPM service component, and the EME runs a first Virtual Machine (VM) and a vTPM agent component. The vTPM agent component obtains a first request from the first VM, acquires the VM's identifier, adds the VM's identifier to the first request, obtains a second request, and then transmits the second request to the TrustZone Driver component. The first request requests the vTPM service component to perform TPM operations, and the second request includes the VM's identifier; the destination of the second request is the vTPM service component. The vTPM service component obtains the second request through the TrustZone Driver component and processes it based on data in a first storage space. The first storage space is the storage space in the TEE corresponding to the VM's identifier, used to store the VM's TPM data.

[0177] Optionally, the trusted execution environment also includes a second storage space for storing the TPM data of the second VM, and the first and second storage spaces are non-overlapping storage spaces.

[0178] Optionally, the second request information also includes a command identifier and parameters to be processed. The command identifier indicates the type of TPM operation to be performed. The vTPM service component is also used to process the parameters to be processed based on the identifier of the second VM and the data in the first storage space to obtain the target data, and to pass the target data to the TrustZone Driver. The destination of the target data is the vTPM agent component. The vTPM agent component is also used to obtain the target data and pass the target data to the first VM.

[0179] Optionally, the parameters to be processed include a key handle and the data to be encrypted. The vTPM service component is also used to invoke a command invocation interface function to obtain the command identifier and parameters to be processed from the second request information. The vTPM service component is also used to encrypt the data to be encrypted using a key determined by vTPM based on the command identifier and the key handle.

[0180] Optionally, the parameters to be processed include a key handle and the data to be decrypted. The vTPM service component is also used to invoke the command invocation interface function to obtain the command identifier and parameters to be processed from the second request information. The vTPM service component is also used to decrypt the data to be decrypted using a key determined by vTPM based on the command identifier and the key handle.

[0181] Optionally, the vTPM agent component is further configured to obtain third request information from the second VM, the third request information being used to request to perform a TPM operation, obtain the identity of the second VM, add the identity of the second VM in the third request information to obtain fourth request information, the fourth request information comprising the identity of the second VM, and transmit the fourth request information to the TrustZone Driver component, the fourth request information being destined for the vTPM service component. The vTPM service component is configured to obtain the fourth request information from the TrustZone Driver component, and process the fourth request information based on data in a second storage space corresponding to the identity of the second VM in the trusted execution environment, the second storage space being used to store TPM data of the second VM.

[0182] Optionally, if the storage space corresponding to the identity of the first VM does not exist in the trusted execution environment, the vTPM service component is further configured to allocate a storage space for the identity of the first VM in the trusted execution environment, and perform a TPM initialization operation on data in the allocated storage space, so that the data in the allocated storage space is updated to TPM initialization data, and the allocated storage space is used as the first storage space.

[0183] Optionally, the vTPM service component is further configured to search for a storage space corresponding to the identity of the first VM in a volatile memory of the computer, and allocate a storage space in the volatile memory if the storage space corresponding to the identity of the first VM does not exist in the volatile memory.

[0184] Optionally, the second request information is transmitted in a first session, the first session being used to transmit information used to request to perform a TPM operation and / or target data between the vTPM service component and the vTPM agent component, the target data being data obtained after performing the TPM operation. The vTPM agent component is further configured to obtain the identity of the first VM when the first VM is started, generate fifth request information, the fifth request information comprising the identity of the first VM, and transmit the fifth request information to the TrustZone Driver component, the fifth request information being used to request to establish the first session, the fifth request information being destined for the vTPM service component. The vTPM service component is further configured to obtain the fifth request information from the TrustZone Driver component, and allocate a storage space in a volatile memory of the computer, the allocated storage space being used as the first storage space.

[0185] Optionally, the first session is a session corresponding to the first VM identifier, and the vTPM service component is further configured to invoke a session open interface function according to the first VM identifier included in the fifth request information, to establish the first session corresponding to the first VM identifier and obtain an identifier of the first session; and the vTPM service component is further configured to transmit the identifier of the first session to the TrustZone Driver component, and the destination of the identifier of the first session is the vTPM agent component.

[0186] Optionally, the vTPM service component is further configured to search for a storage space corresponding to the first VM identifier in a non-volatile memory of the computer. If the storage space corresponding to the first VM identifier exists in the non-volatile memory, a storage space is allocated in the volatile memory, and data in the storage space corresponding to the first VM identifier in the non-volatile memory is copied to the allocated storage space. If the storage space corresponding to the first VM identifier does not exist in the non-volatile memory, a storage space is allocated in the volatile memory.

[0187] Optionally, the vTPM service component is further configured to mark the allocated storage space based on the first VM identifier.

[0188] Optionally, the vTPM agent component is further configured to obtain sixth request information from the first VM, the sixth request information being used to request to close the first session, obtain the first VM identifier, add the first VM identifier in the sixth request information, so as to obtain seventh request information, the seventh request information including the first VM identifier, and transmit the seventh request information to the TrustZone Driver component, the destination of the seventh request information being the vTPM service component; and the vTPM service component is further configured to obtain the sixth request information, determine the first storage space according to the first VM identifier included in the sixth request information, and copy data of the first storage space to a third storage space, the third storage space being located in the non-volatile memory.

[0189] Optionally, the second request information is transmitted by the TrustZone Driver component to the vTPM service component in a monitoring mode, and the TrustZone Driver component runs in a rich execution environment of the computer.

[0190] It should be understood that each component in the computer system respectively implements various steps and methods implemented by the vTPM driver component, the vTPM agent component, the TrustZone driver component and the vTPM service component in the method embodiments, and specific details can be referred to the method embodiments described above. For the sake of brevity, they will not be described here.

[0191] Figure 10A structural schematic diagram of a computer is provided for the embodiments of the present application. The computer 1000 is provided with the computer system described above. The computer 1000 is implemented by a general bus architecture.

[0192] The computer 1000 comprises at least one processor 1001, a communication bus 1002, a memory 1003, and at least one communication interface 1004.

[0193] Optionally, the processor 1001 is a general CPU, NP, microprocessor, or one or more integrated circuits for implementing the scheme of the present application, such as an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The above-mentioned PLD is a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0194] The communication bus 1002 is used to transmit information between the above-mentioned components. The communication bus 1002 is divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0195] Alternatively, the memory 1003 is a read-only memory (ROM) or another type of static storage device that can store static information and instructions usable by the processor 1001. Alternatively, the memory 1003 is a random access memory (RAM), or another type of dynamic storage device that can store information and instructions for use by the processor 1001. Alternatively, the memory 1003 is an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or another optical disk storage, a magnetic disk storage or other magnetic storage devices, or any other medium capable of storing instructions or data that can be accessed by a computer, but not limited to. The memory 1003 can be independent, and connected to the processor 1001 through the communication bus 1002. Alternatively, the memory 1003 and the processor 1001 are integrated together.

[0196] The communication interface 1004 uses any transceiver-like device for communicating with other devices or communication networks. The communication interface 1004 includes a wired communication interface. Alternatively, the communication interface 1004 also includes a wireless communication interface. The wired communication interface is, for example, an Ethernet interface. The Ethernet interface is an optical interface, an electrical interface or a combination thereof. The wireless communication interface is a wireless local area networks (WLAN) interface, a cellular network communication interface or a combination thereof.

[0197] In a specific implementation, as an example, the processor 1001 includes one or more CPUs, such as the CPU0 and the CPU1 shown in FIG. 1. Figure 10 In a specific implementation, as an example, the processor 1001 includes one or more CPUs, such as the CPU0 and the CPU1 shown in FIG. 1.

[0198] In a specific implementation, as an example, the computer 1000 includes multiple processors, such as the processor 1001 and the processor 1005 shown in FIG. 1. Figure 10 In a specific implementation, as an example, the computer 1000 includes multiple processors, such as the processor 1001 and the processor 1005 shown in FIG. 1.

[0199] In some embodiments, the memory 1003 is configured to store program codes 1010 for performing the methods of the present application, and the processor 1001 is configured to execute the program codes 1010 stored in the memory 1003. That is, the computer 1000 implements the above-described method embodiments through the processor 1001 and the program codes 1010 in the memory 1003.

[0200] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0201] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented by other manners. For example, the above-described device embodiments are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0202] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the present embodiment.

[0203] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The above integrated unit can be realized in the form of hardware or in the form of software functional unit.

[0204] The integrated unit, if in the form of a software function unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on such an understanding, the technical solutions of the present application, essentially or in other words, the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk.

Claims

1. A method for implementing a virtual trusted platform module (vTPM), the method comprising: The method comprises: a vTPM service component obtains first request information from a vTPM agent component, the first request information comprising an identifier of a first virtual machine (VM), and the first request information being used to request execution of a TPM operation, wherein the vTPM service component runs in a trusted execution environment of a computer, and the first VM and the vTPM agent component run in a rich execution environment of the computer; the vTPM service component processes the first request information based on data in a first storage space, wherein the first storage space is a storage space corresponding to the identifier of the first VM in the trusted execution environment, and the first storage space is used to store TPM data of the first VM.

2. The method of claim 1, wherein, The trusted execution environment further comprises a second storage space, wherein the second storage space is used to store TPM data of a second VM in the computer, and the first storage space and the second storage space are mutually exclusive storage spaces.

3. The method of claim 1, wherein, The first request information further comprises a command identifier and to-be-processed parameters, and the command identifier is used to indicate a type of the TPM operation to be executed. The vTPM service component processes the first request information based on data in the first storage space, comprising: the vTPM service component processes the to-be-processed parameters based on the command identifier and the data in the first storage space to obtain target data; the vTPM service component transmits the target data to a TrustZone driver component, and the target data is destined for the vTPM agent component.

4. The method of claim 3, wherein, The to-be-processed parameters comprise a key handle and to-be-encrypted data. The vTPM service component processes the to-be-processed parameters based on the command identifier and the data in the first storage space to obtain target data, comprising: the vTPM service component calls a command invocation interface function to obtain the command identifier and the to-be-processed parameters in the first request information; the vTPM service component encrypts the to-be-encrypted data according to the command identifier, and the key is determined by the vTPM according to the key handle.

5. The method of claim 3, wherein, The to-be-processed parameters comprise a key handle and to-be-decrypted data. The vTPM service component processes the to-be-processed parameters based on the command identifier and the data in the first storage space to obtain target data, comprising: the vTPM service component calls a command invocation interface function to obtain the command identifier and the to-be-processed parameters in the first request information; the vTPM service component decrypts the to-be-decrypted data according to the command identifier, and the key is determined by the vTPM according to the key handle.

6. The method of claim 3-5, wherein, Before the vTPM service component processes the first request information based on the data in the first storage space, the method further comprises: if the trusted execution environment does not comprise a storage space corresponding to the identifier of the first VM, the vTPM service component allocates a storage space for the identifier of the first VM in the trusted execution environment; The vTPM service component performs a TPM initialization operation on data in the allocated storage space, so that the data in the allocated storage space is updated to TPM initialization data, and the allocated storage space is used as the first storage space.

7. The method of claim 6, wherein, The vTPM service component allocates storage space for the identifier of the first VM in the computer's volatile memory, including: The vTPM service component looks up storage space corresponding to the identifier of the first VM in the computer's volatile memory; If there is no storage space corresponding to the identifier of the first VM in the volatile memory, the vTPM service component allocates storage space in the volatile memory.

8. The method of claim 7, wherein, The first request information is transmitted in a first session, and the first session is used to transmit the first request information and / or the target data between the vTPM service component and the vTPM agent component; The method further includes: The vTPM service component obtains second request information from the vTPM agent component, the second request information including an identifier of a first VM, and the second request information being used to request establishment of the first session; The vTPM service component allocates storage space in the computer's volatile memory according to the second request information, and uses the allocated storage space as the first storage space.

9. The method of claim 8, wherein, The first session is a session corresponding to the identifier of the first VM, and the method further includes: The vTPM service component invokes a session opening interface function according to the identifier of the first VM included in the second request information, to establish the first session and obtain an identifier of the first session; The vTPM service component passes the identifier of the first session to a TrustZone Driver component in a rich execution environment of the computer, and the destination of the identifier of the first session is the vTPM agent component.

10. The method of claim 7, 8 or 9, wherein, The vTPM service component allocates storage space in the volatile memory, including: The vTPM service component looks up storage space corresponding to the identifier of the first VM in the computer's non-volatile memory; If there is storage space corresponding to the identifier of the first VM in the non-volatile memory, the vTPM service component allocates storage space in the volatile memory, and copies data in the storage space corresponding to the identifier of the first VM in the non-volatile memory to the allocated storage space; If there is no storage space corresponding to the identifier of the first VM in the non-volatile memory, the vTPM service component allocates storage space in the volatile memory.

11. The method of claim 7-9, wherein, After the vTPM service component allocates storage space in the volatile memory, the method further includes: The vTPM service component marks the allocated storage space based on the identifier of the first VM.

12. The method of claim 8-9, wherein, The method further includes: The vTPM service component obtains third request information, the third request information being transmitted in the first session, the third request information including an identification of the first VM, and the third request information being used to request to close the first session; The vTPM service component determines the first storage space according to the identification of the first VM included in the third request information; The vTPM service component copies data of the first storage space to a third storage space, the third storage space being located in a non-volatile memory.

13. The method of claim 1, 2, 4, or 5, wherein, The first request information is delivered by a TrustZone Driver component in a monitoring mode to the vTPM service component, the TrustZone Driver component running in a rich execution environment of the computer.

14. A method of implementing a vTPM, the method comprising: The method comprises: The vTPM agent component obtains first request information from a first VM, the first request information being used to request a vTPM service component to perform a TPM operation, wherein the first VM and the vTPM agent component run in a rich execution environment of a computer, and the vTPM service component runs in a trusted execution environment of the computer; The vTPM agent component obtains an identification of the first VM; The vTPM agent component adds the identification of the first VM in the first request information, thereby obtaining second request information, the second request information including the identification of the first VM; The vTPM agent component delivers the second request information to a TrustZone Driver component running in a trusted execution environment of the computer, the second request information being destined for the vTPM service component.

15. The method of claim 14, wherein the vTPM is implemented by a virtual machine monitor (VMM) or a hypervisor. 15 The vTPM agent component adding the identification of the first VM in the first request information comprises: The vTPM agent component adds the identification of the first VM in the first request information by calling a command call function, thereby obtaining second request information.

16. The method of Claim 14 or 15, wherein, The method further comprises: The vTPM agent component obtains third request information from a second VM, the third request information being used to request to perform a TPM operation; The vTPM agent component obtains an identification of the second VM; The vTPM agent component adds the identification of the second VM in the third request information, thereby obtaining fourth request information, the fourth request information including the identification of the second VM; The vTPM agent component delivers the fourth request information to the TrustZone Driver component, the fourth request information being destined for the vTPM service component.

17. The method of Claim 14 or 15, wherein, The method further comprises: The vTPM agent component obtains target data from the vTPM service component through the TrustZone Driver component, the target data being data obtained by the vTPM service component after performing a TPM operation based on the second request information; The vTPM agent component delivers the target data to the first VM.

18. The method of Claim 14 or 15, wherein, The method further comprises: When the first VM starts, the vTPM agent component acquires the identity of the first VM; The vTPM agent component generates fifth request information, the fifth request information being used for requesting establishment of a session with the vTPM service component, the fifth request information including the identity of the first VM; The vTPM agent component delivers the fifth request information to the TrustZone Driver component, the fifth request information being destined for the vTPM service component.

19. The method of Claim 14 or 15, wherein, The method further includes: The vTPM agent component acquires sixth request information from the first VM, the sixth request information being used for requesting closure of the session with the vTPM service component; The vTPM agent component acquires the identity of the first VM; The vTPM agent component adds the identity of the first VM in the sixth request information, thereby obtaining seventh request information, the seventh request information including the identity of the first VM; The vTPM agent component delivers the seventh request information to the TrustZone Driver component, the seventh request information being destined for the vTPM service component.

20. An electronic device comprising a processor; the processor and a memory are coupled, the memory stores program instructions, when the program instructions stored in the memory are executed by the processor, the method of any one of claims 1-13 is implemented.

21. An electronic device comprising a processor; the processor and a memory are coupled, the memory stores program instructions, when the program instructions stored in the memory are executed by the processor, the method of any one of claims 14-19 is implemented.

22. A computer system, characterized in that A computer system runs a trusted execution environment and a rich execution environment, the trusted execution environment runs a vTPM service component, and the rich execution environment runs a first VM and a vTPM agent component; The vTPM agent component is configured to acquire first request information from the first VM, acquire the identity of the first VM, add the identity of the first VM in the first request information, obtain second request information, and deliver the second request information to a TrustZone Driver component, the first request information being used for requesting the vTPM service component to perform a TPM operation, the second request information including the identity of the first VM, and the second request information being destined for the vTPM service component; The vTPM service component is configured to acquire the second request information through the TrustZone Driver component, and process the second request information based on data in a first storage space, the first storage space being a storage space corresponding to the identity of the first VM in the trusted execution environment, and the first storage space being used for storing TPM data of the first VM.

23. The computer system of claim 22, wherein, The trusted execution environment further includes a second storage space, the second storage space being used for storing TPM data of a second VM, and the first storage space and the second storage space being mutually non-overlapping storage spaces.

24. The computer system of claim 22 or 23, wherein, The second request information further comprises a command identifier and a to-be-processed parameter, and the command identifier is used to indicate a type of a TPM operation to be executed. The vTPM service component is further configured to process the to-be-processed parameter based on the command identifier in the second request information and data in the first storage space, obtain target data, and deliver the target data to the TrustZone Driver, wherein the target data is destined for the vTPM agent component. The vTPM agent component is further configured to obtain the target data and deliver the target data to the first VM.

25. The computer system of claim 24, wherein, The to-be-processed parameter comprises a key handle and to-be-encrypted data. The vTPM service component is further configured to call a command calling interface function to obtain the command identifier and the to-be-processed parameter in the second request information. The vTPM service component is further configured to encrypt the to-be-encrypted data based on the command identifier and a key, wherein the key is determined by the vTPM based on the key handle.

26. The computer system of claim 24, wherein, The to-be-processed parameter comprises a key handle and to-be-decrypted data. The vTPM service component is further configured to call a command calling interface function to obtain the command identifier and the to-be-processed parameter in the second request information. The vTPM service component is further configured to decrypt the to-be-decrypted data based on the command identifier and a key, wherein the key is determined by the vTPM based on the key handle.

27. The computer system of any of claims 22, 23, 25, and 26, wherein, The vTPM agent component is further configured to obtain third request information from a second VM, the third request information being used to request execution of a TPM operation, obtain an identifier of the second VM, add the identifier of the second VM in the third request information to obtain fourth request information, the fourth request information comprising the identifier of the second VM, deliver the fourth request information to the TrustZone Driver component, and the fourth request information being destined for the vTPM service component. The vTPM service component is configured to obtain the fourth request information through the TrustZone Driver component, and process the fourth request information based on data in a second storage space, wherein the second storage space is a storage space corresponding to the identifier of the second VM.

28. The computer system of any of claims 22, 23, 25, and 26, wherein, If the storage space corresponding to the identifier of the first VM does not exist in the trusted execution environment, the vTPM service component is further configured to allocate a storage space for the identifier of the first VM in the trusted execution environment, and perform a TPM initialization operation on data in the allocated storage space, so that the data in the allocated storage space is updated to TPM initialization data, and the allocated storage space is used as the first storage space.

29. The computer system of claim 28, wherein, The vTPM service component is further configured to search for a storage space corresponding to the identifier of the first VM in a volatile memory of the computer, and if the storage space corresponding to the identifier of the first VM does not exist in the volatile memory, allocate a storage space in the volatile memory.

30. The computer system of any of claims 22, 23, 25, and 26, wherein, The second request information is transmitted in a first session, and the first session is used to transmit information for requesting to perform a TPM operation and / or target data between the vTPM service component and the vTPM agent component, and the target data is data obtained after performing the TPM operation; The vTPM agent component is further configured to obtain an identifier of the first VM when the first VM is started, generate fifth request information, the fifth request information including the identifier of the first VM, and transmit the fifth request information to the TrustZone Driver component, the fifth request information being used to request to establish the first session, and a destination of the fifth request information being the vTPM service component; The vTPM service component is further configured to obtain the fifth request information through the TrustZone Driver component, and allocate a storage space in a volatile memory of the computer as the first storage space.

31. The computer system of claim 30, wherein, The first session is a session corresponding to the identifier of the first VM, The vTPM service component is further configured to call a session opening interface function according to the identifier of the first VM included in the fifth request information, to establish the first session corresponding to the identifier of the first VM and obtain an identifier of the first session; The vTPM service component is further configured to transmit the identifier of the first session to the TrustZone Driver component, and a destination of the identifier of the first session being the vTPM agent component.

32. The computer system of claim 29, wherein, The vTPM service component is further configured to search for a storage space corresponding to the identifier of the first VM in a non-volatile memory of the computer, allocate a storage space in the volatile memory if the storage space corresponding to the identifier of the first VM exists in the non-volatile memory, and copy data in the storage space corresponding to the identifier of the first VM in the non-volatile memory to the allocated storage space; If the storage space corresponding to the identifier of the first VM does not exist in the non-volatile memory, allocate a storage space in the volatile memory.

33. The computer system of claim 30, wherein, The vTPM service component is further configured to mark the allocated storage space based on the identifier of the first VM.

34. The computer system of claim 30, wherein, The vTPM agent component is further configured to obtain sixth request information from the first VM, the sixth request information being used to request to close the first session, obtain the identifier of the first VM, add the identifier of the first VM in the sixth request information to obtain seventh request information, the seventh request information including the identifier of the first VM, and transmit the seventh request information to the TrustZone Driver component, a destination of the seventh request information being the vTPM service component; The vTPM service component is further configured to obtain sixth request information, determine the first storage space according to an identity of the first VM included in the sixth request information, and copy data of the first storage space to a third storage space, the third storage space being located in a non-volatile memory.

35. The computer system of any of claims 22, 23, 25, and 26, wherein, The second request information is delivered by the TrustZone Driver component to the vTPM service component in a monitoring mode, the TrustZone Driver component running in a rich execution environment of the computer.

36. A computer-readable storage medium, characterized in that, Computer-readable instructions comprising, when run on a computer, cause the computer to perform the method of any one of claims 1 to 19.

37. A computer program product, characterised in that, Computer-readable instructions comprising, when run on a computer, cause the computer to perform the method of any one of claims 1 to 19.

Images