Access processing method, virtual machine identifier configuration method, chip and computer device

Abstract

Embodiments of the present application provide an access processing method, a virtual machine identifier configuration method, a chip and a computer device. The access processing method comprises: receiving an access request sent to the coprocessor, the access request comprising a virtual machine identifier of a virtual machine requesting access and a virtual address accessed by the virtual machine; judging whether the virtual machine is an encrypted virtual machine according to the virtual machine identifier, the encrypted virtual machine being a virtual machine that protects data using a virtual machine key; and when the result of the judgment is yes, processing the access request according to the virtual machine identifier and the virtual address. It can be seen that the access processing method provided by the embodiments of the present application can safely use the coprocessor in the encrypted virtual machine scenario.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer processing technology, specifically to an access processing method, a virtual machine identifier configuration method, a chip, and a computer device. Background Technology

[0002] Virtualization technology allows a host machine to virtualize multiple virtual machines (VMs), thereby efficiently utilizing the host's hardware resources. Virtualized VMs can have their own virtual machine memory allocated in memory; each VM's virtual machine memory is primarily used for task execution and supporting virtualization. For security protection of virtual machine memory, some or all of the VM's memory can be securely protected using cryptographic keys.

[0003] To ensure data security, some virtual machines are configured with virtual machine keys and encrypted memory. Encrypted memory is virtual machine memory that uses virtual machine keys to encrypt and protect data, thus achieving data encryption protection. A virtual machine equipped with encrypted memory can be called an encrypted virtual machine.

[0004] To reduce the processor resource consumption of data reading / writing or cryptographic calculations, a coprocessor is typically used to perform encryption / decryption operations or direct memory access for data reading / writing. However, the application of coprocessors in encrypted virtual machine scenarios presents data security issues.

[0005] Therefore, how to securely use coprocessors in encrypted virtual machine scenarios has become a pressing technical problem that needs to be solved in this field. Summary of the Invention

[0006] In view of this, embodiments of the present invention provide an access processing method, a virtual machine identifier configuration method, a chip, and a computer device to enable a coprocessor to access encrypted memory in a virtual machine scenario.

[0007] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0008] To address the aforementioned problems, in a first aspect, embodiments of the present invention provide an access processing method applicable to a coprocessor, comprising:

[0009] Receive an access request sent to the coprocessor, the access request including the virtual machine identifier of the virtual machine requesting access, and the virtual address to be accessed by the virtual machine;

[0010] Based on the virtual machine identifier, determine whether the virtual machine is an encrypted virtual machine, which is a virtual machine that uses a virtual machine key to protect data;

[0011] When the determination result is yes, the access request is processed according to the virtual machine identifier and the virtual address.

[0012] Secondly, embodiments of this application provide a virtual machine identifier configuration method, applicable to security processors, including:

[0013] Accepts requests for virtual machine identifier records, including the virtual machine identifier;

[0014] Match the virtual machine identifier included in the virtual machine identifier record request with the virtual machine identifier of the encrypted virtual machine;

[0015] When a match is successful, the virtual machine identifier is configured to be associated with the coprocessor requested by the virtual machine identifier record request. The coprocessor determines whether the virtual machine identifier included in the access request is an encrypted virtual machine. If the determination result is yes, the coprocessor processes the access request based on the virtual machine identifier and virtual address in the access request.

[0016] Thirdly, embodiments of this application also provide an access processing apparatus, including:

[0017] An access request receiving unit is adapted to receive an access request, the access request including the virtual machine identifier of the virtual machine to be accessed, and the virtual address to be accessed by the virtual machine;

[0018] The encrypted virtual machine determination unit is adapted to determine whether the virtual machine is an encrypted virtual machine based on the virtual machine identifier, wherein the encrypted virtual machine is a virtual machine that uses a virtual machine key to protect data;

[0019] The access request processing unit is adapted to process the access request based on the virtual machine identifier and the virtual address when the determination result is yes.

[0020] Fourthly, embodiments of this application also provide a virtual machine identifier configuration device, including:

[0021] The record request receiving unit is adapted to accept a virtual machine identifier record request, including the virtual machine identifier;

[0022] The matching unit is adapted to match the virtual machine identifier included in the virtual machine identifier record request with the virtual machine identifier of the encrypted virtual machine;

[0023] The configuration unit is adapted to configure the virtual machine identifier to the coprocessor requested by the virtual machine identifier record request when a match is successful, so that the coprocessor determines whether the virtual machine identifier included in the access request is an encrypted virtual machine, and when the determination result is yes, the coprocessor processes the access request according to the virtual machine identifier and virtual address in the access request.

[0024] Fifthly, embodiments of this application also provide a chip, including: a processor, a memory management unit, a coprocessor, an input / output memory management unit, and a memory controller; the coprocessor is configured to execute the access processing method as described in the first aspect.

[0025] Sixthly, embodiments of this application also provide a computer device, including the chip described in the third aspect.

[0026] The access processing method provided in this application embodiment is applicable to a coprocessor and includes: receiving an access request sent to the coprocessor, the access request including a virtual machine identifier of the virtual machine to be accessed and a virtual address to be accessed by the virtual machine; determining whether the virtual machine is an encrypted virtual machine based on the virtual machine identifier, the encrypted virtual machine being a virtual machine that uses a virtual machine key to protect data; and when the determination result is yes, processing the access request based on the virtual machine identifier and the virtual address.

[0027] Thus, the access processing method provided in this application embodiment pre-sets the virtual machine identifier of the encrypted virtual machine in the coprocessor. By checking whether the virtual machine identifier in the access request matches the pre-set virtual machine identifier of the encrypted virtual machine, it can be determined whether the virtual machine sending the access request is an encrypted virtual machine. Therefore, only access requests sent by the encrypted virtual machine are allowed to be processed, thereby enabling the coprocessor to securely access data in encrypted memory and securely use the coprocessor in the encrypted virtual machine scenario. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0029] Figure 1 A schematic diagram of a computer system for the access processing method provided in the embodiments of this application;

[0030] Figure 2 This is a flowchart of an access processing method provided in an embodiment of this application;

[0031] Figure 3 The virtual machine identifier configuration method is provided in the embodiments of this application for the access processing method;

[0032] Figure 4 A schematic diagram of a coprocessor structure for the access processing method provided in an embodiment of this application;

[0033] Figure 5This application provides an encryption / decryption key setting method for the access processing method provided in the embodiments of this application.

[0034] Figure 6 This is a schematic diagram of the access processing apparatus provided in the embodiments of this application;

[0035] Figure 7 This is a schematic diagram of the structure of the virtual machine identifier configuration device provided in the embodiments of this application. Detailed Implementation

[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] To facilitate understanding, we will first introduce a method for accessing memory in a virtual machine:

[0038] The virtual machine has an encrypted memory space in memory. Data located in this encrypted memory is encrypted into ciphertext data by the virtual machine's virtual machine key. This virtual machine key is stored in the encryption / decryption engine of the memory controller by the security processor. Any access to memory must go through the memory controller. When the memory controller receives an access request to the encrypted memory, it verifies whether the access request was sent by the virtual machine to which the encrypted memory belongs. Only when the verification is successful will the ciphertext data be read from the encrypted memory, and the ciphertext data will be encrypted and decrypted using the virtual machine key corresponding to that virtual machine in the encryption / decryption engine to obtain the plaintext data.

[0039] Specifically, the memory controller obtains the virtual machine identifier from the access request, determines the virtual machine that sent the access request based on the virtual machine identifier that corresponds one-to-one with the virtual machine, and obtains the virtual machine key corresponding to the virtual machine identifier. When the virtual machine monitor tampers with the nested page table of the virtual machine, causing a virtual machine that does not belong to the encrypted memory to send an access request, the memory controller cannot obtain the correct virtual machine key based on the virtual machine identifier of the tampered virtual machine, and therefore cannot decrypt the ciphertext data in the encrypted memory, thereby preventing the virtual machine monitor from stealing the contents of the encrypted memory.

[0040] In some embodiments, the virtual machine identifier in the virtual machine access request can be added by a memory management unit, which can be integrated inside the processor or, as shown in the figure, located outside the processor and integrated into a system-on-a-chip (SoC) including the processor. The memory management unit receives an access request sent by the virtual machine, which includes a destination address. Since the virtual machine only has virtual addresses and does not have nested page tables to translate virtual addresses to host physical addresses, the destination address sent by the virtual machine is a virtual address. The memory management unit accepts this virtual address and translates it into a host physical address that allows memory access according to the nested page table.

[0041] After the virtual machine retrieves data from memory, it can use encryption / decryption keys to encrypt the plaintext data. To reduce the workload of the processor, the coprocessor can directly access memory; that is, after encrypting the data with the encryption / decryption keys, it can store the encrypted data in the virtual machine's memory space without directly controlling the memory controller through the processor; or it can retrieve data from the virtual machine's memory space without directly controlling the memory controller through the processor, and then encrypt the data using the encryption / decryption keys. This can offload the encryption and decryption calculations, reducing the processor's computational load.

[0042] It is worth noting that the encryption / decryption key and the virtual machine key are not the same key. The virtual machine key is stored in the memory controller and is used to decrypt ciphertext data in encrypted memory or to encrypt plaintext data and store it in encrypted memory. It is a key that corresponds one-to-one with the encrypted virtual machine. The encryption / decryption key, on the other hand, is located in the coprocessor and is used to share the encryption and decryption work of the processor.

[0043] However, the most critical data of a virtual machine is usually stored in encrypted memory. In order to protect the encrypted memory and prevent malicious virtual machine managers from bypassing the processor to obtain the encrypted data in the encrypted memory and decrypt it, they use the coprocessor to obtain the decrypted plaintext data from the encrypted memory. The coprocessor usually cannot access the encrypted memory.

[0044] Therefore, enabling coprocessors to access encrypted memory in virtual machine scenarios presents significant limitations. Coprocessors can only process data not located in encrypted memory, resulting in limited workload sharing with the processor. Thus, enhancing coprocessor support for access processing in virtual machine scenarios has become a pressing technical problem that needs to be solved.

[0045] To enhance coprocessor support for access processing in virtual machine scenarios, this application provides an access processing method. Please refer to [reference needed]. Figure 1 and Figure 2 , Figure 1 A schematic diagram of a computer system for the access processing method provided in the embodiments of this application. Figure 2This is a flowchart of an access processing method provided in an embodiment of this application.

[0046] As shown in the figure, the access processing method provided in this application embodiment is applicable to a coprocessor and includes:

[0047] In step S11, the coprocessor receives an access request sent to the coprocessor. The access request includes the virtual machine identifier of the virtual machine to be accessed and the virtual address to be accessed by the virtual machine.

[0048] It is worth noting that the coprocessor is configured to the virtual machine when the virtual machine starts. Specifically, this can be achieved by mapping the coprocessor's memory space to the virtual machine's virtual address through nested page tables. These nested page tables can be accessed by the memory management unit to perform virtual address translation.

[0049] When a virtual machine needs a coprocessor to process data, and that data resides in encrypted memory, the virtual machine sends a data processing request. This request includes a virtual address corresponding to the encrypted memory and address information. The address information is a virtual address corresponding to the physical address of the coprocessor's storage space. The memory management unit then translates this address information to obtain the physical address of the storage space in the coprocessor. Based on this physical address, the memory management unit can send an access request to the coprocessor's storage unit. This access request includes the virtual address corresponding to the memory in the processing request, and a newly added virtual machine identifier corresponding to the virtual machine sending the processing request. In some embodiments, the storage space may be a memory-mapped register.

[0050] In this way, by configuring the mapping between the coprocessor's physical address and the virtual address of the virtual machine in the nested page table when the virtual machine starts, the virtual machine can send access requests to the coprocessor through virtual address control. The coprocessor then receives and executes subsequent steps. Simultaneously, the memory management unit is responsible for adding the virtual machine identifier, which ensures the correctness of the virtual machine identifier carried in the access request and prevents it from being tampered with by a malicious virtual machine manager.

[0051] Of course, the physical address of the storage space in the coprocessor can also be included in the access request and accepted by the coprocessor, so that the coprocessor stores the virtual machine identifier and the virtual address in the access request into the storage space of the coprocessor according to the physical address.

[0052] The access request includes the virtual machine identifier of the virtual machine issuing the access request. All memory accesses must go through the memory controller; similarly, access to the encrypted memory of an encrypted virtual machine must also go through the memory controller. To verify whether the access was sent by the encrypted virtual machine to which the encrypted memory belongs, the memory controller needs to verify the virtual machine identifier carried in the access request. Therefore, the access request sent by the virtual machine to the coprocessor should include the virtual machine identifier of that virtual machine to prevent the access request to encrypted memory from being intercepted.

[0053] In step S12, the coprocessor determines whether the virtual machine is an encrypted virtual machine based on the virtual machine identifier. The encrypted virtual machine is a virtual machine that uses a virtual machine key to protect data. If it is, step S13 is executed; otherwise, step S14 is executed.

[0054] Upon receiving an access request, the coprocessor must only execute access requests issued by the encrypted virtual machine to prevent malicious virtual machine managers from stealing data stored in encrypted memory.

[0055] Therefore, in one specific implementation, in order to distinguish access requests from configured encrypted virtual machines, when the virtual machine manager configures nested page tables for the encrypted virtual machine, it can simultaneously record the virtual machine identifier of the encrypted virtual machine in the coprocessor. This allows the coprocessor to call the virtual machine identifier of the encrypted virtual machine when it subsequently receives an access request and compare it with the virtual machine identifier in the access request to determine whether the access request can be executed. Specifically, it can be recorded in... Figure 1 In the virtual machine identification module of the coprocessor shown.

[0056] In one specific implementation, to achieve more secure access processing and prevent malicious virtual machine managers from stealing data in encrypted memory, the process of the virtual machine manager recording the virtual machine identifier of the encrypted virtual machine in the coprocessor is described in detail below. Figure 3 , Figure 3 This is a virtual machine identifier configuration method for the access processing method provided in the embodiments of this application.

[0057] As shown in the figure, in step S21, the security processor accepts a virtual machine identifier record request that includes the virtual machine identifier.

[0058] During the process of starting a virtual machine, when allocating encrypted memory for the virtual machine, the virtual machine manager can simultaneously send a virtual machine identifier record request to the security processor. The virtual machine identifier includes the virtual machine identifier of the virtual machine that is being started, and is used to request the security processor to record the virtual machine identifier in the coprocessor.

[0059] In step S22, the security processor matches the virtual machine identifier included in the virtual machine identifier record request with the virtual machine identifier of the encrypted virtual machine. If the match is successful, step S23 is executed; if the match fails, step S24 is executed.

[0060] The security processor includes virtual machine identifiers for all encrypted virtual machines. When a matching virtual machine identifier is found, the match is considered successful, thus determining that the virtual machine corresponding to the virtual machine identifier in the virtual machine tag record request is an encrypted virtual machine; otherwise, it can be determined that the virtual machine corresponding to the virtual machine identifier in the virtual machine identifier record request is not an encrypted virtual machine.

[0061] In step S23, the security processor configures the virtual machine identifier to the coprocessor requested by the virtual machine identifier record request.

[0062] When it is determined that the virtual machine corresponding to the virtual machine identifier is an encrypted virtual machine, the security processor configures the virtual machine identifier in the coprocessor, thereby allowing the coprocessor to execute access requests carrying the virtual machine identifier.

[0063] In step S24, the process ends.

[0064] When it is determined that the virtual machine corresponding to the virtual machine identifier is not an encrypted virtual machine, the configuration of the virtual machine identifier in the coprocessor is prohibited, thereby preventing the virtual machine identifier of a non-encrypted virtual machine from being configured in the coprocessor, which would allow the coprocessor to read data in encrypted memory.

[0065] In this way, the security processor can check the accessible virtual machines sent by the virtual machine manager. Only when it is confirmed that the accessible virtual machine is an encrypted virtual machine will the virtual machine identifier be allowed to be recorded in the coprocessor. This prevents malicious coprocessors from recording the virtual machine identifier of ordinary virtual machines in the coprocessor, thereby enabling control of ordinary virtual machines to steal data in encrypted memory.

[0066] In step S13, the coprocessor processes the access request based on the virtual machine identifier and the virtual address.

[0067] When it is determined that the virtual machine requesting access is an encrypted virtual machine, the coprocessor processes the access request based on the virtual machine identifier and virtual address included in the access request.

[0068] In one specific implementation, the access request may be a read request, and processing the access request may involve the coprocessor sending the virtual address and the virtual machine identifier to the input / output memory management unit. The input / output memory management unit converts the virtual address into a host physical address in memory according to a nested page table, and then sends the host physical address and the virtual machine identifier to the memory controller. The memory controller is used to decrypt the ciphertext data of the host physical address into plaintext data using the virtual machine key corresponding to the virtual machine identifier; and to obtain the plaintext data obtained by the memory controller after decrypting the ciphertext data of the host physical address.

[0069] In another specific embodiment, the access request may be a write request, and processing the access request may involve sending the virtual address, the virtual machine identifier, and the plaintext data to the input / output memory management unit, so that the input / output memory management unit converts the virtual address into a host physical address, and the input / output memory management unit sends the host physical address, the virtual machine identifier, and the plaintext data to the memory controller, and the memory controller is used to encrypt the plaintext data into ciphertext data with the virtual machine key corresponding to the virtual machine identifier, and send the ciphertext data to the host physical address.

[0070] In step S14, the process ends.

[0071] When the virtual machine is not an encrypted virtual machine, access to memory by the virtual machine is prohibited, thereby preventing ordinary virtual machines from stealing data in the encrypted memory of the encrypted virtual machine.

[0072] Thus, the access processing method provided in this application embodiment pre-sets the virtual machine identifier of the encrypted virtual machine in the coprocessor. By checking whether the virtual machine identifier in the access request matches the pre-set virtual machine identifier of the encrypted virtual machine, it can be determined whether the virtual machine sending the access request is an encrypted virtual machine. Therefore, only access requests sent by the encrypted virtual machine are allowed to be processed, thereby enabling the coprocessor to securely access data in encrypted memory and securely use the coprocessor in the encrypted virtual machine scenario.

[0073] After the coprocessor reads plaintext data from encrypted memory, it can perform encryption operations on the plaintext data instead of the processor to reduce the processor's workload. In one specific embodiment, the coprocessor records encryption and decryption keys corresponding to the virtual machine key of the encrypted virtual machine; after the step of obtaining plaintext data obtained by the memory controller decrypting the ciphertext data of the host physical address, the coprocessor can also match the corresponding pre-set encryption and decryption key according to the virtual machine identifier, and perform encryption operations on the plaintext data using the encryption and decryption key.

[0074] To store pre-set encryption and decryption keys in the coprocessor and facilitate subsequent matching with the virtual machine identifier, in one specific embodiment, a key management module can be set up in the coprocessor. Please refer to [reference needed] for details. Figure 4 , Figure 4 This is a schematic diagram of the coprocessor structure for the access processing method provided in the embodiments of this application.

[0075] As shown in the figure, the coprocessor of the access processing method provided in this application embodiment includes a memory-mapped register, an encryption / decryption engine module, a direct access module, a virtual machine identifier module, and an encryption / decryption key management module. The memory-mapped register is adapted to accept the aforementioned access request; the virtual machine identifier module is adapted to store an encrypted virtual machine identifier configured by the security processor, used to match it with the virtual machine identifier in the access request to determine whether the virtual machine sending the access request is an encrypted virtual machine; the direct access module is adapted to support reading or writing data in memory via direct access, i.e., supporting the aforementioned steps of reading plaintext data or writing ciphertext data from encrypted memory; the encryption / decryption key management module records a pre-set encryption / decryption key for the virtual machine, and a key number for the encryption / decryption key, wherein one key number corresponds to one encryption / decryption key for a virtual machine. When the virtual machine identifier recorded in the virtual machine identifier module is removed, the encryption / decryption key recorded in the encryption / decryption key management module corresponding to the removed virtual machine identifier is also removed; the encryption / decryption engine module uses the encryption / decryption key in the encryption / decryption key management module to perform encryption operations on the plaintext data obtained from the encrypted memory.

[0076] The coprocessor structure described above is used to implement the step of matching the corresponding pre-set encryption / decryption key based on the virtual machine identifier. In one specific embodiment, the corresponding key number can be matched from the key management module of the coprocessor based on the virtual machine identifier, and the encryption / decryption key recorded in the key management module can be obtained based on the key number.

[0077] In this way, by setting a key number in the coprocessor that corresponds one-to-one with the virtual machine identifier and the encryption / decryption key, the encryption / decryption key corresponding to the virtual machine identifier in the access request can be obtained, thereby performing encryption operations on the plaintext data read from the encrypted memory according to the access request. Furthermore, since there is a one-to-one correspondence between the key number and the virtual machine identifier in the coprocessor, even if a malicious virtual machine manager controls a regular virtual machine to cause the coprocessor to read plaintext data from the encrypted memory of an encrypted virtual machine, it will be impossible to match the encryption / decryption key of that encrypted virtual machine. Therefore, the coprocessor cannot use the correct encryption / decryption key to encrypt the plaintext data, and consequently, it cannot provide the processed data to the processor or send it to other devices. This further improves the security of the coprocessor's encryption steps for data in encrypted memory.

[0078] In this way, in applications using encrypted virtual machines, the processor can be replaced to read plaintext data from encrypted memory and perform encryption operations on the plaintext data, thereby reducing the workload of the processor and improving the data processing speed.

[0079] The coprocessor needs to perform encryption operations on the acquired plaintext data using the encryption / decryption key; therefore, it first obtains the encryption / decryption key from the processor. To prevent the encryption / decryption key from being leaked or an incorrect key from being obtained during the processor's transmission of the encryption / decryption key to the coprocessor, in one specific implementation, please refer to... Figure 5 , Figure 5 This is a method for setting encryption and decryption keys for the access processing method provided in the embodiments of this application.

[0080] like Figure 5 As shown, the encryption / decryption key setting method of the access processing method provided in this application embodiment includes:

[0081] In step S31, the virtual machine sends a user identity certificate import command to the coprocessor.

[0082] Specifically, the user identity certificate import command can be written into the memory-mapped register of the encrypted virtual machine. Please refer to the above description for the specific writing method.

[0083] In step S32, the coprocessor responds to the user identity certificate import command, imports the user identity certificate, and generates a random number.

[0084] In some embodiments, the user identity certificate may be stored in memory, and the user identity certificate import command may include the physical address of the host storing the user identity certificate. The user certificate includes the user's public key.

[0085] In step S33, the coprocessor uses the user's public key to encrypt the random number to obtain the random number ciphertext, and uses the coprocessor's root key to sign the random number ciphertext to obtain the random number ciphertext signature.

[0086] The coprocessor root key is stored in the coprocessor; in some embodiments, it may be stored in the user certificate, including the user public key encryption / decryption key management module. Figure 4 (As shown).

[0087] In step S34, the coprocessor sends the random number ciphertext, the random number ciphertext signature, and the root certificate corresponding to the coprocessor root key to the virtual machine.

[0088] The root certificate includes the coprocessor public key corresponding to the processor root key.

[0089] In step S35, the virtual machine verifies the random number ciphertext signature and the root certificate. After the random number ciphertext signature and the root certificate are verified, the virtual machine uses the user's private key corresponding to the user's public key to decrypt the random number ciphertext. The virtual machine then uses the decrypted random number to derive a session key, and uses the session key to encrypt the encryption / decryption key to be imported.

[0090] The virtual machine verifies the root key certificate to determine if it is an authentic root key certificate belonging to the coprocessor. If so, it retrieves the coprocessor's public key from the root key certificate and uses it to sign and verify the ciphertext of the random number. If the verification passes, the ciphertext of the random number is considered to have been sent by the coprocessor and has not been tampered with. Therefore, the virtual machine's user private key is used to decrypt the ciphertext of the random number to obtain the random number. In this way, both the virtual machine and the coprocessor have the same random number, preventing the random number from being tampered with or leaked. Therefore, the virtual machine and the coprocessor can use the random number to derive a session key for secure communication.

[0091] In step S36, the virtual machine sends the encryption / decryption key to be imported, which is encrypted with the session key.

[0092] In step S37, the coprocessor uses the session key derived from the random number to decrypt the encryption / decryption key.

[0093] In this way, by setting a session key, the virtual machine can securely set the encryption and decryption keys in the coprocessor, preventing the encryption and decryption keys from being leaked or incorrectly obtained during the process of the processor sending the encryption and decryption keys to the coprocessor.

[0094] To address the aforementioned problems, embodiments of this application also provide an access processing apparatus, please refer to... Figure 6 , Figure 6 This is a schematic diagram of the access processing apparatus provided in an embodiment of this application.

[0095] As shown in the figure, the access processing apparatus provided in this application embodiment includes:

[0096] Access request receiving unit 11 is adapted to receive access requests, the access requests including the virtual machine identifier of the virtual machine to be accessed, and the virtual address to be accessed by the virtual machine;

[0097] The encrypted virtual machine determination unit 12 is adapted to determine whether the virtual machine is an encrypted virtual machine based on the virtual machine identifier, wherein the encrypted virtual machine is a virtual machine that uses a virtual machine key to protect data;

[0098] The access request processing unit 13 is adapted to process the access request based on the virtual machine identifier and the virtual address when the determination result is yes.

[0099] Thus, the access processing device provided in this application embodiment pre-sets the virtual machine identifier of the encrypted virtual machine in the coprocessor. By checking whether the virtual machine identifier in the access request matches the pre-set virtual machine identifier of the encrypted virtual machine, it can be determined whether the virtual machine sending the access request is an encrypted virtual machine. Therefore, only access requests sent by the encrypted virtual machine are allowed to be processed, thereby enabling the coprocessor to securely access data in encrypted memory and securely use the coprocessor in the encrypted virtual machine scenario.

[0100] This application also provides a virtual machine identifier configuration device. Please refer to... Figure 7 , Figure 7 This is a schematic diagram of the structure of the virtual machine identifier configuration device provided in the embodiments of this application.

[0101] As shown in the figure, the virtual machine identification device provided in this application embodiment includes:

[0102] The record request receiving unit 21 is adapted to accept a virtual machine identifier record request including the virtual machine identifier;

[0103] Matching unit 22 is adapted to match the virtual machine identifier included in the virtual machine identifier record request with the virtual machine identifier of the encrypted virtual machine;

[0104] Configuration unit 23 is adapted to configure the virtual machine identifier to the coprocessor requested by the virtual machine identifier record request when a match is successful, so that the coprocessor determines whether the virtual machine identifier included in the access request is an encrypted virtual machine, and when the determination result is yes, the coprocessor processes the access request according to the virtual machine identifier and virtual address in the access request.

[0105] This application also provides a chip including a processor, a memory management unit, a coprocessor, an input / output memory management unit, and a memory controller; the coprocessor is configured to execute the access processing method as described above.

[0106] This application also provides a computer device including the chip described above.

[0107] Thus, the chip and computer device provided in this application embodiment pre-set the virtual machine identifier of the encrypted virtual machine in the coprocessor. By checking whether the virtual machine identifier in the access request matches the pre-set virtual machine identifier of the encrypted virtual machine, it can be determined whether the virtual machine sending the access request is an encrypted virtual machine. Therefore, only access requests sent by the encrypted virtual machine are allowed to be processed, thereby enabling the coprocessor to securely access data in encrypted memory and securely use the coprocessor in the encrypted virtual machine scenario.

[0108] The above description of the disclosed embodiments enables those skilled in the art to implement or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein. The foregoing description of multiple embodiments of the present invention provides various alternative methods that can be combined and cross-referenced without conflict, thereby extending to various possible embodiments, all of which can be considered as embodiments disclosed in the present invention.

[0109] While the embodiments of the present invention have been disclosed above, the present invention is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the present invention; therefore, the scope of protection of the present invention should be determined by the scope defined in the claims.

Claims

1. An access processing method, characterized in that, Suitable for coprocessors, including: Receive an access request sent to the coprocessor, the access request including the virtual machine identifier of the virtual machine requesting access, and the virtual address to be accessed by the virtual machine; Based on the virtual machine identifier, determine whether the virtual machine is an encrypted virtual machine, which is a virtual machine that uses a virtual machine key to protect data; If the determination result is yes, the access request is processed according to the virtual machine identifier and the virtual address; The step of determining whether the virtual machine is an encrypted virtual machine based on the virtual machine identifier includes: The virtual machine identifier of the encrypted virtual machine is invoked, and the virtual machine identifier of the requested virtual machine is matched with the virtual machine identifier of the encrypted virtual machine to determine whether the virtual machine is an encrypted virtual machine; wherein, the virtual machine identifier of the encrypted virtual machine is pre-configured in the coprocessor by the security processor when the encrypted virtual machine starts.

2. The access processing method as described in claim 1, characterized in that, The step of processing the access request based on the virtual machine identifier and the virtual address includes: The virtual address and the virtual machine identifier are sent to the input / output memory management unit, so that the input / output memory management unit converts the virtual address into a host physical address, and the input / output memory management unit sends the host physical address and the virtual machine identifier to the memory controller. The memory controller is used to decrypt the ciphertext data of the host physical address into plaintext data using the virtual machine key corresponding to the virtual machine identifier. Obtain the plaintext data.

3. The access processing method as described in claim 1, characterized in that, The access request also includes plaintext data; The step of processing the access request based on the virtual machine identifier and the virtual address includes: The virtual address, the virtual machine identifier, and the plaintext data are sent to the input / output memory management unit (I / O memory management unit) so that the I / O memory management unit converts the virtual address into a host physical address. The I / O memory management unit then sends the host physical address, the virtual machine identifier, and the plaintext data to the memory controller. The memory controller uses the virtual machine key corresponding to the virtual machine identifier to encrypt the plaintext data into ciphertext data and writes the ciphertext data into the host physical address in memory.

4. The access processing method according to any one of claims 1-3, characterized in that, The access request also includes: the physical address of the storage space in the coprocessor; The method further includes: Based on the physical address, the virtual machine identifier and the virtual address are stored in the coprocessor's storage space.

5. The access processing method as described in claim 2, characterized in that, The coprocessor records encryption and decryption keys corresponding to the encrypted virtual machine; after the step of obtaining the plaintext data, the method further includes: Match the corresponding encryption / decryption key based on the virtual machine identifier; The plaintext data is encrypted using the encryption / decryption key.

6. The access processing method as described in claim 5, characterized in that, The step of matching the corresponding encryption / decryption key based on the virtual machine identifier includes: The corresponding key number is matched from the coprocessor's key management module based on the virtual machine identifier; the key number is the number of the encryption / decryption key recorded in the key management module, in which one key number corresponds to one virtual machine's encryption / decryption key; The encryption / decryption key recorded in the key management module is obtained based on the key number.

7. The access processing method as described in claim 6, characterized in that, Also includes: Set the encryption / decryption key; The encryption / decryption key settings include: Receive a user identity certificate import command sent by a virtual machine, wherein the user identity certificate includes a user public key; In response to the user identity certificate import command, import the user identity certificate and generate a random number; The random number is encrypted using the user's public key to obtain the random number ciphertext, and the random number ciphertext is signed using the coprocessor root key to obtain the random number ciphertext signature. The virtual machine sends the ciphertext of the random number, the signature of the ciphertext of the random number, and the root certificate corresponding to the coprocessor root key to the virtual machine, so that the virtual machine can verify the signature of the ciphertext of the random number and the root certificate. After the signature of the ciphertext of the random number and the root certificate are verified, the virtual machine uses the user's private key corresponding to the user's public key to decrypt the ciphertext of the random number, and the virtual machine uses the decrypted random number to derive a session key. The virtual machine then uses the session key to encrypt the encryption / decryption key to be imported. Accept the encryption / decryption key to be imported, which is encrypted using the session key; The encryption / decryption key is decrypted using the session key derived from the random number.

8. A method for configuring a virtual machine identifier, characterized in that, Suitable for security processors, including: Accepts requests for virtual machine identifier records, including the virtual machine identifier; Match the virtual machine identifier included in the virtual machine identifier record request with the virtual machine identifier of the encrypted virtual machine; When a match is successful, the virtual machine identifier is configured to be associated with the coprocessor requested by the virtual machine identifier record request, so that the coprocessor can determine whether the virtual machine identifier included in the access request is an encrypted virtual machine, and if the determination result is yes, the coprocessor can process the access request according to the virtual machine identifier and virtual address in the access request. The coprocessor determines whether the virtual machine identifier included in the access request is an encrypted virtual machine, including: The virtual machine identifier of the encrypted virtual machine is invoked, and the virtual machine identifier of the requested virtual machine is matched with the virtual machine identifier of the encrypted virtual machine to determine whether the virtual machine is an encrypted virtual machine; wherein, the virtual machine identifier of the encrypted virtual machine is pre-configured in the coprocessor by the security processor when the encrypted virtual machine starts.

9. An access processing apparatus, characterized in that, include: An access request receiving unit is adapted to receive an access request, the access request including the virtual machine identifier of the virtual machine to be accessed, and the virtual address to be accessed by the virtual machine; The encrypted virtual machine determination unit is adapted to determine whether the virtual machine is an encrypted virtual machine based on the virtual machine identifier, wherein the encrypted virtual machine is a virtual machine that uses a virtual machine key to protect data; The access request processing unit is adapted to process the access request based on the virtual machine identifier and the virtual address when the determination result is yes; The step of determining whether the virtual machine is an encrypted virtual machine based on the virtual machine identifier includes: The virtual machine identifier of the encrypted virtual machine is invoked, and the virtual machine identifier of the requested virtual machine is matched with the virtual machine identifier of the encrypted virtual machine to determine whether the virtual machine is an encrypted virtual machine; wherein, the virtual machine identifier of the encrypted virtual machine is pre-configured in the coprocessor by the security processor when the encrypted virtual machine starts.

10. A virtual machine identifier configuration device, characterized in that, include: The record request receiving unit is adapted to accept a virtual machine identifier record request, including the virtual machine identifier; The matching unit is adapted to match the virtual machine identifier included in the virtual machine identifier record request with the virtual machine identifier of the encrypted virtual machine; The configuration unit is adapted to configure the virtual machine identifier to the coprocessor requested by the virtual machine identifier record request when the matching is successful, so that the coprocessor determines whether the virtual machine identifier included in the access request is an encrypted virtual machine, and when the determination result is yes, the coprocessor processes the access request according to the virtual machine identifier and virtual address in the access request; The coprocessor determines whether the virtual machine identifier included in the access request is an encrypted virtual machine, including: The virtual machine identifier of the encrypted virtual machine is invoked, and the virtual machine identifier of the requested virtual machine is matched with the virtual machine identifier of the encrypted virtual machine to determine whether the virtual machine is an encrypted virtual machine; wherein, the virtual machine identifier of the encrypted virtual machine is pre-configured in the coprocessor by the security processor when the encrypted virtual machine starts.

11. A chip, characterized in that, include: The processor, memory management unit, coprocessor, input / output memory management unit, and memory controller; the coprocessor is configured to perform the access processing method as described in any one of claims 1 to 7.

12. A computer device, characterized in that, Including the chip as described in claim 11.

Images