Cloud platform-based virtual machine remote authentication method, device and equipment and storage medium
By generating and merging remote authentication reports of virtual machines in the cloud platform and using a CA certification center for authentication, the security issues of virtual machines are resolved, ensuring the integrity and security of virtual machines and meeting users' trusted computing needs.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA UNITED NETWORK COMM GRP CO LTD
- Filing Date
- 2024-08-27
- Publication Date
- 2026-06-02
AI Technical Summary
In existing cloud platforms, TPM chips have not been effectively provided for use by virtual machines, resulting in serious security problems in the virtual machine operating environment, especially in areas with large data volume, complex logic, long computation time, and high resource consumption.
The system obtains remote authentication requests through a virtual machine, parses and processes the PCR manifest and nonce random number, generates a remote authentication report, and sends it to the Nova-compute interface for merging processing. Finally, the authentication is performed by a CA certification center to ensure the security of the virtual machine.
It enables remote authentication of virtual machines, meets users' demands for trusted and secure virtual machines, ensures the integrity and security of virtual machines, and reduces the risk of data leakage.
Smart Images
Figure CN119071065B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of trusted computing technology, and in particular to a method, apparatus, device and storage medium for remote authentication of virtual machines based on a cloud platform. Background Technology
[0002] The widespread application of cloud platform technology has greatly improved the utilization rate of computing resources for enterprises. OpenStack is an open-source cloud computing management platform project, a combination of a series of open-source software projects. A Trusted Platform Module (TPM) is a chip embedded inside a computer that provides a root of trust. Integrating a TPM into a cloud host on an OpenStack cloud platform ensures secure startup, data encryption, and protection against malicious intrusion, thereby enhancing the security and trustworthiness of the cloud host.
[0003] Trusted computing is a technology driven by trusted computing organizations. Its core computing technology relies heavily on the trusted computing functionality of the TPM / TCM chip, which serves as the root of trust for the entire platform. This hardware-based trusted platform module ensures the overall security of the system. Remote authentication technology is one of the key technologies in a trusted computing solution, used to determine the integrity status of a computer system and playing a crucial role in ensuring computer system security.
[0004] Currently, many computing platform vendors have embedded TPM chips into their products, such as laptops, desktops, servers, and other computing platforms. However, most of these TPM chips are used to ensure the security and trustworthiness of the physical platform, without providing the trusted computing capabilities of the TPM chip to virtual machines, thus failing to ensure the integrity of virtual machines. Therefore, virtual machine runtime environments face serious security challenges. To address these issues, this application provides a cloud-based method for remote authentication of virtual machines. Summary of the Invention
[0005] This application provides a method, apparatus, device, and storage medium for remote authentication of virtual machines based on a cloud platform, in order to solve the problems of large data volume, complex logic, long data calculation time, and high system resource consumption when determining and changing indicators.
[0006] Firstly, this application provides a virtual machine remote authentication method based on a cloud platform, comprising:
[0007] The remote authentication request is obtained through a virtual machine, and the remote authentication request is parsed and processed to obtain a PCR list and a nonce random number;
[0008] Based on the PCR list and the nonce random number, generate a remote authentication report for the virtual machine and send the remote authentication report for the virtual machine to the Nova-compute interface;
[0009] The remote authentication report of the virtual machine and the remote authentication report of the host machine are merged through the Nova-compute interface to obtain a remote authentication report, which is then sent to the CA certification center.
[0010] After receiving the remote authentication report, the CA authentication center performs remote authentication on the virtual machine.
[0011] Optionally, obtaining the remote authentication request through the virtual machine includes:
[0012] After obtaining the remote authentication request sent by the user through the Nova-api interface, the remote authentication preparation request is sent to the CA certification center.
[0013] Based on the remote authentication preparation request, the CA authentication center returns the verification result to the Nova-api interface;
[0014] Based on the verification result, the Nova-api interface sends the remote authentication request to the Nova-compute interface, and after receiving the remote authentication request, the Nova-compute interface sends the remote authentication request to the virtual machine.
[0015] Optionally, before sending the remote authentication preparation request to the CA certification center after obtaining the remote authentication request sent by the user through the Nova-api interface, the method further includes:
[0016] If the virtual machine is successfully created, a device registration preparation request is sent to the CA certification center through the Nova-api interface. The device registration preparation request includes the UUID of the virtual machine.
[0017] Based on the device registration preparation request, the CA certification center generates a nonce random number and returns the registration preparation result to the Nova-api interface. The registration preparation result includes the nonce random number.
[0018] Based on the registration preparation result, the Nova-compute interface receives the device registration request sent by the Nova-api interface and forwards the device registration request to the virtual machine;
[0019] After the virtual machine obtains the device registration request, it collects the baseline PCR value through Tpm-vm-agent, and packages the baseline PCR value and the signature public key to generate a trusted report of the virtual machine.
[0020] After receiving the trusted report through the Nova-compute interface, the registration information of the virtual machine is compressed and a device request for the virtual machine is sent to the CA certification center, wherein the registration information is the trusted report and the signature public key;
[0021] Based on the device request, the CA certification center persists the trusted report and returns the registration result of the virtual machine to the Nova-compute interface.
[0022] Optionally, the step of obtaining the remote authentication request through a virtual machine and parsing the remote authentication request to obtain the PCR list and nonce random number includes:
[0023] After the Tpm-vm-agent service of the virtual machine receives the remote authentication request, it calls the tpm2-tool tool to parse and process the remote authentication request to obtain the nonce random number, the UUID of the virtual machine, and the PCR list.
[0024] Optionally, generating the remote authentication report for the virtual machine based on the PCR list and the nonce random number includes:
[0025] Obtain the public and private keys of the virtual machine, and call the tpm2-tool to encrypt the public key, the PCR manifest, and the nonce random number using the private key to generate a remote authentication report for the virtual machine.
[0026] Optionally, the step of remotely authenticating the virtual machine after receiving the remote authentication report from the CA authentication center includes:
[0027] Based on the remote authentication report, obtain the public key, the UUID of the virtual machine, the PCR list, and the nonce random number;
[0028] The PCR manifest is parsed to obtain the target PCR value, and the public key is verified using the tpm2-tool.
[0029] When the public key verification is successful, determine whether the nonce random number is correct;
[0030] When the nonce is correct, the target PCR value is compared with the baseline PCR value to determine whether the target PCR value is consistent with the baseline PCR value.
[0031] When the target PCR value is consistent with the baseline PCR value, the virtual machine is determined to be in a trusted state.
[0032] Optionally, after determining whether the target PCR value is consistent with the baseline PCR value, the method further includes:
[0033] When the target PCR value is inconsistent with the baseline PCR value, manually sent analysis information is obtained, and the analysis information is used to indicate whether the virtual machine is abnormal.
[0034] When the analysis information indicates that the virtual machine is normal, the virtual machine is determined to be in a trusted state.
[0035] Secondly, this application provides a virtual machine remote authentication device based on a cloud platform, comprising:
[0036] The acquisition module is used to obtain remote authentication requests through a virtual machine;
[0037] The processing module is used to parse the remote authentication request to obtain a PCR list and a nonce random number; generate a remote authentication report for the virtual machine based on the PCR list and the nonce random number, and send the remote authentication report of the virtual machine to the Nova-compute interface; merge the remote authentication report of the virtual machine and the remote authentication report of the host machine through the Nova-compute interface to obtain a remote authentication report, and send the remote authentication report to the CA certification center; after receiving the remote authentication report, the CA certification center performs remote authentication on the virtual machine.
[0038] Optionally, the acquisition module is further configured to acquire remote authentication requests sent by users through the Nova-api interface;
[0039] The processing module is further configured to, after obtaining the remote authentication request sent by the user through the Nova-api interface, send a remote authentication preparation request to the CA certification center; according to the remote authentication preparation request, the CA certification center returns a verification result to the Nova-api interface; according to the verification result, the Nova-api interface sends the remote authentication request to the Nova-compute interface, and after the Nova-compute interface receives the remote authentication request, sends the remote authentication request to the virtual machine.
[0040] Optionally, the processing module is further configured to, upon successful creation of the virtual machine, send a device registration preparation request to the CA certification center via the Nova-api interface, the device registration preparation request including the UUID of the virtual machine; based on the device registration preparation request, the CA certification center generates a nonce random number and returns a registration preparation result to the Nova-api interface, the registration preparation result including the nonce random number; based on the registration preparation result, the Nova-compute interface receives the device registration request sent by the Nova-api interface and forwards the device registration request to the virtual machine;
[0041] The acquisition module is further configured to acquire the device registration request through the virtual machine;
[0042] The processing module is further configured to: after the virtual machine obtains the device registration request, collect a baseline PCR value through Tpm-vm-agent, and package the baseline PCR value and the signature public key to generate a trusted report for the virtual machine; after receiving the trusted report through the Nova-compute interface, compress the registration information of the virtual machine and send the virtual machine's device request to the CA certification center, wherein the registration information is the trusted report and the signature public key; according to the device request, the CA certification center persists the trusted report and returns the registration result of the virtual machine to the Nova-compute interface.
[0043] Optionally, the processing module is further configured to, after the Tpm-vm-agent service of the virtual machine receives the remote authentication request, call the tpm2-tool tool to parse and process the remote authentication request to obtain the nonce random number, the UUID of the virtual machine, and the PCR list.
[0044] Optionally, the acquisition module is further configured to acquire the public key and private key of the virtual machine;
[0045] The processing module is further configured to call the tpm2-tool to encrypt the public key, the PCR list, and the nonce random number using the private key, and generate a remote authentication report for the virtual machine.
[0046] Optionally, the device further includes: a judgment module and a determination module;
[0047] The acquisition module is further configured to acquire the public key, the UUID of the virtual machine, the PCR list, and the nonce random number based on the remote authentication report;
[0048] The processing module is also used to parse the PCR manifest to obtain the target PCR value, and to verify the public key using the tpm2-tool tool;
[0049] The judgment module is used to determine whether the nonce random number is correct when the public key verification is successful.
[0050] The processing module is also used to compare the target PCR value with the baseline PCR value when the nonce random number is correct.
[0051] The judgment module is also used to determine whether the target PCR value is consistent with the benchmark PCR value;
[0052] The determining module is further configured to determine that the virtual machine is in a trusted state when the target PCR value is consistent with the baseline PCR value.
[0053] Optionally, the acquisition module is further configured to acquire manually sent analysis information when the target PCR value is inconsistent with the baseline PCR value, the analysis information being used to indicate whether the virtual machine is abnormal;
[0054] The determining module is further configured to determine that the virtual machine is in a trusted state when the analysis information indicates that the virtual machine is normal.
[0055] Thirdly, this application provides a virtual machine remote authentication device based on a cloud platform, comprising:
[0056] Memory;
[0057] processor;
[0058] The memory stores computer-executed instructions;
[0059] The processor executes computer execution instructions stored in the memory to implement the cloud platform-based virtual machine remote authentication method as described in the first aspect and various possible implementations of the first aspect above.
[0060] Fourthly, this application provides a computer storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the cloud platform-based virtual machine remote authentication method as described in the first aspect and various possible implementations of the first aspect above.
[0061] This application provides a cloud-based method for remote authentication of virtual machines. It obtains a remote authentication report sent by Nova-compute through a CA (Certificate Authority) and uses the target PCR value, nonce random number, and public key from both the virtual machine and the host machine in the remote authentication report to perform security verification on the virtual machine, thereby determining whether the current state of the virtual machine is secure. This method implements remote authentication of virtual machines on the OpenStack cloud platform using TPM, meeting users' requirements for trusted and secure virtual machines and ensuring the integrity of the virtual machine. Attached Figure Description
[0062] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0063] Figure 1 The process of the cloud platform-based virtual machine remote authentication method provided in this application Figure 1 ;
[0064] Figure 2 The virtual machine registration flowchart provided for this application;
[0065] Figure 3 This is a schematic diagram of a virtual machine registration scenario provided in this application;
[0066] Figure 4 The process of the cloud platform-based virtual machine remote authentication method provided in this application Figure 2 ;
[0067] Figure 5 A schematic diagram of the structure of the cloud-based virtual machine remote authentication device provided in this application;
[0068] Figure 6 A schematic diagram of the structure of the cloud-based virtual machine remote authentication device provided in this application.
[0069] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0070] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0071] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein.
[0072] In this application, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.
[0073] First, let's explain the terms used in this application:
[0074] OpenStack: OpenStack is an open-source cloud computing management platform project, a collection of open-source software projects. It was developed and initiated by NASA (National Aeronautics and Space Administration) and Rackspace, and is licensed under the Apache License (a free software license issued by the Apache Software Foundation).
[0075] OpenStack provides scalable and elastic cloud computing services for both private and public clouds. The project aims to provide a simple-to-implement, scalable, feature-rich, and standardized cloud computing management platform.
[0076] Virtual Machine: A virtual machine (VM) is a complete computer system simulated by software, possessing full hardware system functionality and running in a completely isolated environment. In simpler terms, a VM uses software to create multiple virtual machines on a physical computer. Each VM can run independently and can install various software and applications; it is a computer within a computer, a computer virtually created using software.
[0077] UUID: UUID is an abbreviation for Universally Unique Identifier, a software construction standard and part of the Open Software Foundation's work on distributed computing environments. Its purpose is to provide all elements in a distributed system with unique identification information, eliminating the need for a central control point to assign identification information. This allows everyone to create UUIDs that do not conflict with others. Consequently, the issue of duplicate names during database creation is eliminated.
[0078] The widespread application of cloud platform technology has greatly improved the utilization rate of computing resources for enterprises. OpenStack is an open-source cloud computing management platform project, a combination of a series of open-source software projects. A Trusted Platform Module (TPM) is a chip embedded inside a computer that provides a root of trust. Integrating a TPM into a cloud host on an OpenStack cloud platform ensures secure startup, data encryption, and protection against malicious intrusion, thereby enhancing the security and trustworthiness of the cloud host.
[0079] Trusted computing is a technology driven by trusted computing organizations. Its core computing technology relies heavily on the trusted computing functionality of the TPM / TCM chip, which serves as the root of trust for the entire platform. This hardware-based trusted platform module ensures the overall security of the system. Remote authentication technology is one of the key technologies in a trusted computing solution, used to determine the integrity status of a computer system and playing a crucial role in ensuring computer system security.
[0080] Currently, many computing platform vendors have embedded TPM chips into their products, such as laptops, desktops, servers, and other computing platforms. However, most of these TPM chips are used to ensure the security and trustworthiness of the physical platform, without providing the trusted computing capabilities of the TPM chip to virtual machines, thus failing to ensure the integrity of virtual machines. Therefore, virtual machine runtime environments face serious security challenges. To address these issues, this application provides a cloud-based method for remote authentication of virtual machines.
[0081] To address the aforementioned issues, this application provides a cloud-based method for remote authentication of virtual machines. It obtains a remote authentication report sent by Nova-compute from a CA (Certificate Authority) and uses the target PCR value, nonce, and public key from both the virtual machine and the host machine within the remote authentication report to perform security verification on the virtual machine, thereby determining whether the virtual machine's current state is secure. This method achieves remote authentication of virtual machines on the OpenStack cloud platform through TPM, meeting users' demands for trusted and secure virtual machines and ensuring the integrity of the virtual machines.
[0082] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.
[0083] Figure 1 This is an interaction of the virtual machine remote authentication method based on a cloud platform provided in the embodiments of this application. Figure 1 .like Figure 1As shown, the virtual machine remote authentication method based on a cloud platform provided in this embodiment includes:
[0084] S101: Obtain a remote authentication request through a virtual machine, parse and process the remote authentication request to obtain a PCR list and a nonce random number; generate a remote authentication report for the virtual machine based on the PCR list and the nonce random number.
[0085] In the field of trusted computing, the PCR manifest typically refers to the "Platform Configuration Register" list. A nonce is a random or pseudo-random number used to ensure the security and integrity of communication.
[0086] The purpose of parsing the PCR list and nonce random value is to perform remote authentication of the virtual machine later. The nonce random value can ensure that each request is new and prevent attackers from retransmitting previous communication data. The PCR list contains hash values of key configuration information during the startup and operation of the virtual machine. By comparing the current target PCR value with the baseline PCR value when registering the device, it can be confirmed whether the startup process and configuration of the virtual machine have been tampered with.
[0087] The virtual machine has a tpm-vm-agent service that is responsible for remote authentication. After receiving a remote authentication request, it calls the tpm2-tool to parse the remote authentication request, obtain the nonce random value, the virtual machine's UUID and PCR list, and then generate the virtual machine's remote authentication report based on the nonce random value, the virtual machine's UUID and PCR list.
[0088] Understandably, PCR is an important structure within the Trusted Platform Module (TPM) used to store information about system hardware and software configurations, which can be used to verify system integrity and security. Virtual machine UUIDs are used to identify specific virtual machines, ensuring that the verifier knows which specific virtual machine is being verified.
[0089] S102: The virtual machine sends the remote authentication report of the virtual machine to the Nova-compute interface.
[0090] Nova-compute is a core component of OpenStack compute services, responsible for executing the actual virtual machine instantiation tasks on compute nodes.
[0091] Nova-compute typically runs on compute nodes and has complete control over local virtual machines, making it ideal for handling authentication information related to virtual machine state. By sending remote authentication reports to Nova-compute, virtual machines can ensure that the authentication process occurs on trusted compute nodes, reducing the risk of data leakage.
[0092] S103: The Nova-compute interface merges the remote authentication report of the virtual machine and the remote authentication report of the host machine to obtain a remote authentication report.
[0093] After receiving the remote authentication report from the virtual machine, Nova-compute calls tpm-host-agent to obtain the remote authentication report from the host machine, and merges the remote authentication report from the virtual machine and the remote authentication report from the host machine as the final remote authentication report.
[0094] S104: The Nova-compute interface sends a remote authentication report to the CA certification center.
[0095] The Nova-compute interface sends the merged final remote authentication report to the CA certification center. This remote authentication report contains the remote authentication reports of the virtual machine and the host machine.
[0096] S105: The CA certification center performs remote authentication on the virtual machine.
[0097] After receiving the remote authentication report, the CA certification center parses it to obtain the remote authentication report of the current virtual machine and the remote authentication report of the host machine. Based on the information obtained from the analysis of the remote authentication reports of the virtual machine and the host machine, the CA certification center performs remote authentication on the virtual machine.
[0098] This application provides a cloud platform-based virtual machine remote authentication method. The method obtains a remote authentication request from the virtual machine, parses the request to obtain a PCR list and a nonce random number, and generates a remote authentication report which is sent to the Nova-compute interface. Upon receiving the virtual machine's remote authentication report, the Nova-compute interface merges it with the host machine's remote authentication report to obtain a final remote authentication report, which is then sent to a CA (Certificate Authority) to begin remote authentication of the virtual machine. This method can verify whether a virtual machine created and running on the OpenStack cloud platform maintains its initially defined state and whether the entire system environment meets predetermined security standards and policy requirements, thereby achieving effective verification of the virtual machine's state integrity.
[0099] Figure 2 This is a flowchart illustrating the virtual machine registration process provided for this application. This embodiment is... Figure 1 Based on the examples, the virtual machine registration method will be described in detail. For example... Figure 2 As shown, the virtual machine registration method based on a cloud platform provided in this embodiment includes:
[0100] S201: If the virtual machine is successfully created, send a device registration preparation request to the CA certification center through the Nova-api interface. The device registration preparation request includes the UUID of the virtual machine.
[0101] After the virtual machine is successfully created, it needs to check if `trust_vm` in `falvor` is true. If it is true, a device registration preparation request is sent to the CA certification center. This device registration preparation request includes the virtual machine's UUID.
[0102] S202: Based on the device registration preparation request, the CA certification center generates a nonce random number.
[0103] Within the CA certification center, there is a ca-agent service. When the CA certification center receives a device registration preparation request from the Nova-api interface, it constructs the schema of a ca-reports-pool database table and adds the registration information to it. Simultaneously, it generates a nonce and returns it as a response to the Nova-api interface.
[0104] In one possible way, such as Figure 3 As shown, `ca-reports-pool` is a table in the database that records the mapping between a virtual machine's UUID and the path where remote proof benchmark content is stored. The stored remote proof benchmark content includes trusted reports and public keys. Simultaneously, a new data item is added to the `host-vm-table`, recording the mapping relationship between the virtual machine and the host machine.
[0105] S203: The CA certification center returns the registration preparation result to the Nova-api interface, and the registration preparation result includes: a nonce random number.
[0106] Upon receiving a device registration preparation request from the Nova-api interface, the CA certification center will perform remote report persistence preparation and generate a nonce random number. Then, it will return the registration preparation result, including the nonce random number, to the Nova-api interface.
[0107] S204: The Nova-api interface sends the device registration request to the Nova-compute interface.
[0108] When the Nova-api interface receives a response to a device registration request, it parses the response to obtain a nonce random number and then sends a device registration request containing the parsed nonce random number to the Nova-compute interface.
[0109] S205: The Nova-compute interface forwards the device registration request to the virtual machine.
[0110] The Nova-compute service sends this device registration request to the virtual machine.
[0111] S206: After the virtual machine obtains the device registration request, it collects the baseline PCR value through Tpm-vm-agent, and packages the baseline PCR value and the signature public key to generate a trusted report of the virtual machine.
[0112] The virtual machine contains a service called tpm-vm-agent that handles trusted computing requests. When the virtual machine receives a device registration request, tpm-vm-agent calls tpm-tools to generate an endorsement key, which then generates an asymmetric encryption signature public and private key. Finally, tpm-tools uses the private key and a nonce random number to export and encrypt the PCR information stored in the vtpm register to generate a trusted report for the virtual machine.
[0113] S207: The virtual machine sends the trusted report to the Nova-compute interface.
[0114] The virtual machine returns the trust report and the signing public key to the Nova-compute interface.
[0115] S208: The Nova-compute interface compresses the registration information of the virtual machine.
[0116] The registration information for the virtual machine includes the virtual machine's trusted report and signature public key.
[0117] Nova-compute uses a tpm-server-agent service to handle trusted business requests. When Nova-compute receives a trust report and signing public key from a virtual machine, the tpm-server-agent service compresses the trust report and signing public key, which are also the virtual machine's registration information.
[0118] S209: The Nova-compute interface sends the virtual machine's device request to the CA certification center.
[0119] The Nova-compute interface sends the compressed trusted report and the signature public key (i.e., the virtual machine's device request) to the CA certification center.
[0120] S210: Based on the device request, the CA certification center persists the trusted report.
[0121] In this process, the CA-agent within the CA certification center, upon receiving a device request, invokes the tpm2-tool to decrypt the trusted report using the previously recorded nonce and the transmitted signature public key, thereby obtaining the baseline PCR value and exporting it to the baseline report. The baseline report is then stored in the folder corresponding to the report's save path within the CA-resports-pool for this UUID. Simultaneously, the host-vmtable is updated, adding a mapping between the virtual machine and its host machine.
[0122] S211: The CA certification center returns the registration result of the virtual machine to the Nova-compute interface.
[0123] After the virtual machine registration process is completed, the CA certification center returns the registration result of the virtual machine to Nova-compute to store the registration result.
[0124] Understandably, any business that experiences firmware changes on the trusted chain of a virtual machine should trigger virtual machine device registration to update the benchmark report of the remote certification from the CA.
[0125] The cloud-based virtual machine registration method provided in this application collects the firmware status value in the trusted chain of the boot process during startup and stores the measurement result in a register, i.e., a baseline PCR value. Then, the tpm-tool is used to read the baseline PCR value from the register and encapsulates it into a trusted report using the private key of an asymmetric key generated by tpm-tool. This trusted report is then sent to a connected CA certification center as a baseline report for trusted boot and remote authentication. This method, by storing the baseline PCR value during the virtual machine registration process, achieves the purpose of preparing for remote authentication of the virtual machine.
[0126] Figure 4 The process of the cloud platform-based virtual machine remote authentication method provided in the embodiments of this application Figure 2 This embodiment is... Figure 1 Based on the examples, a detailed description of the virtual machine remote authentication method based on a cloud platform is provided. For example... Figure 4As shown, the virtual machine remote authentication method based on a cloud platform provided in this embodiment includes:
[0127] S401: The Nova-api interface retrieves remote authentication requests sent by users.
[0128] In this process, the user initiates a remote authentication request to Nova-api.
[0129] S402: The Nova-api interface sends a remote authentication preparation request to the CA certification center.
[0130] Upon receiving a remote authentication request, Nova-api sends a remote authentication preparation request to the CA (Certificate Authority).
[0131] S403: Based on the remote authentication preparation request, the CA authentication center returns the verification result to the Nova-api interface.
[0132] When the CA certification center receives the remote certification preparation request, it generates a nonce random number and the value of the list of banks of the PCR to be retrieved as the verification result and returns it to Nova-api.
[0133] S404: Based on the verification result, the Nova-api interface sends the remote authentication request to the Nova-compute interface.
[0134] After receiving the verification result, Nova-api sends a remote authentication request to Nova-compute.
[0135] S405: After receiving the remote authentication request, the Nova-compute interface sends the remote authentication request to the virtual machine.
[0136] Nova-compute then forwards this remote authentication request to the virtual machine. The remote authentication request contains a nonce random value and a pcr list, which represents the list value of the pcr bank to be obtained.
[0137] S406: The virtual machine obtains the remote authentication report through Tpm-vm-agent.
[0138] Within the virtual machine, a service called `tpm-vm-agent` handles remote authentication. Upon receiving a remote authentication request, it calls `tpm2-tool` to parse the request and obtain the nonce, the virtual machine's UUID, and the PCR list. It then retrieves the public key used to generate an asymmetric key from the endorsement key. This public key is typically generated during the device registration process and stored in a fixed path by the virtual machine. Next, it extracts the nonce from the report; this value is generated by the CA (Certificate Authority) to prevent retransmissions. It then retrieves the list of PCR banks defined in the report. Typically, TPM stores firmware status in 24 banks, with the first 10 banks usually defined. The first 10 lines store the hash value of the guest's firmware status. Finally, it calls `tpm2-tool` to sign and encrypt the obtained measurement object value using the private key, exporting the resulting virtual machine remote authentication report.
[0139] S407: The virtual machine returns a remote authentication report of the virtual machine to the Nova-compute interface.
[0140] Step S407 is similar to step S102 described above, and will not be repeated here.
[0141] S408: The Nova-compute interface merges the remote authentication report of the virtual machine and the remote authentication report of the host machine to obtain a remote authentication report.
[0142] Step S408 is similar to step S103 above, and will not be described again here.
[0143] S409: The Nova-compute interface sends the remote authentication report to the CA certification center.
[0144] Step S409 is similar to step S104 above, and will not be described again here.
[0145] S410: The CA certification center verifies the remote authentication report of the virtual machine and the remote authentication report of the host machine.
[0146] When the CA certification center receives a remote authentication request, it parses and obtains the remote authentication report of the current virtual machine and the remote authentication report of the host machine. Then, it obtains the public key of the asymmetric key generated by the endorsement key, obtains the generated nonce random number corresponding to the UUID of this virtual machine, and then performs verification by calling tpm2-tool.
[0147] Optionally, the verification mainly focuses on three aspects: 1. Whether the key is correct. 2. Whether the nonce is correct. 3. Whether the parsed target PCR value is consistent with the baseline PCR value previously stored on the device. If all three are equal, the verification passes; otherwise, the verification fails.
[0148] If the public key fails, an authentication failure error will be reported; if the nonce random number verification fails, an error message will be reported indicating command retransmission; if the PCR values are not equal, an error message will be reported indicating unequal status. In this case, manual intervention is required to analyze the cause of the failure. If the unequal PCR values are due to a reasonable reason, such as a customer upgrading firmware, the error will be reset to normal. If the unequal PCR values are caused by an unreasonable analysis, an error message will be reported indicating that the virtual machine is untrusted.
[0149] S411: The CA authentication center returns the remote authentication result to the Nova-compute interface.
[0150] Once the verification is complete, the CA certification center will return the remote certification result to Nova-compute.
[0151] S412: The Nova-compute interface stores the remote authentication result in the nova database.
[0152] After receiving the verification result, Nova-compute saves the result to the nova database. When the remote authentication result indicates that the virtual machine is in a normal state, the virtual machine's UUID is added to the whitelist, triggering a whitelist update. Then, the remote report of the virtual machines in the whitelist is updated to the CA certification center.
[0153] The cloud-based virtual machine remote authentication method provided in this application exports the hash value of the firmware state stored in the virtual machine's VTPM register PCR as a remote authentication report for the virtual machine. This report is then encrypted and encapsulated using a public key to form a trusted report, which is sent to a CA (Certificate Authority). The CA compares this report with the trusted report saved when the virtual machine was created to determine whether the virtual machine has changed and is in a trusted state. This method effectively verifies the consistency between the virtual machine's current security state and its expected settings by performing a rigorous authentication process on both the virtual machine and its host machine.
[0154] Figure 5 This is a schematic diagram of the structure of the cloud-based virtual machine remote authentication device provided in this application. Figure 5 As shown, the virtual machine remote authentication device 500 based on a cloud platform provided in this embodiment includes:
[0155] Module 501 is used to obtain remote authentication requests through a virtual machine;
[0156] The processing module 502 is used to parse and process the remote authentication request to obtain a PCR list and a nonce random number; generate a remote authentication report for the virtual machine based on the PCR list and the nonce random number, and send the remote authentication report of the virtual machine to the Nova-compute interface; merge the remote authentication report of the virtual machine and the remote authentication report of the host machine through the Nova-compute interface to obtain a remote authentication report, and send the remote authentication report to the CA certification center; after receiving the remote authentication report, the CA certification center performs remote authentication on the virtual machine.
[0157] Optionally, the acquisition module 501 is further configured to acquire the remote authentication request sent by the user through the Nova-api interface;
[0158] The processing module 502 is further configured to, after obtaining the remote authentication request sent by the user through the Nova-api interface, send a remote authentication preparation request to the CA certification center; according to the remote authentication preparation request, the CA certification center returns a verification result to the Nova-api interface; according to the verification result, the Nova-api interface sends the remote authentication request to the Nova-compute interface, and after the Nova-compute interface receives the remote authentication request, sends the remote authentication request to the virtual machine.
[0159] Optionally, the processing module 502 is further configured to, upon successful creation of the virtual machine, send a device registration preparation request to the CA certification center via the Nova-api interface, the device registration preparation request including the UUID of the virtual machine; based on the device registration preparation request, the CA certification center generates a nonce random number and returns a registration preparation result to the Nova-api interface, the registration preparation result including the nonce random number; based on the registration preparation result, the Nova-compute interface receives the device registration request sent by the Nova-api interface and forwards the device registration request to the virtual machine;
[0160] The acquisition module 501 is further configured to acquire the device registration request through the virtual machine;
[0161] The processing module 502 is further configured to: after the virtual machine obtains the device registration request, collect a baseline PCR value through Tpm-vm-agent, and package the baseline PCR value and the signature public key to generate a trusted report for the virtual machine; after receiving the trusted report through the Nova-compute interface, compress the registration information of the virtual machine and send the device request of the virtual machine to the CA certification center, wherein the registration information is the trusted report and the signature public key; according to the device request, the CA certification center persists the trusted report and returns the registration result of the virtual machine to the Nova-compute interface.
[0162] Optionally, the processing module 502 is further configured to, after the Tpm-vm-agent service of the virtual machine receives the remote authentication request, call the tpm2-tool tool to perform parsing processing based on the remote authentication request, and obtain the nonce random number, the UUID of the virtual machine and the PCR list.
[0163] Optionally, the acquisition module 501 is further configured to acquire the public key and private key of the virtual machine;
[0164] The processing module 502 is further configured to call the tpm2-tool to encrypt the public key, the PCR list, and the nonce random number using the private key, and generate a remote authentication report for the virtual machine.
[0165] Optionally, the device further includes: a judgment module 503 and a determination module 504;
[0166] The acquisition module 501 is further configured to acquire the public key, the UUID of the virtual machine, the PCR list, and the nonce random number based on the remote authentication report;
[0167] The processing module 502 is further configured to parse the PCR manifest to obtain the target PCR value, and verify the public key using the tpm2-tool tool;
[0168] The judgment module 503 is used to determine whether the nonce random number is correct when the public key verification is successful.
[0169] The processing module 502 is further configured to compare the target PCR value with the baseline PCR value when the nonce random number is correct.
[0170] The judgment module 503 is also used to determine whether the target PCR value is consistent with the benchmark PCR value;
[0171] The determining module 504 is further configured to determine that the virtual machine is in a trusted state when the target PCR value is consistent with the baseline PCR value.
[0172] Optionally, the acquisition module 501 is further configured to acquire manually sent analysis information when the target PCR value is inconsistent with the baseline PCR value, the analysis information being used to indicate whether the virtual machine is abnormal;
[0173] The determining module 504 is further configured to determine that the virtual machine is in a trusted state when the analysis information indicates that the virtual machine is normal.
[0174] Figure 6 This is a schematic diagram of the structure of the cloud-based virtual machine remote authentication device provided in this application. Figure 6 As shown, this application provides a virtual machine remote authentication device based on a cloud platform. The virtual machine remote authentication device 600 based on a cloud platform includes: a receiver 601, a transmitter 602, a processor 603, and a memory 604.
[0175] Receiver 601 is used to receive instructions and data;
[0176] Transmitter 602 is used to send commands and data;
[0177] Memory 604 is used to store instructions executed by the computer;
[0178] The processor 603 is used to execute computer execution instructions stored in the memory 604 to implement the various steps of the cloud platform-based virtual machine remote authentication method in the above embodiments. For details, please refer to the relevant descriptions in the foregoing embodiments of the cloud platform-based virtual machine remote authentication method.
[0179] Alternatively, the memory 604 can be either standalone or integrated with the processor 603.
[0180] When the memory 604 is set up independently, the electronic device also includes a bus for connecting the memory 604 and the processor 603.
[0181] This application also provides a computer storage medium storing computer execution instructions, which, when executed by a processor, implement the cloud-based virtual machine remote authentication method as described above by the cloud-based virtual machine remote authentication device.
[0182] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical nodes; for example, a physical node may have multiple functions, or a function or step may be performed collaboratively by several physical nodes. Some or all physical nodes may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.
[0183] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.
[0184] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.
Claims
1. A virtual machine remote authentication method based on a cloud platform, characterized in that, The method includes: The remote authentication request is obtained through the tpm-vm-agent service of the virtual machine, and the tpm2-tool is called to parse and process the remote authentication request to obtain the PCR list, the nonce random number and the UUID of the virtual machine; Based on the PCR list and the nonce random number, generate a remote authentication report for the virtual machine and send the remote authentication report for the virtual machine to the Nova-compute interface; The Nova-compute interface is used to call tpm-host-agent to obtain the remote authentication report of the host machine, and the remote authentication report of the virtual machine and the remote authentication report of the host machine are merged to obtain a remote authentication report, which is then sent to the CA certification center. After receiving the remote authentication report, the CA authentication center performs remote authentication on the virtual machine.
2. The method according to claim 1, characterized in that, The step of obtaining the remote authentication request through the virtual machine includes: After obtaining the remote authentication request sent by the user through the Nova-api interface, the remote authentication preparation request is sent to the CA certification center. Based on the remote authentication preparation request, the CA authentication center returns the verification result to the Nova-api interface; Based on the verification result, the Nova-api interface sends the remote authentication request to the Nova-compute interface, and after receiving the remote authentication request, the Nova-compute interface sends the remote authentication request to the virtual machine.
3. The method according to claim 1, characterized in that, After obtaining the remote authentication request sent by the user through the Nova-api interface, and before sending the remote authentication preparation request to the CA certification center, the method further includes: If the virtual machine is successfully created, a device registration preparation request is sent to the CA certification center through the Nova-api interface. The device registration preparation request includes the UUID of the virtual machine. Based on the device registration preparation request, the CA certification center generates a nonce random number and returns the registration preparation result to the Nova-api interface. The registration preparation result includes the nonce random number. Based on the registration preparation result, the Nova-compute interface receives the device registration request sent by the Nova-api interface and forwards the device registration request to the virtual machine; After the virtual machine obtains the device registration request, it collects the baseline PCR value through Tpm-vm-agent, and packages the baseline PCR value and the signature public key to generate a trusted report of the virtual machine. After receiving the trusted report through the Nova-compute interface, the registration information of the virtual machine is compressed and a device request for the virtual machine is sent to the CA certification center, wherein the registration information is the trusted report and the signature public key; Based on the device request, the CA certification center persists the trusted report and returns the registration result of the virtual machine to the Nova-compute interface.
4. The method according to claim 1, characterized in that, The step of generating a remote authentication report for the virtual machine based on the PCR list and the nonce random number includes: Obtain the public and private keys of the virtual machine, and call the tpm2-tool to encrypt the public key, the PCR manifest, and the nonce random number using the private key to generate a remote authentication report for the virtual machine.
5. The method according to claim 4, characterized in that, The step of remotely authenticating the virtual machine after receiving the remote authentication report from the CA authentication center includes: Based on the remote authentication report, obtain the public key, the UUID of the virtual machine, the PCR list, and the nonce random number; The PCR manifest is parsed to obtain the target PCR value, and the public key is verified using the tpm2-tool. When the public key verification is successful, determine whether the nonce random number is correct; When the nonce is correct, the target PCR value is compared with the baseline PCR value to determine whether the target PCR value is consistent with the baseline PCR value. When the target PCR value is consistent with the baseline PCR value, the virtual machine is determined to be in a trusted state.
6. The method according to claim 5, characterized in that, After determining whether the target PCR value is consistent with the baseline PCR value, the method further includes: When the target PCR value is inconsistent with the baseline PCR value, manually sent analysis information is obtained, and the analysis information is used to indicate whether the virtual machine is abnormal. When the analysis information indicates that the virtual machine is normal, the virtual machine is determined to be in a trusted state.
7. A virtual machine remote authentication device based on a cloud platform, characterized in that, The device includes: The acquisition module is used to obtain remote authentication requests through the virtual machine's tpm-vm-agent service; The processing module is used to call the tpm2-tool tool to parse and process the remote authentication request, obtaining the PCR list, the nonce random number, and the UUID of the virtual machine; based on the PCR list and the nonce random number, it generates a remote authentication report for the virtual machine and sends the remote authentication report of the virtual machine to the Nova-compute interface; through the Nova-compute interface, it calls tpm-host-agent to obtain the remote authentication report of the host machine, merges the remote authentication report of the virtual machine and the remote authentication report of the host machine to obtain a remote authentication report, and sends the remote authentication report to the CA certification center; after receiving the remote authentication report, the CA certification center performs remote authentication on the virtual machine.
8. A virtual machine remote authentication device based on a cloud platform, characterized in that, include: Memory; processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement a cloud platform-based virtual machine remote authentication method as described in any one of claims 1-6.
9. A computer storage medium, characterized in that, The computer storage medium stores computer execution instructions, which, when executed by a processor, are used to implement a cloud platform-based virtual machine remote authentication method as described in any one of claims 1-6.