Command processing method and related equipment

Abstract

The embodiment of the invention provides a command processing method and related equipment.The command processing method applied to a processor comprises the steps that command encryption information sent by a virtual machine manager is obtained, and the command encryption information comprises a memory address of target command data and a virtual equipment identifier of target virtual equipment; based on the virtual device identifier, determining memory key information corresponding to the target virtual machine; based on the memory key information and the memory address of the target command data, performing decryption to obtain a plaintext of the target command data; and executing a target command based on the plaintext of the target command data to obtain a command result of the target command. According to the command processing method and the related equipment, the data security of the virtual machine in the process of running the virtual equipment is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of virtual machine security, and in particular to a command processing method and related equipment. Background Art

[0002] With the development of new technologies such as cloud computing and big data, virtualization technology is being used more and more widely. Through virtualization technology, a physical host can be virtualized into multiple virtual machines (VMs), thereby efficiently utilizing the hardware resources of the physical host. Among them, in virtualization technology, for peripheral resources, the peripheral resources can be virtualized into virtual devices and allocated to virtual machines, thereby achieving efficient utilization of peripheral resources.

[0003] However, existing virtual machines have security risks when running virtual devices. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a command processing method and related devices, which are used to improve the security of data in a virtual machine during the process of running a virtual device.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions.

[0006] In a first aspect, an embodiment of the present invention provides a command processing method, applied to a processor, comprising:

[0007] Obtaining command encryption information sent by the virtual machine manager, the command encryption information including a memory address of target command data and a virtual device identifier of a target virtual device; wherein the memory encrypts the target command data based on a memory key corresponding to the target virtual machine;

[0008] Based on the virtual device identifier, determining memory key information corresponding to the target virtual machine;

[0009] Based on the memory key information and the memory address of the target command data, decrypt to obtain the plain text of the target command data;

[0010] The target command is executed based on the plain text of the target command data to obtain a command result of the target command.

[0011] Optionally, determining the memory key information corresponding to the target virtual machine based on the virtual device identifier is specifically: determining the memory key information based on device attribute information of the virtual device preset in the processor.

[0012] Optionally, after executing the target command based on the plain text of the target command data to obtain the command result of the target command, the method further includes:

[0013] Based on the memory key information, encrypting the command result of the target command and storing it in the memory;

[0014] Feedback a result acquisition notification message of the command result to the virtual machine manager, so that the virtual machine manager forwards the result acquisition notification message to the target virtual machine.

[0015] Optionally, the encrypting the command result of the target command based on the memory key information and storing it in the memory includes:

[0016] Determine a virtual device identifier of a target virtual device corresponding to the command result;

[0017] Based on the virtual device identifier, determine the memory key information of the target virtual machine corresponding to the command result;

[0018] The command result of the target command is encrypted and stored in the memory using the memory key corresponding to the memory key information.

[0019] Optionally, before obtaining the command encryption information sent by the virtual machine manager, the method further includes:

[0020] Based on the virtual device creation request sent by the virtual machine manager, create a target virtual device, and feed back a virtual device identifier of the target virtual device to the virtual machine manager;

[0021] After the virtual machine manager allocates the target virtual device to the target virtual machine, a corresponding relationship between the virtual device identifier and the memory key information of the target virtual machine is established based on the allocation information fed back by the virtual machine manager.

[0022] Optionally, establishing a correspondence between the virtual device identifier and the memory key information of the target virtual machine based on the allocation information fed back by the virtual machine manager includes:

[0023] Recording the allocation information into the device attribute information corresponding to the target virtual device;

[0024] Query and obtain memory key information of the target virtual device;

[0025] The memory key information is recorded in the device attribute information corresponding to the target virtual device.

[0026] In a second aspect, an embodiment of the present invention provides a command processing method, which is applied to a virtual machine manager, comprising:

[0027] Acquire command initial information sent by the target virtual machine; wherein the command initial information includes a memory address of target command data, and the memory encrypts the target command data based on a memory key corresponding to the target virtual machine;

[0028] Configuring a virtual device identifier of a target virtual device for the command initial information, and using the command initial information and the virtual device identifier as command encryption information;

[0029] The command encryption information is sent to a processor so that the processor executes the command processing method as described in the first aspect.

[0030] Optionally, configuring a virtual device identifier of a target virtual device for the command initial information includes:

[0031] Determine the virtual machine identifier of the target virtual machine that issues the initial information of the command;

[0032] Based on the virtual machine identifier, query the virtual device identifier of the virtual device configured to the target virtual machine;

[0033] The virtual device identifier is configured as a tag to the command initial information to form the command encryption information.

[0034] Optionally, after sending the command encryption information to the processor so that the processor executes the command processing method as described in the first aspect, the method further includes:

[0035] The result notification message fed back by the processor is obtained and forwarded to the target virtual machine.

[0036] Optionally, before obtaining the initial information of the command sent by the target virtual machine, the method further includes:

[0037] Sending a virtual device creation request to the processor, so that the processor creates a target virtual device based on the virtual device creation request and feeds back a virtual device identifier of the target virtual device;

[0038] Allocating the target virtual device to a target virtual machine, and recording allocation information of the target virtual device and the target virtual machine;

[0039] The allocation information is fed back to the processor, so that the processor establishes a corresponding relationship between the virtual device identifier and the memory key information of the target virtual machine based on the allocation information.

[0040] In a third aspect, an embodiment of the present invention provides a command processing method, which is applied to a target virtual machine, wherein the target virtual machine is assigned a target virtual device, comprising:

[0041] Writing the target command data into a memory; wherein the memory encrypts the target command data based on a memory key corresponding to the target virtual machine;

[0042] Sending command initial information to the virtual machine manager, wherein the command initial information includes the memory address of the target command data; so that the virtual machine manager configures the virtual device identifier of the target virtual device for the command initial information, uses the command initial information and the virtual device identifier as command encryption information, sends the command encryption information to the processor, and enables the processor to execute the command processing method as described in the first aspect.

[0043] Optionally, after sending the initial command information to the virtual machine manager, the method further includes:

[0044] Obtain the result notification message fed back by the virtual machine manager;

[0045] A notification message is obtained based on the result, and a command result stored in the memory is obtained.

[0046] In a fourth aspect, an embodiment of the present invention provides a processor configured with a cryptographic module, wherein the cryptographic module is used to execute the command processing method as described in the first aspect above.

[0047] Optionally, the password module is configured with a device information storage logic, and the device information storage logic is used to store device attribute information of the target virtual device, and a correspondence between the virtual device identifier and the memory key information of the target virtual machine is established in the device attribute information of the target virtual device.

[0048] Optionally, the cryptographic module is configured with a command processing logic, and the command processing logic is used to execute a target command to obtain a command result of the target command.

[0049] In a fifth aspect, an embodiment of the present invention provides a virtual machine manager configured with a command forwarding module, wherein the command forwarding module is used to execute the command processing method as described in the second aspect above.

[0050] Optionally, it also includes: a virtual identification configuration module, and the virtual identification configuration module records the configuration information of the virtual machine and the virtual device.

[0051] In a sixth aspect, an embodiment of the present invention provides a virtual machine, configured with a command processing device, wherein the command processing device is used to execute the command processing method as described in the third aspect above with the virtual machine as a target virtual machine.

[0052] In a seventh aspect, an embodiment of the present invention provides a computing device, comprising: the processor described in the fourth aspect, the virtual machine manager described in the fifth aspect, and the virtual machine described in the sixth aspect.

[0053] In an eighth aspect, an embodiment of the present invention provides a computer program product, comprising one or more computer executable instructions, which, when executed, implement the command processing method as described in the first aspect, the second aspect or the third aspect.

[0054] An embodiment of the present invention provides a command processing method and related equipment, wherein the command processing method applied to a processor includes: obtaining command encryption information sent by a virtual machine manager, the command encryption information including a memory address of target command data and a virtual device identifier of a target virtual device; wherein the memory encrypts the target command data based on a memory key corresponding to the target virtual machine; based on the virtual device identifier, determines the memory key information corresponding to the target virtual machine; based on the memory key information and the memory address of the target command data, decrypts to obtain the plaintext of the target command data; and sends the plaintext of the target command data to the target virtual device so that the target virtual device executes the target command and feeds back the command result of the target command.

[0055] It can be seen that when the target command data is written into the memory in the embodiment of the present invention, the memory encrypts the target command data based on the memory key corresponding to the target virtual machine, and in the command processing flow, the memory key information of the target virtual machine assigned to it is determined through the virtual device identifier in the command encryption information, thereby realizing the decryption of the target command data. In other words, the embodiment of the present invention adds an additional encryption and decryption process for command data, so that the command data can be stored in an encrypted manner, and when the command data needs to be used, the command data can be decrypted through the memory key information, so that the command data stored in the memory of the virtual machine in the embodiment of the present invention can adapt to the encryption mechanism of the memory, thereby improving the security of the data of the virtual machine in the process of calling the virtual device. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0057] Figure 1 is a schematic diagram of an optional architecture of a computing device using virtualization technology;

[0058] Figure 2 It is a schematic diagram of an optional architecture of a computing device using a virtualization technology provided by an embodiment of the present invention;

[0059] Figure 3 is an optional flow chart of a command processing method provided by an embodiment of the present invention;

[0060] Figure 4 is an optional flow chart of step S120 provided in an embodiment of the present invention;

[0061] Figure 5 is another optional flow chart of the command processing method provided by an embodiment of the present invention;

[0062] Figure 6 is an optional flow chart of step S170 provided in an embodiment of the present invention;

[0063] Figure 7 It is an optional flow chart of the virtual device configuration method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] As an optional example of the disclosure of the embodiments of the present invention, Figure 1 The following is an exemplary diagram of an optional architecture of a computing device using virtualization technology. It should be noted that the block diagram is provided to facilitate understanding of the contents disclosed in the embodiments of the present invention. The embodiments of the present invention are not limited to Figure 1 The architecture shown.

[0066] refer to Figure 1 , the virtual architecture may include: a host 1 , a virtual machine manager 2 and a peripheral device 3 .

[0067] Among them, host 1 can be understood as a physical host, including a processor and memory, and virtual machine manager 2 runs on the hardware provided by host 1. In an optional example, the processor in host 1 can run a host operating system, and configure a virtual machine manager (VMM, i.e., Virtual Machine Monitor) 2 through the host operating system running therein. Through virtualization technology, the processor in host 1 can also virtualize multiple virtual machines (VM, i.e., Virtual Machine), and the virtual machine manager 2 performs resource configuration management (such as memory resources and peripheral resources) of the multiple virtual machines.

[0068] To ensure the security and independence of data between virtual machines, the secure virtualization technology can configure corresponding keys for virtual machines, and encrypt the memory data of the virtual machines based on the corresponding keys and store them in the memory of the host 1, and decrypt them based on the corresponding keys when the virtual machines need to access them. In some scenarios, the virtual machines generated by the secure virtualization technology using encryption mechanisms can be called CVMs (Confidential Virtual Machines).

[0069] The peripheral device 3 is used to provide peripheral resources for the host, so that the host 1 can allocate and use resources based on the peripheral resources provided by the peripheral device 3. Among them, the peripheral device 3 can be, for example, a cryptographic card (such as a PCI cryptographic card, where PCI is Peripheral Component Interconnect, i.e., peripheral component interconnect), a GPU (graphics processing unit), a GPGPU (graphics processing unit for general computing), or an accelerator card for AI (artificial intelligence) and deep learning, etc. In some optional implementations, the host can configure the peripheral device as a virtual device based on real-time needs, and configure the virtual device as an available peripheral resource for the virtual machine.

[0070] However, the inventor believes that there are security risks in the process of running virtual devices in virtual machines.

[0071] This is because, in virtualization technology, virtual devices can be directly connected to the virtual machine. Based on this direct mechanism (DMA, i.e. Direct Memory Access), when enabling a virtual device to execute a specific command, the corresponding command data needs to be directly transferred from the memory to the virtual device of the virtual machine, so that the virtual device executes the corresponding command based on the command data.

[0072] However, virtual devices such as PCI cryptographic cards usually do not have the function of decrypting encrypted data in memory, and can only accept plain text data of command data. At this time, in order to meet the requirements of peripheral devices for command data, even in the scenario where the virtual machine is allocated with memory with encryption mechanism, the virtual machine needs to use unencrypted memory to store the corresponding command data (for example, a special memory segment with memory encryption mechanism turned off to store the corresponding command data to ensure that the command data is plain text), which makes the corresponding command data have inevitable security risks.

[0073] In view of this, an embodiment of the present invention provides a command processing method and related equipment, wherein the command processing method applied to a processor includes: obtaining command encryption information sent by a virtual machine manager, the command encryption information including a memory address of target command data and a virtual device identifier of a target virtual device; wherein the memory encrypts the target command data based on a memory key corresponding to the target virtual machine; based on the virtual device identifier, determines the memory key information corresponding to the target virtual machine; based on the memory key information and the memory address of the target command data, decrypts to obtain the plaintext of the target command data; and sends the plaintext of the target command data to the target virtual device, so that the target virtual device executes the target command and feeds back the command result of the target command.

[0074] It can be seen that when the target command data is written into the memory in the embodiment of the present invention, the memory encrypts the target command data based on the memory key corresponding to the target virtual machine, and in the command processing flow, the memory key information of the target virtual machine assigned to it is determined through the virtual device identifier in the command encryption information, thereby realizing the decryption of the target command data. In other words, the embodiment of the present invention adds an additional encryption and decryption process for command data, so that the command data can be stored in an encrypted manner, and when the command data needs to be used, the command data can be decrypted through the memory key information, so that the command data stored in the memory of the virtual machine in the embodiment of the present invention can adapt to the encryption mechanism of the memory, thereby improving the security of the data of the virtual machine in the process of calling the virtual device.

[0075] The command processing solution provided by the embodiment of the present invention is described in detail below.

[0076] refer to Figure 2 An optional architecture diagram of a computing device using virtualization technology is shown, such as Figure 2 As shown, the architecture virtualizes multiple virtual machines based on virtualization technology, including: a virtual machine layer 11 composed of multiple virtual machines, a virtual machine manager 12 and a processor (Central Processing Unit, CPU) 13.

[0077] Among them, the processor 13 is configured with a cryptographic module, and the cryptographic module can virtualize multiple virtual devices based on the needs of the virtual device and allocate them to the virtual machine, so that the virtual machine regards the virtual device allocated to the virtual machine as a peripheral device exclusively owned by the virtual machine, so that the virtual machine calls the resources of the virtual device to execute corresponding commands based on the request for the virtual device. In some examples, the virtual device can also be called a virtual cryptographic module (VCM, VirtualCryto Module), a physical cryptographic module can virtualize multiple VCMs, and a VCM can be allocated to a virtual machine for use, and the virtual cryptographic module can provide complete cryptographic module functions, so that the virtual machine believes that it has an independent cryptographic module.

[0078] It should be noted that the cryptographic module is located in the processor 13, but the virtual device virtualized by it provides a calling interface to the virtual machine so that the virtual machine executes corresponding commands based on the resources provided by the cryptographic module. Therefore, from the perspective of the virtual machine, the calling and function implementation of the virtual device are both implemented in the form of an external device, so that the virtual device virtualized by the cryptographic module can be regarded as a external device.

[0079] In this embodiment, taking a virtual machine as an example, the virtual machine can be called a target virtual machine, the corresponding virtual device can be called a target virtual device, the command issued by the target virtual device that needs to be executed can be called a target command, and the command data corresponding to the target command can be called target command data. It can be understood that the target virtual device is a virtual device assigned to the target virtual machine. When the target virtual device is required to execute the target command, the target command data is first written into the memory, and the memory can encrypt the target command data based on the memory key corresponding to the target virtual machine, and send the command initial information including the memory address of the target command data to the virtual machine manager.

[0080] Furthermore, the virtual machine manager 12 in the virtual architecture is further configured with a command forwarding module and a virtual identifier configuration module, so as to configure the virtual device identifier of the target virtual machine for the corresponding command initial information when forwarding the command initial information.

[0081] In this embodiment, the virtual device is configured with a virtual device identifier, so that based on the virtual device identifier, the memory key information corresponding to the target virtual machine can be obtained, and based on the memory key information and the memory address of the target command data, the plaintext of the target command data can be decrypted to obtain the plaintext of the target command data, thereby sending the plaintext of the target command data to the target virtual device.

[0082] Correspondingly, the configured target virtual device executes the target command, and the cryptographic module further encrypts the command result of the target command based on the memory key corresponding to the target virtual machine and stores it in the memory, and feeds back the result information of the command result to the target virtual machine.

[0083] Based on the optional architecture of the above-mentioned computing device, an embodiment of the present invention further provides a command processing method, which can be applied to the computing device of the above-mentioned architecture, and can also be applied to other computing devices of other architectures that can implement the method. Figure 3 FIG. 1 shows an optional flow chart of a command processing method provided by an embodiment of the present invention, which is used for executing when a target virtual machine issues a target command to a target virtual device. Figure 3 , the method comprises the following steps:

[0084] Step S100: The target virtual machine writes the target command data into the memory;

[0085] Among them, the target virtual machine can be understood as any virtualized virtual machine, which interacts with its configured virtual device through command data based on memory, and the virtual machine encrypts its memory data based on secure virtualization technology, that is, based on the key corresponding to the virtual machine, the memory data stored in the memory is encrypted and stored, and when it needs to be read, the memory data is decrypted and read based on the key.

[0086] In combination with the foregoing, the virtual device corresponding to the target virtual machine, that is, the virtual device configured to the target virtual machine can be called the target virtual device, the command issued by it that needs to be executed by the target virtual device can be called the target command, and the command data corresponding to the target command can be called the target command data.

[0087] It is understandable that when the target virtual device is required to execute the target command, the target command data is first written into the memory, and the memory can encrypt the target command data based on the memory key corresponding to the target virtual machine. In some optional examples, the target command data stored in the memory can also be called an encrypted command block (ECB, Encrypted Command Buffer).

[0088] It should be noted that the target virtual machine (i.e., virtual machine) as a client does not need to know the corresponding memory key. The host's hardware device only determines the memory key corresponding to the target virtual machine based on a preset mechanism in the underlying processing logic, and encrypts and decrypts data based on the memory key. Accordingly, the target virtual machine does not need to know the specific encryption information, and may not even notice that the corresponding memory data has been encrypted.

[0089] Similarly, the virtual machine manager only acts as a resource configuration and management party and does not need to know the memory key corresponding to the target virtual machine (ie, virtual machine), thereby ensuring the data security of the target virtual machine to the greatest extent.

[0090] It is understandable that when a virtual machine uses unencrypted memory to store corresponding command data (ie, the command data is in plain text), there may be a risk that the corresponding command data may be stolen by the virtual machine manager. The solution proposed in the embodiment of the present invention can solve this problem.

[0091] Step S110: The target virtual machine sends command initial information to the virtual machine manager;

[0092] The command initial information at least includes the memory address of the target command data, so that corresponding processing is performed based on the memory address. In the example where the target command data stored in the memory is an encrypted command block, the memory address of the target command data is the memory address of the encrypted command block.

[0093] Accordingly, the virtual machine manager can obtain the initial information of the command sent by the target virtual machine. In an optional example, the command forwarding module in the virtual machine manager can obtain the initial information of the command sent by the target virtual machine.

[0094] Step S120: The virtual machine manager configures a virtual device identifier of a target virtual device for the command initial information, and uses the command initial information and the virtual device identifier as command encryption information;

[0095] The virtual device identifier (also referred to as VID) can be understood as identification information for indicating the virtual device. When the virtual device is assigned to the corresponding virtual machine, the virtual device and the virtual machine are bound based on the virtual device identifier, so that the virtual machine bound to it can be determined based on the virtual device identifier, and then the memory key information of the corresponding virtual machine can be obtained.

[0096] It is understandable that after completing the configuration of the virtual machine and the virtual device (that is, the binding of the virtual device and the virtual machine), the virtual device identifier of the target virtual device corresponding to the target virtual machine can be determined based on the issuer of the command initial information, that is, the target virtual machine. In an optional example, the command initial information can also carry the identity information of the target virtual machine or the identity information of the virtual device, so that the virtual device identifier can also be determined based on the identity information of the target virtual machine or the identity information of the virtual device carried in the command initial information, and the virtual device identifier is further configured to the command initial information, so that the command initial information and the virtual device identifier are used as the command encryption information.

[0097] In an alternative example, refer to Figure 4An optional flow chart of step S120 is shown, and step S120 may include the following process:

[0098] Step S121, determining the virtual machine identifier of the target virtual machine that issues the initial information of the command;

[0099] In combination with the foregoing, the virtual machine manager can confirm the virtual machine identifier of the target virtual machine based on the sender of the command initial information, or the command initial information can also carry the identity information of the target virtual machine, and the virtual machine identifier of the target virtual machine can be confirmed based on the identity information of the target virtual machine.

[0100] Step S122: querying the virtual device identifier of the virtual device configured to the target virtual machine based on the virtual machine identifier;

[0101] It should be noted that the virtual machine manager may record configuration information between the virtual machine and the virtual device (for example, binding information between the virtual machine and the virtual device), so that the virtual device identifier of the target virtual device configured to the target virtual machine can be determined by query.

[0102] In a specific example, the virtual identification configuration module may record configuration information of the virtual machine and the virtual device. Accordingly, step S122 may be obtained by querying the virtual identification configuration module by the command forwarding module in the virtual machine manager.

[0103] Step S123: configure the virtual device identifier as a tag to the command initial information to form the command encryption information.

[0104] In an optional example, the virtual device identifier may be used as a tag (ie, added) to the command initial information to form the command encryption information.

[0105] It is understandable that, since the target command data is encrypted and stored in the memory, the virtual machine manager cannot parse and obtain the content therein, thereby protecting the data security of the virtual device.

[0106] In an optional example, step S120 may be performed by a command forwarding module in the virtual machine manager.

[0107] Continue to refer Figure 3 , executing step S130, the virtual machine manager sends the command encryption information to the processor;

[0108] The command encryption information includes at least the memory address of the target command data and the virtual device identifier of the target virtual device, so that the processor can determine the memory key based on the information, and then realize the decryption of the memory data under the pass-through mechanism.

[0109] Accordingly, the processor can obtain the command encryption information sent by the virtual machine manager. In an optional example, the command forwarding module in the virtual machine manager can send the command encryption information to the password module of the processor.

[0110] Step S140: The processor determines the memory key information corresponding to the target virtual machine based on the virtual device identifier;

[0111] Among them, since the command encryption information is configured with a virtual device identifier, the memory key information of the corresponding target virtual machine can be determined based on the virtual device identifier.

[0112] In a specific example, the memory key information can be determined based on the device attribute information of the virtual device preset in the processor. Among them, a correspondence between the virtual device identifier and the memory key information of the target virtual machine is established in the device attribute information of the target virtual device. Specifically, the device attribute information of the virtual device can be the context of the virtual device, in which the relevant configuration information of the virtual machine configured by the target virtual device can be saved. For example, for the target virtual device, the context of the target virtual device at least includes the memory key information of the target virtual machine. In a specific example, the memory key information can be a memory key identifier. Taking the memory key as MEK as an example, the memory key identifier is the ID of MEK.

[0113] In an optional example, step S140 may be performed by a cryptographic module in a processor. Specifically, a device information storage logic may be configured in the cryptographic module, and the device attribute information of the target virtual device may be stored using the device information storage logic, so that the cryptographic module may determine the memory key information of the target virtual machine based on the information stored in the device information storage logic.

[0114] Step S150: The processor decrypts the target command data based on the memory key information and the memory address of the target command data to obtain the plain text of the target command data;

[0115] After determining the specific memory key information, decryption of the target command data can be performed.

[0116] In an optional example, the cryptographic module of the processor may be configured with command processing logic, so that the command processing logic can be used to decrypt the plain text of the target command data based on the memory key information and the memory address of the target command data. The memory key information may be, for example, an identifier (ie, ID) of a memory encryption key (MEK, MemoryEncryption Key).

[0117] In a further optional example, a key management module may be further configured in the processor to manage the memory key, such as recording the correspondence between the memory key information and the memory key, so as to determine the specific memory key based on the memory key information.

[0118] Step S160: The processor executes the target command based on the plain text of the target command data to obtain a command result of the target command;

[0119] It is understandable that after decrypting the target command data, the plaintext of the target command data can be determined, and further the command processing logic of the cryptographic module can execute the target command based on the plaintext to obtain the command result of the target command. In a specific example, the execution of the target command can be, for example, using the target virtual device to perform a cryptographic operation on the data to be operated in the target command data, such as an encryption operation or a decryption operation. The target command is the command corresponding to the target command data.

[0120] Among them, in the example that supports memory encryption, the processor will configure the corresponding memory key for the virtual machine in advance. When different virtual machines access the memory, the processor will automatically use the corresponding memory key to encrypt and decrypt the memory data. For example, the encryption and decryption engine uses the corresponding memory key according to the virtual machine identifier (ASID) of the virtual machine to implement encryption and decryption of the memory data, wherein different virtual machines correspond to different virtual machine identifiers and different memory keys. The command processing method of the embodiment of the present invention can make the interaction of the corresponding virtual device adapt to the memory encryption scheme, thereby improving the security of the command data.

[0121] In a further example, the embodiment of the present invention also provides a processing flow of command results. For details, refer to Figure 5 Another optional flow chart of the command processing method provided by the embodiment of the present invention is shown, and the processing flow of the command result further includes:

[0122] Step S170: The processor encrypts the command result of the target command based on the memory key information and stores the result into the memory;

[0123] After obtaining the command result fed back by the target virtual device, the command processing logic of the cryptographic module can further encrypt the command result based on the memory key information and store it in the memory.

[0124] In a specific example, refer to Figure 6 An optional flow chart of step S170 is shown, where step S170 may include:

[0125] Step S171, determining the virtual device identifier of the target virtual device corresponding to the command result;

[0126] It is understandable that the processor can determine the specific virtual device identifier based on the command result.

[0127] Step S172: determining the memory key information of the target virtual machine corresponding to the command result based on the virtual device identifier;

[0128] The memory key information of the target virtual machine may be determined based on the device attribute information of the virtual device preset in the processor. For details, please refer to the description of step S140.

[0129] Step S173: using the memory key corresponding to the memory key information, encrypt the command result of the target command and store it in the memory.

[0130] After the memory key information is determined, a corresponding memory key may be determined based on the memory key information, and then the command result of the target command may be encrypted and stored in the memory using the memory key.

[0131] Wherein, step S170 can be executed based on the command processing logic in the cryptographic module.

[0132] Continue to refer Figure 5 , executing step S180, the processor feeds back a result acquisition notification message of the command result to the virtual machine manager;

[0133] The result acquisition notification message of the command result is fed back to the virtual machine manager, so that the virtual machine manager forwards the result acquisition notification message to the target virtual machine.

[0134] The result acquisition notification message is used to indicate that the command result of the target command has been acquired, so that the target virtual machine reads the corresponding command result in a preset memory page after receiving the result acquisition notification message.

[0135] Wherein, step S180 can be executed based on the command processing logic in the cryptographic module.

[0136] Step S190: the virtual machine manager forwards the result acquisition notification message to the target virtual machine;

[0137] Wherein, step S190 may be executed based on a command forwarding module in the virtual machine manager.

[0138] Step S200: The target virtual machine obtains a notification message based on the result and obtains a command result stored in the memory;

[0139] It can be understood that in the example of supporting memory encryption, the processor will configure the corresponding memory key for the virtual machine in advance. When the virtual machine accesses the memory, the processor will automatically use the corresponding memory key to encrypt and decrypt the memory data. Correspondingly, after the target virtual machine obtains the result notification message, it can directly access the command result based on the normal memory access process.

[0140] In a further optional example, the embodiment of the present invention further provides a virtual device configuration method adapted to the aforementioned command processing scheme, which is used to configure a virtual device for a virtual machine and provides a basis for the command processing method provided by the embodiment of the present invention. Specifically, the virtual device configuration method is used to be executed before the command processing method of the present invention, referring to Figure 7 An optional flow chart of a virtual device configuration method is shown, the virtual device configuration method comprising:

[0141] Step S300: The virtual machine manager sends a virtual device creation request to the processor;

[0142] A virtual device creation request is sent to request the processor to create a virtual device. Taking the creation of a target virtual device for a target virtual machine as an example, the virtual device creation request is used to request the processor to create a target virtual device.

[0143] In a specific example, the cryptographic module in the processor may provide a virtual device creation interface for the virtual machine manager, and the virtual machine manager may send the virtual device creation request by calling the virtual device creation interface, so that the processor may start the virtual device creation process.

[0144] It should be noted that the creation of a virtual device can be performed before or after the creation process of the target virtual machine; when performed after the creation process of the target virtual machine, the identity information of the corresponding target virtual machine can be sent to the processor at the same time, so that the processor can perform corresponding configuration information or establish a record of corresponding relationship information based on the identity information.

[0145] Step S310: The processor creates a target virtual device based on the virtual device creation request, and feeds back a virtual device identifier of the target virtual device to the virtual machine manager;

[0146] The target virtual device is an exclusive resource allocated to the target virtual machine, but it can be regarded as an independent device on the target virtual machine side.

[0147] The processor can create a target virtual device based on the virtual device creation request, and after the creation is completed, feed back the virtual device identifier of the target virtual device to the virtual machine manager, so that the virtual machine manager binds the target virtual device to the target virtual machine and records the corresponding binding relationship.

[0148] It should be noted that the process of creating a target virtual device includes the creation of device attribute information of the target virtual device, so that the attribute information of the target virtual device is recorded based on the device attribute information of the target virtual device.

[0149] In an optional example, the device attribute information of the target virtual device may at least include configuration information of the target virtual device and the target virtual machine, and memory key information corresponding to the target virtual machine. It is understandable that when the target virtual device is created and the configuration relationship between the target virtual device and the target virtual machine has not yet been established, the corresponding configuration information and memory key information in the device attribute information of the target virtual device may be invalid information or blank information, and will be written after the configuration relationship between the target virtual device and the target virtual machine is established.

[0150] Step S320: The virtual machine manager allocates the target virtual device to the target virtual machine, and records allocation information of the target virtual device and the target virtual machine;

[0151] By recording the allocation information of the target virtual device and the target virtual machine, an information basis is provided for configuring the virtual device identifier of the target virtual device for the command initial information sent by the target virtual machine in the command processing flow.

[0152] In a specific example, the virtual machine manager can implement the allocation described in this step by binding the target virtual device to the target virtual machine, and accordingly, the allocation information can be the binding information of the target virtual device and the target virtual machine. By binding the target virtual device to the target virtual machine, the target virtual machine can legally use the exclusive resources configured for it.

[0153] In a specific example, the cryptographic module in the processor may provide a virtual device binding interface for the virtual machine manager, and the virtual machine manager may send allocation information (eg, binding information) of the target virtual device and the target virtual machine by calling the virtual device binding interface.

[0154] The virtual identification configuration module may record the allocation information of the target virtual device and the target virtual machine to provide information support for the command processing method provided in the embodiment of the present invention. In a specific example set, the virtual machine manager may record the allocation information based on the target virtual device identification.

[0155] In an optional example, the virtual machine manager may allocate a target virtual device to the target virtual machine when the target virtual machine is started, or may allocate a target virtual device to the target virtual machine when the target virtual machine is created, and the embodiment of the present invention does not make any specific limitation here.

[0156] Step S330: the virtual machine manager feeds back the allocation information to the processor;

[0157] Step S340: The processor establishes a correspondence between the virtual device identifier and the memory key information of the target virtual machine based on the allocation information.

[0158] By establishing a correspondence between the virtual device identifier and the memory key information of the target virtual machine, information support is provided for the step of determining the memory key information corresponding to the target virtual machine based on the virtual device identifier in the command processing flow.

[0159] In a specific example, the allocation information can be recorded in the device attribute information corresponding to the target virtual device, and the memory key information of the target virtual machine can be queried and obtained, and then the memory key information can be recorded in the device attribute information corresponding to the target virtual device, thereby establishing a correspondence between the virtual device identifier and the memory key information of the target virtual machine.

[0160] Among them, the processor can record the configuration information and memory key information into the device information storage logic used to store the device attribute information of the target virtual device, thereby providing information support for the command processing method provided in the embodiment of the present invention.

[0161] It can be understood that the resource overhead of creating a virtual device in the embodiment of the present invention mainly includes the memory occupied by the virtual device device attribute information and the virtual device identifier configured for the virtual device. In the context of increasingly abundant memory resources, the resources consumed in this solution are obviously insignificant.

[0162] It should be noted that some conventional peripheral device virtualization technologies, such as the SRIOV (Single Root I / O Virtualization) technology applied to PCI devices, require hardware resource support from the peripheral devices, resulting in limited data on the peripheral devices that can be created. In comparison, the embodiments of the present invention can expand the number of virtual devices with fewer resources, thereby placing less restrictions on the number of virtual devices that can be created.

[0163] In addition, in some conventional peripheral device virtualization technologies, a virtual device appears as an independent peripheral device on the bus, so it is necessary to configure the corresponding device number and occupy the corresponding bus resources during interaction. The embodiment of the present invention executes the corresponding commands based on the cryptographic module inside the processor, so there is no need to occupy bus resources. In other words, in comparison, the command processing method of the embodiment of the present invention can reduce resource consumption.

[0164] An embodiment of the present invention further provides a virtual machine, in which a command processing device is configured. The command processing device is used to use the virtual machine as a target virtual machine to execute the command processing method applied to the target virtual machine in the above embodiment.

[0165] The embodiment of the present invention further provides a computing device, and the optional architecture of the computing device can refer to Figure 2 , including: a processor provided by an embodiment of the present invention, a virtual machine manager provided by an embodiment of the present invention, and a virtual machine provided by an embodiment of the present invention.

[0166] An embodiment of the present invention further provides a computer program product, which may include one or more computer executable instructions, and the one or more computer executable instructions implement the command processing method as described above when executed.

[0167] The above describes multiple implementation schemes provided by the embodiments of the present invention. The various optional methods introduced in the implementation schemes can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible implementation schemes, which can all be considered as implementation schemes disclosed and open in the embodiments of the present invention.

[0168] Although the embodiments of the present invention are disclosed above, the present invention is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the scope defined by the claims.

Claims

1. A command processing method, characterized in that: Applicable to processors, including: Obtaining command encryption information sent by the virtual machine manager, the command encryption information including a memory address of target command data and a virtual device identifier of a target virtual device; wherein the memory encrypts the target command data based on a memory key corresponding to the target virtual machine; Based on the virtual device identifier, determining memory key information corresponding to the target virtual machine; Based on the memory key information and the memory address of the target command data, decrypt to obtain the plain text of the target command data; The target command is executed based on the plain text of the target command data to obtain a command result of the target command.

2. The command processing method according to claim 1, characterized in that: The determining of the memory key information corresponding to the target virtual machine based on the virtual device identifier specifically includes: determining the memory key information based on device attribute information of the virtual device preset in the processor.

3. The command processing method according to claim 1, characterized in that: After executing the target command based on the plain text of the target command data to obtain the command result of the target command, the method further includes: Based on the memory key information, encrypting the command result of the target command and storing it in the memory; Feedback a result acquisition notification message of the command result to the virtual machine manager, so that the virtual machine manager forwards the result acquisition notification message to the target virtual machine.

4. The command processing method according to claim 3, characterized in that: The step of encrypting the command result of the target command based on the memory key information and storing the result in the memory includes: Determine a virtual device identifier of a target virtual device corresponding to the command result; Based on the virtual device identifier, determine the memory key information of the target virtual machine corresponding to the command result; The command result of the target command is encrypted and stored in the memory using the memory key corresponding to the memory key information.

5. The command processing method according to claim 1, characterized in that: Before obtaining the encrypted command information sent by the virtual machine manager, the method further includes: Based on the virtual device creation request sent by the virtual machine manager, create a target virtual device, and feed back a virtual device identifier of the target virtual device to the virtual machine manager; After the virtual machine manager allocates the target virtual device to the target virtual machine, a corresponding relationship between the virtual device identifier and the memory key information of the target virtual machine is established based on the allocation information fed back by the virtual machine manager.

6. The command processing method according to claim 5, characterized in that: Based on the allocation information fed back by the virtual machine manager, a correspondence between the virtual device identifier and the memory key information of the target virtual machine is established, including: Recording the allocation information into the device attribute information corresponding to the target virtual device; Query and obtain memory key information of the target virtual device; The memory key information is recorded in the device attribute information corresponding to the target virtual device.

7. A command processing method, characterized in that: Applies to hypervisors, including: Acquire command initial information sent by the target virtual machine; wherein the command initial information includes a memory address of target command data, and the memory encrypts the target command data based on a memory key corresponding to the target virtual machine; Configuring a virtual device identifier of a target virtual device for the command initial information, and using the command initial information and the virtual device identifier as command encryption information; The command encryption information is sent to a processor so that the processor executes the command processing method as claimed in claim 1.

8. The command processing method according to claim 7, characterized in that: The step of configuring the virtual device identifier of the target virtual device for the command initial information includes: Determine the virtual machine identifier of the target virtual machine that issues the initial information of the command; Based on the virtual machine identifier, query the virtual device identifier of the virtual device configured to the target virtual machine; The virtual device identifier is configured as a tag to the command initial information to form the command encryption information.

9. The command processing method according to claim 7, characterized in that: After sending the command encryption information to the processor so that the processor executes the command processing method according to claim 1, the method further comprises: The result notification message fed back by the processor is obtained and forwarded to the target virtual machine.

10. The command processing method according to claim 7, characterized in that: Before obtaining the initial information of the command sent by the target virtual machine, the method further includes: Sending a virtual device creation request to the processor, so that the processor creates a target virtual device based on the virtual device creation request and feeds back a virtual device identifier of the target virtual device; Allocating the target virtual device to a target virtual machine, and recording allocation information of the target virtual device and the target virtual machine; The allocation information is fed back to the processor, so that the processor establishes a corresponding relationship between the virtual device identifier and the memory key information of the target virtual machine based on the allocation information.

11. A command processing method, characterized in that: Applied to a target virtual machine, the target virtual machine is allocated with a target virtual device, including: Writing the target command data into a memory; wherein the memory encrypts the target command data based on a memory key corresponding to the target virtual machine; Sending command initial information to a virtual machine manager, wherein the command initial information includes a memory address of target command data; so that the virtual machine manager configures a virtual device identifier of a target virtual device for the command initial information, using the command initial information and the virtual device identifier as command encryption information, sending the command encryption information to a processor, and causing the processor to execute the command processing method as described in claim 1.

12. The command processing method according to claim 11, characterized in that: After sending the command initial information to the virtual machine manager, the method further includes: Obtain the result notification message fed back by the virtual machine manager; A notification message is obtained based on the result, and a command result stored in the memory is obtained.

13. A processor, characterized in that: A password module is configured, and the password module is used to execute the command processing method according to any one of claims 1 to 6.

14. The processor according to claim 13, characterized in that The password module is configured with a device information storage logic, and the device information storage logic is used to store device attribute information of the target virtual device. The device attribute information of the target virtual device establishes a corresponding relationship between the virtual device identifier and the memory key information of the target virtual machine.

15. The processor according to claim 13, characterized in that The password module is configured with a command processing logic, and the command processing logic is used to execute a target command to obtain a command result of the target command.

16. A virtual machine manager, characterized in that: A command forwarding module is configured, and the command forwarding module is used to execute the command processing method as described in any one of claims 7-10.

17. The virtual machine manager according to claim 16, characterized in that: Also includes: A virtual identification configuration module records configuration information of virtual machines and virtual devices.

18. A virtual machine, characterized in that: A command processing device is configured, and the command processing device is used to execute the command processing method according to any one of claims 11-12 with the virtual machine as the target virtual machine.

19. A computing device, characterized in that include: The processor of any one of claims 13 to 15, the virtual machine manager of any one of claims 16 to 17, and the virtual machine of claim 18.

20. A computer program product, characterized in that It comprises one or more computer executable instructions, and when the one or more computer executable instructions are executed, the command processing method according to any one of claims 1 to 12 is implemented.

Images