Virtual machine trusted startup method based on dual-system architecture

Abstract

The invention discloses a trusted startup method for a virtual machine based on a dual-system architecture. The trusted startup method comprises the following three parts: S1, constructing a virtual trusted root; and S2, constructing a trust chain from the physical trusted root to the virtual trusted root. And S3, starting acquisition of key information by the virtual machine. On the basis of a protection part TPCM physical trusted root, the credibility of a physical base is transmitted to an upper layer through credibility verification, and a vTPCM virtual trusted root of each virtual machine is constructed in a virtualized mode; based on the vTPCM virtual trusted root of each virtual machine, a complete trusted chain is established for a trusted verification mechanism in the virtual machine, and the trusted characteristic of the vTPCM is expanded to the virtual machine, so that the security guarantee for the startup of a virtualization platform and the virtual machine in the cloud environment is realized.

Description

Technical Field

[0001] The present invention relates to the fields of information security and virtualization, and in particular to a virtual machine trusted startup method based on a dual-architecture. Background Art

[0002] Cloud computing is a new computing model centered on resource leasing, application hosting, and service outsourcing. By entrusting computing tasks and data to cloud service providers, users can greatly reduce their computing and storage burdens. Virtualization technology is the underlying core technology in cloud computing, which needs to provide cloud users with an isolated and secure computing environment. However, as the scale of cloud computing expands, the endless security issues faced by virtualized environments have become the main obstacle to the implementation of cloud services.

[0003] Building a trusted cloud computing platform is an effective means to solve the above problems. Trusted computing is a forward-looking security technology, which aims to perform security protection while performing computing operations, so that the results of operations and process behaviors are always consistent with expectations under any conditions, and the entire computing process is measurable and controllable without interference, thereby establishing an active defense information security assurance system. In order to establish an independent and controllable domestic trusted computing system, my country took the lead in proposing active immune trusted computing and built a dual architecture with computing and protection in parallel. In the dual architecture, the protection component side uses TPCM as the trusted root to perform trusted verification and active measurement of the entire platform, enhance the computing power and control capabilities of the trusted chip, realize active control of the computing platform, and provide support for building a trust chain from the physical trust root to the virtual trust root.

[0004] The patent name of CN117744088A is "A virtual machine trusted startup method based on TPCM under ARM architecture", which is characterized by adding a TPCM interface call function in the KVM module to expand the measurement values ​​of each component in the virtual machine startup process into the protected storage area corresponding to TPCM; and adding measurement hooks in QEMU, UEFI, SHIM, and GRUB respectively, so that they provide measurement functions for UEFI, SHIM, GRUB, and OS Kernel, and pass the measurement information to TPCM through KVM, thereby ensuring the security of the virtual machine startup process. However, the chain trust chain structure used in this solution has too many trust chain nodes, resulting in serious trust loss, and this method does not adopt a dual system architecture and cannot guarantee the security of the server computing environment.

[0005] The patent name CN112905300A is "A method and system for trusted startup of a virtual machine", which is characterized in that during the startup process of the host machine, the host system is security-measured through the built-in security chip of the server to ensure the trustworthiness of the host system, and then the virtual machine is booted using the virtual unified extensible firmware interface in the host machine, and the measurement value is generated based on the virtual machine core file in the virtual machine image read by the virtual unified extensible firmware interface, where the core file refers to grub.cfg and vmlinuz. The advantage of this solution is that it measures the core files of the virtual machine through the virtual UEFI, does not rely on other software except the virtual machine monitor, and simplifies the process of trusted startup. However, this solution does not measure other key components for virtual machine startup such as grub and initrd, and does not establish a trust chain from the physical machine to the virtual machine. Secondly, this solution uses a chip with a built-in server, which cannot actively access and measure the resources of the computing components, which does not conform to the active measurement concept of Trusted Computing 3.0. Summary of the invention

[0006] The present invention is based on a dual-system architecture that complies with the Trusted Computing 3.0 theory. On the basis of the physical trusted root of the protection component TPCM, the trustworthiness of the physical base is transferred to the upper layer through trusted verification, and a vTPCM virtual trusted root of each virtual machine is constructed in a virtualized manner; based on the vTPCM virtual trusted root of each virtual machine, a complete trusted chain is established for the trusted verification mechanism in the virtual machine, and the trusted characteristics of the vTPCM are extended to the virtual machine, thereby realizing the security protection of the virtualization platform and the startup of the virtual machine in the cloud environment.

[0007] The technical purpose of the present invention is to design a virtual machine trusted startup method based on a dual-architecture, which mainly includes three parts:

[0008] S1, construction of virtual root of trust. Based on the physical TPCM, a mechanism for actively measuring and controlling the virtual machine is constructed in the protection component. When the virtual machine starts, the protection component actively collects the key information of the virtual machine startup, and calls the physical TPCM interface to perform hash operation on the key information to obtain a hash value. The protection component uses the hash value of the key information as the measurement value, and compares the measurement value with the reference value stored in the protection storage area corresponding to the physical TPCM, while expanding the virtual machine specific PCR and recording the measurement log. The protection component determines the consistency between the reference value and the measurement value as the basis for whether to allow the virtual machine to start up in a trusted manner.

[0009] S2, build a trust chain from the physical trusted root to the virtual trusted root. The physical TPCM completes the trust chain construction from the startup to the operation of the protection component, and then the physical TPCM actively measures the BIOS, OS Loader, and kernel code of the computing component, and returns the control information to the computing component. The protection component will then actively verify the trust of the virtualization components, virtual machine monitors, and other trusted applications in the computing component, thereby extending the trust chain to the virtualization components at all levels of the computing component. The design enables each virtual machine to build its own trust chain based on its own vTPCM virtual trusted root, ensuring the trustworthiness of each virtual machine during the startup and operation stages.

[0010] S3, collection of key information for virtual machine startup. In the Qemu-KVM virtualization architecture, the virtual machine startup process involves several components, including UEFI, SHIM, GRUB, OS Kernel, and Initrd. The contents of these components are used as key information for trusted virtual machine startup. With the assistance of the virtual machine monitor of the computing component and the operating system call, by deploying an agent in the computing component, key information for virtual machine startup is collected and sent to the protection component, and control information is obtained from the protection component.

[0011] Furthermore, a virtual trusted root is constructed in the protection component. The construction process is as follows:

[0012] (1) By transplanting the trusted software stack TSS to the protection component, the protection component supports trusted cryptographic services based on SM2, SM3, and SM4 algorithms. TSS provides a function call interface to the upper-layer trusted application, and converts the operation instructions of the hardware trusted cryptographic module into a byte stream. By calling the interface of the physical TPCM, the byte stream of the operation instruction is transmitted to the trusted cryptographic module through the device driver. After the trusted cryptographic module completes the cryptographic operation, TSS obtains the calculation result through the interface of the physical TPCM and returns the calculation result to the upper-layer trusted application.

[0013] (2) By adding a new TPCM function module, the protection component provides virtual NV resources to each virtual machine and provides a resource operation interface to the upper-level trusted application. The constructed virtual NV resources store the baseline values ​​of image files including UEFI firmware, SHIM, GRUB, OS Kernel, and Initrd during the trusted boot process of the virtual machine, the virtual machine SRK, and the virtual machine migration key information.

[0014] (3) By adding a new TPCM function module, the protection component provides virtual PCR resources for each virtual machine and provides a resource operation interface to the upper-level trusted application. The constructed virtual PCR resources are unidirectionally expanded based on the measurement results of each image file of the virtual machine and the measurement log is recorded. The value of the virtual PCR resource is used for remote attestation of the virtual machine.

[0015] Furthermore, a trust chain from the physical trusted root to the virtual trusted root is constructed. The construction process is as follows:

[0016] (1) A secure encryption channel is constructed between the computing component and the protection component through key negotiation and the SM4 symmetric encryption algorithm.

[0017] (2) The physical TPCM performs trustworthy verification on the U-Boot firmware, OS Kernel, and trusted application components of the protection component in turn; the physical TPCM performs trustworthy verification on the BIOS of the computing component, and the measurement agent in the BIOS collects OS Loader information and transmits it to the protection component through an encrypted channel for measurement verification; the measurement agent is deployed in the OS Loader and OS Kernel of the computing component to collect key information of the kernel and virtualization components and transmit it to the protection component, and obtain control information from the protection component, thereby building a centralized trust chain structure.

[0018] Furthermore, the process of collecting key information of virtual machine startup is as follows:

[0019] (1) Deploy Libvirt and Qemu-KVM virtualization environments on the computing component, use Libvirt to create a new virtual machine and generate a virtual machine configuration file. Deploy a virtual machine measurement agent on the computing component to complete the collection of key information during the virtual machine startup process, and transmit the key information to the computing component through an encrypted channel, and then obtain the control information returned from the computing component. The measurement agent determines whether the virtual machine trusted startup process is normal based on the control information.

[0020] (2) The virtual machine measurement agent of the computing component first parses the virtual machine configuration file to obtain the virtual machine UUID, firmware type, firmware path, disk path, and disk type. The measurement agent then mounts the virtual machine disk according to the disk type and disk path. If the virtual machine disk type is RAW, the Linux mount system call is called to mount the disk; if the virtual machine disk type is QCOW2, the Libguestfs open source library is called to load it.

[0021] (3) The virtual machine measurement agent of the computing component first reads the QEMU virtual machine firmware according to the virtual machine firmware path, and then parses and obtains the SHIM, GRUB, OS Kernel, and Initrd virtual machine startup key information from the virtual machine disk. The measurement agent assembles the key information into a message and transmits it to the protection component through an encrypted channel, and waits to obtain the control information returned by the protection component, and determines whether the virtual machine startup process is normal based on this control information.

[0022] (4) When the virtual machine starts, Libvirt hooks will be automatically triggered, allowing the measurement agent to intercept the virtual machine startup process.

[0023] (5) By deploying measurement agents in computing components, a centralized trust chain architecture is built during the virtual machine startup process to transfer trust from the physical TPCM to the virtual machine via the virtual TPCM.

[0024] Compared with the prior art, the present invention constructs a virtual TPCM based on a physical TPCM, so that each virtual machine has its vTPCM to actively measure and control in each life cycle, thereby ensuring the security of the virtual machine when it is started and running.

[0025] By adopting a dual system architecture, the summary values ​​of key information during the virtual machine startup process are all recorded in the protection component, and the measurement process is completed in the protection component, which is in line with the basic idea of ​​active measurement of Trusted Computing 3.0.

[0026] By deploying measurement agents in computing components, the trust chain is extended from protection components to computing components, and a centralized trust chain construction solution is adopted to reduce the loss in the trust transfer process. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 The diagram is a structure diagram of the virtual TPCM based on dual architecture.

[0028] Figure 2 Deliver an overall flow chart for the chain of trust. DETAILED DESCRIPTION

[0029] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0030] Figure 1 The diagram is a structure diagram of the virtual TPCM based on dual architecture.

[0031] Figure 2 Deliver an overall flow chart for the chain of trust.

[0032] The technical solution adopted by the present invention is a virtual machine trusted startup method based on a dual-architecture, which mainly includes three parts:

[0033] S1, construction of virtual root of trust. Based on the physical TPCM, a mechanism for actively measuring and controlling virtual machines is constructed in the protection component. When the virtual machine starts, the protection component actively collects the key information of the virtual machine startup and calls the TPCM interface to perform hash operations on the key information. The protection component uses the hash value of the key information as the measurement value, and compares the measurement value with the reference value stored in the protection storage area corresponding to the TPCM, while expanding the virtual machine specific PCR and recording the measurement log. The protection component determines the consistency between the reference value and the measurement value as the basis for whether to allow the virtual machine to start up in a trusted manner.

[0034] S2, build a trust chain from the physical trusted root to the virtual trusted root. The physical TPCM completes the trust chain construction from the boot to the operation of the protection component system, and then the TPCM actively measures the BIOS, OS Loader, and kernel code of the computing component, and returns the control information to the computing component. The protection component will then actively verify the trust of the virtualization components, virtual machine monitors, and other trusted applications in the computing component, thereby extending the trust chain to the virtualization components at all levels of the computing component. The design enables each virtual machine to build its own trust chain based on its own vTPCM virtual trusted root, ensuring the trustworthiness of each virtual machine during the boot and operation stages.

[0035] S3, collection of key information for virtual machine startup. Under the Qemu-KVM virtualization architecture, the virtual machine startup process mainly involves several components such as UEFI, SHIM, GRUB, OS Kernel, Initrd, etc. The contents of these components are used as key information for trusted startup of the virtual machine. With the assistance of the virtual machine monitor of the computing component and the operating system call, the present invention deploys an agent in the computing component, collects key information for virtual machine startup, sends it to the protection component, and obtains control information from the protection component.

[0036] Furthermore, a virtual trusted root is constructed in the protection component. The construction process is as follows:

[0037] (1) By transplanting the trusted software stack TSS to the protection component, the protection component supports trusted cryptographic services based on algorithms such as SM2, SM3, and SM4. TSS provides a function call interface to the upper-layer trusted application, and converts the operation instructions of the hardware trusted cryptographic module into a byte stream, and then calls the interface of the physical TPCM to pass the operation instruction byte stream to the trusted cryptographic module through the device driver. After the trusted cryptographic module completes the cryptographic operation, TSS obtains the calculation result through the TPCM interface and returns the result to the upper-layer trusted application.

[0038] (2) By adding a new TPCM function module, the protection component provides virtual NV resources for each virtual machine and provides a resource operation interface to the upper-level trusted application. The constructed virtual NV will store the baseline values ​​of image files including UEFI firmware, SHIM, GRUB, OS Kernel, Initrd, virtual machine SRK, virtual machine migration key, and other information during the trusted boot process of the virtual machine.

[0039] (3) By adding a new TPCM function module, the protection component provides virtual PCR resources for each virtual machine and provides a resource operation interface to the upper-level trusted application. The constructed virtual PCR is unidirectionally expanded based on the measurement results of each image file of the virtual machine and records the measurement log. The virtual PCR value will be used for remote attestation of the virtual machine.

[0040] Furthermore, a trust chain from the physical trusted root to the virtual trusted root is constructed. The construction process is as follows:

[0041] (1) A secure encryption channel is constructed between the computing component and the protection component through key negotiation and the SM4 symmetric encryption algorithm.

[0042] (2) The physical TPCM performs trustworthy verification on the U-Boot firmware, OS Kernel, trusted applications and other components of the protection component in turn; the physical TPCM performs trustworthy verification on the BIOS of the computing component, and the measurement agent in the BIOS collects OS Loader information and transmits it to the protection component through an encrypted channel for measurement verification; similarly, the measurement agent is deployed in the OS Loader and OS Kernel of the computing component to collect key information of the kernel and virtualization components and transmit it to the protection component, and obtain control information from the protection component, thereby building a centralized trust chain structure.

[0043] Furthermore, key information about virtual machine startup is collected. The process is as follows:

[0044] (1) Deploy Libvirt and Qemu-KVM virtualization environments on the computing component, use Libvirt to create a new virtual machine and generate a virtual machine configuration file. Deploy a virtual machine measurement agent on the computing component to complete the collection of key information during the virtual machine startup process, and transmit this information to the computing component through an encrypted channel, and then obtain the returned control information from the computing component. The measurement agent determines whether the virtual machine trusted startup process is normal based on the control information.

[0045] (2) The virtual machine measurement agent of the computing component first parses the virtual machine configuration file to obtain information such as the virtual machine UUID, firmware type, firmware path, disk path, and disk type. The measurement agent then mounts the virtual machine disk according to the disk type and disk path. If the virtual machine disk type is RAW, the Linux mount system call is called to mount the disk; if the virtual machine disk type is QCOW2, the Libguestfs open source library is called to load it.

[0046] (3) The virtual machine measurement agent of the computing component first reads the QEMU virtual machine firmware according to the virtual machine firmware path, and then parses and obtains the virtual machine startup key information such as SHIM, GRUB, OS Kernel, and Initrd from the virtual machine disk. The measurement agent assembles the key information into a message and transmits it to the protection component through an encrypted channel, and waits to obtain the control information returned by the protection component, and determines whether the virtual machine startup process is normal based on this control information.

[0047] (4) When the virtual machine starts, Libvirt hooks will be automatically triggered, allowing the measurement agent to intercept the virtual machine startup process.

[0048] (5) As described above, by deploying measurement agents in computing components, a centralized trust chain architecture is constructed during the virtual machine startup process, overcoming the trust loss problem caused by the chain trust chain structure and transferring trust from the physical TPCM to the virtual machine via the virtual TPCM.

[0049] The present invention constructs a virtual TPCM based on the physical TPCM, so that each virtual machine has its vTPCM to actively measure and control in each life cycle, ensuring the security of the virtual machine during startup and operation. By adopting a dual system architecture, the summary values ​​of key information during the virtual machine startup process are all recorded in the protection component, and the measurement process is completed in the protection component, which is in line with the basic idea of ​​active measurement of Trusted Computing 3.0. By deploying a measurement agent in the computing component, the trust chain is extended from the protection component to the computing component, and a centralized trust chain construction solution is adopted to reduce the loss in the trust transmission process.

Claims

1. A virtual machine trusted startup method based on dual architecture, characterized in that: It consists of three parts: S1, construction of virtual root of trust; based on physical TPCM, a mechanism for actively measuring and controlling virtual machines is constructed in the protection component; when the virtual machine is started, the protection component actively collects key information for virtual machine startup, and calls the physical TPCM interface to perform hash operation on the key information to obtain a hash value; the protection component uses the hash value of the key information as a measurement value, and compares the measurement value with the reference value stored in the protection storage area corresponding to the physical TPCM, while expanding the virtual machine PCR and recording the measurement log; the protection component determines whether to allow the virtual machine to start up in a trusted manner by determining the consistency between the reference value and the measurement value; S2, build a trust chain from the physical trusted root to the virtual trusted root; the physical TPCM completes the trust chain construction from the startup to the operation of the protection component, and then the physical TPCM actively measures the BIOS, OS Loader, and kernel code of the computing component, and returns the control information to the computing component; the protection component will then actively verify the trust of the virtualization components, virtual machine monitors, and other trusted applications in the computing component, thereby extending the trust chain to the virtualization components at all levels of the computing component; through design, each virtual machine can build its own trust chain based on its own vTPCM virtual trusted root, ensuring the trustworthiness of each virtual machine during the startup and operation stages; S3, collection of key information for virtual machine startup; under the Qemu-KVM virtualization architecture, the virtual machine startup process involves several components, including UEFI, SHIM, GRUB, OS Kernel, and Initrd. The contents of these components are used as key information for trusted virtual machine startup; with the assistance of the virtual machine monitor of the computing component and the operating system call, by deploying an agent in the computing component, key information for virtual machine startup is collected and sent to the protection component, and control information is obtained from the protection component.

2. A virtual machine trusted startup method based on dual architecture according to claim 1, characterized in that: The construction process of constructing a virtual trusted root in the protection component is as follows: (1) By transplanting the trusted software stack TSS to the protection component, the protection component supports the trusted cryptographic services based on the SM2, SM3, and SM4 algorithms; TSS provides a function call interface to the upper-layer trusted application, and converts the operation instructions of the hardware trusted cryptographic module into a byte stream, and transmits the byte stream of the operation instructions to the trusted cryptographic module through the device driver by calling the interface of the physical TPCM; After the trusted cryptographic module completes the cryptographic operation, the TSS obtains the calculation result through the interface of the physical TPCM and returns the calculation result to the upper-layer trusted application; (2) By adding a new TPCM function module, the protection component provides virtual NV resources to each virtual machine and provides a resource operation interface to the upper-level trusted application; the constructed virtual NV resources store the baseline values ​​of image files including UEFI firmware, SHIM, GRUB, OS Kernel, and Initrd during the trusted boot process of the virtual machine, the virtual machine SRK, and the virtual machine migration key information; (3) By adding the TPCM function module, the protection component provides virtual PCR resources to each virtual machine and provides a resource operation interface to the upper-layer trusted application; The constructed virtual PCR resource is unidirectionally expanded according to the measurement results of each image file of the virtual machine and the measurement log is recorded; the value of the virtual PCR resource is used for remote certification of the virtual machine.

3. The method for trusted startup of a virtual machine based on a dual-architecture according to claim 1, characterized in that: Construct a trust chain from a physical root of trust to a virtual root of trust; The construction process is as follows: (1) A secure encryption channel is constructed between the computing component and the protection component through key negotiation and the SM4 symmetric encryption algorithm; (2) The physical TPCM performs trustworthy verification on the U-Boot firmware, OS Kernel, and trusted application components of the protection component in turn; the physical TPCM performs trustworthy verification on the BIOS of the computing component, and the measurement agent in the BIOS collects OS Loader information and transmits it to the protection component through an encrypted channel for measurement verification; the measurement agent is deployed in the OS Loader and OS Kernel of the computing component to collect key information of the kernel and virtualization components and transmit it to the protection component, and obtain control information from the protection component, thereby building a centralized trust chain structure.

4. The method for trusted startup of a virtual machine based on a dual-architecture according to claim 1, characterized in that: The process of collecting key information about virtual machine startup is as follows: (1) Deploy Libvirt and Qemu-KVM virtualization environments on the computing component, use Libvirt to create a new virtual machine and generate a virtual machine configuration file; deploy a virtual machine measurement agent on the computing component to complete the collection of key information during the virtual machine startup process, and transmit the key information to the computing component through an encrypted channel, and then obtain the returned control information from the computing component; The measurement agent determines whether the trusted boot process of the virtual machine is normal based on the control information; (2) The virtual machine measurement agent of the computing component first parses the virtual machine configuration file to obtain the virtual machine UUID, firmware type, firmware path, disk path, and disk type; then the measurement agent mounts the virtual machine disk according to the disk type and disk path. If the virtual machine disk type is RAW, the Linux mount system call is called to mount the disk; If the virtual machine disk type is QCOW2, call the Libguestfs open source library to load it; (3) The virtual machine measurement agent of the computing component first reads the QEMU virtual machine firmware according to the virtual machine firmware path, and then parses and obtains the SHIM, GRUB, OS Kernel, and Initrd virtual machine startup key information from the virtual machine disk; the measurement agent assembles the key information into a message and transmits it to the protection component through an encrypted channel, and waits to obtain the control information returned by the protection component, and determines whether the virtual machine startup process is normal based on this control information; (4) When the virtual machine starts, Libvirt hooks are automatically triggered, so that the measurement agent can intercept the virtual machine startup process; (5) By deploying measurement agents in computing components, a centralized trust chain architecture is built during the virtual machine startup process to transfer trust from the physical TPCM to the virtual machine via the virtual TPCM.

Images