Privacy protection method based on confidential cloud computing, terminal and storage medium

Abstract

The invention discloses a privacy protection method based on confidential cloud computing, a terminal and a storage medium, and the method comprises the steps: obtaining a target confidential virtual machine, and deploying an instance of a target vTPM in the target confidential virtual machine; a target transport protocol is constructed, communication between the front end and the rear end of the target vTPM is carried out based on the target transport protocol, the front end of the target vTPM is a client virtual machine, and the rear end of the target vTPM is the target confidential virtual machine; and constructing a target verification mechanism, and verifying the credibility of the target confidential virtual machine based on the target verification mechanism. According to the method, the vTPM instance is deployed in the confidential virtual machine, and the unique transmission protocol and verification mechanism are constructed, so that the simulation software of the vTPM can directly run on the rear-end CVM, and the confidentiality and integrity of vTPM service are ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a privacy protection method, terminal and storage medium based on confidential cloud computing. Background Art

[0002] In the existing technology, cloud computing technology relies on virtualization technology to enable the same host machine to efficiently run multiple virtual machines deployed by customers ( VM, Virtual Machine ), thus achieving a high degree of resource sharing. However, in confidential cloud computing scenarios, the host platform is no longer considered a trusted entity, posing significant risks in terms of data privacy and security. To address this challenge, confidential virtual machines ( CVM, Confidential Virtual Machine ) came into being, using virtualization technology that supports confidentiality CPU (like Intel TDX (Trust Domain Extensions), AMD SEV (Secure Encrypted Virtualization) etc.) and through CPU right CVM The running memory is encrypted, which effectively avoids the risk of plain text storage of memory data in the memory controlled by the host machine and ensures the security of the running data.

[0003] on the other hand, TPM, Trusted Platform Module As a physical chip in a computer system, it provides the system with important cryptographic services such as measurement startup, key generation, key management, and data encryption and decryption. However, in a cloud computing environment, since the host platform is no longer trustworthy, the virtual TPM ( vTPM, Virtual Trusted Platform Module ) also loses the trust foundation in confidential cloud computing scenarios. Therefore, in order to meet the virtual machine TPM Service needs require the development of a new vTPM Supply solutions to ensure TPM The simulation instance is in a trusted execution environment (TEE). TEE, Trusted Execution Environment ) is run under CVM Provide reliable TPM services, while also taking into account compatibility and performance requirements.

[0004] Therefore, the prior art still needs to be improved and enhanced. Summary of the invention

[0005] In view of the above-mentioned defects of the prior art, the present invention provides a privacy protection method, device, terminal and storage medium based on confidential cloud computing, aiming to solve the problems in the prior art of virtual TPM In confidential cloud computing scenarios, the trust foundation is lost and it is impossible to ensure TPM Simulates issues with instances running in a trusted execution environment.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is as follows: A first aspect of the present invention provides a privacy protection method based on confidential cloud computing, the method comprising: Get the target confidential virtual machine and vTPM An instance of is deployed in the target confidential virtual machine; Construct a target transmission protocol, and perform the target transmission based on the target transmission protocol. vTPM The goal of communication between the front-end and the back-end is vTPM The front end is the client virtual machine, the target vTPM The backend is the target confidential virtual machine; A target verification mechanism is constructed, and the credibility of the target confidential virtual machine is verified based on the target verification mechanism.

[0007] In one implementation, the target vTPM An instance of is deployed in the target confidential virtual machine, including: Based on the target confidential virtual machine vTPM Encrypt the instance; A target service interface is obtained, and based on the target service interface, the target confidential virtual machine interacts with the outside world.

[0008] In one implementation, constructing a target transmission protocol includes: Introducing new TPM Extension instructions TPM _ TLS , used to transmit encrypted TLS Data flow; The encrypted TLS Data flow segmentation encapsulation in traditional TPM package format to ensure compatibility with existing TPM Compatibility of communication channels; exist Linux Kernel and OVMF Integrated lightweight TLS Library.

[0009] In one implementation, the target transmission protocol is based on the target vTPM The communication between the front-end and the back-end includes: Get the original TPM Request, for the original TPM Request to proceed TLS Encrypt to obtain the target encrypted data stream; transmitting the encrypted data stream to the target confidential virtual machine; The target confidential virtual machine receives the encrypted data stream and decrypts it to obtain the original TPM Request and process.

[0010] In one implementation, transmitting the encrypted data stream to the target confidential virtual machine includes: The target encrypted data stream is segmented to obtain a plurality of data stream segments no larger than 4096 bytes. TPM _ TLS The load of instructions; The data stream segment is transmitted to the target confidential virtual machine at the back end.

[0011] In one implementation, the target confidential virtual machine receives the encrypted data stream and decrypts it to obtain the original TPM Requests, including: The target confidential virtual machine extracts the data stream segment and sends it to a data buffer to be processed; pass TLS The context decrypts the processed data buffer and reassembles TLS The data stream gets the original TPM ask.

[0012] In one implementation, verifying the credibility of the target confidential virtual machine based on the target verification mechanism includes: When the client virtual machine starts and enters the open virtual machine firmware stage, the client virtual machine establishes a TLS connect; The client virtual machine initiates a target verification request to the target confidential virtual machine; After the target confidential virtual machine receives the target verification request, it generates a target verification report based on the target verification request and obtains the target based on the target verification report. PEK The signature is sent to the client virtual machine; The client virtual machine is based on the target PEK Public key authentication of the target PEK Sign to obtain the authenticity of the target confidential virtual machine.

[0013] In one implementation, the target verification report includes a challenge value generated based on the target verification request and an integrity measurement value of the target confidential virtual machine.

[0014] According to a second aspect of the present invention, a terminal is provided, comprising a processor and a computer-readable storage medium communicatively connected to the processor, wherein the computer-readable storage medium is suitable for storing a plurality of instructions, and the processor is suitable for calling the instructions in the computer-readable storage medium to execute the steps of implementing any of the above-mentioned privacy protection methods based on confidential cloud computing.

[0015] According to a third aspect of the present invention, a computer-readable storage medium is provided, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the privacy protection method based on confidential cloud computing as described in any one of the above items.

[0016] Compared with the prior art, the present invention provides a privacy protection method, terminal and storage medium based on confidential cloud computing. The privacy protection method based on confidential cloud computing obtains the target confidential virtual machine and stores the target confidential virtual machine in the target virtual machine. vTPM The instance of is deployed in the target confidential virtual machine, and then the target transmission protocol is constructed, and the target is carried out based on the target transmission protocol. vTPM The goal of communication between the front-end and the back-end is vTPM The front end is the client virtual machine, the target vTPM The backend of the target confidential virtual machine is further constructed to verify the credibility of the target confidential virtual machine based on the target verification mechanism. The privacy protection method based on confidential cloud computing proposed in the present invention is to vTPM The instance is deployed in a confidential virtual machine and a unique transmission protocol and verification mechanism are built to solve the virtual TPM In confidential cloud computing scenarios, the trust foundation is lost and it is impossible to ensure TPM The problem of running the simulation instance in a trusted execution environment makes vTPM The simulation software can be run directly on the backend CVM On, guaranteed vTPM Confidentiality and integrity of the services. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of an embodiment of a privacy protection method based on confidential cloud computing provided by the present invention; Figure 2 Embodiment of the privacy protection method based on confidential cloud computing provided by the present invention CvTPM Structural diagram; Figure 3 Embodiment of the privacy protection device based on confidential cloud computing provided by the present invention CvTPM Schematic diagram of the encrypted transmission protocol structure; Figure 4Embodiment of the privacy protection device based on confidential cloud computing provided by the present invention CvTPM Front-end and back-end verification flow chart; Figure 5 A schematic diagram of the principles of an embodiment of a terminal provided by the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0019] Those skilled in the art will appreciate that, unless expressly stated, the singular forms '"a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0020] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as herein.

[0021] The privacy protection method based on confidential cloud computing provided by the present invention can be applied to a terminal with computing capabilities, and the terminal can execute the privacy protection method based on confidential cloud computing provided by the present invention to enable TPM The simulated instance can be TEE Run in the environment CVM Provide reliable TPM Serve.

[0022] Embodiment 1 With the rapid development of cloud computing technology, individuals and corporate users are increasingly relying on cloud service platforms to deploy and manage their virtual machines ( VM) and its applications. Cloud computing uses virtualization technology to enable the same physical host to support multiple virtual machines deployed by customers, thereby achieving efficient sharing and utilization of resources. However, while this highly resource-sharing operation mode brings convenience, it also raises widespread concerns about the privacy and security of computing data. Especially in confidential cloud computing scenarios, the host platform is no longer trusted and may affect or attack customer virtual machines through various means, thereby threatening the confidentiality and integrity of customer data.

[0023] In the threat model of confidential cloud computing, as a host of customer virtual machines ( VM ) host platform is excluded from the Trusted Computing Base ( TCB, Trusted Computing Base ), which means that the host platform is no longer considered a trusted entity. Therefore, the traditional security mechanism based on host trust is no longer applicable in confidential cloud computing scenarios. To address this challenge, confidential virtual machines ( CVM ) came into being. Confidential virtual machines are equipped with support for confidential virtualization technology. CPU (like Intel TDX , AMD SEV etc.) platforms, through CPU right CVM The running memory is encrypted to avoid the plaintext storage of memory data in the memory controlled by the host machine, thereby realizing the protection of the running data.

[0024] The Trusted Platform Module ( TPM ) is a physical chip installed on the computer motherboard, providing cryptographic services for the computer system, such as measurement startup, key generation, key management, and data encryption and decryption. Because it has a complete interactive protocol and non-volatile storage independent of the external system, TPM It is widely used in the measurement and verification process of the computer boot process, as well as the functional implementation of some cryptographic libraries.

[0025] However, in a cloud computing environment, each virtual machine also needs TPM Traditionally, these services are provided by the host through software simulation, that is, virtualization. TPM Example ( vTPM However, in confidential cloud computing scenarios, since the host is no longer trusted, the vTPM This limits the use of confidential virtual machines in TPM Its service capabilities also affect its data security and privacy protection level.

[0026] Therefore, in order to solve the problem of confidential cloud computing vTPMIn order to solve the trust problem, a privacy protection method based on confidential cloud computing is provided in this embodiment. The privacy protection method based on confidential cloud computing makes vTPM The simulated instance can be run in a trusted execution environment (TEE). TEE ) to ensure its safety and reliability; vTPM It should be compatible with existing virtual machine management systems and applications to ensure its wide applicability and ease of use; in terms of performance, vTPM It can provide efficient services to meet the performance requirements of virtual machines. In this embodiment, confidential virtualization technology and trusted execution environment technology are combined to provide a reliable TPM services while ensuring their compatibility and performance.

[0027] like Figure 1 As shown, in one embodiment of the privacy protection method based on confidential cloud computing provided by the present invention, the privacy protection based on confidential cloud computing includes the steps of: S 100. Get the target confidential virtual machine and vTPM An instance of is deployed in the target confidential virtual machine.

[0028] The target vTPM An instance of is deployed in the target confidential virtual machine, including: Based on the target confidential virtual machine vTPM Encrypt the instance; A target service interface is obtained, and based on the target service interface, the target confidential virtual machine interacts with the outside world.

[0029] In this embodiment, a vTPM Supply plan, named CvTPM , is a kind of utilization AMD SEV - SNPCVM Technology-enabled vTPM A provisioning solution designed specifically for confidential cloud computing scenarios. SEV - SNP yes AMD (Advanced Micro Devices) A secure encrypted virtualization technology launched by Secure Nested Paging It is in AMD Previous SEV (Secure Encrypted Virtualization) and SEV - ES (Secure Encrypted Virtualization - Encrypted State) The result of further development based on technology. CvTPM While ensuring compatibility, TPM The front end of the service (i.e. the customer VM ),rear end( vTPM instances), and the communication channel between them remains encrypted to prevent untrustedVMM (Virtual Machine Manager) and others CVM (Confidential Virtual Machine) attack.

[0030] like Figure 2 As shown, CvTPM It mainly consists of three parts, including: (1) vTPM Example, in this embodiment is CvTPM The backend is actually a software-level TPM Service simulation, too Figure 2 middle" SEV Backend virtual machine refers to the part: This simulation is achieved by combining libtpms and swtpm These two tools are used to achieve this. vTPM The example strictly follows TPM 2.0 specification, which means it can be like a real TPM hardware, receives and responds to those that meet TPM In this setting, TPM It is no longer a physical hardware, but is implemented as a specific CVM (Cloud Virtual Machine) software. CVM It has some special security properties, such as memory encryption and state encryption, which ensure that the virtual machine manager ( VMM ) cannot CVM In short, vTPM An instance is a computer running on a protected CVM Software in the TPM function, and because CVM The safety properties of TPM Higher security. This design not only retains TPM The original functions have been enhanced with enhanced security and flexibility in virtualized environments; (2) Client virtual machine ( VM )and TPM drive, in this embodiment is CvTPM The front end is also Figure 2 middle" SEV "User virtual machine" refers to the following parts: CvTPM The front end of the virtual machine consists of two parts: OVMF ( Open Virtual Machine Firmware, Designed for virtual machines UEFI (Unified Extensible Firmware Interface) Bootloader) TPM Drivers, as well as the underlying operating system during the operation of the virtual machine operating systemTPM Driver. These two parts of the driver meet the needs of the client virtual machine during startup and operation. TPM Different needs. CvTPM Protocol, both drivers can CvTPM The backend performs encrypted communication to ensure secure data transmission. TPM Before the service, you can also confirm through remote verification CvTPM The integrity of the backend is further enhanced. In short, the TPM The driver is divided into two parts: the startup phase and the runtime phase. They connect to the backend through encrypted communication and verify the integrity of the backend before using the service. (3) CvTPM Encrypted transmission protocol, in this embodiment, the CvTPM The encrypted transport protocol is defined as the target transport protocol, that is, CvTPM A unified set of front-end and back-end CvTPM Encrypted transmission protocol. This protocol not only supports TPM All the functions of the original communication protocol, and additionally use TLS (Transport Layer Security) Encrypted transmission protocol to ensure that TPM The data will not be stolen by malicious virtual machine managers ( VMM, Virtual Machine Manager ) to read or tamper with. CvTPM When the encrypted transmission protocol is connected by handshake, the front end will specifically request the back end CVM Provide a start-up report. The purpose of this report is to confirm CVM The integrity of the backend service is ensured to be provided by a tamper-free and trusted environment. CvTPM The encrypted transmission protocol ensures TPM Functional integrity, through TLS Encryption and boot report verification enhance the security of data transmission and backend services.

[0031] Specifically, refer to Figure 2 , in this embodiment, CvTPM The front and back ends are QEMU (Quick EMUlator) The virtual machine manager is used to perform the bridging. QEMU Built-in vTPM The interface is natively supported by a special character device ( char device ) as a control channel, which is mainly used to communicate with the host in order to negotiate and create CVM Used vTPM In addition, there is a data channel, which is dedicated to transmitting requests and responses from the front end and the back end.

[0032] It is worth noting that CvTPM The backend is deployed on a separate backend CVM Therefore, QEMU and the host need to work together to ensure that the client CVM In TPM Simulator (also known as TPMEmulator ) can successfully connect to the backend CVM In vTPM In this way, seamless data transmission and functional interaction can be achieved between the front-end and back-end.

[0033] in short, QEMU As a bridge, connecting CvTPM The front and back ends are connected, and communication and collaboration between the two are achieved through control channels and data channels. Prior to this, the data channel and the control channel will be initialized separately.

[0034] That is to say, in this embodiment, vTPM Backend instance (by libtpms and swtpm Combined implementation) deployed in a separate CVM Run it in , and then use CVM The memory encryption and state encryption features prevent VMM right vTPM The code and data of the instance can be directly accessed or tampered with, and a streamlined kernel operating system is used as the backend CVM Basic environment, minimize TCB size, further, by strictly limiting the backend CVM Interaction with the outside world is only allowed through specified vTPM Service interface for communication.

[0035] This effectively isolates the target vTPM Instances of this type prevent untrusted hosts and VMM Direct access or tampering vTPM data and code; also ensure vTPM The confidentiality and integrity of the service can be run safely even in a malicious host environment; at the same time, it minimizes TCB size, reducing the potential attack surface; further, there is no need to vTPM The simulation software has been substantially modified to maintain good compatibility and maintainability.

[0036] S 200. Construct a target transmission protocol, and perform the target transmission based on the target transmission protocol. vTPM The goal of communication between the front-end and the back-end is vTPMThe front end is the client virtual machine, the target vTPM The backend of the target confidential virtual machine is the target confidential virtual machine.

[0037] The target transmission protocol is the CvTPM Encrypted transmission protocol.

[0038] The constructing of the target transmission protocol includes: Introducing new TPM Extension instructions TPM _ TLS , used to transmit encrypted TLS Data flow; The encrypted TLS Data flow segmentation encapsulation in traditional TPM package format to ensure compatibility with existing TPM Compatibility of communication channels; exist Linux Kernel and OVMF Integrated lightweight TLS Library.

[0039] The target transmission protocol is based on the target vTPM The communication between the front-end and the back-end includes: Get the original TPM Request, for the original TPM Request to proceed TLS Encrypt to obtain the target encrypted data stream; transmitting the encrypted data stream to the target confidential virtual machine; The target confidential virtual machine receives the encrypted data stream and decrypts it to obtain the original TPM Request and process.

[0040] The transmitting the encrypted data stream to the target confidential virtual machine includes: The target encrypted data stream is segmented to obtain a plurality of data stream segments no larger than 4096 bytes. TPM _ TLS The load of instructions; The data stream segment is transmitted to the target confidential virtual machine at the back end.

[0041] The target confidential virtual machine receives the encrypted data stream and decrypts it to obtain the original TPM Requests, including: The target confidential virtual machine extracts the data stream segment and sends it to a data buffer to be processed; pass TLS ( Transport Layer Security , Transport Layer Security Protocol) context to decrypt the processed data buffer and reassembleTLS The data stream gets the original TPM ask.

[0042] Specifically, refer to Figure 3 , the target transmission protocol is the CvTPM The working principle of the encrypted transmission protocol follows the "request / response" model. In this model, the customer virtual machine, that is, the front end (client), sends a message that conforms to the target confidential virtual machine, that is, the back end (as the server). TPM After the backend processes the request, it returns the result to the frontend in the form of a response packet. These request packets and response packets are composed of a 10-byte Header (header, the beginning of the data structure) and variable length Body composition.

[0043] Header The structure contains three main parts: Tag (16 bits) to mark the current TPM Characteristics and properties of sessions; length Length (32 bits), indicating the entire data stream (including Header and Body )’s length; and Ordinal / ReturnCode , which represents the instruction number initiated by the front-end in the request and represents the result of the back-end processing the instruction in the response.

[0044] To enhance the front-end and back-end TPM The security of command interaction, CvTPM Introduced TLS Encrypted transmission protocol. On this basis, CvTPM A new extension command has also been added TPM _ TLS , used to convert the encrypted TPM The instruction data stream is transmitted in segments.

[0045] When the front end sends TPM When the command is given, the request packet will be established through the previous handshake TLS The context is encrypted to obtain encrypted request packets. These encrypted request packets are sent to CommandDataflow (Instruction data stream) buffer, waiting to be transmitted to the backend. In order to ensure maximum compatibility, CommandDataflow Buffering is still done through traditional TPM However, due to TPM Chip and software simulation vTPM The buffers are relatively small (each TPM The packet must not exceed 4096 bytes), so it is necessary to CommandDataflowThe buffered content is transmitted in segments.

[0046] Each piece of data will be used as a TPM Package Body Part, the fit is set to TPM _ TLS of Ordinal , forming a new special package and passing the traditional TPM The front-end and back-end channels transmit the data to the back-end. TPM _ TLS After the data packet is extracted Body Part of it is sent to the data buffer to be processed, and then through TLS The context decrypts the buffer and retrieves the original TPM Instructions and process them.

[0047] Similarly, when the backend returns the request result, it will also encrypt and transmit the response packet in a similar way. Linux Bottom layer and QEMU The bottom layer is responsible for transmission and forwarding TPM The various components of the package mainly focus on TPM Bag Header In Length fields, thus introducing new protocols and changing Body The storage content is completely transparent to third parties other than the front-end and back-end. This means that even if CvTPM Transport protocols and TLS Encryption will not affect the normal operation and compatibility of existing systems.

[0048] That is to say, in this embodiment, based on TLS Agreement vTPM The communication data between the front-end and back-end is encrypted, and then the new TPM Extension instructions TPM _ TLS , used to transmit encrypted TLS After that, the encrypted data is segmented and encapsulated in traditional TPM package format, ensure that it is compatible with existing TPM The compatibility of the communication channels is further Linux Kernel and OVMF (Open Virtual Machine Firmware) Integrated lightweight TLS Library (such as wolfSSL ), supporting encrypted communications during the early boot phase.

[0049] When a customer CVM Need to use TPM When serving, TPM The driver first converts the original TPM Request approved TLSThen, the encrypted data stream is divided into multiple fragments of no more than 4096 bytes, each fragment as a TPM _ TLS instruction load. These special TPM Package through the existing TPM Communication channel transmission to the backend CVM After receiving these packets, the backend reassembles them TLS Data stream, decrypted to get the original TPM The request is processed and then encrypted and returned in the same way as the response.

[0050] This ensures vTPM Communication data between the front-end and back-end is not intercepted by an untrusted virtual machine manager in the middle. VMM ( Virtual Machine Manager ) eavesdropping or tampering; at the same time, maintain the existing TPM The compatibility of the communication architecture is VMM and other components; further, support security from the early stages of system startup TPM Communication, Coverage CVM Furthermore, it can also flexibly adapt to different scales. TPM Request and response, overcoming the traditional TPM Data size limitation in communication.

[0051] S 300. Construct a target verification mechanism, and verify the credibility of the target confidential virtual machine based on the target verification mechanism.

[0052] The verifying the credibility of the target confidential virtual machine based on the target verification mechanism includes: When the client virtual machine starts and enters the open virtual machine firmware stage, the client virtual machine establishes a TLS connect; The client virtual machine initiates a target verification request to the target confidential virtual machine; After the target confidential virtual machine receives the target verification request, it generates a target verification report based on the target verification request and obtains the target based on the target verification report. PEK The signature is sent to the client virtual machine; The client virtual machine is based on the target PEK Public key authentication of the target PEK Sign to obtain the authenticity of the target confidential virtual machine.

[0053] The target verification report includes a challenge value generated based on the target verification request and an integrity measurement value of the target confidential virtual machine.

[0054] This embodiment also includes building the target verification mechanism to verify the credibility of the target confidential virtual machine.

[0055] Specifically, refer to Figure 4 ,exist CvTPM During the verification process of the front-end and back-end, due to AMDSEV - SNP There is no similar RTMR (Timer / Counter Register) The metric registers are used to directly verify the virtual machine ( VM ) is started. Therefore, in order to ensure that the client virtual machine ( CVM ) boot measurement, which depends on the open virtual machine firmware ( OVMF ) Actively use startup parameters to expand TPM (Trusted Platform Module) PCR ( Platform Configuration Registers , Platform Configuration Register) register.

[0056] When the client virtual machine is started, the virtual machine monitor ( VMM ) will transfer the client virtual machine's OVMF The image and necessary static data are loaded into memory and requested SEV The firmware encrypts this memory area. SEV The firmware will be based on CVM The initial memory state and security policy generate a verification report, which can be used to verify CVM Once verified, customers can securely CVM Inject confidential data into it so that it can start normally. In this process, OVMF is a component that is considered to be trusted.

[0057] OVMF Included CvTPM A front-end driver that can be used in the Unified Extensible Firmware Interface ( UEFI ) The different stages of startup are VMM Virtual MMIO ( Memory-Mapped I / O , memory mapped input and output) interface with CvTPM However, when using CvTPM Before serving the backend, the frontend driver needs to first verify the integrity of the backend and the CVM This process is similar to SGX ( Software Guard Extensions, Software Guard Extensions).

[0058] In this embodiment, on the same platform, CPU Playing two CVM Verifiers play the role of arbitrators.CVM A random number will be generated as a challenge and sent to the verifier CVM . The Verified CVM Will then request CPU Generates a report containing metrics from the startup period, which can prove CVM integrity and trusted execution environment ( TEE ) exists, and by CPU Use only CPU Signed by a key with access rights. CVM After receiving the report, you can ask CPU Verify the report's signature. Although currently equipped AMDSEV The security processor does not yet provide a command to directly verify the signature, but this process can still be accomplished through additional implementation.

[0059] CPU The verification report generated is endorsed by the platform key ( PEK, Platform Encryption Key ) signed, and PEK The public key can then be used in the platform's certificate signing request ( CSR, Certificate Signing Request ) process from SEV After verifying the keychain published by the platform, the customer can export CPU of PEK The public key is injected into the initial boot memory. CVM The verification report measures the initial startup memory, so the injected PEK Under the supervision and control of the customer, thus extending the chain of trust to CVM of OVMF middle.

[0060] once CvTPM The front and back ends have completed verification. OVMF The front end can be used during the startup process TPM Functions to record and measure CVM The startup process. PCR The value can be retrieved at runtime and returned to the client as reliable proof that the process was initiated.

[0061] That is to say, in this embodiment, the AMD SEV - SNP Firmware provided API (Application Programming Interface) , to achieve something like Intel SGX Local authentication mechanism, in the client CVM of OVMF Phase integration validation logic, as used vTPM Pre-service pre-check step, further, using the platform endorsement key ( PEK ) signs the verification report andCVM Medium Preset PEK Public key,Finally, the verification process includes a challenge-response mechanism to ensure the timeliness and pertinence of the verification.

[0062] Specifically, in the customer CVM During startup, OVMF In the first stage, a verification request is initiated. It generates a random number as a challenge and sends it to vTPM rear end CVM .rear end CVM ask AMD SEV - SNP The firmware generates a verification report containing the random number, which contains the backend CVM The integrity metric of PEK Signature. Customer CVM After receiving the report, use the preset PEK The public key verifies the signature and checks whether the integrity measurement value in the report is consistent with the expected value. CVM Will continue to use it vTPM Backend services.

[0063] This ensures that customers CVM Only use verified, untampered vTPM Backend services; and build vTPM The complete trust chain of the service enhances the security of the entire confidential computing environment; it also supports dynamic verification and detects potential tampering or replacement attacks at runtime; further providing customers with vTPM Clear proof of service trustworthiness enhances user confidence in the cloud platform.

[0064] In summary, in this embodiment, CvTPM The design and implementation process of the front-end and back-end are as follows: CvTPM The front-end aspect is mainly aimed at running Linux The guest virtual machine of the operating system ( CVM ). In order to Linux The bottom layer TPM The drive can be CvTPM The driver has been modified to enable secure communication with the backend. TPM Clients can use CvTPM The encrypted transmission protocol establishes a connection with the backend. Linux It is called at the beginning of the startup TPM Related services, in order to ensure compatibility and service availability, a lightweight TLS Library wolfSSL . In this way, the kernel's underlying TPM The driver can use this cryptography library toTLS Further, in this embodiment, it is found Linux Responsible for handling the kernel space and user space TPM The requested function, and OVMF Process all TPM Request functions and adapt them CvTPM Encrypted transmission protocol. In addition, CvTPM The front-end and back-end verification processes are arranged in OVMF stage, by OVMF exist TLS Initiate verification after a successful handshake.

[0065] CvTPM The backend of swtpm and libtpms constitute. swtpm As TPM The backend interface and daemon are responsible for providing a single vTPM Example. libtpms It integrates TPM The implementation logic of the service. CvTPM Backend CVM In the process, a vTPM Instance manager for multiple clients on the same platform CVM Provide independent backend services. CVM Technology puts the entire system into a trusted execution environment ( TEE ), so it is more compatible with general system software. TPM The backend state storage can be CVM The internal virtual disk is used as the backend interface. swtpm Responsible for responding to the front-end verification request and passing TLS Context for encrypted transmission TPM The instruction data stream is decrypted and the response data stream is encrypted.

[0066] For the backend CVM For example, its startup process should be simple enough to rely entirely on AMD SEV The backend uses remote authentication technology to prove its integrity to the verifier. CVM The operating system should use a streamlined kernel to minimize the trusted computing base ( TCB ) size, thus avoiding the backend CVM Internal vulnerabilities TPM The confidentiality and integrity of the service is compromised. CVM Interaction with the outside world is strictly limited and can only be done through designated vTPM The service interface communicates to prevent unauthorized third parties from accessing the backendCVM Illegal reading and interaction of content.

[0067] It can be seen that CvTPM For confidential cloud computing application scenarios, it can provide customers with virtual TPM Services. Customer deployed CVM Open virtual machine firmware during boot time ( OVMF ) and the operating system during operation, it can be used normally TPM Before using the service, customers can AMD Security processor, through CvTPM The local verification process for platform deployment CvTPM rear end CVM and its internal vTPM The service is validated to ensure that its characteristics are consistent with the backend image that was pre-negotiated or guaranteed with the platform. VMM Excluded TCB In addition, no CVM ,rear end CVM And obtain any valid information from the front-end and back-end channels. vTPM The simulation software can be run directly on the backend CVM No need to remove CvTPM Other changes beyond the integration of encrypted transmission protocol, so it has higher software compatibility.

[0068] In summary, this embodiment provides a privacy protection method based on confidential cloud computing, by obtaining a target confidential virtual machine, vTPM The instance of is deployed in the target confidential virtual machine, and then the target transmission protocol is constructed, and the target is carried out based on the target transmission protocol. vTPM The goal of communication between the front-end and the back-end is vTPM The front end is the client virtual machine, the target vTPM The backend of the target confidential virtual machine is further constructed to verify the credibility of the target confidential virtual machine based on the target verification mechanism. The privacy protection method based on confidential cloud computing proposed in this embodiment is to vTPM The instance is deployed in a confidential virtual machine and a unique transmission protocol and verification mechanism are built to solve the virtual TPM In confidential cloud computing scenarios, the trust foundation is lost and it is impossible to ensure TPM The problem of running the simulation instance in a trusted execution environment makes vTPM The simulation software can be run directly on the backend CVM On, guaranteed vTPM Confidentiality and integrity of the services.

[0069] It should be understood that, although the various steps in the flowcharts given in the accompanying drawings of the present specification are displayed in sequence according to the indications of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0070] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory ( ROM ), programmable ROM ( PROM ), electrically programmable ROM ( EPROM ), electrically erasable programmable ROM ( EEPROM ) or flash memory. Volatile memory may include random access memory ( RAM ) or external cache memory. By way of illustration and not limitation, RAM Available in various forms, such as static RAM ( SRAM ),dynamic RAM ( DRAM ),synchronous DRAM ( SDRAM ), Double Data Rate SDRAM ( DDR SDRAM ), Enhanced SDRAM ( ESDRAM ), Synchronous Link ( Synchlink ) DRAM ( SLDRAM )、Memory Bus( Rambus )direct RAM ( RDRAM ), Direct Memory Bus Dynamics RAM ( DRDRAM ), and memory bus dynamics RAM ( RDRAM )wait.

[0071] Embodiment 2 Based on the above embodiment, the present invention also provides a terminal, such as Figure 5 As shown, the terminal includes a processor 10 and a memory 20. Figure 5 Only some components of the terminal are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0072] In some embodiments, the memory 20 may be an internal storage unit of the terminal, such as a hard disk or memory of the terminal. In other embodiments, the memory 20 may also be an external storage device of the terminal, such as a plug-in hard disk, a smart memory card ( Smart Media Card , SMC ), Safety Numbers ( Secure Digital , SD ) card, flash memory card ( Flash Card ) etc. Furthermore, the memory 20 may also include both an internal storage unit of the terminal and an external storage device. The memory 20 is used to store application software installed on the terminal and various types of data. The memory 20 may also be used to temporarily store data that has been output or is to be output. In one embodiment, a privacy protection program 30 based on confidential cloud computing is stored on the memory 20, and the privacy protection program 30 based on confidential cloud computing can be executed by the processor 10, thereby realizing the privacy protection method based on confidential cloud computing in the present application.

[0073] In some embodiments, the processor 10 may be a central processing unit (CPU). Central Processing Unit , CPU ), a microprocessor or other chip, used to run the program code or process data stored in the memory 20, such as executing the privacy protection method based on confidential cloud computing, etc.

[0074] In one embodiment, when the processor 10 executes the privacy protection program 30 based on confidential cloud computing in the memory 20, the following steps are implemented: Get the target confidential virtual machine and vTPM An instance of is deployed in the target confidential virtual machine; Construct a target transmission protocol, and perform the target transmission based on the target transmission protocol. vTPM The goal of communication between the front-end and the back-end is vTPM The front end is the client virtual machine, the target vTPM The backend is the target confidential virtual machine; A target verification mechanism is constructed, and the credibility of the target confidential virtual machine is verified based on the target verification mechanism.

[0075] Among them, the target vTPM An instance of is deployed in the target confidential virtual machine, including: Based on the target confidential virtual machine vTPM Encrypt the instance; A target service interface is obtained, and based on the target service interface, the target confidential virtual machine interacts with the outside world.

[0076] Wherein, the construction of the target transmission protocol includes: Introducing new TPM Extension instructions TPM _ TLS , used to transmit encrypted TLS Data flow; The encrypted TLS Data flow segmentation encapsulation in traditional TPM package format to ensure compatibility with existing TPM Compatibility of communication channels; exist Linux Kernel and OVMF Integrated lightweight TLS Library.

[0077] Wherein, the target is transmitted based on the target transmission protocol vTPM The communication between the front-end and the back-end includes: Get the original TPM Request, for the original TPM Request to proceed TLS Encrypt to obtain the target encrypted data stream; transmitting the encrypted data stream to the target confidential virtual machine; The target confidential virtual machine receives the encrypted data stream and decrypts it to obtain the original TPM Request and process.

[0078] The step of transmitting the encrypted data stream to the target confidential virtual machine includes: The target encrypted data stream is segmented to obtain a plurality of data stream segments no larger than 4096 bytes. TPM _ TLS The load of instructions; The data stream segment is transmitted to the target confidential virtual machine at the back end.

[0079] The target confidential virtual machine receives the encrypted data stream and decrypts it to obtain the original TPM Requests, including: The target confidential virtual machine extracts the data stream segment and sends it to a data buffer to be processed; passTLS The context decrypts the processed data buffer and reassembles TLS The data stream gets the original TPM ask.

[0080] Wherein, verifying the credibility of the target confidential virtual machine based on the target verification mechanism includes: When the client virtual machine starts and enters the open virtual machine firmware stage, the client virtual machine establishes a TLS connect; The client virtual machine initiates a target verification request to the target confidential virtual machine; After the target confidential virtual machine receives the target verification request, it generates a target verification report based on the target verification request and obtains the target based on the target verification report. PEK The signature is sent to the client virtual machine; The client virtual machine is based on the target PEK Public key authentication of the target PEK Sign to obtain the authenticity of the target confidential virtual machine.

[0081] The target verification report includes a challenge value generated based on the target verification request and an integrity measurement value of the target confidential virtual machine.

[0082] Embodiment 3 The present invention also provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the privacy protection method based on confidential cloud computing as described above.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A privacy protection method based on confidential cloud computing, characterized in that: The privacy protection method based on confidential cloud computing includes: Get the target confidential virtual machine and vTPM An instance of is deployed in the target confidential virtual machine; Construct a target transmission protocol, and perform the target transmission based on the target transmission protocol. vTPM The goal of communication between the front-end and the back-end is vTPM The front end is the client virtual machine, the target vTPM The backend is the target confidential virtual machine; A target verification mechanism is constructed, and the credibility of the target confidential virtual machine is verified based on the target verification mechanism.

2. The privacy protection method based on confidential cloud computing according to claim 1, characterized in that: The target vTPM An instance of is deployed in the target confidential virtual machine, including: Based on the target confidential virtual machine vTPM Encrypt the instance; A target service interface is obtained, and based on the target service interface, the target confidential virtual machine interacts with the outside world.

3. The privacy protection method based on confidential cloud computing according to claim 1 is characterized in that: The constructing of the target transmission protocol includes: Introducing new TPM Extension instructions TPM _ TLS , used to transmit encrypted TLS Data flow; The encrypted TLS Data flow segmentation encapsulation in traditional TPM package format to ensure compatibility with existing TPM Compatibility of communication channels; exist Linux Kernel and OVMF Integrated lightweight TLS Library.

4. The privacy protection method based on confidential cloud computing according to claim 3 is characterized in that: The target transmission protocol is based on the target vTPM The communication between the front-end and the back-end includes: Get the original TPM Request, for the original TPM Request to proceed TLS Encrypt to obtain the target encrypted data stream; transmitting the encrypted data stream to the target confidential virtual machine; The target confidential virtual machine receives the encrypted data stream and decrypts it to obtain the original TPM Request and process.

5. The privacy protection method based on confidential cloud computing according to claim 4 is characterized in that: The transmitting the encrypted data stream to the target confidential virtual machine includes: The target encrypted data stream is segmented to obtain a plurality of data stream segments no larger than 4096 bytes. TPM _ TLS The load of instructions; The data stream segment is transmitted to the target confidential virtual machine at the back end.

6. The privacy protection method based on confidential cloud computing according to claim 5 is characterized in that: The target confidential virtual machine receives the encrypted data stream and decrypts it to obtain the original TPM Requests, including: The target confidential virtual machine extracts the data stream segment and sends it to a data buffer to be processed; pass TLS The context decrypts the processed data buffer and reassembles TLS The data stream gets the original TPM ask.

7. The privacy protection method based on confidential cloud computing according to claim 1, characterized in that: The verifying the credibility of the target confidential virtual machine based on the target verification mechanism includes: When the client virtual machine starts and enters the open virtual machine firmware stage, the client virtual machine establishes a TLS connect; The client virtual machine initiates a target verification request to the target confidential virtual machine; After the target confidential virtual machine receives the target verification request, it generates a target verification report based on the target verification request and obtains the target based on the target verification report. PEK The signature is sent to the client virtual machine; The client virtual machine is based on the target PEK Public key authentication of the target PEK Sign to obtain the authenticity of the target confidential virtual machine.

8. The privacy protection method based on confidential cloud computing according to claim 7 is characterized in that: The target verification report includes a challenge value generated based on the target verification request and an integrity measurement value of the target confidential virtual machine.

9. A terminal, characterized in that: The terminal includes: a processor, a computer-readable storage medium communicatively connected to the processor, the computer-readable storage medium being suitable for storing a plurality of instructions, and the processor being suitable for calling the instructions in the computer-readable storage medium to execute the steps of the privacy protection method based on confidential cloud computing as described in any one of claims 1 to 8 above.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the privacy protection method based on confidential cloud computing as described in any one of claims 1-8.

Images