Portable Physical Root and Cloud Host Security Control Method Based on Portable Physical Root

Abstract

An embodiment of the present invention discloses a portable physical root. The portable physical root includes a cryptographic security chip, a system on chip, and an Ethernet interface; wherein, the cryptographic security chip is used to provide functions of public-private key generation, data encryption, and digital signature; the system on chip is used to provide a software operating system for the portable physical root to complete the interactive authentication between the portable physical root and the cloud host; the Ethernet interface is used to connect the portable physical root to the network and communicate with the trusted root of the cloud host. By adopting the technical solution of the embodiment of the present invention, the constructed portable physical root is used as a security control device for the cloud host to perform security authentication and security control on the cloud host, so as to effectively prevent hacker attacks, reduce the trust risk, and improve the portable mobility of the security control device.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of information security technology, and in particular, to a portable root of trust and a method for securing a cloud host based on the portable root of trust. Background Art

[0002] Trust means that an entity is trustworthy if it can achieve the expected purpose in the expected way. The technology for ensuring entity trust is called trusted computing technology, and the core of trusted computing technology is the root of trust. The root of trust does not need to be proven, and the three security aspects of technology, entity, and management together ensure the trustworthiness of the root of trust. Starting from the root of trust, a trusted computing environment can be constructed by means of hierarchical measurement.

[0003] The root of trust is usually built into a computing device and is immovable. However, with the development of cloud computing, users deploy their services to the cloud by renting cloud hosts; at the same time, users are increasingly adopting mobile office methods. Since the root of trust of a cloud host is provided by a cloud service provider, there are trust risks, making it impossible for users to solely rely on this root of trust and requiring the addition of a security control device independently owned by themselves; in addition, the need for users to work remotely also requires that this security control device has the characteristics of portability and mobility.

[0004] Therefore, how to secure a cloud host is a technical problem that needs to be urgently solved by those skilled in the art. Summary of the Invention

[0005] Embodiments of the present invention provide a portable root of trust and a method for securing a cloud host based on the portable root of trust to achieve security authentication and security control of the cloud host, effectively prevent hacker attacks, reduce trust risks, and improve the portability and mobility of the security control device.

[0006] In a first aspect, embodiments of the present invention provide a portable root of trust, characterized in that the portable root of trust includes a cryptographic security chip, a system-on-chip, and an Ethernet interface; wherein,

[0007] The cryptographic security chip is used to provide public-private key generation, data encryption, and digital signature functions;

[0008] The system-on-chip is used to provide a software operating system for the portable root of trust to complete the mutual authentication between the portable root of trust and the cloud host;

[0009] The Ethernet interface is used to connect the portable root of trust to a network and communicate with the root of trust of the cloud host.

[0010] Second aspect, embodiments of the present invention further provide a cloud host security control method based on a portable physical root, characterized in that the method is implemented using a portable physical root, and the method includes:

[0011] In the cloud host startup phase, the portable physical root is communicatively connected to the cloud host trusted root through an Ethernet interface, and mutual authentication is completed.

[0012] In the phase where an external entity accesses the cloud host, the portable physical root and the cloud host trusted root form a consortium, and the consortium performs access authentication and access authorization on the external entity to perform security control on the cloud host.

[0013] Embodiments of the present invention provide a portable physical root, which includes a cryptographic security chip, a system-on-chip, and an Ethernet interface; wherein, the cryptographic security chip is used to provide public and private key generation, data encryption, and digital signature functions; the system-on-chip is used to provide a software operating system for the portable physical root to complete the mutual authentication between the portable physical root and the cloud host; the Ethernet interface is used to connect the portable physical root to the network and communicate with the trusted root of the cloud host. In the embodiments of the present invention, the constructed portable physical root is used as a security control device for the cloud host to perform security authentication and security control on the cloud host, so as to effectively prevent hacker attacks, reduce trust risks, and improve the portability and mobility of the security control device. Description of the Drawings

[0014] By reading the detailed description of the non-limiting embodiments with reference to the following drawings, other features, objectives, and advantages of the present invention will become more apparent. The drawings are only for the purpose of showing the preferred embodiments and are not considered to be a limitation of the present invention. Moreover, throughout the drawings, the same reference numerals are used to represent the same components. In the drawings:

[0015] Figure 1 is a schematic structural diagram of a portable physical root provided in an embodiment of the present invention;

[0016] Figure 2 is a schematic structural diagram of another portable physical root provided in an embodiment of the present invention;

[0017] Figure 3 is a schematic structural diagram of a portable physical root participating in the working process of a cloud host provided in an embodiment of the present invention;

[0018] Figure 4 is a flowchart of a cloud host security control method based on a portable physical root provided in an embodiment of the present invention;

[0019] Figure 5A flowchart of a method for securely controlling a cloud host during the startup phase provided in an embodiment of the present invention;

[0020] Figure 6 A flowchart of a method for securely controlling a cloud host during the external entity access phase provided in an embodiment of the present invention;

[0021] Figure 7 A schematic structural diagram of another portable entity root participating in the working process of a cloud host provided in an embodiment of the present invention;

[0022] Figure 8 A schematic structural diagram of a cloud host security control device based on a portable entity root provided in an embodiment of the present invention;

[0023] Figure 9 A schematic structural diagram of an electronic device provided in an embodiment of the present invention. Detailed implementation manners

[0024] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present invention, rather than limiting the present invention. Additionally, it should be noted that for the sake of description, only the parts related to the present invention rather than all the structures are shown in the drawings.

[0025] Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations (or steps) as sequential processes, many of the operations (or steps) can be implemented in parallel, concurrently, or simultaneously. In addition, the order of the operations can be rearranged. The process can be terminated when its operations are completed, but it can also have additional steps not included in the drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0026] Among them, the acquisition, storage, use, and processing of data in the technical solution of the present application all comply with the relevant regulations of national laws and regulations. It should be noted that in the embodiments of the present application, some industry-existing solutions such as certain software, components, or models may be mentioned. They should be regarded as exemplary, and their purpose is only to illustrate the feasibility in the implementation of the technical solution of the present application, but it does not mean that the applicant has already or necessarily used this solution.

[0027] It should be noted that the terms "first", "second", etc. in the description, claims and above-mentioned drawings of the present invention are used to distinguish similar objects, and do not necessarily need to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present invention described here can be implemented in an order other than those illustrated or described here.

[0028] Embodiment 1

[0029] Figure 1 It is a schematic structural diagram of a portable physical root provided in an embodiment of the present invention. This embodiment is applicable to the situation where a user rents a cloud host and uses the portable physical root to perform security control on the cloud host, such as Figure 1 As shown, the portable physical root 100 provided in the embodiment of the present invention may include: a cryptographic security chip 110, a system-on-chip 120, and an Ethernet interface 130; among them:

[0030] The cryptographic security chip 110 is used to provide public and private key generation, data encryption, and digital signature functions;

[0031] The system-on-chip 120 is used to provide a software operating system for the portable physical root to complete the interactive authentication between the portable physical root and the cloud host;

[0032] The Ethernet interface 130 is used to connect the portable physical root to the network and communicate with the trusted root of the cloud host.

[0033] Among them, when a user rents a cloud host and deploys services to the cloud, the portable physical root constructed according to the embodiment of the present invention is used to perform security control on the rented cloud host. The portable physical root may refer to a security control device for performing security control on the cloud host. Among them, the portable physical root is a compactly packaged and independently operable card-type device with cryptographic security functions, and can be connected to the network through an Ethernet interface.

[0034] Among them, the portable physical root includes a cryptographic security chip. The cryptographic security chip is a device that can independently generate keys and perform encryption and decryption. It has an independent processor and storage unit inside, can store keys and feature data, and provides encryption and security authentication services for the device. The cryptographic security chip is an integrated circuit chip that implements one or more cryptographic algorithms and directly or indirectly uses cryptographic techniques to protect keys and sensitive information. As the lowest-level security guarantee of intelligent terminals, its application can effectively prevent security threats such as hacker attacks. In the embodiment of the present invention, the cryptographic security chip is equipped with public and private key generation, data encryption, and digital signature functions to authenticate and perform security control on the cloud host when the portable physical root accesses the cloud host, so as to effectively prevent hacker attacks and reduce the trust risk.

[0035] Among them, the system-on-chip may refer to a technology that integrates a complete system on a single chip and packetizes all or part of the necessary electronic circuits. In an embodiment of the present invention, the system-on-chip provides a software operating system for the portable physical root to complete the interactive authentication between the portable physical root and the cloud host.

[0036] The Ethernet interface connects the portable physical root to the network and communicates with the trusted root of the cloud host. Among them, since the cloud host is deployed in the cloud, it is impossible to insert a physical root device in the form of a USB, nor can all the data of the cloud server be transmitted to the physical root through the network; therefore, in an embodiment of the present invention, the portable physical root is communicatively connected to the cloud host through the Ethernet interface, and collaborative password calculation is performed with the cloud host through the Ethernet interface to jointly complete the process of trusted authentication. Optionally, the Ethernet interface supports the trusted security function of a remote server across the network, has more resources and computing capabilities than other physical roots in the prior art, and supports network operations.

[0037] In an alternative solution of an embodiment of the present invention, the portable physical root further includes an enclosed housing that encloses the password security chip and the system-on-chip inside the portable physical root.

[0038] Among them, referring to Figure 2 , Figure 2 the left side in [Figure] shows the internal module composition of the portable physical root M1, which is composed of a password security chip, a system-on-chip (Chip Operating System, COS), and an Ethernet interface. Figure 2 The right side in [Figure] shows the external schematic diagram of the portable physical root M1, including a compact enclosed housing and an Ethernet interface. When using the portable physical root, insert the portable physical root into the network cable to power it on; after use, pull out the portable physical root from the network cable and carry it with you to improve the portability and mobility of the portable physical root.

[0039] In an alternative solution of an embodiment of the present invention, the portable physical root is an independently operating card-type device, and the portable physical root is connected to a preset network through an Ethernet interface and forms a union with the trusted root of the cloud host; among them, the union is used to complete the interactive authentication between the portable physical root and the trusted root of the cloud host.

[0040] Among them, referring to Figure 3, the portable entity root M1 is connected to a preset network through an Ethernet interface and forms a consortium LI with the trusted root M2 of the cloud host, and the consortium is used to complete the interactive authentication between the portable entity root and the trusted root of the cloud host. When the cloud server starts, the portable entity root needs to be connected to the network, and any step in the startup process needs to be jointly completed using this consortium, otherwise it cannot be completed. For example, when the portable entity root accesses the cloud host, the consortium is required to perform interactive authentication on the portable entity root and the trusted root of the cloud host. After the interactive authentication is successful, it is determined that the portable entity root has been successfully accessed, otherwise the access is unsuccessful. After the portable entity root access is completed, the cloud host is securely controlled using the shown portable entity root.

[0041] An embodiment of the present invention provides a portable entity root, which includes a cryptographic security chip, a system-on-chip, and an Ethernet interface; wherein, the cryptographic security chip is used to provide public-private key generation, data encryption, and digital signature functions; the system-on-chip is used to provide a software operating system for the portable entity root to complete the interactive authentication between the portable entity root and the cloud host; the Ethernet interface is used to connect the portable entity root to the network and communicate with the trusted root of the cloud host. The portable entity root constructed using the embodiment of the present invention performs security authentication and security control on the cloud host to effectively prevent hacker attacks, reduce trust risks, and improve portability and mobility.

[0042] Embodiment Two

[0043] Figure 4 It is a flowchart of a cloud host security control method based on a portable entity root provided in an embodiment of the present invention. This embodiment is applicable to the situation where a user rents a cloud host and uses a portable entity root to perform security control on the cloud host. The method of this embodiment can be executed by a cloud host security control device based on a portable entity root, and this device can be implemented using the constructed portable entity root. This device can be configured in a server for cloud host security control based on a portable entity root. The method specifically includes the following steps:

[0044] S410. In the cloud host startup phase, connect the portable entity root and the trusted root of the cloud host for communication through the Ethernet interface and complete the interactive authentication.

[0045] Among them, in the cloud host, the trusted root can build a platform trust chain from hardware to software, from the bottom layer to the top layer. The trusted root can measure and verify the software stack through algorithms and keys implanted in the trusted hardware by the chip manufacturer and the integrated dedicated microcontroller to ensure the trustworthiness of the cloud host system and provide basic security protection for the cloud host.

[0046] In real life, users deploy their services to the cloud by renting cloud hosts. However, since the trusted root of the cloud host is provided by the cloud service provider, there are certain risks. Therefore, in the embodiments of the present invention, a portable physical root is used to securely control the cloud host, reducing the trust risk, and the portable physical root has certain portable and mobile characteristics.

[0047] In the cloud host startup phase, the portable physical root communicates and connects with the cloud host trusted root through Ethernet and completes mutual authentication. Among them, the mutual authentication is completed in a union formed by the portable physical root and the cloud host trusted root. See Figure 3 The portable physical root and the cloud host trusted root form a union, and joint password verification is performed in the union to communicate and connect the portable physical root and the cloud host trusted root to securely control the cloud host.

[0048] S420. In the phase when an external entity accesses the cloud host, the portable physical root and the cloud host trusted root form a union, and the union is used to perform access authentication and access authorization on the external entity to securely control the cloud host.

[0049] Among them, the external entity may refer to an entity that exchanges data with the cloud host. When the external entity accesses the cloud host, first form a union of the portable physical root and the cloud host trusted root and perform mutual authentication to securely control the cloud host. The union is used to perform access authentication and access authorization on the external entity to securely control the cloud host.

[0050] The embodiments of the present invention provide a cloud host security control method based on a portable physical root. In the cloud host startup phase, the portable physical root is communicatively connected to the cloud host trusted root through an Ethernet interface and mutual authentication is completed. In the phase when an external entity accesses the cloud host, the portable physical root and the cloud host trusted root form a union, and the union is used to perform access authentication and access authorization on the external entity to securely control the cloud host. By adopting the technical solution of the embodiments of the present invention, a union is formed by the portable physical root and the cloud host trusted root, and mutual authentication is performed on the portable physical root and the cloud host trusted root through the union to securely control the cloud host. Security authentication is performed on the external entity through the union to prevent malicious access by the external entity and improve the security of the cloud host.

[0051] Embodiment III

[0052] Figure 5The figure is a flowchart of a cloud host security control method based on a portable physical root provided in an embodiment of the present invention. The embodiment of the present invention further optimizes the foregoing embodiment on the basis of the above embodiment, and the embodiment of the present invention can be combined with each optional solution in one or more of the above embodiments. As Figure 5 shown, the cloud host security control method based on a portable physical root provided in the embodiment of the present invention may include the following steps:

[0053] S510. Insert the portable physical root into a network cable through an Ethernet interface to power on and run the portable physical root.

[0054] Among them, referring to Figure 7 , the cloud service provider deploys cloud server physical machines on computing nodes, generates multiple cloud hosts on the cloud server physical machines, and runs a linux host operating system and virtual machine management software (Virtual Machine Monitor, VMM). In the embodiment of the present invention, taking cloud host 1 as an example, a user rents cloud host 1 from the cloud service provider, and the cloud service provider initializes a trusted root in cloud host 1.

[0055] In the cloud host startup phase, the user inserts the portable physical root constructed in the embodiment of the present invention into the network cable, and the portable physical root runs.

[0056] S520. Power on and start the cloud host to power on and run the trusted root built in the cloud host.

[0057] The rented cloud host 1 is powered on and started to power on and run the trusted root built in the cloud host 1.

[0058] S530. The trusted root of the cloud host communicates and connects with the portable physical root to form a union.

[0059] Among them, the portable physical root is communicatively connected to the trusted root of cloud host 1 to form a union. Among them, any step in the cloud host startup phase requires the union to complete together to ensure the security of the cloud host.

[0060] S540. In the union, the trusted root of the cloud host and the portable physical root perform mutual authentication using a preset public key.

[0061] After the successful connection between the trusted root of the cloud host and the portable entity root, the system firmware of the portable entity root is first measured for integrity, and then a signature is requested, which requires joint cryptographic calculations by the consortium to complete; after the firmware integrity measurement is completed, the integrity measurement of the trusted operating system of the cloud host is performed, and similarly, the signature for this process requires joint cryptographic calculations by the consortium to complete. That is, after both parties pass the calculations, the subsequent measurements are continued; otherwise, the startup is stopped and an error is returned.

[0062] As an optional but non-limiting implementation, the trusted root of the cloud host and the portable entity root perform mutual authentication using a preset public key, including but not limited to steps A1 - A3:

[0063] Step A1: The trusted root of the cloud host verifies the portable entity root based on the first public key pre-configured in the portable entity root, and obtains a first verification result; among them, the preset public key includes the first public key, and the first public key is generated by the trusted root of the cloud host.

[0064] Step A2: The portable entity root verifies the trusted root of the cloud host based on the second public key pre-configured in the trusted root of the cloud host, and obtains a first verification result; among them, the preset public key includes the second public key, and the second public key is generated by the portable entity root.

[0065] Step A3: Based on the first verification result and the second verification result, mutual authentication is performed between the trusted root of the cloud host and the portable entity root.

[0066] Among them, when the trusted root of the cloud host verifies the portable entity root, it obtains the first public key pre-configured in the portable entity root by the trusted root of the cloud host from the portable entity root, and the first public key is generated by the trusted root of the cloud host; the trusted root of the cloud host determines whether the public key in the portable entity root is provided by the trusted root of the cloud host to perform the first authentication on the portable entity root. Optionally, the first authentication may refer to the trusted root of the cloud host generating a first signature, the trusted root of the cloud host obtaining the first public key, and using the first public key to authenticate the first signature to authenticate the portable entity root.

[0067] In addition to the trusted root of the cloud host authenticating the portable entity root, the portable entity root also needs to authenticate the trusted root of the cloud host. Obtain the second public key from the trusted root of the cloud host, and determine whether the second public key is the public key generated by the portable entity root to perform the second authentication on the trusted root of the cloud host. Optionally, the second authentication may refer to the portable entity root generating a second signature, the portable entity root obtaining the second public key, and using the second public key to authenticate the second signature to authenticate the trusted root of the cloud host.

[0068] After the authentication of the portable physical root and the trusted root of the cloud host is completed, the interactive authentication is completed. Among them, the interactive authentication is completed in the consortium.

[0069] An embodiment of the present invention provides a cloud host security control method based on a portable physical root. In the cloud host startup stage, the portable physical root is inserted into the network cable through an Ethernet interface to power on and run the portable physical root; the cloud host is powered on and started to power on and run the trusted root built in the cloud host; the trusted root of the cloud host is communicatively connected to the portable physical root and forms a consortium; in the consortium, the trusted root of the cloud host and the portable physical root perform interactive authentication using a preset public key. By adopting the technical solution of the embodiment of the present invention, when a user rents a cloud host and starts the cloud host, the portable physical root and the trusted root of the cloud host need to perform interactive authentication, which ensures the security control of the cloud host; at the same time, the portable physical root has portability, and the user can carry it with them, which is convenient for the user to use for mobile office.

[0070] Embodiment 4

[0071] Figure 6 It is a flowchart of a cloud host security control method based on a portable physical root provided in an embodiment of the present invention. The embodiment of the present invention further optimizes the foregoing embodiment on the basis of the above embodiment, and the embodiment of the present invention can be combined with each optional solution in the above one or more embodiments. As Figure 6 shown, the cloud host security control method based on a portable physical root provided in the embodiment of the present invention may include the following steps:

[0072] S610. In the stage of an external entity accessing the cloud host, the portable physical root and the trusted root of the cloud host form a consortium, and the consortium generates a data signature.

[0073] Among them, the embodiment of the present invention takes the cloud host accessing an external entity as an example to perform security control on the cloud host. Before the external entity accesses the cloud host, the interactive authentication between the portable physical root and the trusted root of the cloud host has been completed. In the stage of the external entity accessing the cloud host, the portable physical root and the trusted root of the cloud host form a consortium, and the consortium generates a data signature. The data signature is jointly generated by the portable physical root and the trusted root of the cloud host; for example, a part of the data signature is generated by the portable physical root, and another part is generated by the trusted root of the cloud host, and the two parts are combined to form the data signature. The data signature is jointly generated by the portable physical root and the trusted root of the cloud host, which ensures the security of the cloud host.

[0074] S620. According to the data signature, the consortium performs joint password authentication with the external entity.

[0075] Among them, the combined password authentication performs interactive authentication on the consortium and external entities. After the consortium determines the identity of the external entity and the external entity determines the identity of the consortium, the external entity is connected to the cloud host.

[0076] As an optional but non-limiting implementation manner, the combined password authentication between the consortium and the external entity based on the digital signature includes, but is not limited to, steps B1 - B2:

[0077] Step B1: The consortium obtains the third public key pre-configured in the external entity and uses the third public key to verify the digital signature to authenticate the external entity; wherein, the third public key is a combined public key jointly generated by the portable entity root and the cloud host trusted root.

[0078] Step B2: The external entity obtains the fourth public key pre-configured in the consortium to authenticate the consortium; wherein, the fourth public key is generated by the external entity.

[0079] Among them, when the external entity accesses the cloud host, the external entity also needs to be verified. In the embodiments of the present invention, the consortium is used to authenticate the external entity, and at the same time, the external entity also needs to authenticate the consortium.

[0080] The consortium obtains the third public key pre-configured in the external entity and uses the third public key to verify the digital signature generated by the consortium. The third public key is generated by the consortium, and the digital signature is verified using the third public key to authenticate the external entity. Similarly, the external entity obtains the fourth public key pre-configured in the consortium and authenticates the consortium based on the fourth public key. Only after the external entity authentication is passed and the consortium authentication is passed can the external entity be connected to the cloud host.

[0081] S630. After the combined password authentication between the consortium and the external entity is successful, the consortium authorizes the external entity to access to perform security control on the cloud host.

[0082] Among them, after the combined password authentication between the external entity and the consortium is successful, the consortium authorizes the external entity to access.

[0083] As an optional but non-limiting implementation manner, the method further includes:

[0084] If the interactive authentication between the portable entity root and the cloud host trusted root is not completed, or the interactive authentication between the consortium and the external entity is not completed, the connection between the portable entity root and the cloud host trusted root is disconnected, and the cloud server maintains its original operating state; wherein, the cloud server includes a cloud host, a cloud host trusted root, and an operating system.

[0085] Among them, the communication connection between the portable entity root and the trusted root of the cloud host, as well as the access, access authentication, and authorization of the cloud host and external entities, all require the participation of the portable entity root. If the portable entity root and the trusted root of the cloud host have not completed the mutual authentication, or the consortium and the external entity have not completed the mutual authentication, the connection between the portable entity root and the trusted root of the cloud host will be disconnected, and the cloud server will be kept in its original operating state, thus ensuring the security of the cloud host. Among them, keeping the cloud server in its original operating state includes, but is not limited to, that the cloud server cannot download and update, the system software or user software cannot add or reduce functions, and the working state of the system cannot be switched, such as restarting, suspending, and logging off.

[0086] An embodiment of the present invention provides a cloud host security control method based on a portable entity root. In the stage of an external entity accessing the cloud host, the portable entity root and the trusted root of the cloud host form a consortium, and the consortium generates a data signature; according to the data signature, the consortium and the external entity perform joint password authentication; wherein, the joint password authentication is to perform mutual authentication on the consortium and the external entity; after the joint password authentication between the consortium and the external entity is successful, the consortium authorizes the external entity to access, so as to perform security control on the cloud host. By adopting the technical solution of the embodiment of the present invention, when an external entity accesses the cloud host, the portable entity root and the trusted root of the cloud host form a consortium, and the external entity and the consortium perform mutual authentication to ensure the security of the cloud host and reduce the risk of hacker attacks.

[0087] Embodiment 5

[0088] Figure 8 It is a structural schematic diagram of a cloud host security control device based on a portable entity root provided in an embodiment of the present invention. The technical solution of this embodiment is applicable to the situation where a user rents a cloud host and uses a portable entity root to perform security control on the cloud host. This device can be implemented by software and / or hardware and is generally integrated on any electronic device with network communication functions. The electronic device includes, but is not limited to: devices such as servers, computers, and personal digital assistants. As Figure 8 shown, the cloud host security control device based on a portable entity root provided in this embodiment may include: a cloud host startup authentication module 810 and an external entity access authentication module 820; wherein,

[0089] The cloud host startup authentication module 810 is used to communicate and connect the portable entity root and the trusted root of the cloud host through an Ethernet interface and complete mutual authentication in the cloud host startup stage;

[0090] The external entity access authentication module 820 is used to form a union of the portable entity root and the cloud host trusted root during the stage when an external entity accesses the cloud host, and perform access authentication and access authorization on the external entity through the union to perform security control on the cloud host.

[0091] Based on the above embodiments, optionally, the cloud host startup authentication module is specifically used for:

[0092] Insert the portable entity root into the network cable through the Ethernet interface to power on and run the portable entity root;

[0093] Power on and start the cloud host to power on and run the trusted root built in the cloud host;

[0094] The cloud host trusted root is communicatively connected to the portable entity root and forms a union;

[0095] In the union, the cloud host trusted root and the portable entity root perform mutual authentication using a preset public key.

[0096] Based on the above embodiments, optionally, the cloud host startup authentication module is specifically used for:

[0097] The cloud host trusted root verifies the portable entity root according to the first public key pre-configured in the portable entity root to obtain a first verification result; wherein, the preset public key includes the first public key, and the first public key is generated by the cloud host trusted root;

[0098] The portable entity root verifies the cloud host trusted root according to the second public key pre-configured in the cloud host trusted root to obtain a first verification result; wherein, the preset public key includes the second public key, and the second public key is generated by the portable entity root;

[0099] Based on the first verification result and the second verification result, perform mutual authentication on the cloud host trusted root and the portable entity root.

[0100] Based on the above embodiments, optionally, the external entity access authentication module is specifically used for:

[0101] During the stage when an external entity accesses the cloud host, form a union of the portable entity root and the cloud host trusted root, and the union generates a data signature;

[0102] Based on the data signature, the union performs joint password authentication with the external entity; wherein, the joint password authentication is to perform mutual authentication on the union and the external entity;

[0103] After the joint password authentication between the union and the external entity is successful, the union performs access authorization on the external entity to perform security control on the cloud host.

[0104] Based on the above embodiments, optionally, the external entity access authentication module is further specifically configured to:

[0105] The consortium obtains the third public key pre-configured in the external entity, and uses the third public key to verify the data signature to authenticate the access of the external entity; wherein, the third public key is a joint public key jointly generated by the portable entity root and the cloud host trusted root;

[0106] The external entity obtains the fourth public key pre-configured in the consortium to authenticate the consortium; wherein, the fourth public key is generated by the external entity.

[0107] Based on the above embodiments, optionally, the data signature is jointly generated by the portable entity root and the cloud host trusted root.

[0108] Based on the above embodiments, optionally, the cloud host security control device based on the portable entity root further includes a connection disconnection module, which is specifically configured to:

[0109] If the portable entity root and the cloud host trusted root do not complete the mutual authentication, or the consortium and the external entity do not complete the mutual authentication, then disconnect the connection between the portable entity root and the cloud host trusted root, and keep the cloud server in its original running state; wherein, the cloud server includes a cloud host, a cloud host trusted root, and an operating system.

[0110] The cloud host security control device based on the portable entity root provided in the embodiments of the present invention can execute the cloud host security control method based on the portable entity root provided in any of the above embodiments of the present invention, and has the corresponding functions and beneficial effects of executing the cloud host security control method based on the portable entity root. For the detailed process, refer to the relevant operations of the cloud host security control method based on the portable entity root in the foregoing embodiments.

[0111] Embodiment Six

[0112] Figure 9 It is a schematic structural diagram of an electronic device provided in an embodiment of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as, a laptop computer, a desktop computer, a workbench, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as, a personal digital processor, a cellular phone, a smart phone, a wearable device (such as a helmet, glasses, a watch, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present invention described herein and / or claimed.

[0113] AsFigure 9 As shown, the electronic device 10 includes at least one processor 11 and a memory communicatively connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc. The memory stores a computer program executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0114] Multiple components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disc, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0115] The processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include but are not limited to a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the cloud host security control method based on a portable entity root.

[0116] In some embodiments, the cloud host security control method based on a portable entity root can be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method described above can be executed. Alternatively, in other embodiments, the processor 11 can be configured to execute the cloud host security control method based on a portable entity root by any other appropriate means (e.g., by means of firmware).

[0117] In particular, according to an embodiment of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, an embodiment of the present invention includes a computer program product that includes a computer program carried on a non-transitory computer-readable medium, the computer program including program code for performing the cloud host security control method based on a portable entity root shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication unit 19, or installed from the storage unit 18, or installed from the ROM 12. When the computer program is executed by the processor 11, the above-described functions defined in the cloud host security control method according to the embodiment of the present invention are performed.

[0118] The various embodiments of the systems and techniques described above in this document can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, the programmable processor can be a dedicated or general-purpose programmable processor, and can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit the data and instructions to the storage system, the at least one input device, and the at least one output device.

[0119] The computer programs for implementing the methods of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to the processors of general-purpose computers, dedicated computers, or other programmable data processing devices, such that when the computer programs are executed by the processors, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer programs can be executed entirely on the machine, partially on the machine, as an independent software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0120] In the context of the present invention, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer-readable storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, the computer-readable storage medium can be a machine-readable signal medium. More specific examples of the machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0121] To provide for interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can also be used to provide for interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0122] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer having a graphical user interface or a web browser through which the user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0123] A computing system may include a client and a server. The client and the server are generally far from each other and usually interact via a communication network. The relationship between the client and the server is created by computer programs running on respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system and solves the defects of difficult management and weak business scalability existing in traditional physical hosts and VPS services.

[0124] Embodiment Seven

[0125] The embodiment of the present invention also provides a computer program product, including a computer program which, when executed by a processor, implements the cloud host security control method based on a portable entity root provided in any embodiment of the present application.

[0126] In the process of implementing the computer program product, computer program code for performing the operations of the present invention can be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network - including a local area network (LAN) or a wide area network (WAN) - or can be connected to an external computer (for example, by using an Internet service provider to connect through the Internet).

[0127] It should be understood that various forms of the processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in the present invention can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved, and no limitations are imposed herein.

[0128] The above specific embodiments do not constitute a limitation to the protection scope of the present invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims

1. A portable physical root, characterized in that, The portable entity root includes a cryptographic security chip, a system-on-chip, and an Ethernet interface; wherein, The cryptographic security chip is used to provide functions of public-private key generation, data encryption, and digital signature; The system-on-chip is used to provide a software operating system for the portable entity root to complete the interactive authentication between the portable entity root and the cloud host; The Ethernet interface is used to connect the portable entity root to the network and communicate with the trusted root of the cloud host; Wherein, the portable entity root is connected to a preset network through the Ethernet interface and forms a consortium with the trusted root of the cloud host; during the cloud host startup phase and during the external entity access to the cloud host phase, the consortium is used to complete the authentication; Specifically, during the external entity access to the cloud host phase, the portable entity root and the trusted root of the cloud host form a consortium, and the consortium generates a data signature; based on the data signature, the consortium performs joint password authentication with the external entity; wherein, the data signature is jointly generated by the portable entity root and the trusted root of the cloud host, and the joint password authentication is an interactive authentication of the consortium and the external entity; after the joint password authentication between the consortium and the external entity is successful, the consortium authorizes the external entity to access, so as to perform security control on the cloud host.

2. The portable physical root according to claim 1, characterized in that, The portable entity root further includes an enclosed housing, and the enclosed housing encloses the cryptographic security chip and the system-on-chip inside the portable entity root.

3. The portable physical root according to claim 1, characterized in that, The portable entity root is an independently operating card-type device, and the portable entity root is connected to a preset network through the Ethernet interface and forms a consortium with the trusted root of the cloud host; wherein, the consortium is used to complete the interactive authentication between the portable entity root and the trusted root of the cloud host.

4. A cloud host security control method based on a portable entity root, characterized in that, The method is implemented using a portable entity root, and the method includes: During the cloud host startup phase, the portable entity root and the trusted root of the cloud host are communicatively connected through the Ethernet interface, and the interactive authentication is completed; During the external entity access to the cloud host phase, the portable entity root and the trusted root of the cloud host form a consortium, and the consortium performs access authentication and access authorization on the external entity to perform security control on the cloud host; Wherein, during the external entity access to the cloud host phase, the portable entity root and the trusted root of the cloud host form a consortium, and the consortium performs access authentication and access authorization on the external entity to perform security control on the cloud host, including: During the external entity access to the cloud host phase, the portable entity root and the trusted root of the cloud host form a consortium, and the consortium generates a data signature; based on the data signature, the consortium performs joint password authentication with the external entity; wherein, the data signature is jointly generated by the portable entity root and the trusted root of the cloud host, and the joint password authentication is an interactive authentication of the consortium and the external entity; after the joint password authentication between the consortium and the external entity is successful, the consortium authorizes the external entity to access, so as to perform security control on the cloud host.

5. The method according to claim 4, wherein During the cloud host startup phase, the portable entity root and the trusted root of the cloud host are communicatively connected through the Ethernet interface, and the interactive authentication is completed, including: Insert the portable entity root into the network cable through the Ethernet interface to power on and run the portable entity root; Power on and start the cloud host to power on and run the trusted root built in the cloud host; The trusted root of the cloud host is communicatively connected to the portable entity root and forms a consortium; In the consortium, the trusted root of the cloud host and the portable entity root perform mutual authentication using a preset public key.

6. The method according to claim 5, characterized in that, The trusted root of the cloud host and the portable entity root perform mutual authentication using a preset public key, including: The trusted root of the cloud host verifies the portable entity root based on the first public key pre-configured in the portable entity root to obtain a first verification result; wherein, the preset public key includes the first public key, and the first public key is generated by the trusted root of the cloud host; The portable entity root verifies the trusted root of the cloud host based on the second public key pre-configured in the trusted root of the cloud host to obtain a first verification result; wherein, the preset public key includes the second public key, and the second public key is generated by the portable entity root; Based on the first verification result and the second verification result, perform mutual authentication on the trusted root of the cloud host and the portable entity root.

7. The method according to claim 4, wherein The consortium performs joint password authentication with an external entity based on the data signature, including: The consortium obtains the third public key pre-configured in the external entity and uses the third public key to verify the data signature to authenticate the access of the external entity; wherein, the third public key is a joint public key jointly generated by the portable entity root and the trusted root of the cloud host; The external entity obtains the fourth public key pre-configured in the consortium to authenticate the consortium; wherein, the fourth public key is generated by the external entity.

8. The method according to claim 4, characterized in that, The method further includes: If the mutual authentication between the portable entity root and the trusted root of the cloud host is not completed, or the mutual authentication between the consortium and the external entity is not completed, disconnect the portable entity root from the trusted root of the cloud host and keep the cloud server in its original operating state; wherein, the cloud server includes a cloud host, a trusted root of the cloud host, and an operating system.

Images