Methods, apparatus, media, electronic devices and products for trusted virtual machines

Abstract

A method, apparatus, medium, electronic device, and product for a trusted virtual machine. The method is applied to a virtual machine deployed in a trusted execution environment. The virtual machine's operating system image includes a root file system and a kernel, both stored in a first partition. The first partition also stores a hash tree corresponding to the root file system and the hash value of the root node of the hash tree. The first partition is a read-only partition. The method includes: starting the kernel based on the hash value when the virtual machine starts; performing an integrity check on the root file system based on the hash value and the hash tree; mounting the root file system if it passes the integrity check; and mounting a second partition onto the root file system. The second partition is a read-write partition used to store data generated by the virtual machine during operation in a transparently encrypted form. This facilitates rapid integrity verification of the entire root file system based on hash values ​​and hash trees, and enables persistent, encrypted storage of dynamic data.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to a method, apparatus, medium, electronic device, and product for a trusted virtual machine. Background Technology

[0002] A Trusted Execution Environment (TEE) is a hardware technology that uses hardware to ensure data confidentiality, isolation, and the trustworthiness of the computation process. Early TEE technologies primarily provided process-level security. Hardware-protected processes could defend against attacks from privileged processes and the operating system. Some TEEs also provided clear measurement mechanisms for protected processes to help establish process trustworthiness. However, process-level TEEs had poor usability and incurred high costs for service migration.

[0003] Current mainstream TEE capabilities extend their protection scope from a single process to the entire virtual machine (confidential virtual machine), performing hardware hardening on the entire virtual machine's runtime. This provides the application layer with a convenient and low-cost way to deploy a TEE environment. Virtual machines contain a large number of dependent libraries and applications, and their Trusted Computing Base (TCB) is relatively large. How to efficiently and comprehensively measure and verify the content of confidential virtual machines is a key issue. Furthermore, while confidential virtual machines focus on ensuring data security during computation, they do not support ensuring data security when it is written to disk. Summary of the Invention

[0004] This summary section is provided to briefly introduce the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, this disclosure provides a method for a trusted virtual machine, which is applied to a virtual machine deployed in a trusted execution environment. The operating system image of the virtual machine includes a root file system and a kernel. The root file system and the kernel are stored in a first partition. The first partition is also used to store a hash tree corresponding to the root file system and the hash value of the root node of the hash tree. The first partition is a read-only partition.

[0006] The method includes:

[0007] When the virtual machine starts, the kernel is started based on the hash value;

[0008] Integrity verification is performed on the root file system based on the hash value and the hash tree;

[0009] If the root file system passes the integrity check, then the root file system is mounted.

[0010] The second partition is mounted onto the root file system; wherein the second partition is a read-write partition, used to store the data generated by the virtual machine during operation in a transparent and encrypted form.

[0011] In a second aspect, this disclosure provides an apparatus for a trusted virtual machine, which is applied to a virtual machine deployed in a trusted execution environment. The operating system image of the virtual machine includes a root file system and a kernel. The root file system and the kernel are stored in a first partition. The first partition is also used to store a hash tree corresponding to the root file system and the hash value of the root node of the hash tree. The first partition is a read-only partition.

[0012] The device includes:

[0013] A kernel startup module is used to start the kernel based on the hash value when the virtual machine starts.

[0014] The verification module is used to perform integrity verification on the root file system based on the hash value and the hash tree;

[0015] The first mount module is used to mount the root file system if the root file system passes the integrity check.

[0016] The second mounting module is used to mount the second partition to the root file system; wherein the second partition is a read-write partition, used to store the data generated by the virtual machine during operation in a transparent and encrypted form.

[0017] Thirdly, this disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the method for a trusted virtual machine provided in the first aspect of this disclosure.

[0018] Fourthly, this disclosure provides an electronic device, comprising:

[0019] A storage device on which computer programs are stored;

[0020] A processing device for executing the computer program in the storage device to implement the steps of the method for a trusted virtual machine provided in the first aspect of this disclosure.

[0021] Fifthly, this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method for a trusted virtual machine provided in the first aspect of this disclosure.

[0022] In the above technical solution, the root file system and kernel of the virtual machine's operating system image, as well as the hash tree corresponding to the root file system and the hash value of the root node of the hash tree—all immutable static content required for the virtual machine's operation—are stored in read-only mode in the first partition. This facilitates rapid integrity verification of the entire root file system based on the hash values ​​and hash tree in the first partition. Furthermore, data generated during the virtual machine's operation is stored in a transparently encrypted form in a read-write second partition. That is, dynamic data is transparently encrypted when written to disk, ensuring the security of dynamic data during disk storage and seamlessly decrypting it when read, thereby achieving persistent, encrypted storage of dynamic data.

[0023] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0024] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale. In the drawings:

[0025] Figure 1 This is a flowchart illustrating a method for a trusted virtual machine according to an exemplary embodiment.

[0026] Figure 2 This is a schematic diagram of a virtual machine disk partitioning according to an exemplary embodiment.

[0027] Figure 3 This is an architecture diagram illustrating a confidential virtual machine image scheme according to an exemplary embodiment.

[0028] Figure 4 This is a schematic diagram illustrating a dynamic data encryption process according to an exemplary embodiment.

[0029] Figure 5 This is a block diagram illustrating an apparatus for a trusted virtual machine according to an exemplary embodiment.

[0030] Figure 6 This is a schematic diagram of the structure of an electronic device according to an exemplary embodiment. Detailed Implementation

[0031] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0032] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0033] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0034] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0035] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0036] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0037] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, relevant users should be informed of the type, scope of use, and usage scenarios of the information involved in this disclosure through appropriate means in accordance with relevant laws and regulations, and authorization should be obtained from the relevant users. Among them, relevant users may include any type of rights holder, such as individuals, enterprises, and groups.

[0038] For example, in response to receiving an active request from a user, a prompt message is sent to the relevant user to clearly inform the user that the requested operation will require obtaining and using the user's information, thereby enabling the relevant user to choose whether to provide information to the software or hardware such as the electronic device, application, server, or storage medium that performs the operation of the technical solution disclosed herein based on the prompt message.

[0039] As an optional but non-restrictive implementation, in response to a user's active request, a prompt message can be sent to the user, such as a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide information to the electronic device.

[0040] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0041] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0042] Figure 1 This is a flowchart illustrating a method for a trusted virtual machine according to an exemplary embodiment. Figure 1 As shown, the method for a trusted virtual machine may include S101 to S104.

[0043] In S101, when the virtual machine starts, the kernel is started based on the hash value of the root node of the hash tree corresponding to the root file system.

[0044] In this disclosure, the method for a trusted virtual machine can be applied to a virtual machine deployed in a trusted execution environment, wherein the main content of the virtual machine can be divided into a read-only, immutable static part and a read-write, mutable dynamic part.

[0045] The static portion consists of common content required for virtual machine operation, such as pre-installed system libraries ( / lib) and pre-installed software (e.g., the contents of the / usr / sbin directory). This type of content is relatively general and unrelated to sensitive user-level data; therefore, it can be stored in read-only mode, and its consistency can be measured through efficient data integrity verification schemes.

[0046] The dynamic portion consists of various data installed and generated during the virtual machine's operation, such as deployed applications and temporary data generated by those applications. This type of content is business-related and may contain sensitive user-level data, therefore it needs to be stored in a dynamic and encrypted manner.

[0047] The virtual machine's operating system image (OS Image) includes a root file system and a kernel. The root file system and kernel are stored in the first partition. The first partition also stores the hash tree corresponding to the root file system and the hash value of the root node of the hash tree. The first partition is read-only and used to store plaintext data. For example... Figure 2 and Figure 3 As shown, the first partition includes three sub-partitions: part0, part1, and part2. Part0 is the virtual machine boot partition, containing the necessary content for virtual machine startup and is typically read-only. Part1 stores the root file system, containing essential operating system content such as system libraries and pre-installed software. Part2 stores verification data, which is data used to verify the integrity of the root file system, such as the hash tree corresponding to the root file system. For example, a Merkle Hash Tree algorithm can be used to generate the Merkle Hash Tree for the root file system.

[0048] like Figure 3 As shown, the first sub-partition, part0, is used to store the Unified Kernel Image (UKI). The UKI includes the kernel, the initial root filesystem (initrd), and kernel parameters (kernelparam, i.e., kernel command-line arguments). The initial root filesystem is the initialization image that the virtual machine depends on for startup; that is, the virtual machine's operating system image also includes the initial root filesystem, which is stored in the first partition.

[0049] like Figure 2 and Figure 3 As shown, the virtual machine disk also includes a second partition, part3. Partition part3 is used to store the data of the dynamic part mentioned above, that is, various data installed and generated during the operation of the virtual machine, such as applications, user data, container instances / images, etc. Partition part3 is a read-write partition used to store encrypted data.

[0050] like Figure 3As shown, the third subpartition part2 is an optional partition. That is, the verification data can be stored separately in the third subpartition part2, or the third subpartition part2 can be omitted, and the verification data can be stored at the end of the root file system in the second subpartition part1.

[0051] When the virtual machine starts, the virtual machine firmware can read the virtual machine startup configuration (i.e., kernel parameters) and the kernel from the first subpartition part0. At the same time, it reads the integrity hash value of the root file system (i.e., the hash value of the root node of the hash tree corresponding to the root file system), and then uses this value as the kernel parameter. After that, the kernel is started according to the kernel parameter.

[0052] Before startup, the kernel can measure kernel parameters and write them into hardware registers for use in subsequent remote verification of the virtual machine.

[0053] In S102, the integrity of the root file system is verified based on the hash value of the root node of the hash tree corresponding to the root file system and the hash tree corresponding to the root file system.

[0054] In S103, if the root file system passes the integrity check, then the root file system is mounted.

[0055] like Figure 3 As shown, after the kernel loads, the integrity verification setup tool veritysetup can be used to perform integrity verification on the root file system based on the hash value of the root node of the hash tree corresponding to the root file system (root hash) and the hash tree corresponding to the root file system (i.e., the verification metabase). If the root file system passes the integrity verification, it is then mounted using the veritysetup tool, connecting it to the root file system. Figure 3 The read-only partition shown corresponds to the root file system. If the root file system fails the integrity check, it indicates that the root file system content is incorrect. In this case, you can exit with an error message.

[0056] The veritysetup tool is a command-line tool for configuring device mapper mappings managed by device mapping integrity verification (dm-verity).

[0057] In S104, the second partition is mounted to the root file system. The second partition is a read-write partition used to store data generated by the virtual machine during operation in a transparent and encrypted form.

[0058] In one possible implementation, such as Figure 3 As shown, the second partition can be mounted onto the root file system using the mount command via an overlay mechanism, thus creating an overlay file system from the root file system (e.g., ...). Figure 3The overlay file system (overlayfs) shown in the diagram allows the application layer to access the overlay file system according to business needs.

[0059] Among them, such as Figure 3 As shown, the application layer can include containers, processes, data, etc., and the second partition is... Figure 3 The image shows a read / write partition. The `mount` command is used in Unix-like operating systems (such as Linux and macOS) to mount file systems.

[0060] The second partition is used to store dynamic data generated during the virtual machine's operation in a transparently encrypted form. That is, the dynamic data is transparently encrypted and decrypted through dynamic data encryption. In other words, the dynamic data is transparently encrypted when it is written to disk (i.e., stored in the second partition) and decrypted without being noticed when it is read out.

[0061] In the above technical solution, the root file system and kernel of the virtual machine's operating system image, as well as the hash tree corresponding to the root file system and the hash value of the root node of the hash tree—all immutable static content required for the virtual machine's operation—are stored in read-only mode in the first partition. This facilitates rapid integrity verification of the entire root file system based on the hash values ​​and hash tree in the first partition. Furthermore, dynamic data generated during the virtual machine's operation is stored in a transparently encrypted form in a read-write second partition. That is, dynamic data is transparently encrypted when written to disk, ensuring the security of dynamic data during disk storage, and is seamlessly decrypted when read, thus achieving persistent, encrypted storage of dynamic data.

[0062] In one possible implementation, virtual machine disk initialization is required upon initial startup of the virtual machine. Specifically, the method described above for trusted virtual machines further includes the following three steps:

[0063] Get the hash tree corresponding to the root file system and the hash value of the root node of the hash tree corresponding to the root file system;

[0064] Store the hash tree corresponding to the root file system, the hash value of the root node of the hash tree corresponding to the root file system, the root file system, and the kernel in the first partition;

[0065] Initialize the second partition as an empty partition.

[0066] In this disclosure, a hash tree corresponding to the root file system can be generated using dm-verity, the hash value of the root node of the hash tree corresponding to the root file system can be calculated, and the hash tree can be stored as a verification element. Figure 2 and Figure 3 The third sub-partition part2 is used to store the hash value. Figure 2 and Figure 3 The first subpartition, part0, is used as one of the virtual machine startup parameters. Additionally, the root file system can be stored in part0. Figure 2 and Figure 3 The kernel is stored in the first subpartition part0, which is the second subpartition part1, and the second subpartition part3 is initialized as a blank partition.

[0067] The following provides a detailed explanation of the specific implementation method for performing integrity verification on the root file system based on the hash value of the root node of the hash tree corresponding to the root file system and the hash tree corresponding to the root file system in S102 above. Specifically, it can be achieved through the following steps (a1) and (a2):

[0068] Step (a1): Based on the hash tree corresponding to the root file system, measure the root file system to obtain the measure value of the root node of the hash tree corresponding to the root file system.

[0069] Step (a2): If the metric value matches the hash value of the root node of the hash tree corresponding to the root file system, then the root file system is determined to have passed the integrity check.

[0070] In this disclosure, the hash value of each file is calculated when it is opened in the root file system. Then, based on the hash value of each file, hash calculation is performed layer by layer according to the hash tree corresponding to the root file system to obtain the hash value of the root node of the hash tree, which is used as the measure value of the root node of the hash tree corresponding to the root file system. After that, the measure value of the root node is compared with the hash value of the root node of the hash tree corresponding to the root file system. If the two are consistent, it is determined that the root file system has passed the integrity check. If the two are inconsistent, it is determined that the root file system has failed the integrity check.

[0071] The following is a detailed description of the specific implementation method for mounting the second partition to the root file system in S104 above. Specifically, S104 above may include the following steps (b1) to (b4).

[0072] Step (b1): Load the initial root file system from the first partition.

[0073] Step (b2): Obtain the key for transparent encryption using the initial root file system.

[0074] Step (b3): ​​Open the second partition based on the key.

[0075] Step (b4): Mount the second partition onto the root file system using the overlay mechanism, utilizing the initial root file system.

[0076] like Figure 4As shown, after the virtual machine starts and the kernel is loaded, the kernel can load the initial root file system from the first partition. This initial root file system then loads the necessary system modules for communication, such as network / virtualization communication components. Following this, the mounting of the encrypted data disk begins (e.g., using Linux Unified Key Setup (LUKS)). Specifically, as... Figure 4 As shown, the initial root file system can be used to obtain a key for transparent encryption from the Trusted Key Service (TKS) through the host machine. Then, it is determined whether the virtual machine is being loaded for the first time, i.e., whether it is starting for the first time. If the virtual machine is not starting for the first time, the second partition is opened based on this key, enabling transparent encryption and decryption of the data in the second partition. Afterwards, the second partition is mounted onto the root file system using an overlay mechanism (i.e., mounting the second partition), thus enabling encryption and decryption of all sensitive data during the virtual machine's operation.

[0077] like Figure 4 As shown, in the case of the virtual machine's initial startup, before opening the second partition, an encryption tool can be used to initialize the second partition (a blank partition). Then, the obtained key is used to perform encryption initialization on the second partition (i.e., full-disk encryption during partition initialization), that is, configuring the second partition to use transparent encryption with the key using the initial root file system. Specifically, as... Figure 4 As shown, prior to (b3) above, S104 may further include the following step (b5):

[0078] Step (b5): When the virtual machine starts for the first time, the second partition is configured to use a key for transparent encryption using the initial root file system.

[0079] In the above implementation, the partition encryption scheme of the external key management service is combined to achieve secure data persistence, while ensuring stateful restart of the virtual machine. That is, privacy data is not lost or leaked after the virtual machine is shut down, and privacy data can be recovered after restart.

[0080] The following is a detailed description of the specific implementation method for obtaining the key for transparent encryption using the initial root file system in step (b2) above.

[0081] Specifically, the initial root file system of the virtual machine can be used to send a key acquisition request to the trusted key service via the host machine of the virtual machine. The key acquisition request includes remote proof of the virtual machine. The trusted key service is used to remotely prove the virtual machine based on the remote proof. When the virtual machine is determined to be trustworthy through remote proof, the trusted key service sends the locally stored key to the initial root file system via the host machine. Then, the initial root file system receives the key.

[0082] In this disclosure, such as Figure 4 As shown, the initial root file system of the virtual machine can first send a key acquisition request, including remote proof of the virtual machine, to a relay service on the virtual machine's host machine to obtain the encryption key for the second partition. After receiving the key acquisition request, the relay service can forward the key acquisition request, including remote proof of the virtual machine, to a trusted key service to obtain the encryption key for the second partition from the trusted key service. After obtaining the key acquisition request, the trusted key service can parse the key acquisition request to obtain the remote proof of the virtual machine. Then, the trusted key service performs remote proof on the virtual machine based on the remote proof to determine whether the virtual machine is running in a trusted execution environment, that is, to determine whether the virtual machine is trusted. Only when the trusted key service determines that the virtual machine is trusted through remote proof will it send the locally stored key to the initial root file system via the host machine.

[0083] In this disclosure, remote proof evidence for a virtual machine may include a remote proof report, wherein the virtual machine can be measured during startup and operation phases to obtain corresponding measurement values, which are included in the remote proof report; then, a measurement benchmark value can be determined based on the virtual machine image, and the measurement value is compared with the measurement benchmark value. If the two are consistent, the virtual machine is determined to be trustworthy; otherwise, the virtual machine is determined to be untrustworthy.

[0084] In the above implementation, the trusted distribution of keys is achieved through an external key management service based on a remote proof scheme, which can prevent the leakage of encrypted virtual machine data due to key leakage.

[0085] In one possible implementation, the method for a trusted virtual machine described above may further include the following two steps:

[0086] After mounting the second partition to the root file system, start the init process;

[0087] The root file system is initialized using the init process, and the data generated by the virtual machine during operation is stored in a transparently encrypted form in the mounted second partition.

[0088] In this disclosure, the init process is the first user-level process started by the kernel, and its process ID is always 1, also known as process number 1. After the second partition is mounted to the root file system, that is, after the mounting of the encrypted data disk is completed, the init process can be started. Then, the control of the virtual machine is transferred to the init process. The init process completes the initialization of the operating system and writes the dynamically generated data, after encryption, to the second partition part3 after it has been mounted via overlay.

[0089] Figure 5 This is a block diagram illustrating an apparatus for a trusted virtual machine according to an exemplary embodiment. The apparatus 300 is applied to a virtual machine deployed in a trusted execution environment. The operating system image of the virtual machine includes a root file system and a kernel. The root file system and the kernel are stored in a first partition, which is also used to store a hash tree corresponding to the root file system and the hash value of the root node of the hash tree. The first partition is a read-only partition. Figure 5 As shown, the apparatus 300 for a trusted virtual machine includes:

[0090] Kernel startup module 301 is used to start the kernel based on the hash value when the virtual machine starts;

[0091] The verification module 302 is used to perform integrity verification on the root file system based on the hash value and the hash tree;

[0092] The first mount module 303 is used to mount the root file system if the root file system passes the integrity check.

[0093] The second mounting module 304 is used to mount the second partition to the root file system; wherein the second partition is a read-write partition, used to store the data generated by the virtual machine during operation in a transparent and encrypted form.

[0094] In the above technical solution, the root file system and kernel of the virtual machine's operating system image, as well as the hash tree corresponding to the root file system and the hash value of the root node of the hash tree—all immutable static content required for the virtual machine's operation—are stored in read-only mode in the first partition. This facilitates rapid integrity verification of the entire root file system based on the hash values ​​and hash tree in the first partition. Furthermore, data generated during the virtual machine's operation is stored in a transparently encrypted form in a read-write second partition. That is, dynamic data is transparently encrypted when written to disk, ensuring the security of dynamic data during disk storage and seamlessly decrypting it when read, thereby achieving persistent, encrypted storage of dynamic data.

[0095] Optionally, the operating system image further includes an initial root file system, which is stored in the first partition;

[0096] The second mounting module 304 includes:

[0097] A loading submodule is used to load the initial root file system from the first partition;

[0098] The submodule is opened to obtain a key for transparent encryption using the initial root file system, and to open the second partition based on the key;

[0099] The mount submodule is used to mount the second partition to the root file system using the initial root file system via an overlay mechanism.

[0100] Optionally, the opening submodule includes:

[0101] The sending submodule is used to send a key acquisition request to the trusted key service via the host machine of the virtual machine using the initial root file system; wherein, the key acquisition request includes remote proof evidence of the virtual machine, the trusted key service is used to remotely prove the virtual machine based on the remote proof evidence, and when the virtual machine is determined to be trustworthy through the remote proof, the locally stored key is sent to the initial root file system via the host machine;

[0102] A receiving submodule is used for the initial root file system to receive the key.

[0103] Optionally, the second mounting module 304 further includes:

[0104] A configuration submodule is configured to, before the opening submodule opens the second partition based on the key, configure the second partition to be transparently encrypted using the key when the virtual machine is first started, using the initial root file system.

[0105] Optionally, the apparatus 300 for a trusted virtual machine further includes:

[0106] The startup module is used to start the init process after the second partition is mounted to the root file system;

[0107] The first storage module is used to initialize the root file system using the init process and store the data generated by the virtual machine during operation in a transparently encrypted form in the mounted second partition.

[0108] Optionally, when the virtual machine is first started, the apparatus 300 for the trusted virtual machine further includes:

[0109] The acquisition module is used to acquire the hash tree and the hash value;

[0110] The second storage module is used to store the hash tree, the hash value, the root file system, and the kernel into the first partition;

[0111] An initialization module is used to initialize the second partition as an empty partition.

[0112] Optionally, the verification module 302 includes:

[0113] The measurement submodule is used to measure the root file system based on the hash tree to obtain the measurement value of the root node;

[0114] A determination submodule is used to determine that the root file system has passed the integrity check if the metric value matches the hash value.

[0115] In addition, this disclosure also provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the method for a trusted virtual machine provided in this disclosure.

[0116] This disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method for a trusted virtual machine described above.

[0117] The following is for reference. Figure 6 The diagram illustrates a structural schematic of an electronic device (e.g., a terminal device or a server) 600 suitable for implementing embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0118] like Figure 6As shown, electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 601, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 602 or a program loaded from storage device 608 into random access memory (RAM) 603. RAM 603 also stores various programs and data required for the operation of electronic device 600. Processing device 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0119] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 6 An electronic device 600 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0120] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined in the methods of embodiments of this disclosure.

[0121] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0122] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0123] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0124] The aforementioned computer-readable medium carries one or more programs. When these programs are executed by the electronic device, the electronic device causes the following to occur: Upon startup of the virtual machine, it starts the kernel based on a hash value, wherein the operating system image of the virtual machine includes a root file system and a kernel, the root file system and the kernel are stored in a first partition, the first partition also being used to store the hash tree corresponding to the root file system and the hash value of the root node of the hash tree, the first partition being a read-only partition; it performs an integrity check on the root file system based on the hash value and the hash tree; if the root file system passes the integrity check, it is mounted; and a second partition is mounted onto the root file system; wherein the second partition is a read-write partition used to store data generated by the virtual machine during operation in a transparently encrypted form.

[0125] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0126] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0127] The modules described in the embodiments of this disclosure can be implemented in software or in hardware. The name of a module does not necessarily limit the module itself; for example, a kernel startup module can also be described as "a module that starts the kernel based on the hash value when the virtual machine starts."

[0128] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0129] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0130] According to one or more embodiments of this disclosure, Example 1 provides a method for a trusted virtual machine, the method being applied to a virtual machine deployed in a trusted execution environment, wherein the operating system image of the virtual machine includes a root file system and a kernel, the root file system and the kernel are stored in a first partition, the first partition is further used to store a hash tree corresponding to the root file system and the hash value of the root node of the hash tree, and the first partition is a read-only partition.

[0131] The method includes:

[0132] When the virtual machine starts, the kernel is started based on the hash value;

[0133] Integrity verification is performed on the root file system based on the hash value and the hash tree;

[0134] If the root file system passes the integrity check, then the root file system is mounted.

[0135] The second partition is mounted onto the root file system; wherein the second partition is a read-write partition, used to store the data generated by the virtual machine during operation in a transparent and encrypted form.

[0136] According to one or more embodiments of this disclosure, Example 2 provides the method of Example 1, wherein the operating system image further includes an initial root file system stored in the first partition;

[0137] Mounting the second partition to the root file system includes:

[0138] Load the initial root file system from the first partition;

[0139] The key for transparent encryption is obtained using the initial root file system, and the second partition is opened based on the key;

[0140] The second partition is mounted to the root file system using the initial root file system via an overlay mechanism.

[0141] According to one or more embodiments of this disclosure, Example 3 provides the method of Example 2, wherein obtaining the key for transparent encryption using the initial root file system includes:

[0142] The initial root file system is used to send a key acquisition request to the trusted key service via the host machine of the virtual machine; wherein, the key acquisition request includes remote proof evidence of the virtual machine, the trusted key service is used to remotely prove the virtual machine based on the remote proof evidence, and when the virtual machine is determined to be trustworthy through the remote proof, the locally stored key is sent to the initial root file system via the host machine;

[0143] The initial root file system receives the key.

[0144] According to one or more embodiments of this disclosure, Example 4 provides the method of Example 2, wherein, before the step of opening the second partition based on the key, the step of mounting the second partition to the root file system further includes:

[0145] When the virtual machine starts for the first time, the second partition is configured to be transparently encrypted using the key using the initial root file system.

[0146] According to one or more embodiments of this disclosure, Example 5 provides the method of Example 1, the method further comprising:

[0147] After mounting the second partition to the root file system, the init process is started;

[0148] The init process is used to initialize the root file system and to store the data generated by the virtual machine during its operation in a transparently encrypted form in the mounted second partition.

[0149] According to one or more embodiments of this disclosure, Example 6 provides the method of Example 1, wherein when the virtual machine is first started, the method further includes:

[0150] Obtain the hash tree and the hash value;

[0151] The hash tree, the hash value, the root file system, and the kernel are stored in the first partition;

[0152] Initialize the second partition as an empty partition.

[0153] According to one or more embodiments of this disclosure, Example 7 provides the method of Example 1, wherein performing integrity verification on the root file system based on the hash value and the hash tree includes:

[0154] Based on the hash tree, the root file system is metricd to obtain the metric value of the root node;

[0155] If the metric value matches the hash value, then the root file system is determined to have passed the integrity check.

[0156] According to one or more embodiments of this disclosure, Example 8 provides an apparatus for a trusted virtual machine, the apparatus being applied to a virtual machine deployed in a trusted execution environment, wherein the operating system image of the virtual machine includes a root file system and a kernel, the root file system and the kernel being stored in a first partition, the first partition being further used to store a hash tree corresponding to the root file system and the hash value of the root node of the hash tree, the first partition being a read-only partition.

[0157] The device includes:

[0158] A kernel startup module is used to start the kernel based on the hash value when the virtual machine starts.

[0159] The verification module is used to perform integrity verification on the root file system based on the hash value and the hash tree;

[0160] The first mount module is used to mount the root file system if the root file system passes the integrity check.

[0161] The second mounting module is used to mount the second partition to the root file system; wherein the second partition is a read-write partition, used to store the data generated by the virtual machine during operation in a transparent and encrypted form.

[0162] According to one or more embodiments of the present disclosure, Example 9 provides a computer-readable medium having a computer program stored thereon that, when executed by a processing device, implements the steps of the method described in any one of Examples 1-7.

[0163] According to one or more embodiments of this disclosure, Example 10 provides an electronic device, including:

[0164] A storage device on which computer programs are stored;

[0165] A processing device for executing the computer program in the storage device to implement the steps of any one of the methods in Examples 1-7.

[0166] According to one or more embodiments of the present disclosure, Example 11 provides a computer program product including a computer program that, when executed by a processor, implements the steps of the method described in any one of Examples 1-7.

[0167] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0168] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0169] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative forms of implementing the claims. Regarding the apparatus in the above embodiments, the specific manner in which the various modules perform their operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

Claims

1. A method for a trusted virtual machine, characterized in that, The method is applied to virtual machines deployed in a trusted execution environment. The operating system image of the virtual machine includes a root file system and a kernel. The root file system and the kernel are stored in a first partition. The first partition is also used to store the hash tree corresponding to the root file system and the hash value of the root node of the hash tree. The first partition is a read-only partition. The method includes: When the virtual machine starts, the kernel is started based on the hash value; Integrity verification is performed on the root file system based on the hash value and the hash tree; If the root file system passes the integrity check, then the root file system is mounted. The second partition is mounted onto the root file system; wherein, the second partition is a read-write partition, used to store the data generated by the virtual machine during operation in a transparent and encrypted form; The operating system image also includes an initial root file system, which is stored in the first partition; The step of mounting the second partition onto the root file system includes: loading the initial root file system from the first partition; obtaining a key for transparent encryption using the initial root file system, and opening the second partition based on the key; and mounting the second partition onto the root file system using the initial root file system through an overlay mechanism.

2. The method according to claim 1, characterized in that, The step of obtaining the key for transparent encryption using the initial root file system includes: The initial root file system is used to send a key acquisition request to the trusted key service via the host machine of the virtual machine; wherein, the key acquisition request includes remote proof evidence of the virtual machine, the trusted key service is used to remotely prove the virtual machine based on the remote proof evidence, and when the virtual machine is determined to be trustworthy through the remote proof, the locally stored key is sent to the initial root file system via the host machine; The initial root file system receives the key.

3. The method according to claim 1, characterized in that, Before the step of opening the second partition based on the key, the step of mounting the second partition to the root file system further includes: When the virtual machine starts for the first time, the second partition is configured to be transparently encrypted using the key using the initial root file system.

4. The method according to claim 1, characterized in that, The method further includes: After mounting the second partition to the root file system, the init process is started; The init process is used to initialize the root file system and to store the data generated by the virtual machine during its operation in a transparently encrypted form in the mounted second partition.

5. The method according to claim 1, characterized in that, When the virtual machine is first started, the method further includes: Obtain the hash tree and the hash value; The hash tree, the hash value, the root file system, and the kernel are stored in the first partition; Initialize the second partition as an empty partition.

6. The method according to claim 1, characterized in that, The step of performing integrity verification on the root file system based on the hash value and the hash tree includes: Based on the hash tree, the root file system is metricd to obtain the metric value of the root node; If the metric value matches the hash value, then the root file system is determined to have passed the integrity check.

7. An apparatus for a trusted virtual machine, characterized in that, The device is applied to virtual machines deployed in a trusted execution environment. The operating system image of the virtual machine includes a root file system and a kernel. The root file system and the kernel are stored in a first partition. The first partition is also used to store the hash tree corresponding to the root file system and the hash value of the root node of the hash tree. The first partition is a read-only partition. The device includes: A kernel startup module is used to start the kernel based on the hash value when the virtual machine starts. The verification module is used to perform integrity verification on the root file system based on the hash value and the hash tree; The first mount module is used to mount the root file system if the root file system passes the integrity check. The second mount module is used to mount the second partition to the root file system; wherein, the second partition is a read-write partition, used to store the data generated by the virtual machine during operation in a transparent and encrypted form; The operating system image also includes an initial root file system, which is stored in the first partition; The second mounting module includes: A loading submodule is used to load the initial root file system from the first partition; A key processing submodule is used to obtain a key for transparent encryption using the initial root file system and open the second partition based on the key; The mount execution submodule is used to mount the second partition to the root file system using the initial root file system via an overlay mechanism.

8. A computer-readable medium having a computer program stored thereon, characterized in that, When executed by a processing device, the computer program performs the steps of the method according to any one of claims 1-6.

9. An electronic device, characterized in that, include: A storage device on which computer programs are stored; A processing device for executing the computer program in the storage device to implement the steps of the method according to any one of claims 1-6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-6.

Images