ARM platform confidential virtualization system and method based on TrustZone

Abstract

The invention provides a confidential virtualization system and method based on ARM TrustZone, and belongs to the field of computer virtualization and trusted computing. The system adopts a double-virtual machine monitor architecture and comprises a common monitor (non-secure resource management and scheduling) of a common world EL2 level, a security monitor (TCB core for maintaining privacy and integrity of a virtual machine) of a security world S-EL1 / S-EL2 level and a world switching module (for realizing cross-world control right switching) of an EL3 level, and safe operation is guaranteed through four core processes. Aiming at a platform without ARMv8.4 Secure EL2 expansion, same-level strong isolation is realized through memory page table switching and sensitive instruction replacement, dynamic collaborative memory allocation and a shadow page table rapid synchronization mechanism are combined, and the resource utilization rate and performance are considered. The method is adaptive to a universal ARM platform, the TCB scale is minimized, isolation and safety are improved, compatibility and efficiency are optimized, and the method is suitable for edge computing, the Internet of Things and other low-cost safety scenes.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cloud computing security and virtualization technology, in particular, to an ARM platform confidential virtualization system based on TrustZone and a software virtualization method based on peer protection. BACKGROUND

[0002] With the rapid development of cloud computing technology, more and more enterprises and individual users migrate their businesses to the cloud platform. Although cloud deployment has significant advantages in terms of cost, maintenance and scalability, the security of the cloud platform is still a major concern for businesses involving sensitive data such as finance and healthcare. In traditional cloud service architecture, cloud service providers have the highest privilege level of virtual machine monitors (Hypervisor), which means that once the Hypervisor is compromised by a vulnerability, the cloud service provider or attacker can access or tamper with user data running on the cloud server. To solve this trust problem, the concept of confidential computing (Confidential Computing) has emerged. Confidential computing aims to build a trusted execution environment (TEE) using specific hardware features to ensure the confidentiality and integrity of data during the computing process, even if the cloud service provider cannot access it.

[0003] Currently, hardware-based confidential virtualization technology has become the industry mainstream, such as Intel TDX and AMD SEV-SNP technology on x86 platforms have been widely used. With the rise of ARM architecture in the data center field due to its high energy efficiency, the ARM ecosystem also urgently needs similar solutions. Although ARM officially introduced CCA in the latest ARMv9 architecture, its commercial landing still faces many challenges: there are currently very few hardware devices supporting CCA, the software ecosystem is not mature, and a large number of existing ARMv8 architecture-based servers in the data center cannot support CCA through upgrades. This prevents the majority of ARM server users from enjoying the security benefits of confidential virtualization.

[0004] In order to implement confidential computing on existing ARM servers, using the widely popular ARM TrustZone technology has become a viable alternative. TrustZone isolates the processor state into the normal world and the secure world, naturally having isolation properties. However, existing virtualization solutions based on TrustZone have obvious technical bottlenecks: Trusted Computing Base (TCB) inflation: If the entire virtual machine monitor function is placed in the secure world for security, it will result in a dramatic increase in the amount of code in the secure world, making it difficult to develop and maintain, and more likely to introduce security vulnerabilities, violating the minimization principle of secure system design.

[0005] Resource management rigidity: TrustZone usually adopts a static memory partition mechanism, i.e., dividing a fixed size of secure memory at startup. This static strategy cannot meet the elastic requirements of dynamic creation, destruction and load changes of virtual machines in the cloud environment, seriously affecting system performance and memory utilization.

[0006] Strong hardware dependency: In order to run multiple virtual machines in the secure world, the hardware usually needs to have SecureEL2 (S-EL2) privilege level extension. However, this feature only exists in ARMv8.4 and later chips, and most existing ARM servers do not support this feature, limiting the universality of the scheme.

[0007] Difficult cooperation between dual systems: If you try to decouple the security mechanism and resource management (i.e., dual virtual machine monitor architecture), how to ensure safe, efficient and dynamic cooperation between the untrusted ordinary monitor and the trusted secure monitor, and prevent the ordinary monitor from destroying the confidential virtual machine through malicious configuration (such as memory mapping attack, interrupt injection attack), is a technical problem that needs to be solved at present.

[0008] In summary, the existing confidential computing scheme either relies on new hardware that has not yet been popularized (such as CCA), or the implementation on old hardware has the problems of low performance, poor compatibility or insufficient security. Therefore, there is an urgent need for an efficient confidential virtualization system that can be deployed on widely existing ARM platforms, has a low TCB, dynamic resource management capability and does not depend on S-EL2 features. SUMMARY

[0009] In view of the defects in the prior art, the purpose of the present application is to provide an ARM platform confidential virtualization system and method based on TrustZone.

[0010] The ARM TrustZone-based confidential virtualization system provided by the present application comprises: The ordinary monitor module runs in the ordinary world and is used for managing the non-secure resources of the confidential virtual machine and scheduling, and serves as a non-secure side agent for interaction between the confidential virtual machine and the underlying hardware resources; The secure monitor module runs in the secure world and serves as a trusted computing base of the system, is used for maintaining the privacy and integrity of the confidential virtual machine, and constructs an isolated execution environment; The world switching module runs in the highest privilege level of the ARM architecture, serves as a bridge connecting the ordinary world and the secure world, and is used for realizing control right switching, context management and security state conversion of the two worlds. Preferably, the ordinary monitor module comprises: a lifecycle management unit configured to capture a confidential virtual machine creation / destroy request initiated by a user mode tool, allocate a virtual machine control block in a normal world, and send the request to a secure monitor module through a world switching module; a vCPU scheduling unit configured to maintain a system scheduling queue, determine a vCPU running on a physical CPU, load a context of a confidential virtual machine vCPU in the normal world, and switch control through the world switching module; a physical memory allocation unit configured to reserve or dynamically allocate continuous normal physical memory by using a kernel continuous memory allocator, initiate a request to the secure monitor module, and convert the normal physical memory into secure memory; an I / O device driving unit configured to reuse a Linux / KVM device driving model, receive an I / O data request of a secure world, and drive a physical network card or a disk to complete data interaction. Preferably, the secure monitor module comprises: a metadata management unit configured to create, maintain or destroy confidential virtual machine metadata in secure memory in response to a request of a normal monitor module; a running intervention processing unit configured to perform a security check on a virtual machine state and restore a context before scheduling a confidential virtual machine vCPU, and perform register state cleaning when the virtual machine exits running, and cover registers with fixed values to prevent sensitive information leakage; a secure memory management unit configured to receive a physical address transmitted by a normal monitor, convert normal memory into secure memory accessible only by a secure world by configuring a TrustZone address space controller or modifying a secure side page table attribute; an I / O data synchronization unit configured to maintain a shadow buffer located in normal memory, synchronize I / O data generated by a confidential virtual machine from a secure memory buffer to the shadow buffer, and realize device data interaction between a secure world and a normal world. Preferably, the metadata comprises vCPU register states and a secure page table base address, and the metadata is invisible to the normal world Preferably, the world switching module comprises: a request capturing unit configured to capture an SMC call request initiated by a normal monitor module or a secure monitor module; a context management unit configured to save CPU general registers and system registers of a current world when switching worlds, and restore corresponding register information from a context structure body of a target world; a secure state switching unit configured to read and modify an NS bit of a secure configuration register, and realize switching between a non-secure state and a secure state of a CPU; a control flow directing unit configured to set a program counter according to a target of a switching request, and transfer control to an entry address of a target monitor module.

[0011] Preferably, the system adopts a dynamic cooperative memory allocation mechanism, comprising: When the system starts, a large continuous memory pool is reserved by the operating system continuous memory allocator; When the non-confidential virtual machine runs, the memory pool is normally used by the operating system; When the confidential virtual machine starts, the normal monitor module allocates continuous memory, the used memory in the memory pool is migrated to another place, and the security monitor module converts the allocated memory into secure memory; When the confidential virtual machine is destroyed, the security monitor module clears the memory pages and keeps the secure memory state; When the normal world memory is tight, the security monitor module integrates the idle continuous secure memory and converts it into normal memory to return to the operating system. Preferably, the key interaction process of the system includes memory page fault exception handling process, sensitive instruction processing process, interrupt exception handling process and I / O interaction processing process; wherein, When the memory page fault exception is handled, the normal monitor module allocates physical memory and updates the page table, and the security monitor module synchronizes the shadow page table; When the sensitive instruction is processed, the domain switching is triggered by the instruction replacement, and the security monitor module reviews and simulates the execution; When the interrupt exception is handled, the virtual interrupt is injected into the confidential virtual machine after being routed to the normal monitor module for processing by the world switching module; When the I / O interaction is processed, the data transmission is realized by synchronizing the buffer area of the secure memory and the normal memory.

[0012] According to the software virtualization method based on the same level protection provided by the application, applied to the confidential virtualization system based on ARM TrustZone, comprising: Memory virtualization step: the security monitor module maintains a privileged domain page table pointing to the global secure memory and a shadow page table pointing to the memory of a specific confidential virtual machine in the memory; the privileged domain page table is loaded when the security monitor code is run, the corresponding shadow page table is forced to be loaded when switching to the confidential virtual machine, and the page table base address register is switched at the boundary of entering and exiting the virtual machine; CPU virtualization step: in the stage of loading the confidential virtual machine image, the security monitor module scans the binary code, identifies the sensitive instruction of modifying the system control register, and replaces it with the domain switching instruction triggering the exception, to realize the safe switching from the restricted domain to the privileged domain. Preferably, it also includes a control flow hijacking protection mechanism: In the domain switching code, after the page table base address is written into the register, the integrity of the value is immediately checked by the executed instruction, the expected address is reloaded and compared with the actual used value, and if they are inconsistent, the system is terminated.

[0013] Preferably, a shadow page table fast synchronization mechanism is further included, the confidential virtual machine actively informs the security monitor to update the page table through an API, and the mechanism comprises: Minimizing domain switching overhead: regarding the domain switching as a function call, only saving the caller saved registers; utilizing the ARM architecture ASID feature, assigning a dedicated ASID to the security monitor, and not needing to flush the TLB when switching; Lock-free shadow page query: extending the memory page metadata structure, directly storing the shadow page address, and realizing O / 1 lock-free query; verifying the pointer legality through a bidirectional pointer reference mechanism; Accelerating the second stage address translation: introducing a direct mapping array, taking the page frame number as an index, and optimizing the conversion from the guest physical address to the host physical address to a single memory access; Lazy second stage mapping: when the page table is synchronized, the page fault is only marked as invalid; when the confidential virtual machine accesses the page and triggers an exception, actual physical memory allocation is performed.

[0014] Compared with the prior art, the present application has the following beneficial effects: 1. The present application adopts a dual virtual machine monitor architecture, retains complex resource management functions in the ordinary monitor, and isolates key security mechanisms (such as state washing and memory attribute conversion) in the security monitor, thereby minimizing the trusted computing base, and even if the operating system in the ordinary world is attacked, the security of the confidential virtual machine can be ensured through the hardware isolation feature of the ARM TrustZone; 2. The software virtualization method based on the same level protection proposed in the present application solves the problem that some ARM hardware platforms do not support the Secure EL2 extension. Through the shadow page table and binary translation technology, strong isolation of the security monitor to the confidential virtual machine is realized in the same privilege level (S-EL1), greatly expanding the hardware application range of the confidential computing technology; 3. The present application manages the context at the EL3 level through the world switching module, ensures the atomicity and security during the switching process between the ordinary world and the security world, and prevents security risks caused by side channel attacks or state residues; 4. The design of the present application allows maximum reuse of existing virtualization infrastructure (such as KVM), reduces the development and maintenance cost of the system, and simultaneously realizes flexible configuration of the confidential virtual machine resources through the dynamic conversion mechanism of the secure memory; 5. The present application details the processing flow of the page fault exception, sensitive instruction, interrupt exception and I / O interaction, and through precise cooperation between the modules, the integrity of the confidential virtual machine function is effectively realized while ensuring the security. BRIEF DESCRIPTION OF DRAWINGS

[0015] Other features, objects, and advantages of the application will become more apparent from the following detailed description when read in connection with the following drawings: Figure 1 is a schematic diagram of the architecture of the present application; Figure 2 is a schematic diagram of the second stage page fault processing flow in the present application; Figure 3 is a schematic diagram of the sensitive instruction processing flow in the present application; Figure 4 is a schematic diagram of the interrupt processing flow in the present application; Figure 5 is a schematic diagram of the I / O processing flow in the present application. DETAILED DESCRIPTION

[0016] The present application will be described in detail below with specific embodiments. The following embodiments will help those skilled in the art to further understand the present application, but do not limit the present application in any form. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present application. These are within the scope of protection of the present application.

[0017] The present application adopts a dual virtual machine monitor architecture, including a normal monitor module, a secure monitor module, and a world switching module. Among them, the normal monitor module acts as a non-secure side agent, responsible for the physical resource management of the confidential virtual machine, including vCPU scheduling, physical memory dynamic allocation, and I / O device driving; the secure monitor module is used to manage the security mechanism of the confidential virtual machine, responsible for building an isolated execution environment, performing metadata management, running intervention processing (state cleaning), secure memory conversion, and I / O data synchronization; the world switching module runs at the highest privilege level, used to realize the context switching and control flow direction of the normal world and the secure world. The present application also designs the specific cooperation flow of the system when processing page fault exceptions, sensitive instructions, interrupt exceptions, and I / O interactions. In addition, the present application provides a software virtualization method based on the same level protection, which realizes strong isolation within the same privilege level through shadow page table and binary code scanning technology without relying on the hardware Secure EL2 feature.

[0018] Embodiment 1 According to the confidential virtualization system of an ARM platform based on TrustZone provided by the present application, a dual virtual machine monitor architecture is adopted, as shown in Figure 1 including a normal monitor module, a secure monitor module, and a world switching module.

[0019] Normal monitor module: running in the normal world, used to manage the non-secure resources of the confidential virtual machine and scheduling; responsible for the scheduling decision of vCPU, the dynamic allocation of normal physical memory, and the driving and management of physical I / O devices, as a non-secure side agent for the interaction between the confidential virtual machine and the underlying hardware resources. Refer to Figure 1 As shown on the left, the normal monitor module runs in the EL2 level of the normal world, and is mainly based on the existing KVM or Xen and other virtualization infrastructures for modification. The normal monitor module reuses the virtual machine monitor function, including: a lifecycle management unit, a vCPU scheduling unit, a physical memory allocation unit, and an I / O device driving unit.

[0020] The lifecycle management unit is responsible for initiating the creation or destruction request of the confidential virtual machine, and sending the request to the secure monitor module for processing through the world switching module, that is, when the user initiates a command in the user mode tool (such as QEMU), the unit captures the request, allocates the necessary virtual machine control block in the normal world, and sends the request to the secure monitor module for processing through the world switching module.

[0021] The vCPU scheduling unit is responsible for deciding the vCPU running on the current physical CPU, and switching the control right through the world switching module when scheduling the vCPU of the confidential virtual machine to run. The unit maintains the scheduling queue of the system, and when the scheduler decides to run a vCPU of a confidential virtual machine, loads the context of the vCPU in the normal world, and switches the control right through the world switching module.

[0022] The physical memory allocation unit is responsible for allocating continuous normal physical memory for the confidential virtual machine through the continuous memory allocator, and initiating the request to the secure monitor module to convert the normal physical memory into secure memory. Specifically, a large block of continuous normal physical memory is reserved or dynamically allocated by using the continuous memory allocator of the kernel, and a request is initiated to the secure monitor module to convert the normal physical memory into secure memory.

[0023] The I / O device driving unit is responsible for driving the normal physical I / O device, and receiving the I / O data request from the secure world, and completing the actual interaction with the physical device.

[0024] Secure monitor module: running in the secure world, used to build and maintain the isolated execution environment of the confidential virtual machine; responsible for the metadata management of the confidential virtual machine, the attribute conversion of the secure memory, the simulation execution of the sensitive instructions, and the state cleaning and checking before and after the world switching, maintaining the confidentiality and integrity of the confidential virtual machine. Refer to Figure 1As shown on the right side, the security monitor module runs at the S-EL1 or S-EL2 level of the secure world and is a trusted computing base of the entire system. The security monitor module running in the secure world includes a metadata management unit, a running intervention processing unit, a secure memory management unit, and an I / O data synchronization unit.

[0025] The metadata management unit is responsible for the lifecycle management of confidential virtual machine metadata. In response to a request initiated by the normal monitor module, the metadata (such as vCPU register state, secure page table base address, etc.) of the confidential virtual machine is correspondingly created, maintained or destroyed in the secure memory, ensuring that these data are invisible to the normal world.

[0026] The running intervention processing unit is responsible for processing the secure trap-in and trap-out operations. Before the normal monitor schedules the confidential virtual machine vCPU to run, the security check is performed on the confidential virtual machine state and its context is restored; before the confidential virtual machine exits the running back to the normal monitor, the state of the confidential virtual machine is cleaned up to prevent sensitive information leakage.

[0027] The secure memory management unit is responsible for configuring the page table attribute and converting the normal memory allocated by the normal monitor module into secure memory accessible only by the secure world. By configuring the TZASC (TrustZone Address Space Controller) of the TrustZone controller or modifying the secure side page table attribute, the normal memory is converted into secure memory accessible only by the secure world.

[0028] The I / O data synchronization unit is responsible for managing the shadow buffer and synchronizing the I / O data generated in the confidential virtual machine from the secure memory to the normal memory to realize the data interaction between the secure world and the normal world device. Specifically, a shadow buffer located in the normal memory is maintained, and the I / O data generated in the confidential virtual machine is synchronized from the buffer in the secure memory to the shadow buffer to realize the data interaction between the secure world and the normal world device.

[0029] World switching module: running at the highest privilege level, as a bridge connecting the normal world and the secure world; used to capture switching requests, save and restore hardware context, and realize the control flow direction between the normal monitor module and the security monitor module. The world switching module runs at the highest privilege level EL3 of the ARM architecture, as a bridge connecting the two worlds, including a request capture unit, a context management unit, a security state switching unit, and a control flow direction unit.

[0030] The request capture unit is responsible for capturing the SMC (Secure Monitor Call) call request initiated by the normal monitor module or the security monitor module.

[0031] The context management unit is responsible for saving the current world's CPU general registers (X0-X30) and system registers (SPSR, ELR, etc.) state when a switch occurs, and restoring the corresponding register information of the target world.

[0032] The security state switching unit is responsible for modifying the security state bit of the CPU, switching the CPU state from the non-secure state to the secure state, or vice versa. Specifically, by reading and modifying the NS (Non-Secure) bit of the security configuration register (SCR_EL3), the CPU state is switched from the non-secure state to the secure state, or vice versa.

[0033] The control flow steering unit is responsible for pointing the program counter (PC) to the entry address of the target monitor module according to the target of the switch request.

[0034] In summary, the present application is based on the ARM TrustZone technology, aiming to solve the problem of user data privacy protection in the cloud environment. The existing technology usually relies on special hardware (such as Intel SGX or ARM CCA), while the present scheme expands the scope of confidential computing by using the widely existing TrustZone. In the design of the dual virtual machine monitor architecture, the present application fully considers the balance between performance and security.

[0035] The ordinary monitor module actually undertakes the task of managing the physical resources of the confidential virtual machine. It is responsible for heavy, non-secure sensitive tasks. For example, the scheduling algorithm (CFS, etc.) of vCPU is extremely complex, and if it is placed in the secure world, it will greatly increase the size of the trusted computing base and introduce potential vulnerabilities. Therefore, the present application retains the scheduling logic in the ordinary world and only notifies the decision result of "who to schedule" to the secure world.

[0036] The secure monitor module is responsible for the security mechanism of the confidential virtual machine. It does not care about the scheduling strategy, but only cares about whether the state of the confidential virtual machine is legal before running the confidential virtual machine. By performing batch checks before falling into the virtual machine, it is ensured that even if the software in the ordinary world maliciously tampers with the state of the confidential virtual machine, it can be discovered in time; or it cares about whether there is sensitive state left in the registers after the virtual machine falls out. By enforcing state cleaning at the World Switch boundary, it is ensured that even if the software in the ordinary world is hacked, hackers cannot obtain the data of the confidential virtual machine by reading the residual registers.

[0037] In terms of memory management, the application adopts a dynamic cooperative allocation mechanism. When the system starts, the system reserves a large continuous memory pool for the confidential virtual machine through the continuous memory allocator of the operating system (such as the CMA of Linux). When there is no confidential virtual machine running in the system, these memories will be normally used by the operating system (for example, used for file page cache or anonymous page) to improve resource utilization. When the confidential virtual machine starts, the ordinary monitor module in the system will allocate continuous memory for the confidential virtual machine through the interface (such as cma_alloc) provided by the continuous memory allocator. In this process, the system will perform a page-based memory migration algorithm (Page Migration): the kernel first scans the target CMA region for the occupied physical pages, allocates new physical page frames in the normal memory region, then copies the data from the CMA region to the new page, updates the corresponding page table entry (PTE) mapping, and finally releases the CMA region. After that, the security monitor module of the system will be responsible for converting these allocated and emptied memories into secure memories. When the confidential virtual machine is destroyed, the security monitor module will clear the memory pages, and the state will remain as secure memory, so as to be allocated to other confidential virtual machines; when the normal world memory is tight - specifically, the host operating system monitors that the system free memory is lower than the preset low water line (WatermarkLow), and wakes up the memory recovery thread (such as kswapd), the ordinary monitor module will send a memory request to the security monitor module. The security monitor will integrate the secure memories and arrange a large amount of free continuous secure memories, and convert their states to normal memories, so as to return to the normal world.

[0038] Embodiment 2 This embodiment provides a software virtualization method based on the same level protection for hardware platforms (such as popular devices such as Raspberry Pi) that do not support the ARMv8.4 Secure EL2 extension. This method realizes the isolation of the security monitor (privileged domain) and the confidential virtual machine (restricted domain) in the same privilege level of Secure EL1. This method is applied to the confidential virtualization system based on ARM TrustZone described in Embodiment 1.

[0039] As shown in Figures 2 to 5 , the software virtualization method based on the same level protection of this embodiment is specifically described. This method includes a memory virtualization step and a CPU virtualization step.

[0040] The memory virtualization step is to maintain a privileged domain page table and a shadow page table for the security monitor module, and to switch the page table base register when entering and exiting the confidential virtual machine. The security monitor module divides the secure memory into a privileged domain and a restricted domain through the shadow page table mechanism. Specifically, the security monitor module maintains a privileged domain page table pointing to the global secure memory and a normal domain shadow page table pointing to the memory of a specific confidential virtual machine in the memory; the privileged domain page table is loaded when the system runs the security monitor code, the corresponding normal domain shadow page table is forced to be loaded when switching to the confidential virtual machine, and the page table base register is switched at the boundary of entering and exiting the confidential virtual machine.

[0041] The CPU virtualization step is to scan the virtual machine image and replace the sensitive instructions with domain switching instructions to achieve safe switching from the restricted domain to the privileged domain. When loading the confidential virtual machine image, the security monitor module scans the binary code, identifies the sensitive instructions that modify the system control register, and replaces them with domain switching instructions that can trigger an exception, thereby achieving safe switching from the restricted domain to the privileged domain.

[0042] In order to better illustrate the workflow of the system, the specific steps of the system when handling memory page faults, sensitive instructions, interrupt exceptions, and I / O interactions will be introduced below.

[0043] Specifically, referring to FIG. 8, the steps of memory page fault exception handling are as follows: Figure 2 Step 1): A confidential virtual machine occurs a page fault exception, first jumps to the page fault exception handling program of the confidential virtual machine itself.

[0044] Step 2): The confidential virtual machine checks and finds that this exception belongs to the second stage page fault and cannot be handled by itself, executes the domain switching instruction to transfer the control to the security monitor module.

[0045] Step 3): The security monitor module parses the domain switching request, records the page fault exception address, and calls the world switching module at EL3 by SMC to switch to the normal monitor module by the world switching module.

[0046] Step 4): The normal monitor module formally handles the page fault exception, allocates a new physical memory page for the confidential virtual machine using the continuous memory allocator, and updates the corresponding second stage page table.

[0047] Step 5): The control is returned to the security monitor module via the world switching module.

[0048] Step 6): The security monitor module synchronizes the mapping information of the second stage page table to the shadow page table of the confidential virtual machine.

[0049] ​Step 7): The secure monitor module switches control back to the confidential VM and continues execution of the subsequent instructions.

[0050] Referring to Figure 3 illustrated, the steps of sensitive instruction handling are as follows: Step 1): When the confidential VM needs to perform an operation that modifies a system register (e.g., modifying SCTLR_EL1), it actually executes a domain switch instruction that has been replaced by the secure monitor.

[0051] Step 2): Control flow is transferred to the secure monitor module via domain switch.

[0052] Step 3): The secure monitor module parses the reason for this domain switch and confirms that the confidential VM intends to modify a system register.

[0053] Step 4): The secure monitor module checks whether the request of the confidential VM is legal.

[0054] Step 5): If the request is legal, the secure monitor module simulates the execution of the corresponding system register modification operation (e.g., updating the state of the virtual register maintained internally).

[0055] Step 6): The secure monitor module switches control back to the confidential VM and continues execution of the subsequent instructions.

[0056] Referring to Figure 4 illustrated, the steps of interrupt exception handling are as follows: Step 1): During the execution of the confidential VM, an interrupt exception (e.g., a clock interrupt) occurs, which is first routed to the world switch module at EL3.

[0057] Step 2): The world switch module verifies the legality of the program, and then switches control to the normal monitor module.

[0058] Step 3): The normal monitor module handles the interrupt exception, and after handling, it again falls into the world switch module through SMC calling.

[0059] Step 4): The world switch module injects a virtual interrupt into the confidential VM in a software manner.

[0060] Step 5): The system switches back to the confidential VM and jumps to the interrupt handling program of the confidential VM itself for processing.

[0061] Referring to Figure 5 illustrated, the steps of I / O interaction handling are as follows: Step 1): The confidential VM writes the I / O data to be transmitted into a shadow buffer located in the secure memory.

[0062] Step 2): The confidential VM executes the domain switch instruction to transfer the control to the secure monitor module.

[0063] Step 3): The secure monitor module copies the I / O data in the shadow buffer to the real buffer located in the normal memory.

[0064] Step 4): The secure monitor module transfers the control to the normal monitor module through the world switch.

[0065] Step 5): The normal monitor module informs the backend device emulator (such as QEMU) to perform the subsequent I / O operation.

[0066] Step 6): After the I / O operation is completed, the control flow returns to the confidential VM in the original route, and the I / O interaction is completed.

[0067] Further, in the software virtualization implementation of the same level protection, the application first solves a key problem: how to limit the behavior of the same level code without higher privilege level.

[0068] In order to deploy the application to a wider ARM platform, the system does not depend on the Secure EL2 hardware feature. This makes the secure monitor have to be deployed in the EL1 privilege level of the secure world, which is in the same privilege level as the kernel of the confidential VM. However, this way may bring security risks. Without any software protection, a malicious confidential VM can easily break through the security isolation line, threatening the secure monitor module or other normal confidential VMs. For example, the confidential VM may maliciously modify the TTBR to point to a page table designed by itself, thereby breaking the boundary of memory isolation.

[0069] The application solves this problem through static binary rewriting technology. The system will forcibly scan and replace all sensitive instructions during the loading of the confidential VM image. Specifically, based on the fixed-length characteristics of ARM instructions, the system traverses the instruction stream in steps of 4 bytes, and identifies all instructions that attempt to operate privileged resources according to the instruction code characteristics, such as reading and writing key system configuration registers through MSR / MRS instructions, or performing sensitive operations of system state management. This means that although the confidential VM nominally runs in the EL1 privilege level, it has actually lost the ability to directly operate the hardware. Every attempt to modify the hardware by it will become an "exception", which is switched to the privileged domain through the domain switch operation, and finally captured and reviewed by the secure monitor.

[0070] On this basis, the application further solves the control flow hijacking problem in the isolated domain switching process.

[0071] When performing domain switch, the system needs to modify the page table base register (TTBR) to switch the page table. However, a malicious guest VM can exploit return-oriented programming (ROP) or jump-oriented programming (JOP) techniques to skip the instruction of loading the legal page table address and directly jump to the instruction of modifying the TTBR. This time-of-check-to-time-of-use (TOCTTOU) vulnerability can cause the system to load the page table forged by the attacker, thereby completely breaking the memory isolation.

[0072] To this end, the system introduces a lightweight recheck mechanism. The core logic is: in the switching code, after the page table base address is written into the register, immediately execute the instruction to perform integrity check on the value (i.e. reload the expected address and compare with the actual used value). If inconsistency is found, it means that the control flow is hijacked, and the system will immediately terminate running.

[0073] The mechanism guarantees the security of the system domain switching.

[0074] The application also solves another core problem: how to efficiently maintain the consistency of the guest page table and the shadow page table.

[0075] The traditional full-virtualization synchronization mechanism (such as "write protection + page fault exception") has a long path, and each trigger requires a complete domain switch, which will introduce a serious performance bottleneck under the system architecture.

[0076] To this end, the embodiment of the application designs a shadow page table fast synchronization mechanism. The mechanism adopts a semi-virtualization design, and the confidential virtual machine actively notifies the security monitor for page table update through an API, and cooperates with the following four key optimizations: Minimize domain switching overhead: the system regards domain switching as a function call, and only saves the callee-saved registers. At the same time, by using the ASID feature of the ARM architecture, a dedicated ASID is allocated for the security monitor, so that there is no need to flush the TLB when switching, avoiding the expensive TLB refill overhead.

[0077] Lock-free shadow page query: to solve the lock competition problem under multi-core concurrency, the system extends the memory page metadata structure (such as struct page) to directly store the shadow page address, realizing decentralized O(1) lock-free query. At the same time, a bidirectional pointer reference mechanism is used to verify the legality of the pointer, ensuring security. The bidirectional pointer reference mechanism includes that the guest page metadata stores the shadow page address, the metadata of the shadow page stores the guest page address, and the bidirectional comparison is performed during verification to prevent forged pointers.

[0078] Accelerating second stage address translation: In order to accelerate the conversion of the customer physical address to the host physical address, the system introduces a direct mapping array. The array is indexed by page frame number, instead of the traditional multi-level page table traversal, and the address translation is optimized to a single memory access.

[0079] Lazy second stage mapping: In order to reduce unnecessary physical memory allocation and world switching, the system adopts a lazy mapping strategy. When the page table is synchronized, if the page fault is only marked as invalid and returned; only when the confidential virtual machine really accesses the page to trigger an exception, the actual physical memory allocation is performed.

[0080] The present application aims to solve the defects in the prior art that the confidential virtualization scheme often relies on specific hardware extensions (such as S-EL2), resulting in limited compatibility, or cannot effectively protect the privacy and integrity of the confidential virtual machine when the general world operating system is damaged.

[0081] The embodiment of the present application provides a confidential virtualization system and method based on ARM TrustZone, adopts a dual virtual machine monitor architecture, retains the complex resource management function in the general monitor, and isolates the key security mechanism in the security monitor, so as to minimize the trusted computing base. At the same time, for the platform that does not support hardware virtualization extension, a software virtualization method based on the same level protection is proposed, and through the shadow page table and static binary translation technology, the strong isolation of the security monitor to the confidential virtual machine is realized in the same privilege level. Compared with the prior art, the present application can obtain compatibility and performance improvement on the basis of stronger isolation and security.

[0082] Those skilled in the art know that, in addition to implementing the system provided by the present application and each device, module and unit thereof in a pure computer readable program code manner, the same functions can also be realized by logically programming the method steps in the form of logic gates, switches, special integrated circuits, programmable logic controllers and embedded microcontrollers. Therefore, the system provided by the present application and each device, module and unit thereof can be considered as a hardware component, and the devices, modules and units included therein for realizing various functions can also be considered as structures in the hardware component; the devices, modules and units for realizing various functions can also be considered as both software modules realizing the method and structures in the hardware component.

[0083] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A confidential virtualization system based on ARM TrustZone, characterized in that, include: The ordinary monitoring module runs in the ordinary world and is used to manage the insecure resources and scheduling of confidential virtual machines, acting as an insecure proxy for the interaction between confidential virtual machines and underlying hardware resources. The security monitor module runs in a secure world, serving as the system's trusted computing base. It is used to maintain the privacy and integrity of confidential virtual machines and to build an isolated execution environment. The world switching module runs at the highest privilege level of the ARM architecture. It acts as a bridge between the normal world and the secure world, and is used to switch control between the two worlds, manage contexts, and transition between security states.

2. The confidential virtualization system based on ARM TrustZone according to claim 1, characterized in that, The general monitoring module includes: The lifecycle management unit is used to capture confidential virtual machine creation / destruction requests initiated by user-space tools, allocate virtual machine control blocks in the normal world, and send the requests to the security monitor module through the world switching module; The vCPU scheduling unit is used to maintain the system scheduling queue, determine the vCPUs running on the physical CPUs, load the confidential virtual machine vCPUs in the context of the normal world, and switch control through the world switching module. The physical memory allocation unit is used to reserve or dynamically allocate contiguous ordinary physical memory using the kernel contiguous memory allocator, and then send a request to the security monitor module to convert the ordinary physical memory into secure memory. The I / O device driver unit is used to reuse the Linux / KVM device driver model, receive I / O data requests from the secure world, and drive the physical network card or disk to complete data interaction.

3. The confidential virtualization system based on ARM TrustZone according to claim 1, characterized in that, The security monitoring module includes: The metadata management unit is used to create, maintain, or destroy confidential virtual machine metadata in secure memory in response to requests from the general monitor module. The execution intervention processing unit is used to perform security checks on the virtual machine state and restore the context before scheduling confidential virtual machines vCPUs, and to perform register state cleanup when the virtual machine exits runtime, overwriting the registers with fixed values ​​to prevent the leakage of sensitive information. The secure memory management unit is used to receive physical addresses from ordinary monitors and convert ordinary memory into secure memory accessible only by the secure world by configuring the TrustZone address space controller or modifying the secure sidepage table attributes. The I / O data synchronization unit is used to maintain a shadow buffer located in ordinary memory, and synchronize I / O data generated by the confidential virtual machine from the secure memory buffer to the shadow buffer, so as to realize the interaction of device data between the secure world and the ordinary world.

4. The confidential virtualization system based on ARM TrustZone according to claim 3, characterized in that, The metadata includes vCPU register status and security page table base address, and the metadata is not visible to the ordinary world.

5. The confidential virtualization system based on ARM TrustZone according to claim 1, characterized in that, The world switching module includes: The request capture unit is used to capture SMC call requests initiated by the ordinary monitor module or the security monitor module; The context management unit is used to save the CPU general-purpose registers and system registers of the current world when switching worlds, and to restore the corresponding register information from the context structure of the target world. The security state switching unit is used to read and modify the NS bit of the security configuration register to switch the CPU between the non-secure state and the secure state. The control flow steering unit is used to set the program counter according to the target of the switching request and transfer control to the entry address of the target monitor module.

6. The confidential virtualization system based on ARM TrustZone according to claim 1, characterized in that, The system employs a dynamic cooperative memory allocation mechanism, including: When the system starts up, a large contiguous memory pool is reserved through the operating system's contiguous memory allocator; When a non-secret virtual machine is running, the memory pool is normally requisitioned by the operating system. When the confidential virtual machine starts, the ordinary monitoring module allocates contiguous memory, the memory requisitioned in the memory pool is moved elsewhere, and the security monitoring module converts the allocated memory into secure memory. When a confidential virtual machine is destroyed, the security monitor module clears the memory pages to maintain a secure memory state; When memory is scarce in the normal world, the security monitor module integrates free contiguous secure memory and converts it into ordinary memory to be returned to the operating system.

7. The confidential virtualization system based on ARM TrustZone according to claim 1, characterized in that, The key interaction processes of the system include memory page fault handling, sensitive instruction handling, interrupt exception handling, and I / O interaction handling; among them... When handling memory page faults, the regular monitor module allocates physical memory and updates the page table, while the security monitor module synchronizes the shadow page table. When processing sensitive instructions, the domain switching is triggered by instruction replacement, and the security monitoring module reviews and simulates the execution. When an interruption occurs, the interrupt is routed through the world switching module to the ordinary monitor module for processing, and then a virtual interrupt is injected into the confidential virtual machine. During I / O interaction processing, data transmission is achieved by synchronizing buffers in safe memory and ordinary memory.

8. A software virtualization method based on peer protection, applied to the confidential virtualization system based on ARM TrustZone as described in any one of claims 1-7, characterized in that, include: Memory virtualization steps: The security monitor module maintains privileged domain page tables pointing to global secure memory and shadow page tables pointing to specific confidential virtual machine memory in memory; When running the security monitor code, the privileged domain page table is loaded. When switching to a confidential virtual machine, the corresponding shadow page table is forcibly loaded, and the page table base address register is switched at the boundary between entering and leaving the virtual machine. CPU virtualization steps: During the loading of the confidential virtual machine image, the security monitor module scans the binary code, identifies sensitive instructions that modify the system control register, and replaces them with domain switching instructions that trigger exceptions, thereby achieving a secure switch from a restricted domain to a privileged domain.

9. The software virtualization method based on peer protection according to claim 8, characterized in that, It also includes control flow hijacking protection mechanisms: In the domain switching code, after the page table base address is written to the register, an instruction is immediately executed to perform an integrity check on the value, reload the expected address and compare it with the actual value used. If they do not match, the system operation is terminated.

10. The software virtualization method based on peer protection according to claim 8, characterized in that, It also includes a shadow page table fast synchronization mechanism, in which the confidential virtual machine proactively notifies the security monitor via API to update the page table. This mechanism includes: Minimize domain switching overhead: Treat domain switching as a function call, only saving the registers saved by the callee; Utilize the ASID feature of the ARM architecture to assign a dedicated ASID to the security monitor, eliminating the need to refresh the TLB during switching; Lock-free shadow page lookup: Extend the memory page metadata structure to directly store shadow page addresses, achieving O / 1 lock-free lookup; verify pointer validity through a two-way pointer reference mechanism; Accelerate second-stage address translation: Introduce a direct mapping array, indexed by page frame number, to optimize the translation from client physical address to host physical address into a single memory access; Lazy second-stage mapping: During page table synchronization, page faults are only marked as invalid; when a confidential virtual machine accesses the page and triggers an exception, the actual physical memory allocation is then performed.

Images