Virtual trusted root migration method and corresponding device

Abstract

The invention provides a virtual trusted root migration method, which is applied to a virtual machine live migration process and comprises the following steps of: setting a virtual trusted root and a virtual trusted root manager in a trusted execution environment; in the process of migrating the virtual trusted root to different physical platforms, the encryption material of the trusted execution environment is used for protecting the virtual trusted root, the security and reliability of virtual trusted root migration are improved, and the situation of data leakage caused by external attacks on the virtual trusted root in the migration process is reduced.

Description

Technical Field

[0001] This application relates to the field of information security, specifically to a method and apparatus for migrating a virtual trusted root. Background Technology

[0002] In cloud-network separation application scenarios, the hardware and software used in the network functions virtualization infrastructure (NFVI) need to prove their trustworthiness to network operators in order for operators to trust the NFVI. The cloud vendor responsible for providing the NFVI uses a physical root of trust to prove the NFVI's trustworthiness to the network operator. To ensure the trustworthiness of the virtualized network elements running on the NFVI, a virtual root of trust is also needed to provide the network operator with trusted configuration information for the virtualized network elements.

[0003] When virtual machines within a virtualized network element need to be migrated to different physical platforms, the virtual root of trust also needs to migrate along with the virtual machines to ensure their trustworthiness. However, the migration of the virtual root of trust poses a security risk of data leakage. Summary of the Invention

[0004] This application provides a method for virtual root of trust migration, which is used to perform trusted migration of the virtual root of trust of a virtual machine when the virtual machine is hot-migrated to different physical platforms. This reduces the risk of data leakage during the migration of the virtual root of trust and improves the trustworthiness and security of the virtual root of trust migration.

[0005] A first aspect of this application provides a method for migrating a virtual trusted root. The method is applied to a controller of a virtualization system, the controller being located in a trusted domain. The method includes: receiving a virtual machine migration request from a first virtual machine manager, the virtual machine migration request indicating that a first virtual machine requests migration; the first virtual machine and the first virtual machine manager being contained in a first virtual platform of the virtualization system; the virtualization system further including a first trusted execution environment (TEX) for storing the virtual trusted root of the virtual machine in the first virtual platform; receiving a virtual machine migration response from a second virtual machine manager, the virtual machine migration response indicating permission for the first virtual machine to migrate to a second virtual platform; the second virtual platform including a second virtual machine manager and a second TEX, the second TEX for storing the virtual trusted root of the virtual machine in the second virtual platform; and migrating the virtual trusted root of the first virtual machine from the first TEX to the second TEX according to an encryption strategy.

[0006] In this application, a trusted domain is an area where components within the region trust each other and are securely trusted, through a series of security technologies and strategies. The controller can be implemented through a sub-function of the Orchestrator in the virtualization system.

[0007] In this application, the virtual machine migration process can be hot migration, that is, migrating a running virtual machine from one physical server (or compute node) to another physical server without interrupting the operation of the virtual machine or shutting down the power.

[0008] In this application, the virtual machine migration request may include the address information of the first virtual machine manager and the identifier of the first virtual machine. The first virtual machine is the virtual machine to be migrated, i.e., the source virtual machine, and the second virtual machine is the virtual machine to be migrated, i.e., the target virtual machine.

[0009] Optionally, the virtual machine migration request may include a certificate for the first trusted execution environment.

[0010] In this application, the first trusted execution environment is further used to store a first virtual trusted root manager, which manages the virtual trusted roots of virtual machines in the first virtual platform; the second trusted execution environment is further used to store a second virtual trusted root manager, which manages the virtual trusted roots of virtual machines in the second virtual platform. By setting the virtual trusted root manager and the virtual trusted roots in the trusted execution environment, the security of the virtual trusted roots of virtual machines is improved.

[0011] In this application, the first trusted execution environment and the second trusted execution environment are trusted execution environments (TEEs). The first and second trusted execution environments can provide a secure and isolated execution environment for the virtual trusted root and virtual trusted root manager of the virtual machines in the first virtual platform, as well as for the virtual trusted root and virtual trusted root manager of the virtual machines in the second virtual platform. This improves the security of the virtual trusted root of the virtual machines.

[0012] In this application, the encryption strategy can be to encrypt the context data of the virtual trusted root using a public key in a trusted execution environment, or to encrypt the context data of the virtual trusted root using a certificate in a trusted execution environment.

[0013] In the first aspect described above, by using a controller in the trusted domain to assist the source and target virtual machine managers in exchanging key materials (encryption public keys or certificates) for the trusted execution environment used to store the virtual root of trust for the virtual machine after receiving a migration request from the source virtual machine manager, and by transmitting the migration data encrypted with the key materials, the security of the virtual root of trust during the migration process is improved, and the possibility of data leakage during the hot migration of the virtual machine is reduced. Simultaneously, storing the virtual root of trust in the trusted execution environment reduces the reliance on the physical root of trust during the virtual machine migration process.

[0014] In one possible implementation, when the encryption strategy is key-based encryption, the virtual machine migration response includes the encryption public key of the second trusted execution environment;

[0015] According to the encryption strategy, the virtual trusted root of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment, including: sending a first trusted root migration instruction to the first virtual machine manager;

[0016] The first trusted root migration instruction includes the identifier of the first virtual machine and the encrypted public key of the second trusted execution environment. The identifier of the first virtual machine is used to instruct the first virtual machine manager to send the second trusted root migration instruction to the first virtual trusted root manager through the first virtual machine. The second trusted root migration instruction includes the encrypted public key of the second trusted execution environment. The encrypted public key of the second trusted execution environment is used by the first virtual trusted root manager to encrypt the context data of the virtual trusted root of the first virtual machine.

[0017] Send the first trusted root migration response to the second virtual machine manager;

[0018] The first trusted root migration response includes the encrypted virtual trusted root of the first virtual machine and the identifier of the second trusted execution environment. The identifier of the second trusted execution environment is used to instruct the second virtual machine manager to send the second trusted root migration response to the second virtual trusted root manager. The second trusted root migration response includes the identifier of the second virtual machine and the context data of the encrypted virtual trusted root of the first virtual machine. The second virtual machine is the first virtual machine that is migrated to the second virtual platform. The context data of the encrypted virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and then stored in the second trusted execution environment.

[0019] In this application, the context data of the virtual root of trust may include instance data of the virtual root of trust, the correspondence between virtual machines and the virtual root of trust, and the value of the platform configuration register (PCR). The core data of the virtual root of trust includes its identifier, status, configuration, and other information. This data is used to identify and verify the identity and status of the virtual root of trust, thereby ensuring the security and reliability of the virtual machine. The correspondence between the virtual machine and the virtual root of trust records the association between the virtual machine and the virtual root of trust, ensuring that the virtual machine can correctly interact and communicate with the virtual root of trust. The PCR is used to measure the trustworthiness of the virtual root of trust.

[0020] In this possible implementation, the context data of the virtual trusted root is encrypted using the public key of the second trusted execution environment, which improves the security of the virtual trusted root when migrating from the first trusted execution environment to the second trusted execution environment. Furthermore, the encrypted context data of the virtual trusted root can only be decrypted using the private key of the second trusted execution environment, reducing the possibility of data leakage of the virtual trusted root during the migration process.

[0021] In one possible implementation, when the encryption strategy is certificate encryption, the virtual machine migration request also includes the certificate of the first trusted execution environment, and the virtual machine migration response also includes the certificate of the second trusted execution environment;

[0022] According to the encryption strategy, the virtual root of trust of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment, including:

[0023] A third trusted root migration instruction is sent to the first virtual machine manager; wherein the third trusted root migration instruction includes the identifier of the first virtual machine and the certificate of the second trusted execution environment, the identifier of the first virtual machine is used to instruct the first virtual machine manager to send a fourth trusted root migration instruction to the first virtual trusted root manager through the first virtual machine, the fourth trusted root migration instruction includes the certificate of the second trusted execution environment, the certificate of the second trusted execution environment is used by the first virtual trusted root manager to establish a TLS channel, and the TLS channel is used by the first virtual trusted root manager to migrate the context data of the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment.

[0024] In this application, the TLS channel is an encrypted channel established based on the Transport Layer Security (TLS) protocol, used to provide confidentiality, data integrity, and authenticity between two communicating applications, thereby improving the confidentiality and integrity of the communication. The TLS channel can be authenticated through digital certificates to ensure the authenticity of the identities of both communicating parties.

[0025] In this possible implementation, a TLS channel is established between the first and second virtual trusted root managers using certificates from the first and second trusted execution environments. The context data of the virtual trusted root is transmitted through the TLS channel, which improves the security of the virtual trusted root when migrating from the first to the second trusted execution environment. Furthermore, the use of certificates to verify the first and second virtual trusted root managers during the establishment of the TLS channel reduces the risk of attacks on the virtual trusted root during the migration process.

[0026] In one possible implementation, the virtual machine migration request also includes the identifier of the first virtual machine;

[0027] After receiving a virtual machine migration request from the first virtual machine manager, the method further includes: obtaining resource configuration information of the first virtual machine based on the identifier of the first virtual machine, wherein the resource configuration information includes at least one of the memory capacity occupied by the first virtual machine, the storage space used by the first virtual machine, and the processor configuration used by the first virtual machine; and determining the second virtual machine manager based on the resource configuration information.

[0028] In this application, the controller determines that the second virtual machine manager is in a normal operating state, and there is at least one second virtual machine in the second virtual machine manager that can satisfy the resource configuration information of the first virtual machine.

[0029] In this possible implementation, the controller determines the second virtual machine manager where the second virtual machine is located based on the resource configuration information of the first virtual machine to be migrated. This reduces the chance of virtual machine root of trust migration failure due to unsatisfactory resource configuration and improves the success rate of virtual machine root of trust migration.

[0030] In one possible implementation, before receiving the virtual machine migration response from the second virtual machine manager, the method further includes: sending a remote verification request to the first virtual machine manager and the second virtual machine manager, the remote verification request being used to determine whether the first virtual machine manager and the second virtual machine manager are in a trusted state; if both the first virtual machine manager and the second virtual machine manager are in a trusted state, then sending a migration notification to the second virtual machine manager, the migration notification being used to instruct the first virtual machine to migrate to the second virtual platform where the second virtual machine manager resides.

[0031] In this application, the controller can initiate remote verification requests to the trusted platform module (TPM) in the first virtual platform where the first virtual machine manager is located and the TPM in the second virtual platform where the second virtual machine manager is located, respectively, and determine whether the first virtual machine manager and the second virtual machine manager are in a trusted state by verifying the metric values ​​in the TPM.

[0032] In this possible implementation, the first and second virtual platforms where the virtual machine to be migrated resides are authenticated before the virtual machine is migrated, which improves the security of virtual trusted root migration.

[0033] A second aspect of this application provides a method for migrating a virtual trusted root. The method is applied to a first virtual machine manager of a virtualization system, the first virtual machine manager being located on a first virtual platform of the virtualization system. The method includes:

[0034] A virtual machine migration request is sent to the controller located in the trusted domain. The virtual machine migration request is used to instruct the first virtual machine to request migration. The first virtual machine is contained in the first virtual platform. The virtualization system also includes a first trusted execution environment, which is used to store the virtual trusted root of the virtual machine in the first virtual platform.

[0035] According to the encryption strategy, the context data of the virtual trusted root of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment; the second trusted execution environment is used to store the virtual trusted root context data of the virtual machine in the second virtual platform.

[0036] In this application, the first trusted execution environment is further used to store a first virtual trusted root manager, which is used to manage the virtual trusted roots of virtual machines in the first virtual platform; the second trusted execution environment is further used to store a second virtual trusted root manager, which is used to manage the virtual trusted roots of virtual machines in the second virtual platform, and the second virtual platform also includes a second virtual machine manager.

[0037] The second aspect mentioned above involves storing the virtual root of trust in a trusted execution environment (TEX). By verifying the encrypted credentials related to the TEX between the virtual machine manager to be migrated and the virtual machine manager after migration, the risk of data leakage due to external attacks during hot migration of the virtual root of trust is reduced, thus improving the security and reliability of the virtual root of trust migration. Furthermore, by verifying the source and target virtual machines through the TEX, the dependence on the physical roots of trust of the source and target virtual machines is reduced, thereby improving the migration efficiency of virtual machines and their virtual roots of trust.

[0038] In one possible implementation, when the encryption strategy is to use key encryption,

[0039] According to the encryption strategy, the virtual root of trust of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment, including:

[0040] Receive a first trusted root migration instruction from the controller, the first trusted root migration instruction including the identifier of the first virtual machine and the encrypted public key of the second trusted execution environment;

[0041] Based on the identifier of the first virtual machine, a second trusted root migration instruction is sent to the first virtual trusted root manager through the first virtual machine; the second trusted root migration instruction includes the encryption public key of the second trusted execution environment, which is used by the first virtual trusted root manager to encrypt the context data of the virtual trusted root of the first virtual machine;

[0042] A first trusted root migration response is sent to the controller; wherein, the first trusted root migration response includes the encrypted context data of the virtual trusted root of the first virtual machine and the identifier of the second trusted execution environment. The identifier of the second trusted execution environment is used to instruct the second virtual machine manager to send a second trusted root migration response to the second virtual trusted root manager. The second trusted root migration response includes the identifier of the second virtual machine and the encrypted virtual trusted root of the first virtual machine. The second virtual machine is the first virtual machine that is migrated to the second virtual platform. The encrypted virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and then stored in the second trusted execution environment.

[0043] In this possible implementation, the context data of the virtual trusted root is encrypted using the public key of the second trusted execution environment, which improves the security of the virtual trusted root when migrating from the first trusted execution environment to the second trusted execution environment. Furthermore, the encrypted context data of the virtual trusted root can only be decrypted using the private key of the second trusted execution environment, reducing the possibility of data leakage of the virtual trusted root during the migration process.

[0044] In one possible implementation, when the encryption strategy is certificate-based encryption, the virtual machine migration request also includes the certificate of the first trusted execution environment;

[0045] According to the encryption strategy, the virtual root of trust of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment, including:

[0046] Receive a third trusted root migration instruction from the controller; wherein the third trusted root migration instruction includes the identifier of the first virtual machine and the certificate of the second trusted execution environment;

[0047] Based on the identifier of the first virtual machine, a fourth trusted root migration instruction is sent to the first virtual trusted root manager through the first virtual machine; wherein, the fourth trusted root migration instruction includes the certificate of the second trusted execution environment, the certificate of the second trusted execution environment is used by the first virtual trusted root manager to establish a TLS channel, and the TLS channel is used by the first virtual trusted root manager to migrate the context data of the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment.

[0048] In this possible implementation, a TLS channel is established between the first and second virtual trusted root managers using certificates from the first and second trusted execution environments. The context data of the virtual trusted root is transmitted through the TLS channel, which improves the security of the virtual trusted root when migrating from the first to the second trusted execution environment. Furthermore, the use of certificates to verify the first and second virtual trusted root managers during the establishment of the TLS channel reduces the risk of attacks on the virtual trusted root during the migration process.

[0049] In one possible implementation, after sending the virtual machine migration request to the controller located in the trusted domain, the following steps are also included:

[0050] Receive a remote verification request from the controller, which is used to determine whether the first virtual machine manager is in a trusted state; send a remote verification report to the controller.

[0051] In this possible implementation, the virtual platform on which the virtual machine resides is determined to be trustworthy by remotely verifying the virtual trusted root manager, thereby improving the security of virtual trusted root migration of the virtual machine.

[0052] A third aspect of this application provides a method for migrating a virtual trusted root, characterized in that the method is applied to a first virtual trusted root manager of a virtualization system, the first virtual trusted root manager being located in a first trusted execution environment, and the method includes:

[0053] The system receives a trusted root migration instruction from a first virtual machine. The trusted root migration instruction includes the identifier and encryption information of a second trusted execution environment. The context data of the virtual trusted root of the first virtual machine is stored in the first trusted execution environment. The first trusted execution environment is contained in the first virtual platform of the virtualization system. The second trusted execution environment is used to store the context data of the virtual trusted root of the virtual machine in the second virtual platform and the second virtual trusted root manager. The second virtual trusted root manager is used to manage the virtual trusted root of the virtual machine in the second virtual platform.

[0054] According to the encrypted information, the virtual trusted root of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment.

[0055] The third aspect mentioned above involves setting the virtual root of trust and the virtual root of trust manager in a trusted execution environment. By verifying the encrypted credentials related to the trusted execution environment between the virtual machine manager to be migrated and the virtual machine manager after migration before migrating the virtual root of trust, the risk of data leakage caused by external attacks during hot migration of the virtual root of trust is reduced, thus improving the security and reliability of the migration of the virtual root of trust. Furthermore, by verifying the source virtual machine and the target virtual machine through the trusted execution environment, the dependence on the physical root of trust of the source virtual machine and the target virtual machine is reduced, thereby improving the migration efficiency of virtual machines and the virtual root of trust of virtual machines.

[0056] In one possible implementation, the virtualization system also includes a controller located in the trusted domain;

[0057] If the encrypted information is the public key of the second trusted execution environment, then according to the encrypted information, the context data of the virtual trusted root of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment, including:

[0058] The virtual trusted root of the first virtual machine is encrypted using the public key of the second trusted execution environment;

[0059] A first trusted root migration response is sent to the first virtual machine; wherein, the first trusted root migration response includes the encrypted context data of the virtual trusted root of the first virtual machine and the identifier of the second trusted execution environment. The identifier of the second trusted execution environment is used to instruct the first virtual machine to send a second trusted root migration response to the second virtual trusted root manager in the second trusted execution environment through the controller. The second trusted root migration response includes the identifier of the second virtual machine and the encrypted context data of the virtual trusted root of the first virtual machine. The second virtual machine is the first virtual machine that is migrated to the second virtual platform. The encrypted context data of the virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and stored in the second trusted execution environment.

[0060] In this possible implementation, the context data of the virtual trusted root is encrypted using the public key of the second trusted execution environment, which improves the security of the virtual trusted root when migrating from the first trusted execution environment to the second trusted execution environment. Furthermore, the encrypted context data of the virtual trusted root can only be decrypted using the private key of the second trusted execution environment, reducing the possibility of data leakage of the virtual trusted root during the migration process.

[0061] In one possible implementation, if the encrypted information is a certificate of the second trusted execution environment, then the virtual root of trust of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment according to the encrypted information, including:

[0062] A TLS channel is established based on the certificate of the second trusted execution environment, and the TLS channel is connected to the second trusted root manager in the second trusted execution environment;

[0063] The third trusted root migration instruction is sent to the second trusted root manager using a TLS channel. The third trusted root migration instruction includes the virtual trusted root of the first virtual machine and the identifier of the second virtual machine, which is the first virtual machine that is being migrated to the second virtual platform.

[0064] In this possible implementation, a TLS channel is established between the first and second virtual trusted root managers using certificates from the first and second trusted execution environments. The context data of the virtual trusted root is transmitted through the TLS channel, which improves the security of the virtual trusted root when migrating from the first to the second trusted execution environment. Furthermore, the use of certificates to verify the first and second virtual trusted root managers during the establishment of the TLS channel reduces the risk of attacks on the virtual trusted root during the migration process.

[0065] In one possible implementation, the method further includes:

[0066] Receive a first remote verification request from a third virtual machine in the first virtual platform;

[0067] Obtain the virtual trusted root of the third virtual machine based on the identifier of the third virtual machine;

[0068] Send a second remote verification request to the virtual root of trust of the third virtual machine; wherein the second remote verification request is used to obtain the first remote verification report of the virtual root of trust of the third virtual machine;

[0069] Send a second remote verification report to the third virtual machine; wherein the second remote verification report includes a first remote verification report, a remote verification report of the first trusted execution environment, the certificate of the first trusted execution environment, and a remote report signature. The remote report signature is obtained by encrypting the first remote verification report and the remote verification report of the first trusted execution environment using the private key of the certificate of the first trusted execution environment. The second remote verification report is used by the trusted direction of the third virtual machine to verify the trusted status of the third virtual machine.

[0070] In this possible implementation, a remote verification report is provided to the virtual machine through a virtual root of trust in the trusted execution environment, which improves the trustworthiness of the virtual machine's identity and does not rely on a physical root of trust to provide proof for the virtual platform where the virtual machine resides, thus improving the efficiency of the virtual machine providing a trusted identity.

[0071] A fourth aspect of this application provides a migration apparatus for a virtual root of trust, comprising:

[0072] The transceiver unit is used to receive virtual machine migration requests from the first virtual machine manager; the virtual machine migration request is used to instruct the first virtual machine to request migration, the first virtual machine and the first virtual machine manager are contained in the first virtual platform of the virtualization system, the virtualization system also includes a first trusted execution environment, the first trusted execution environment is used to store the virtual trusted root of the virtual machine in the first virtual platform;

[0073] The transceiver unit is also used to receive a virtual machine migration response from the second virtual machine manager. The virtual machine migration response is used to indicate that the first virtual machine is allowed to migrate into the second virtual platform. The second virtual platform includes the second virtual machine manager and the second trusted execution environment. The second trusted execution environment is used to store the virtual trusted root of the virtual machine in the second virtual platform.

[0074] The processing module is used to migrate the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encryption policy.

[0075] In one possible implementation, the first trusted execution environment is further used to store a first virtual trusted root manager, which manages the virtual trusted roots of virtual machines in the first virtual platform; the second trusted execution environment is further used to store a second virtual trusted root manager, which manages the virtual trusted roots of virtual machines in the second virtual platform.

[0076] In one possible implementation, when the encryption strategy is key-based encryption, the virtual machine migration response includes the encryption public key of the second trusted execution environment;

[0077] The transceiver unit is used to send a first trusted root migration instruction to a first virtual machine manager; wherein, the first trusted root migration instruction includes the identifier of the first virtual machine and the encryption public key of the second trusted execution environment, the identifier of the first virtual machine is used to instruct the first virtual machine manager to send a second trusted root migration instruction to the first virtual trusted root manager through the first virtual machine, and the second trusted root migration instruction includes the encryption public key of the second trusted execution environment, the encryption public key of the second trusted execution environment is used by the first virtual trusted root manager to encrypt the context data of the virtual trusted root of the first virtual machine;

[0078] The transceiver unit is also used to send a first trusted root migration response to the second virtual machine manager; wherein, the first trusted root migration response includes the encrypted virtual trusted root of the first virtual machine and the identifier of the second trusted execution environment, the identifier of the second trusted execution environment is used to instruct the second virtual machine manager to send a second trusted root migration response to the second virtual trusted root manager, the second trusted root migration response includes the identifier of the second virtual machine and the context data of the encrypted virtual trusted root of the first virtual machine, the second virtual machine is the first virtual machine migrated to the second virtual platform, and the context data of the encrypted virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and stored in the second trusted execution environment.

[0079] In one possible implementation, when the encryption strategy is certificate encryption, the virtual machine migration request also includes the certificate of the first trusted execution environment, and the virtual machine migration response also includes the certificate of the second trusted execution environment;

[0080] The transceiver module is used to send a third trusted root migration instruction to the first virtual machine manager. The third trusted root migration instruction includes the identifier of the first virtual machine and the certificate of the second trusted execution environment. The identifier of the first virtual machine is used to instruct the first virtual machine manager to send a fourth trusted root migration instruction to the first virtual trusted root manager through the first virtual machine. The fourth trusted root migration instruction includes the certificate of the second trusted execution environment. The certificate of the second trusted execution environment is used by the first virtual trusted root manager to establish a TLS channel. The TLS channel is used by the first virtual trusted root manager to migrate the context data of the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment.

[0081] In one possible implementation, the virtual machine migration request also includes the identifier of the first virtual machine;

[0082] After receiving the virtual machine migration request from the first virtual machine manager, the process also includes:

[0083] The transceiver module is also used to obtain resource configuration information of the first virtual machine based on the identifier of the first virtual machine. The resource configuration information includes at least one of the following: memory capacity occupied by the first virtual machine, storage space size used by the first virtual machine, and processor configuration used by the first virtual machine.

[0084] The processing module is also used to determine the second virtual machine manager based on resource configuration information.

[0085] In one possible implementation, before receiving the virtual machine migration response from the second virtual machine manager,

[0086] The transceiver module is also used to send remote verification requests to the first virtual machine manager and the second virtual machine manager. The remote verification requests are used to determine whether the first virtual machine manager and the second virtual machine manager are in a trusted state.

[0087] If both the first virtual machine manager and the second virtual machine manager are in a trusted state, the transceiver module is also used to send a migration notification to the second virtual machine manager. The migration notification is used to instruct the first virtual machine to migrate to the second virtual platform where the second virtual machine manager is located.

[0088] The fifth aspect of this application provides a migration apparatus for a virtual root of trust, comprising:

[0089] The transceiver module is used to send a virtual machine migration request to the controller located in the trusted domain. The virtual machine migration request is used to instruct a first virtual machine to request migration. The first virtual machine is contained in a first virtual platform. The virtualization system also includes a first trusted execution environment, which is used to store the virtual trusted root of the virtual machine in the first virtual platform.

[0090] The processing module is used to migrate the context data of the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encryption policy; the second trusted execution environment is used to store the virtual trusted root context data of the virtual machine in the second virtual platform.

[0091] In one possible implementation, the first trusted execution environment is further used to store a first virtual trusted root manager, which manages the virtual trusted roots of virtual machines in the first virtual platform; the second trusted execution environment is further used to store a second virtual trusted root manager, which manages the virtual trusted roots of virtual machines in the second virtual platform, and the second virtual platform also includes a second virtual machine manager.

[0092] In one possible implementation, when the encryption strategy is to use key encryption,

[0093] The transceiver module is also used to receive a first trusted root migration indication from the controller, the first trusted root migration indication including the identifier of the first virtual machine and the encrypted public key of the second trusted execution environment;

[0094] The transceiver module is also used to send a second trusted root migration instruction to the first virtual trusted root manager through the first virtual machine based on the identifier of the first virtual machine; the second trusted root migration instruction includes the encryption public key of the second trusted execution environment, which is used by the first virtual trusted root manager to encrypt the context data of the virtual trusted root of the first virtual machine;

[0095] The transceiver module is also used to send a first trusted root migration response to the controller; wherein, the first trusted root migration response includes the encrypted context data of the virtual trusted root of the first virtual machine and the identifier of the second trusted execution environment. The identifier of the second trusted execution environment is used to instruct the second virtual machine manager to send a second trusted root migration response to the second virtual trusted root manager. The second trusted root migration response includes the identifier of the second virtual machine and the encrypted virtual trusted root of the first virtual machine. The second virtual machine is the first virtual machine that has been migrated to the second virtual platform. The encrypted virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and then stored in the second trusted execution environment.

[0096] In one possible implementation, when the encryption strategy is certificate-based encryption, the virtual machine migration request also includes the certificate of the first trusted execution environment;

[0097] The transceiver module is also used to receive a third trusted root migration indication from the controller; wherein the third trusted root migration indication includes the identifier of the first virtual machine and the certificate of the second trusted execution environment;

[0098] The transceiver module is also used to send a fourth trusted root migration instruction to the first virtual trusted root manager through the first virtual machine based on the identifier of the first virtual machine; wherein, the fourth trusted root migration instruction includes the certificate of the second trusted execution environment, the certificate of the second trusted execution environment is used by the first virtual trusted root manager to establish a TLS channel, and the TLS channel is used by the first virtual trusted root manager to migrate the context data of the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment.

[0099] In one possible implementation, after sending a virtual machine migration request to the controller located in the trusted domain,

[0100] The transceiver module is also used to receive remote authentication requests from the controller, which are used to determine whether the first virtual machine manager is in a trusted state.

[0101] The transceiver module is also used to send remote verification reports to the controller.

[0102] The sixth aspect of this application provides a migration apparatus for a virtual root of trust, comprising:

[0103] The transceiver module is used to receive a trusted root migration instruction from the first virtual machine. The trusted root migration instruction includes the identifier and encryption information of the second trusted execution environment. The context data of the virtual trusted root of the first virtual machine is stored in the first trusted execution environment. The first trusted execution environment is contained in the first virtual platform of the virtualization system. The second trusted execution environment is used to store the context data of the virtual trusted root of the virtual machine in the second virtual platform and the second virtual trusted root manager. The second virtual trusted root manager is used to manage the virtual trusted root of the virtual machine in the second virtual platform.

[0104] The processing module is used to migrate the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encrypted information.

[0105] In one possible implementation, the virtualization system also includes a controller located in the trusted domain;

[0106] If the encrypted information is the public key of the second trusted execution environment, then:

[0107] The processing module is also used to encrypt the virtual trusted root of the first virtual machine using the cryptographic public key of the second trusted execution environment;

[0108] The transceiver module is also used to send a first trusted root migration response to the first virtual machine; wherein, the first trusted root migration response includes the encrypted context data of the virtual trusted root of the first virtual machine and the identifier of the second trusted execution environment. The identifier of the second trusted execution environment is used to instruct the first virtual machine to send a second trusted root migration response to the second virtual trusted root manager in the second trusted execution environment through the controller. The second trusted root migration response includes the identifier of the second virtual machine and the encrypted context data of the virtual trusted root of the first virtual machine. The second virtual machine is the first virtual machine that has migrated to the second virtual platform. The encrypted context data of the virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and then stored in the second trusted execution environment.

[0109] In one possible implementation, if the encrypted information is a certificate of a second trusted execution environment, then:

[0110] The processing module is also used to establish a TLS channel based on the certificate of the second trusted execution environment, and the TLS channel is connected to the second virtual trusted root manager in the second trusted execution environment;

[0111] The transceiver module is also used to send a third trusted root migration instruction to the second virtual trusted root manager using a TLS channel. The third trusted root migration instruction includes the virtual trusted root of the first virtual machine and the identifier of the second virtual machine, where the second virtual machine is the first virtual machine that is being migrated to the second virtual platform.

[0112] In one possible implementation, the transceiver module is also used to receive a first remote authentication request from a third virtual machine in the first virtual platform;

[0113] The transceiver module is also used to obtain the virtual trusted root of the third virtual machine based on the identifier of the third virtual machine;

[0114] The transceiver module is also used to send a second remote verification request to the virtual root of trust of the third virtual machine; wherein, the second remote verification request is used to obtain the first remote verification report of the virtual root of trust of the third virtual machine;

[0115] The transceiver module is also used to send a second remote verification report to the third virtual machine; wherein, the second remote verification report includes a first remote verification report, a remote verification report of the first trusted execution environment, the certificate of the first trusted execution environment, and a remote report signature. The remote report signature is obtained by encrypting the first remote verification report and the remote verification report of the first trusted execution environment using the private key of the certificate of the first trusted execution environment. The second remote verification report is used by the trusted direction of the third virtual machine to verify the trusted status of the third virtual machine.

[0116] A seventh aspect of this application provides a migration apparatus for a virtual root of trust. The apparatus may include at least one processor, a memory, and a communication interface. The processor is coupled to the memory and the communication interface. The memory stores instructions, the processor executes the instructions, and the communication interface communicates with other devices under the control of the processor. When executed by the processor, the instructions cause the processor to perform a method of the first aspect or any possible implementation thereof.

[0117] An eighth aspect of this application provides a migration apparatus for a virtual root of trust. The apparatus may include at least one processor, a memory, and a communication interface. The processor is coupled to the memory and the communication interface. The memory stores instructions, the processor executes the instructions, and the communication interface communicates with other devices under the control of the processor. When executed by the processor, the instructions cause the processor to perform a method of the second aspect or any possible implementation thereof.

[0118] A ninth aspect of this application provides a migration apparatus for a virtual root of trust. The apparatus may include at least one processor, a memory, and a communication interface. The processor is coupled to the memory and the communication interface. The memory stores instructions, the processor executes the instructions, and the communication interface communicates with other devices under the control of the processor. When executed by the processor, the instructions cause the processor to perform a method from the third aspect or any possible implementation thereof.

[0119] The tenth aspect of this application provides a computer-readable storage medium storing one or more computer-executable instructions, wherein when the computer-executable instructions are executed by a processor, the processor performs a method as described in the first aspect or any possible implementation thereof.

[0120] The eleventh aspect of this application provides a computer-readable storage medium for storing one or more computer-executable instructions, wherein when the computer-executable instructions are executed by a processor, the processor performs a method as described in the second aspect above or any possible implementation thereof.

[0121] The twelfth aspect of this application provides a computer-readable storage medium storing one or more computer-executable instructions, wherein when the computer-executable instructions are executed by a processor, the processor performs a method as described in the third aspect above or any possible implementation thereof.

[0122] The thirteenth aspect of this application provides a computer program product that stores one or more computer-executable instructions, wherein when the computer-executable instructions are executed by a processor, the processor executes the method described in the first aspect or any possible implementation thereof.

[0123] The fourteenth aspect of this application provides a computer program product storing one or more computer-executable instructions, wherein when the computer-executable instructions are executed by a processor, the processor executes the method described in the second aspect or any possible implementation thereof.

[0124] The fifteenth aspect of this application provides a computer program product storing one or more computer-executable instructions, wherein when the computer-executable instructions are executed by a processor, the processor executes the method described in the third aspect or any possible implementation thereof.

[0125] The sixteenth aspect of this application provides a chip system including a processor for supporting a computer device in implementing the functions involved in the first aspect or any possible implementation thereof. In one possible design, the chip system may further include a memory for storing necessary program instructions and data. This chip system may be composed of chips or may include chips and other discrete devices.

[0126] The seventeenth aspect of this application provides a chip system including a processor for supporting a computer device in implementing the functions involved in the second aspect or any possible implementation thereof. In one possible design, the chip system may further include a memory for storing necessary program instructions and data. This chip system may be composed of chips or may include chips and other discrete devices.

[0127] The eighteenth aspect of this application provides a chip system including a processor for supporting a computer device in implementing the functions involved in the third aspect or any possible implementation thereof. In one possible design, the chip system may further include a memory for storing necessary program instructions and data. This chip system may be composed of chips or may include chips and other discrete devices.

[0128] The nineteenth aspect of this application provides a virtualization system, including: a controller, a first virtual machine manager, and a first virtual trusted root manager. The controller is used to execute the method of the first aspect or any possible implementation of the first aspect, the first virtual machine manager is used to execute the method of the second aspect or any possible implementation of the second aspect, and the first virtual trusted root manager is used to execute the method of the third aspect or any possible implementation of the third aspect.

[0129] The technical effects of the fourth aspect or any possible implementation of the fourth aspect, the seventh aspect, the tenth aspect, the thirteenth aspect, the sixteenth aspect, or the nineteenth aspect can be found in the first aspect or the technical effects of different possible implementations of the first aspect, and will not be repeated here.

[0130] The technical effects of the fifth aspect or any possible implementation of the fifth aspect, the eighth aspect, the eleventh aspect, the fourteenth aspect, the seventeenth aspect, or the nineteenth aspect can be found in the technical effects of the second aspect or different possible implementations of the second aspect, and will not be repeated here.

[0131] The technical effects of the sixth aspect or any possible implementation of the sixth aspect, the ninth aspect, the twelfth aspect, the fifteenth aspect, the eighteenth aspect, or the nineteenth aspect can be found in the technical effects of the third aspect or different possible implementations of the third aspect, and will not be repeated here. Attached Figure Description

[0132] Figure 1A This is a schematic diagram of the architecture of the virtualization system provided in the embodiments of this application;

[0133] Figure 1B This is another schematic diagram of the virtualization system provided in the embodiments of this application;

[0134] Figure 1C This is another schematic diagram of the virtualization system provided in the embodiments of this application;

[0135] Figure 2 This is a schematic diagram of an embodiment of the virtual trusted root migration method provided in this application;

[0136] Figure 3AThis is a schematic diagram of another embodiment of the virtual trusted root migration method provided in this application;

[0137] Figure 3B This is a schematic diagram of another embodiment of the virtual trusted root migration method provided in this application;

[0138] Figure 4A This is a schematic diagram of another embodiment of the virtual trusted root migration method provided in this application;

[0139] Figure 4B This is a schematic diagram of another embodiment of the virtual trusted root migration method provided in this application;

[0140] Figure 5A This is a schematic diagram of another embodiment of the virtual trusted root migration method provided in this application;

[0141] Figure 5B This is a schematic diagram of another embodiment of the virtual trusted root migration method provided in this application;

[0142] Figure 6 This is a schematic diagram of the structure of the virtual trusted root migration device provided in the embodiments of this application;

[0143] Figure 7 This is another schematic diagram of the virtual trusted root migration device provided in the embodiments of this application;

[0144] Figure 8 This is another schematic diagram of the virtual trusted root migration device provided in the embodiments of this application;

[0145] Figure 9 This is another schematic diagram of the virtual trusted root migration device provided in the embodiments of this application. Detailed Implementation

[0146] The embodiments of this application are described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. As those skilled in the art will recognize, with the development of technology and the emergence of new scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0147] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0148] This application provides a method for migrating a virtual root of trust, which improves the security and reliability of virtual root of trust migration during virtual machine hot migration. This application also provides corresponding apparatus, computer-readable storage media, computer program products, and virtualization systems. These will be described in detail below.

[0149] For ease of understanding, the technical terms involved in the embodiments of this application are briefly introduced below:

[0150] (1) Network element virtualization: This refers to transforming physical network element devices (such as routers, switches, firewalls, etc.) into virtual network elements through virtualization technology and running them on a general-purpose hardware platform. Virtual machine technology is the foundation of network element virtualization. It simulates multiple independent virtual environments on a general-purpose hardware platform, and each virtual environment can run one or more virtual network elements. Virtual machine technology provides abstraction and isolation of hardware resources, enabling virtual network elements to be seamlessly migrated and deployed on different hardware platforms.

[0151] (2) Virtual Machine: A virtual machine is an application of virtualization technology. It simulates a complete computer system through software, including hardware resources such as processor, memory, and disk. These virtual hardware resources are provided by the physical hardware resources of the host machine, but they are encapsulated and isolated through virtualization technology, so that each virtual machine believes that it has exclusive access to these resources.

[0152] (3) Host machine: refers to the physical server that runs virtualization software and can run multiple virtual machines. These virtual machines share the host machine's physical resources, such as processors, memory, storage, and networks. The main task of the host machine is to allocate resources and manage the virtualization software to ensure that the virtual machines can run safely and efficiently.

[0153] (4) Virtual machine manager: It is a software tool used to manage virtual machines. It can directly control and manage hardware resources such as CPU, memory, and storage, provide necessary hardware support for virtual machines, and provide a complete image of the underlying hardware to the upper layer, so that the virtual machine can run operating system and application as if using real hardware.

[0154] (5) Root of Trust: The root of trust is the source of trust for building a trusted system environment and is the foundation of trust for the entire trusted environment. It ensures that the system startup process is secure and trustworthy and provides basic security support for the operation of upper-layer application systems. In trusted computing systems, the root of trust is usually implemented as a hardware-based cryptographic chip, such as the cryptographic security chip in a TPM. It supports at least three functions: integrity measurement, storage, and reporting (remote proof), and can check other entities within the system and reliably store and output the check results.

[0155] (6) TPM: TPM is a standalone hardware module that can store keys, passwords, and digital certificates. It can be embedded in computing devices that require TPM functionality. The TPM chip can resist external software attacks and physical theft, ensuring the security of information storage. The main function of TPM is to record the integrity verification values ​​of the hardware and software modules during device startup.

[0156] (7) Virtual Root of Trust: Responsible for managing and providing trusted configuration information for virtualized network elements. It can provide virtual machines with security functions similar to a physical root of trust (TPM), such as platform authentication, integrity protection, and secure storage. The virtual root of trust implements the measurement of the hardware root of trust and the generation of measurement reports in software. A large amount of sensitive system information is stored in the virtual root of trust.

[0157] (8) TEE: Also known as Trusted Execution Environment, it is a computing environment composed of hardware and software. TEE uses hardware to isolate sensitive data and code from the operating system and other applications to prevent unauthorized access and tampering. In this way, even if the operating system or other applications are compromised, the data and code stored in the TEE remain safe. The main functions of TEE include protecting sensitive data, verifying the source and integrity of applications, and providing a trusted execution environment.

[0158] (9) In the embodiments of this application, "send" and "receive" indicate the direction of signal transmission. For example, "send information to XX" can be understood as the destination of the information being XX, which may include sending directly through the air interface or sending indirectly through the air interface by other units or modules. "Receive information from YY" can be understood as the source of the information being YY, which may include receiving directly from YY through the air interface or receiving indirectly from YY through the air interface by other units or modules. "Send" can also be understood as the "output" of the chip interface, and "receive" can also be understood as the "input" of the chip interface.

[0159] (10) The terms "system" and "network" in the embodiments of this application can be used interchangeably. "Multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, or B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the related objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, "at least one of A, B and C" includes A, B, C, AB, AC, BC or ABC. And, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of this application are used to distinguish multiple objects and are not used to limit the order, sequence, priority or importance of multiple objects.

[0160] (11) In the embodiments of this application, "instruction" may include direct instruction and indirect instruction, as well as explicit instruction and implicit instruction. The information indicated by a certain piece of information (as described below, the instruction information) is called the information to be instructed. In the specific implementation process, there are many ways to indicate the information to be instructed, such as, but not limited to, directly indicating the information to be instructed, such as the information to be instructed itself or its index. It can also indirectly indicate the information to be instructed by indicating other information, where there is an association between the other information and the information to be instructed; or it can only indicate a part of the information to be instructed, while the other parts of the information to be instructed are known or pre-agreed upon. For example, the instruction can be implemented by using a pre-agreed (e.g., protocol predefined or pre-configured) arrangement order of various information, thereby reducing the instruction overhead to a certain extent. This application does not limit the specific method of instruction. It is understood that for the sender of the instruction information, the instruction information can be used to indicate the information to be instructed, and for the receiver of the instruction information, the instruction information can be used to determine the information to be instructed.

[0161] In this application, unless otherwise specified, the same or similar parts between the various embodiments can be referred to each other. In the various embodiments of this application, and the various methods / designs / implementations within each embodiment, unless otherwise specified or logically conflicting, the terminology and / or descriptions between different embodiments and between the various methods / designs / implementations within each embodiment are consistent and can be mutually referenced. The technical features in different embodiments and the various methods / designs / implementations within each embodiment can be combined to form new embodiments, methods, or implementations based on their inherent logical relationships. The following descriptions of the embodiments of this application do not constitute a limitation on the scope of protection of this application.

[0162] The virtual trusted root migration method provided in this application embodiment can be applied to virtualization systems. Figure 1A This illustrates a typical logical architecture of a virtualization system, based on Figure 1A The virtualization system 100 includes a virtual platform 110 and a controller 140 located in a trusted domain.

[0163] The virtual platform 110 includes a virtual machine manager 120 for managing virtual machines, a trusted execution environment 200, and a hardware trusted module. The virtual machine manager 120 is responsible for launching and migrating virtual machines and virtual roots of trust. The trusted execution environment 200 includes both TEE hardware and software components, including the TEE OS. The virtual roots of trust and the virtual root of trust manager 130 are the software components of the trusted execution environment 200. The hardware trusted module is responsible for providing metrics and measurement reports for the hardware and software on the virtual platform 110.

[0164] The controller 140 is responsible for assisting the migration of the virtual root of trust across different virtual platforms 110.

[0165] The virtual trusted root migration method provided in this application embodiment is applied to Figure 1A When using the virtualization system shown, it can be as follows: Figure 1B As shown in the image.

[0166] Virtual machine manager 1201 manages virtual machines in the first virtual platform 1101, and virtual machine manager 1202 manages virtual machines in the second virtual platform 1102. The first virtual platform 1101 includes a Trusted Execution Environment 2001, which includes a Virtual Trusted Root Manager 1301. The Virtual Trusted Root Manager 1301 manages the virtual trusted roots of the virtual machines in the first virtual platform 1101. The second virtual platform 1102 includes a Trusted Execution Environment 2002, which includes a Virtual Trusted Root Manager 1302. The Virtual Trusted Root Manager 1302 manages the virtual trusted roots of the virtual machines in the second virtual platform 1102.

[0167] The controller 140 in the trusted domain is used to receive a migration request from the virtual machine manager 1201 in the first virtual platform 1101 and migrate the virtual machine from the first virtual platform 1101 to the second virtual platform 1102. The migration of the virtual machine includes the migration of the virtual trusted root of the virtual machine.

[0168] The controller 140 is responsible for sending the encrypted material of the trusted execution environment 2002 in the second virtual platform 1102 to the virtual trusted root manager 1301 in the trusted execution environment 2001 in the first virtual platform 1101.

[0169] The Virtual Trusted Root Manager 1301 is used to encrypt the virtual trusted root of the virtual machine in the first virtual platform 1101 using the cryptographic material of the Trusted Execution Environment 2002 in the second virtual platform 1102, and send it to the Virtual Trusted Root Manager 1302 of the Trusted Execution Environment 2002 in the second virtual platform 1101 through the controller 140.

[0170] The Virtual Trusted Root Manager 1302 is used to restore the virtual trusted root of the virtual machine. During the process of migrating the virtual machine of the first virtual platform 1101 to the virtual machine of the second virtual platform 1102, the virtual trusted root of the corresponding virtual machine is migrated.

[0171] The system architecture of the virtualization system provided in this application can also be as follows: Figure 1C As shown, the Trusted Controller can receive virtual machine root of trust migration instructions from the virtual machine manager in the virtual trusted platform, and assist the source virtual machine manager and the target virtual machine manager in exchanging cryptographic materials or data content of virtual machines and virtual roots of trust, thereby completing the operation of migrating virtual machines and virtual roots of trust of trust of virtual machines from one virtual trusted platform to another.

[0172] The Virtual Machine Manager is responsible for managing virtual machines within the Virtual Trusted Platform. Virtual machines can request remote authentication information from the Virtual Trusted Root. The Virtual Trusted Root Manager and the Virtual Trusted Root are configured within a Trusted Execution Environment (TEE). The Virtual Trusted Root Manager is responsible for receiving external requests, which may include creating a Virtual Trusted Root for a virtual machine, establishing a secure connection with the Trusted Controller, or establishing a secure connection with the Trusted Root Manager in another Virtual Trusted Platform's TEE and completing virtual machine migrations.

[0173] Based on the aforementioned virtualization system, the virtual trusted root migration method provided in this application includes:

[0174] S201. The first virtual machine manager sends a virtual machine migration request to the controller, and the controller receives the virtual machine migration request from the first virtual machine manager accordingly.

[0175] In this application, a virtual machine migration request is used to instruct a first virtual machine to request migration. The first virtual machine and a first virtual machine manager are contained in a first virtual platform of a virtualization system. The virtualization system also includes a first trusted execution environment, which is used to store the virtual trusted root of the virtual machine in the first virtual platform.

[0176] In this application, the controller resides within a trusted domain, which is an area where components within the domain trust each other and are securely trusted through a series of security technologies and policies. The controller can be implemented through a sub-function of the Orchestrator in the virtualization system.

[0177] In this application, the virtual machine migration type can be hot migration, which means migrating a running virtual machine from one physical server (or compute node) to another without interrupting its operation or shutting down the power. Hot migration of virtual machines can migrate overloaded virtual machines to less loaded hosts without interrupting service. The virtual machine migration process includes the migration of the virtual root of trust.

[0178] In this application, the first virtual platform can provide its own trusted proof through the physical root of trust carried by the platform.

[0179] Optionally, the virtual machine migration request may include a certificate of the first trusted execution environment (TEX). When the virtual machine migration request includes a certificate of the first TEX, the controller may send the certificate of the first TEX to the second virtual machine manager, thereby instructing the second virtual machine manager to return a certificate of the second TEX for use in establishing a TLS channel.

[0180] S202. The second virtual machine manager sends a virtual machine migration response to the controller, and the controller receives the virtual machine migration response from the second virtual machine manager accordingly.

[0181] In this application, the virtual machine migration response is sent after the second virtual machine manager confirms that the resource configuration of the first virtual machine can be satisfied. The resource configuration of the first virtual machine may include information such as the memory capacity occupied by the first virtual machine and the required processor configuration.

[0182] In this application, the virtual machine migration response is used to indicate permission for the first virtual machine to migrate to the second virtual platform. The second virtual platform includes a second virtual machine manager and a second trusted execution environment. The second trusted execution environment is used to store the virtual trusted root of the virtual machine in the second virtual platform.

[0183] In this application, the first trusted execution environment and the second trusted execution environment are TEEs. These environments provide a secure and isolated execution environment for the virtual trusted root and virtual trusted root manager of the virtual machines in the first virtual platform, as well as for the virtual trusted root and virtual trusted root manager of the virtual machines in the second virtual platform. This improves the security of the virtual trusted root of the virtual machines.

[0184] In this application, the virtual machine migration response may include cryptographic materials of the second trusted execution environment. These cryptographic materials can be either a public key or a certificate. The cryptographic materials are used to encrypt the virtual root of trust of the first virtual machine based on an encryption policy.

[0185] S203. The controller migrates the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment.

[0186] In this application, the first trusted execution environment is further used to store a first virtual trusted root manager, which manages the virtual trusted roots of virtual machines in the first virtual platform; the second trusted execution environment is further used to store a second virtual trusted root manager, which manages the virtual trusted roots of virtual machines in the second virtual platform. By setting the virtual trusted root manager and the virtual trusted roots in the trusted execution environment, the security of the virtual trusted roots of virtual machines is improved.

[0187] As described above, the solution provided in this application stores the virtual root of trust (VTR) and its corresponding VTR manager for each virtual machine in a trusted execution environment (TEA). This allows the use of cryptographic materials provided by the TEA to protect the VTR migration process, preventing data leakage due to external attacks and improving the security and reliability of the VTR migration. Furthermore, the cryptographic materials provided by the TEA help the virtual machine managers of the source and target virtual machines provide mutual authentication, reducing reliance on physical VTRs for identity verification across different physical platforms and thus improving the efficiency of VTR migration.

[0188] In one possible embodiment, the virtual machine migration request may also include the identifier of the first virtual machine;

[0189] In this application, after receiving a virtual machine migration request from the first virtual machine manager, the controller obtains the resource configuration information of the first virtual machine based on the identifier of the first virtual machine.

[0190] The resource configuration information includes at least one of the following: the memory capacity occupied by the first virtual machine, the storage space used by the first virtual machine, and the processor configuration used by the first virtual machine.

[0191] In this application, the controller determines the second virtual machine manager based on resource configuration information. The second virtual machine manager needs to meet the resource configuration information of the first virtual machine, that is, the second virtual platform where the second virtual machine manager resides needs to have sufficient memory space to set up the first virtual machine, or be able to provide sufficient storage space for the first virtual machine, or the processor configuration of the second virtual platform needs to meet the processor configuration of the first virtual machine, etc.

[0192] In this application, after determining the second virtual machine manager, the controller obtains the IP address of the first virtual machine based on the identifier of the first virtual machine, and performs remote verification on the first virtual platform where the first virtual machine manager is located and the second virtual platform where the second virtual machine manager is located, thereby determining that the first virtual platform and the second virtual platform are in a trusted state.

[0193] The controller can obtain the platform's metric value by initiating remote verification requests to the physical root of trust carried in the first and second virtual platforms, respectively, in order to determine whether the first and second virtual platforms are trustworthy.

[0194] By using the above method, the controller remotely verifies the first virtual platform where the virtual root of the source virtual machine is located and the second virtual platform where the virtual root of the target virtual machine is located before the virtual root of trust migration, thereby improving the security and reliability of the virtual root of trust migration.

[0195] In this application, the controller sends a virtual machine migration notification to the second virtual machine manager to instruct the second virtual machine manager to migrate the virtual trusted root. The virtual machine migration notification includes the identifier of the first virtual machine manager and the identifier of the first virtual machine.

[0196] In one possible embodiment, when the encryption strategy is key-based encryption, the process by which the controller migrates the virtual root of trust of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encryption strategy can be referred to [reference needed]. Figure 3A To understand, such as Figure 3A As shown, it also includes the following steps:

[0197] S301. The first virtual machine manager sends a virtual machine migration request to the controller, and the controller receives the virtual machine migration request from the first virtual machine manager.

[0198] The virtual machine migration response includes the encrypted public key of the second trusted execution environment.

[0199] S302. The second virtual machine manager sends a virtual machine migration response to the controller, and the controller receives the virtual machine migration response from the second virtual machine manager accordingly.

[0200] S303. The controller sends a first trusted root migration instruction to the first virtual machine manager.

[0201] The first trusted root migration instruction includes the identifier of the first virtual machine and the encrypted public key of the second trusted execution environment. The identifier of the first virtual machine is used to instruct the first virtual machine manager to send the second trusted root migration instruction to the first virtual trusted root manager through the first virtual machine. The second trusted root migration instruction includes the encrypted public key of the second trusted execution environment. The encrypted public key of the second trusted execution environment is used by the first virtual trusted root manager to encrypt the context data of the virtual trusted root of the first virtual machine.

[0202] In this application, the first virtual machine manager sends a first trusted root migration instruction to the corresponding first virtual machine based on the identifier of the first virtual machine. The first virtual machine sends a second trusted root migration instruction to the first virtual trusted root manager located in the first trusted execution environment.

[0203] The second trusted root migration instruction includes the cryptographic public key of the second trusted execution environment and the identifier of the second trusted execution environment.

[0204] Upon receiving the second trusted root migration instruction, the first virtual trusted root manager uses the encryption public key of the second trusted execution environment to encrypt the context data of the first virtual machine's virtual trusted root after packaging.

[0205] In this application, the context data of the virtual root of trust may include instance data of the virtual root of trust, the correspondence between virtual machines and the virtual root of trust, and the value of the Measurement Register (PCR). The core data of the virtual root of trust includes its identifier, status, configuration, and other information. This data is used to identify and verify the identity and status of the virtual root of trust, thereby ensuring the security and reliability of the virtual machine. The correspondence between the virtual machine and the virtual root of trust records the association between the virtual machine and the virtual root of trust, ensuring that the virtual machine can correctly interact and communicate with the virtual root of trust. The PCR is used to measure the trustworthiness of the virtual root of trust.

[0206] In this application, the first virtual trusted root manager sends the encrypted virtual trusted root context data of the first virtual machine to the first virtual machine manager through the first virtual machine, and then the first virtual machine manager sends it to the controller.

[0207] S304. The controller sends the first trusted root migration response to the second virtual machine manager.

[0208] The first trusted root migration response includes the encrypted context data of the virtual trusted root of the first virtual machine and the identifier of the second trusted execution environment. The identifier of the second trusted execution environment is used to instruct the second virtual machine manager to send the second trusted root migration response to the second virtual trusted root manager. The second trusted root migration response includes the identifier of the second virtual machine and the encrypted context data of the virtual trusted root of the first virtual machine. The second virtual machine is the first virtual machine that is migrated to the second virtual platform. The encrypted context data of the virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and then stored in the second trusted execution environment.

[0209] Figure 3A The migration process for the overall virtual root of trust corresponding to the illustrated embodiment can be as follows: Figure 3B As shown. See also Figure 3B The migration of the virtual root of trust includes the following steps:

[0210] S301b. The first virtual machine manager initiates a virtual machine migration request to the controller.

[0211] S302b. The controller determines the second virtual machine manager, establishes a migration context, and obtains the IP address of the first virtual machine manager.

[0212] The controller obtains the resource configuration information of the first virtual machine based on its identifier, and then determines the second virtual machine manager that meets the resource configuration information. The migration context includes the identifier of the first virtual machine.

[0213] S303b. The controller performs remote authentication of the first virtual machine manager.

[0214] The controller can remotely verify the first virtual machine manager by initiating a remote verification request to the physical root of trust of the first virtual platform where the first virtual machine manager resides.

[0215] S304b. The controller performs remote authentication of the second virtual machine manager.

[0216] The controller can remotely verify the second virtual machine manager by initiating a remote verification request to the physical root of trust of the second virtual platform where the second virtual machine manager resides.

[0217] The S305b controller sends a migration notification to the second virtual machine manager.

[0218] The migration notification includes the identifier of the first virtual machine and the identifier of the first virtual machine manager.

[0219] S306b. The second virtual machine manager sends a virtual machine migration response to the controller.

[0220] The virtual machine migration response includes the encrypted public key of the second trusted execution environment and the identifier of the second trusted execution environment.

[0221] S307b. The controller sends a first trusted root migration instruction to the first virtual machine manager.

[0222] The first trusted root migration instruction includes information such as the identifier of the first virtual machine, the encrypted public key of the second trusted execution environment, and the identifier of the second trusted execution environment.

[0223] S308b. The first virtual machine manager sends the first trusted root migration instruction to the first virtual machine.

[0224] S309b. The first virtual machine sends a second trusted root migration instruction to the first virtual trusted root manager.

[0225] S310b. The first virtual trusted root manager packages the context data of the virtual trusted root of the first virtual machine and encrypts the packaged data.

[0226] The first virtual trusted root manager uses the public key of the second trusted execution environment to encrypt the packaged data.

[0227] S311b. The first virtual trusted root manager sends a first trusted root migration response to the first virtual machine.

[0228] The first trusted root migration response includes the identifier of the second trusted execution environment.

[0229] S312b. The first virtual machine sends a first trusted root migration response to the first virtual machine manager.

[0230] S313b. The first virtual machine manager sends the first trusted root migration response to the controller.

[0231] S314b. The controller sends a first trusted root migration response to the second virtual machine manager.

[0232] S315b. The second virtual machine manager sends a second trusted root migration response to the second virtual trusted root manager.

[0233] The second virtual machine manager obtains the second virtual trusted root manager based on the identifier of the second trusted execution environment.

[0234] S316b. The second virtual trusted root manager decrypts the context data of the encrypted virtual trusted root of the first virtual machine.

[0235] The second virtual trusted root manager uses the encryption private key of the second trusted execution environment to decrypt the context data of the encrypted virtual trusted root of the first virtual machine.

[0236] S317b. The second virtual trusted root manager notifies the second virtual machine virtual trusted root that it is available.

[0237] S318b. The second virtual trusted root manager notifies the second virtual machine manager that the migration of the virtual trusted root of the second virtual machine is complete.

[0238] In this application, after receiving the first trusted root migration response, the second virtual machine manager sends the encrypted virtual trusted root context data of the first virtual machine in the first trusted root migration response to the second virtual trusted root manager in the second trusted execution environment according to the identifier of the second trusted execution environment.

[0239] The second virtual trusted root manager uses the encryption private key of the second trusted execution environment to decrypt the encrypted context data of the first virtual machine's virtual trusted root, thereby obtaining the context data of the first virtual machine's virtual trusted root.

[0240] The second virtual root of trust manager restores the context data of the virtual root of trust of the first virtual machine to the virtual root of trust of the second virtual machine, and notifies the second virtual machine and the second virtual machine manager that the migration process of the virtual root of trust is complete.

[0241] In this possible embodiment, the security of the virtual trusted root is improved when it is migrated from the first trusted execution environment to the second trusted execution environment by encrypting the context data of the virtual trusted root using the encryption public key in the second trusted execution environment. Furthermore, the encrypted context data of the virtual trusted root can only be decrypted using the encryption private key of the second trusted execution environment, which reduces the possibility of data leakage of the virtual trusted root during the migration process.

[0242] In one possible embodiment, when the encryption policy is certificate-based encryption, the process by which the controller migrates the virtual root of trust of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encryption policy can be referred to [reference needed]. Figure 4A To understand, such as Figure 4A As shown, it also includes the following steps:

[0243] S401. The first virtual machine manager sends a virtual machine migration request to the controller, and the controller receives the virtual machine migration request from the first virtual machine manager accordingly.

[0244] The virtual machine migration request also includes the certificate for the first trusted execution environment.

[0245] S402. The controller sends a migration notification to the second virtual machine manager.

[0246] The migration notification includes the certificate for the first trusted execution environment.

[0247] S403. The second virtual machine manager sends a virtual machine migration response to the controller, and the controller receives the virtual machine migration response from the second virtual machine manager accordingly.

[0248] The virtual machine migration response also includes the certificate for the second trusted execution environment.

[0249] S404. The controller sends a third trusted root migration instruction to the first virtual machine manager.

[0250] The third trusted root migration instruction includes the identifier of the first virtual machine and the certificate of the second trusted execution environment. The identifier of the first virtual machine is used to instruct the first virtual machine manager to send the fourth trusted root migration instruction to the first virtual trusted root manager through the first virtual machine. The fourth trusted root migration instruction includes the certificate of the second trusted execution environment. The certificate of the second trusted execution environment is used by the first virtual trusted root manager to establish a TLS channel. The TLS channel is used by the first virtual trusted root manager to migrate the context data of the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment.

[0251] In this application, the first virtual machine manager sends a third trusted root migration instruction to the corresponding first virtual machine based on the identifier of the first virtual machine. The first virtual machine sends a fourth trusted root migration instruction to the first virtual trusted root manager located in the first trusted execution environment.

[0252] S405. The first virtual machine manager establishes a TLS channel.

[0253] In this application, the TLS channel is an encrypted channel established based on the Transport Layer Security (TLS) protocol, used to provide confidentiality, data integrity, and authenticity between two communicating applications, thereby improving the confidentiality and integrity of the communication. The TLS channel can be authenticated through digital certificates to ensure the authenticity of the identities of both communicating parties.

[0254] In this application, the first virtual machine manager establishes a direct TLS channel between the first virtual machine manager and the second virtual machine manager based on the certificates of the first trusted execution environment and the second trusted execution environment.

[0255] S406. The first virtual machine manager uses a TLS channel to send the context data of the virtual trusted root of the first virtual machine to the second virtual machine manager.

[0256] In this application, the second virtual trusted root manager restores the context data of the virtual trusted root of the first virtual machine to the virtual trusted root of the second virtual machine, and notifies the second virtual machine and the second virtual machine manager that the migration process of the virtual trusted root is complete.

[0257] In this possible embodiment, a TLS channel is established between the first and second virtual trusted root managers using certificates in the first and second trusted execution environments. The context data of the virtual trusted root is transmitted through the TLS channel, which improves the security of the virtual trusted root when migrating from the first to the second trusted execution environment. Furthermore, the use of certificates to verify the first and second virtual trusted root managers during the establishment of the TLS channel reduces the risk of the virtual trusted root being attacked during the migration process.

[0258] Figure 4A The migration process for the overall virtual root of trust corresponding to the illustrated embodiment can be as follows: Figure 4B As shown. See also Figure 4B The migration of the virtual root of trust includes the following steps:

[0259] S401b. The first virtual machine manager initiates a virtual machine migration request to the controller.

[0260] The virtual machine migration request includes the certificate of the first trusted execution environment where the virtual trusted root of the first virtual machine is located.

[0261] S402b. The controller determines the second virtual machine manager, establishes a migration context, and obtains the IP address of the first virtual machine manager.

[0262] S403b. The controller performs remote authentication of the first virtual machine manager.

[0263] The controller can remotely verify the first virtual machine manager by initiating a remote verification request to the physical root of trust of the first virtual platform where the first virtual machine manager resides.

[0264] S404b. The controller performs remote authentication of the second virtual machine manager.

[0265] The controller can remotely verify the second virtual machine manager by initiating a remote verification request to the physical root of trust of the second virtual platform where the second virtual machine manager resides.

[0266] S405b. The controller sends a migration notification to the second virtual machine manager.

[0267] The migration notification includes the certificate for the first trusted execution environment.

[0268] S406b. The second virtual machine manager sends a migration notification to the second virtual trusted root manager.

[0269] S407b. The second virtual machine manager sends a virtual machine migration response to the controller.

[0270] The virtual machine migration response includes the certificate for the second trusted execution environment.

[0271] S408b. The controller sends a third trusted root migration instruction to the first virtual machine manager.

[0272] The third trusted root migration instruction includes the certificate of the second trusted execution environment and the identifier of the second trusted execution environment.

[0273] S409b. The first virtual machine manager sends a third trusted root migration instruction to the first virtual machine.

[0274] S410b. The first virtual machine sends a fourth trusted root migration instruction to the first virtual trusted root manager.

[0275] The fourth trusted root migration instruction includes the certificate of the second trusted execution environment and the identifier of the second trusted execution environment.

[0276] S411b. The first virtual trusted root manager packages the context data of the virtual trusted root of the first virtual machine.

[0277] S412b. The first virtual trusted root manager and the second virtual trusted root manager establish a TLS channel and mutually verify the certificates of the first trusted execution environment and the second trusted execution environment.

[0278] The first virtual trusted root manager establishes a TLS channel with the second virtual trusted root manager in the second trusted execution environment based on the identifier of the second trusted execution environment.

[0279] S413b. The first virtual trusted root manager sends the packaged virtual trusted root context data of the first virtual machine to the second virtual trusted root manager via a TLS channel.

[0280] S414b. The second virtual root of trust manager injects the context data of the virtual root of trust of the first virtual machine into the virtual root of trust of the second virtual machine.

[0281] S415b. The second virtual trusted root manager notifies the second virtual machine that the virtual trusted root is available.

[0282] S416b. The second virtual trusted root manager notifies the second virtual machine manager that the migration of the virtual trusted root of the second virtual machine is complete.

[0283] In one possible embodiment, the first virtual trusted root manager can also provide remote authentication for the virtual machine, a process which can be referred to in [reference needed]. Figure 5A To understand, such as Figure 5A As shown, it also includes the following steps:

[0284] S501. The third virtual machine sends the first remote authentication request to the first virtual trusted root manager.

[0285] In this application, if a trusted party needs to use the services provided by a third virtual machine, the trusted party can initiate a remote verification request to the third virtual machine to obtain proof of the trustworthiness of the third virtual machine. The third virtual machine forwards the remote verification request to the first virtual root of trust manager used to manage the virtual root of trust of the third virtual machine.

[0286] The first remote verification request includes the identifier of the third virtual machine.

[0287] S502. The first virtual trusted root manager sends a second remote authentication request to the virtual trusted root of the third virtual machine.

[0288] In this application, the first virtual root of trust finds the virtual root of trust corresponding to the third virtual machine based on the identifier of the third virtual machine, and sends a second remote verification request to the virtual root of trust of the third virtual machine.

[0289] S503. The virtual root of trust of the third virtual machine sends a first remote report to the first virtual root of trust manager.

[0290] In this application, the virtual trusted root of the third virtual machine sends a first remote report to the first virtual trusted root manager based on the second remote verification request.

[0291] S504. The first virtual trusted root manager sends a second remote report to the third virtual machine.

[0292] In this application, the first virtual trusted root manager can package the first remote report and its own remote report to obtain the second remote report.

[0293] The first virtual trusted root manager can also send the certificate of the first trusted execution environment and the signature obtained by calculating the second remote report using the certificate's private key to the third virtual machine.

[0294] In this application, the third virtual machine can send the received second remote report, the certificate of the first trusted execution environment, and the signature calculated by using the certificate's private key to the second remote report to the trusted party, which then sends them to the verifier to verify the identity of the third virtual machine.

[0295] The authenticator can be a dedicated server for verifying the identity of the virtual machine. After verifying the identity, the authenticator sends the verification result to the trusted party.

[0296] In this possible embodiment, when remotely verifying the identity of the virtual machine, the certificate of the first trusted execution environment can be added to the verification report as a trusted proof of the virtual machine and the platform where the virtual root of trust resides. This reduces the dependence on the physical root of trust during platform verification and improves the verification efficiency of virtual machine authentication.

[0297] Figure 5A The remote verification process for the overall virtual root of trust corresponding to the illustrated embodiment can be as follows: Figure 5B As shown. See also Figure 5B This includes the following steps:

[0298] S501b. The trusted direction sends the first remote authentication request to the third virtual machine.

[0299] S502b. The third virtual machine sends the first remote authentication request to the first virtual trusted root manager.

[0300] S503b. The first virtual root of trust management searches for the virtual root of trust of the third virtual machine.

[0301] The first virtual trusted root manager searches for the virtual trusted root of the third virtual machine based on the identifier of the third virtual machine.

[0302] S504b. The first virtual trusted root manager sends a second remote authentication request to the virtual trusted root.

[0303] S505b. The virtual root of trust sends a first remote report to the first virtual root of trust manager.

[0304] S506b. The first virtual trusted root manager generates a second remote report.

[0305] In this application, the first virtual trusted root manager packages the first remote report and the remote report local to the first virtual trusted root manager.

[0306] The second remote report includes the first remote report, the remote report of the first virtual trusted root manager itself, the certificate of the first trusted execution environment, and the signature of the packaged remote report using the private key of the certificate of the first trusted execution environment.

[0307] S507b. The first virtual trusted root manager sends the second remote report to the third virtual machine.

[0308] S508b. The third virtual machine sends the second remote report to the trusted party.

[0309] S509b. The trusting party sends a second remote report to the authenticating party.

[0310] S510b. The authenticator verifies the second remote report.

[0311] The verifier can first verify the certificate and signature of the first trusted execution environment, and then verify the remote report of the first virtual trusted root manager and the first remote report.

[0312] S511b. The authenticator sends the remote authentication result to the trusted party.

[0313] When all content in S510b passes verification, the remote verification result of the third virtual machine can be confirmed as trustworthy.

[0314] The above embodiments describe methods for migrating virtual trusted roots in a virtualization system. The following describes a virtual trusted root migration apparatus provided in the embodiments of this application, with reference to the accompanying drawings.

[0315] like Figure 6 As shown, the virtual trusted root migration device 600 provided in this application embodiment can be the controller described above. The virtual trusted root migration device 600 includes:

[0316] The transceiver unit 601 is used to receive a virtual machine migration request from a first virtual machine manager. The virtual machine migration request is used to instruct the first virtual machine to request migration. The first virtual machine and the first virtual machine manager are contained in a first virtual platform of the virtualization system. The virtualization system also includes a first trusted execution environment. The first trusted execution environment is used to store the virtual trusted root of the virtual machine in the first virtual platform.

[0317] The transceiver unit 601 is used to receive a virtual machine migration response from the second virtual machine manager. The virtual machine migration response is used to indicate that the first virtual machine is allowed to migrate into the second virtual platform. The second virtual platform includes the second virtual machine manager and the second trusted execution environment. The second trusted execution environment is used to store the virtual trusted root of the virtual machine in the second virtual platform.

[0318] The processing unit 602 is used to migrate the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encryption policy.

[0319] The solution provided in this application embodiment assists the virtual trusted root and its corresponding virtual trusted root manager stored in the Trusted Execution Environment (TEE) in exchanging encrypted materials provided by the TEE during migration. In this way, the encrypted materials provided by the TEE can be used to protect the migration of the virtual trusted root, preventing data leakage caused by external attacks during the migration process, thus improving the security and reliability of the virtual trusted root migration. Furthermore, the encrypted materials provided by the TEE can help the virtual machine manager of the source virtual machine and the virtual machine manager of the target virtual machine to provide identity verification between each other, reducing the dependence on the physical trusted root when verifying identity between different physical platforms, thereby improving the migration efficiency of the virtual trusted root.

[0320] Optionally, the first trusted execution environment is further used to store a first virtual trusted root manager, which is used to manage the virtual trusted roots of virtual machines in the first virtual platform; the second trusted execution environment is further used to store a second virtual trusted root manager, which is used to manage the virtual trusted roots of virtual machines in the second virtual platform.

[0321] Optionally, when the encryption strategy is key encryption, the virtual machine migration response includes the encryption public key of the second trusted execution environment. The transceiver unit 601 is also used to send a first trusted root migration instruction to the first virtual machine manager. The first trusted root migration instruction includes the identifier of the first virtual machine and the encryption public key of the second trusted execution environment. The identifier of the first virtual machine is used to instruct the first virtual machine manager to send the second trusted root migration instruction to the first virtual trusted root manager through the first virtual machine. The second trusted root migration instruction includes the encryption public key of the second trusted execution environment. The encryption public key of the second trusted execution environment is used by the first virtual trusted root manager to encrypt the context data of the virtual trusted root of the first virtual machine.

[0322] The transceiver unit 601 is further configured to send a first trusted root migration response to the second virtual machine manager; wherein, the first trusted root migration response includes encrypted context data of the virtual trusted root of the first virtual machine and an identifier of the second trusted execution environment, the identifier of the second trusted execution environment is used to instruct the second virtual machine manager to send a second trusted root migration response to the second virtual trusted root manager, the second trusted root migration response includes the identifier of the second virtual machine and encrypted context data of the virtual trusted root of the first virtual machine, the second virtual machine is the first virtual machine migrated to the second virtual platform, and the encrypted context data of the virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and stored in the second trusted execution environment.

[0323] Optionally, when the encryption strategy is certificate encryption, the virtual machine migration request also includes the certificate of the first trusted execution environment, and the virtual machine migration response also includes the certificate of the second trusted execution environment. The transceiver unit 601 is also used to send a third trusted root migration instruction to the first virtual machine manager. The third trusted root migration instruction includes the identifier of the first virtual machine and the certificate of the second trusted execution environment. The identifier of the first virtual machine is used to instruct the first virtual machine manager to send a fourth trusted root migration instruction to the first virtual trusted root manager through the first virtual machine. The fourth trusted root migration instruction includes the certificate of the second trusted execution environment. The certificate of the second trusted execution environment is used by the first virtual trusted root manager to establish a TLS channel. The TLS channel is used by the first virtual trusted root manager to migrate the context data of the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment.

[0324] Optionally, the virtual machine migration request may also include the identifier of the first virtual machine; after receiving the virtual machine migration request from the first virtual machine manager, the processing unit 602 is further configured to obtain the resource configuration information of the first virtual machine based on the identifier of the first virtual machine, the resource configuration information including at least one of the memory capacity occupied by the first virtual machine, the storage space size used by the first virtual machine, and the processor configuration used by the first virtual machine.

[0325] The processing unit 602 is also used to determine a second virtual machine manager based on resource configuration information.

[0326] Optionally, before receiving the virtual machine migration response from the second virtual machine manager, the transceiver unit 601 is further configured to send a remote verification request to the first virtual machine manager and the second virtual machine manager, the remote verification request being used to determine whether the first virtual machine manager and the second virtual machine manager are in a trusted state.

[0327] If both the first virtual machine manager and the second virtual machine manager are in a trusted state, the transceiver unit 601 is further configured to send a migration notification to the second virtual machine manager, the migration notification being used to instruct the first virtual machine to migrate to the second virtual platform where the second virtual machine manager resides.

[0328] The above-mentioned details regarding the transceiver unit 601 and processing unit 602 of the virtual root of trust migration device 600 can be understood by referring to the relevant content of the controller in the aforementioned method embodiment section, and will not be repeated here.

[0329] like Figure 7 As shown, the virtual trusted root migration device 700 provided in this application embodiment can be the first virtual machine manager described above. The virtual trusted root migration device 700 includes:

[0330] The transceiver unit 701 is used to send a virtual machine migration request to the controller located in the trusted domain. The virtual machine migration request is used to instruct a first virtual machine to request migration. The first virtual machine is contained in a first virtual platform. The virtualization system also includes a first trusted execution environment. The first trusted execution environment is used to store the virtual trusted root of the virtual machine in the first virtual platform.

[0331] The processing unit 702 is used to migrate the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encryption policy; the second trusted execution environment is used to store the virtual trusted root of the virtual machine in the second virtual platform.

[0332] Optionally, the first trusted execution environment is further used to store a first virtual trusted root manager, which manages the virtual trusted roots of virtual machines in the first virtual platform; the second trusted execution environment is further used to store a second virtual trusted root manager, which manages the virtual trusted roots of virtual machines in the second virtual platform, and the second virtual platform also includes a second virtual machine manager.

[0333] Optionally, when the encryption strategy is to use key encryption, the transceiver unit 701 is also used to receive a first trusted root migration indication from the controller, the first trusted root migration indication including the identifier of the first virtual machine and the encryption public key of the second trusted execution environment;

[0334] The transceiver unit 701 is also configured to send a second trusted root migration instruction to the first virtual trusted root manager through the first virtual machine based on the identifier of the first virtual machine; the second trusted root migration instruction includes the encryption public key of the second trusted execution environment, which is used by the first virtual trusted root manager to encrypt the context data of the virtual trusted root of the first virtual machine;

[0335] The transceiver unit 701 is further configured to send a first trusted root migration response to the controller; wherein, the first trusted root migration response includes encrypted context data of the virtual trusted root of the first virtual machine and an identifier of the second trusted execution environment, the identifier of the second trusted execution environment is used to instruct the second virtual machine manager to send a second trusted root migration response to the second virtual trusted root manager, the second trusted root migration response includes the identifier of the second virtual machine and encrypted context data of the virtual trusted root of the first virtual machine, the second virtual machine is the first virtual machine migrated to the second virtual platform, and the encrypted context data of the virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and stored in the second trusted execution environment.

[0336] Optionally, when the encryption strategy is to use certificate encryption, the virtual machine migration request also includes the certificate of the first trusted execution environment; the transceiver unit 701 is also used to receive a third trusted root migration instruction from the controller; wherein the third trusted root migration instruction includes the identifier of the first virtual machine and the certificate of the second trusted execution environment;

[0337] The transceiver unit 701 is further configured to send a fourth trusted root migration instruction to the first virtual trusted root manager through the first virtual machine based on the identifier of the first virtual machine; wherein the fourth trusted root migration instruction includes a certificate of the second trusted execution environment, the certificate of the second trusted execution environment is used by the first virtual trusted root manager to establish a TLS channel, and the TLS channel is used by the first virtual trusted root manager to migrate the context data of the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment.

[0338] Optionally, after sending a virtual machine migration request to the controller located in the trusted domain, the transceiver unit 701 is also configured to receive a remote verification request from the controller, the remote verification request being used to determine whether the first virtual machine manager is in a trusted state.

[0339] The transceiver unit 701 is also used to send remote verification reports to the controller.

[0340] The above-mentioned details regarding the transceiver unit 701 and processing unit 702 of the virtual root of trust migration device 700 can be understood by referring to the relevant content of the first virtual machine manager in the aforementioned method embodiment section, and will not be repeated here.

[0341] like Figure 8 As shown, the virtual trusted root migration device 800 provided in this application embodiment can be the first virtual trusted root manager described above. The virtual trusted root migration device 800 includes:

[0342] The transceiver unit 801 is used to receive a trusted root migration instruction from the first virtual machine; the trusted root migration instruction includes the identifier and encryption information of the second trusted execution environment, the virtual trusted root of the first virtual machine is stored in the first trusted execution environment, the first trusted execution environment is contained in the first virtual platform of the virtualization system, the second trusted execution environment is used to store the virtual trusted root of the virtual machine in the second virtual platform and the second virtual trusted root manager, and the second virtual trusted root manager is used to manage the virtual trusted root of the virtual machine in the second virtual platform;

[0343] The processing unit 802 is used to migrate the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encrypted information.

[0344] Optionally, the virtualization system also includes a controller located in the trusted domain; if the encrypted information is the public key of the second trusted execution environment, the processing unit 802 is further configured to encrypt the context data of the virtual trusted root of the first virtual machine using the public key of the second trusted execution environment.

[0345] The transceiver unit 801 is further configured to send a first trusted root migration response to the first virtual machine; wherein, the first trusted root migration response includes encrypted context data of the virtual trusted root of the first virtual machine and an identifier of the second trusted execution environment, the identifier of the second trusted execution environment is used to instruct the first virtual machine to send a second trusted root migration response to the second virtual trusted root manager in the second trusted execution environment through the controller, the second trusted root migration response includes the identifier of the second virtual machine and encrypted context data of the virtual trusted root of the first virtual machine, the second virtual machine is the first virtual machine migrated to the second virtual platform, and the encrypted context data of the virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and stored in the second trusted execution environment.

[0346] Optionally, if the encrypted information is a certificate of the second trusted execution environment, the processing unit 802 is further configured to establish a TLS channel based on the certificate of the second trusted execution environment, and the TLS channel is connected to the second virtual trusted root manager in the second trusted execution environment;

[0347] The transceiver unit 801 is also used to send a third trusted root migration instruction to the second virtual trusted root manager using a TLS channel. The third trusted root migration instruction includes the context data of the virtual trusted root of the first virtual machine and the identifier of the second virtual machine, wherein the second virtual machine is the first virtual machine that is migrated to the second virtual platform.

[0348] Optionally, the transceiver unit 801 is also configured to receive a first remote authentication request from a third virtual machine in the first virtual platform;

[0349] The processing unit 802 is also used to obtain the virtual trusted root of the third virtual machine based on the identifier of the third virtual machine;

[0350] The transceiver unit 801 is also used to send a second remote verification request to the virtual trusted root of the third virtual machine; wherein, the second remote verification request is used to obtain the first remote verification report of the virtual trusted root of the third virtual machine;

[0351] The transceiver unit 801 is also used to send a second remote verification report to the third virtual machine; wherein, the second remote verification report includes a first remote verification report, a remote verification report of the first trusted execution environment, a certificate of the first trusted execution environment, and a remote report signature. The remote report signature is obtained by encrypting the first remote verification report and the remote verification report of the first trusted execution environment using the private key of the certificate of the first trusted execution environment. The second remote verification report is used by the trusted direction of the third virtual machine to verify the trusted status of the third virtual machine.

[0352] The above-mentioned details regarding the transceiver unit 801 and processing unit 802 of the virtual root of trust migration device 800 can be understood by referring to the relevant content of the first virtual root of trust manager in the aforementioned method embodiment section, and will not be repeated here.

[0353] like Figure 9 The diagram shown illustrates a possible logical structure of the virtual root of trust migration device 900 described in the above embodiments of this application. The virtual root of trust migration device 900 includes a processor 901, a communication interface 902, a memory 903, and a bus 904. The processor 901, communication interface 902, and memory 903 are interconnected via the bus 904. In the embodiments of this application, the processor 901 is used to control and manage the operation of the virtual root of trust migration device 900; for example, the processor 901 is used to execute... Figures 2 to 5B The steps involved in determining the relevant information include, for example, the processing steps performed by the aforementioned controller, first virtual machine manager, or first virtual trusted root manager. The communication interface 902 is used to support communication between the virtual trusted root migration device 900 and other components. For example, the communication interface 902 can perform the receiving or sending steps described in the above method embodiments. Figure 7 , Figure 8 and Figure 9 The functions of transceiver units 701, 801, and 901 are described. Memory 903 is used to store the program code and data of the virtualization system 100.

[0354] The processor 901 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, etc. The bus 904 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0355] In another embodiment of this application, a computer-readable storage medium is also provided, which stores computer-executable instructions. When at least one processor of the device executes the computer-executable instructions, the device performs the aforementioned... Figures 2 to 5B The virtual trusted root migration method described in some embodiments.

[0356] In another embodiment of this application, a computer program product is also provided, comprising computer-executable instructions stored in a computer-readable storage medium; at least one processor of the device can read the computer-executable instructions from the computer-readable storage medium, and the at least one processor executes the computer-executable instructions to cause the device to perform the above-described actions. Figures 2 to 5B The virtual trusted root migration method described in some embodiments.

[0357] In another embodiment of this application, a chip system is also provided, the chip system including a processor for supporting the migration means of a virtual root of trust to implement the above. Figures 2 to 5B The virtual root of trust migration method is described in some embodiments. In one possible design, the chip system may further include a memory containing necessary program instructions and data for the virtual root of trust migration apparatus. This chip system may be composed of chips or may include chips and other discrete devices.

[0358] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this application.

[0359] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0360] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0361] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0362] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0363] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of this application, essentially, or the parts that contribute to the prior art, or parts of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for virtual trusted root migration, characterized in that, The method is applied to a controller of a virtualization system, the controller being located in a trusted domain, the method comprising: The system receives a virtual machine migration request from a first virtual machine manager. The virtual machine migration request is used to instruct the first virtual machine to request migration. The first virtual machine and the first virtual machine manager are contained in a first virtual platform of the virtualization system. The virtualization system also includes a first trusted execution environment, which is used to store the virtual trusted root of the virtual machine in the first virtual platform. Receive a virtual machine migration response from a second virtual machine manager, the virtual machine migration response being used to indicate that the first virtual machine is allowed to migrate into a second virtual platform, the second virtual platform including the second virtual machine manager and a second trusted execution environment, the second trusted execution environment being used to store virtual trusted roots of virtual machines in the second virtual platform; According to the encryption strategy, the virtual trusted root of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment.

2. The method according to claim 1, characterized in that, The first trusted execution environment is further used to store a first virtual trusted root manager, which is used to manage the virtual trusted roots of virtual machines in the first virtual platform; the second trusted execution environment is further used to store a second virtual trusted root manager, which is used to manage the virtual trusted roots of virtual machines in the second virtual platform.

3. The method according to claim 2, characterized in that, When the encryption strategy is to use key encryption, the virtual machine migration response includes the encryption public key of the second trusted execution environment; The step of migrating the virtual root of trust of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encryption strategy includes: Send a first trusted root migration instruction to the first virtual machine manager; wherein, the first trusted root migration instruction includes the identifier of the first virtual machine and the encryption public key of the second trusted execution environment, the identifier of the first virtual machine is used to instruct the first virtual machine manager to send a second trusted root migration instruction to the first virtual trusted root manager through the first virtual machine, the second trusted root migration instruction includes the encryption public key of the second trusted execution environment, and the encryption public key of the second trusted execution environment is used by the first virtual trusted root manager to encrypt the context data of the virtual trusted root of the first virtual machine; A first trusted root migration response is sent to the second virtual machine manager; wherein, the first trusted root migration response includes encrypted context data of the virtual trusted root of the first virtual machine and an identifier of the second trusted execution environment, the identifier of the second trusted execution environment is used to instruct the second virtual machine manager to send a second trusted root migration response to the second virtual trusted root manager, the second trusted root migration response includes an identifier of the second virtual machine and encrypted context data of the virtual trusted root of the first virtual machine, the second virtual machine is the first virtual machine migrated to the second virtual platform, and the encrypted context data of the virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and stored in the second trusted execution environment.

4. The method according to claim 2, characterized in that, When the encryption strategy is to use certificate encryption, the virtual machine migration request also includes the certificate of the first trusted execution environment, and the virtual machine migration response also includes the certificate of the second trusted execution environment; The step of migrating the virtual root of trust of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encryption strategy includes: A third trusted root migration instruction is sent to the first virtual machine manager; wherein the third trusted root migration instruction includes the identifier of the first virtual machine and the certificate of the second trusted execution environment, the identifier of the first virtual machine is used to instruct the first virtual machine manager to send a fourth trusted root migration instruction to the first virtual trusted root manager through the first virtual machine, the fourth trusted root migration instruction includes the certificate of the second trusted execution environment, the certificate of the second trusted execution environment is used by the first virtual trusted root manager to establish a TLS channel, and the TLS channel is used by the first virtual trusted root manager to migrate the context data of the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment.

5. The method according to any one of claims 1-4, characterized in that, The virtual machine migration request also includes the identifier of the first virtual machine; After receiving the virtual machine migration request from the first virtual machine manager, the process also includes: Based on the identifier of the first virtual machine, the resource configuration information of the first virtual machine is obtained. The resource configuration information includes at least one of the following: the memory capacity occupied by the first virtual machine, the storage space used by the first virtual machine, and the processor configuration used by the first virtual machine. The second virtual machine manager is determined based on the resource configuration information.

6. The method according to any one of claims 1-5, characterized in that, Before receiving the virtual machine migration response from the second virtual machine manager, the process also includes: Send a remote verification request to the first virtual machine manager and the second virtual machine manager, the remote verification request being used to determine whether the first virtual machine manager and the second virtual machine manager are in a trusted state; If both the first virtual machine manager and the second virtual machine manager are in a trusted state, a migration notification is sent to the second virtual machine manager. The migration notification is used to instruct the first virtual machine to migrate to the second virtual platform where the second virtual machine manager is located.

7. A method for virtual trusted root migration, characterized in that, The method is applied to a first virtual machine manager of a virtualization system, the first virtual machine manager being located on a first virtual platform of the virtualization system, the method comprising: A virtual machine migration request is sent to a controller located in a trusted domain. The virtual machine migration request is used to instruct a first virtual machine to request migration. The first virtual machine is contained in the first virtual platform. The virtualization system also includes a first trusted execution environment, which is used to store the virtual trusted root of the virtual machine in the first virtual platform. According to the encryption strategy, the virtual trusted root of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment; the second trusted execution environment is used to store the virtual trusted root of the virtual machine in the second virtual platform.

8. The method according to claim 7, characterized in that, The first trusted execution environment is further used to store a first virtual trusted root manager, which is used to manage the virtual trusted roots of virtual machines in the first virtual platform; the second trusted execution environment is further used to store a second virtual trusted root manager, which is used to manage the virtual trusted roots of virtual machines in the second virtual platform, and the second virtual platform further includes a second virtual machine manager.

9. The method according to claim 8, characterized in that, When the encryption strategy is to use key encryption The step of migrating the virtual root of trust of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encryption strategy includes: Receive a first trusted root migration indication from the controller, the first trusted root migration indication including the identifier of the first virtual machine and the cryptographic public key of the second trusted execution environment; Based on the identifier of the first virtual machine, a second trusted root migration instruction is sent to the first virtual trusted root manager through the first virtual machine; the second trusted root migration instruction includes the encryption public key of the second trusted execution environment, which is used by the first virtual trusted root manager to encrypt the context data of the virtual trusted root of the first virtual machine; A first trusted root migration response is sent to the controller; wherein the first trusted root migration response includes encrypted context data of the virtual trusted root of the first virtual machine and an identifier of the second trusted execution environment, the identifier of the second trusted execution environment is used to instruct the second virtual machine manager to send a second trusted root migration response to the second virtual trusted root manager, the second trusted root migration response includes an identifier of the second virtual machine and encrypted context data of the virtual trusted root of the first virtual machine, the second virtual machine is the first virtual machine migrated to the second virtual platform, and the encrypted context data of the virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and stored in the second trusted execution environment.

10. The method according to claim 8, characterized in that, When the encryption strategy is to use certificate encryption, the virtual machine migration request also includes the certificate of the first trusted execution environment; The step of migrating the virtual root of trust of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encryption strategy includes: Receive a third trusted root migration instruction from the controller; wherein the third trusted root migration instruction includes the identifier of the first virtual machine and the certificate of the second trusted execution environment; Based on the identifier of the first virtual machine, a fourth trusted root migration instruction is sent to the first virtual trusted root manager through the first virtual machine; wherein, the fourth trusted root migration instruction includes the certificate of the second trusted execution environment, the certificate of the second trusted execution environment is used by the first virtual trusted root manager to establish a TLS channel, and the TLS channel is used by the first virtual trusted root manager to migrate the context data of the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment.

11. The method according to any one of claims 7-10, characterized in that, Following the sending of the virtual machine migration request to the controller located in the trusted domain, the process also includes: Receive a remote verification request from the controller, the remote verification request being used to determine whether the first virtual machine manager is in a trusted state; Send a remote verification report to the controller.

12. A method for virtual trusted root migration, characterized in that, The method is applied to a first virtual trusted root manager of a virtualization system, the first virtual trusted root manager being located in a first trusted execution environment, the method comprising: The system receives a trusted root migration instruction from a first virtual machine. The trusted root migration instruction includes the identifier and encryption information of a second trusted execution environment. The virtual trusted root of the first virtual machine is stored in the first trusted execution environment. The first trusted execution environment is contained in the first virtual platform of the virtualization system. The second trusted execution environment is used to store the virtual trusted root of the virtual machine in the second virtual platform and the second virtual trusted root manager. The second virtual trusted root manager is used to manage the virtual trusted root of the virtual machine in the second virtual platform. According to the encrypted information, the virtual trusted root of the first virtual machine is migrated from the first trusted execution environment to the second trusted execution environment.

13. The method according to claim 12, characterized in that, The virtualization system also includes a controller located in the trusted domain; If the encrypted information is the public key of the second trusted execution environment, then the step of migrating the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encrypted information includes: The context data of the virtual trusted root of the first virtual machine is encrypted using the public key of the second trusted execution environment; A first trusted root migration response is sent to the first virtual machine; wherein, the first trusted root migration response includes encrypted context data of the virtual trusted root of the first virtual machine and an identifier of the second trusted execution environment, the identifier of the second trusted execution environment is used to instruct the first virtual machine to send a second trusted root migration response to the second virtual trusted root manager in the second trusted execution environment through the controller, the second trusted root migration response includes the identifier of the second virtual machine and encrypted context data of the virtual trusted root of the first virtual machine, the second virtual machine is the first virtual machine migrated to the second virtual platform, and the encrypted context data of the virtual trusted root of the first virtual machine is decrypted by the second virtual trusted root manager using the encryption private key of the second trusted execution environment and stored in the second trusted execution environment.

14. The method according to claim 12, characterized in that, If the encrypted information is a certificate of the second trusted execution environment, then the step of migrating the virtual trusted root of the first virtual machine from the first trusted execution environment to the second trusted execution environment according to the encrypted information includes: A TLS channel is established based on the certificate of the second trusted execution environment, and the TLS channel is connected to the second virtual trusted root manager in the second trusted execution environment; The third trusted root migration instruction is sent to the second virtual trusted root manager using the TLS channel. The third trusted root migration instruction includes the context data of the virtual trusted root of the first virtual machine and the identifier of the second virtual machine, wherein the second virtual machine is the first virtual machine that has been migrated to the second virtual platform.

15. The method according to any one of claims 12-14, characterized in that, The method further includes: Receive a first remote verification request from the third virtual machine in the first virtual platform; The virtual trusted root of the third virtual machine is obtained based on the identifier of the third virtual machine; Send a second remote verification request to the virtual root of trust of the third virtual machine; wherein the second remote verification request is used to obtain a first remote verification report of the virtual root of trust of the third virtual machine; Send a second remote verification report to the third virtual machine; wherein the second remote verification report includes the first remote verification report, the remote verification report of the first trusted execution environment, the certificate of the first trusted execution environment, and a remote report signature. The remote report signature is obtained by encrypting the first remote verification report and the remote verification report of the first trusted execution environment using the private key of the certificate of the first trusted execution environment. The second remote verification report is used by the trusted direction verifier of the third virtual machine to verify the trusted status of the third virtual machine.

16. A migration device for a virtual root of trust, characterized in that, Includes a processor and a computer-readable storage medium storing a computer program; The processor is coupled to the computer-readable storage medium, and the computer program, when executed by the processor, implements the method as described in any one of claims 1-15.

17. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program instructions that, when executed, cause the method as described in any one of claims 1 to 15 to be performed.

18. A computer program product containing program instructions, characterized in that, When the program instructions are executed on a computer, the computer causes the computer to perform the method as described in any one of claims 1 to 15.

Images