Starting method and device, storage medium and computer program product

Abstract

The invention provides a starting method and device, a storage medium and a computer program product. The method comprises the following steps: before an encryption component of the confidential virtual machine is started, calling an authentication component to execute authentication verification, after the authentication verification succeeds, obtaining a secret key of the encryption component from trusted equipment, and / or decrypting the encryption component based on the secret key, so as to continue to start the confidential virtual machine; wherein the integration operation of the authentication component is executed before the encryption component is started.

Description

Technical Field

[0001] This application relates to security technology, and more particularly to a startup method and apparatus, storage medium, and computer program product. Background Technology

[0002] A Confidential Virtual Machine (CVM) is a virtual machine that runs in a hardware-protected Trusted Execution Environment (TEE). It is designed to provide users with a secure computing environment, ensuring the confidentiality and integrity of running workloads and their data, protecting them from arbitrary reading or modification by the host machine and high-privilege software and hardware (such as the hypervisor, virtual machine monitor, host operating system, hardware with Direct Memory Access (DMA), etc.).

[0003] Currently, the CVM encrypted image authentication boot scheme is usually implemented by using programs or scripts built into the initial memory file system (initramfs) or by modifying the bootloader. This results in the inability to simultaneously satisfy the confidentiality and universality of encrypted image authentication boot. Summary of the Invention

[0004] This application provides a booting method and apparatus, a storage medium, and a computer program product.

[0005] The technical solution of this application is implemented as follows: In a first aspect, this application proposes a startup method, the method comprising: Before starting the encryption component of the confidential virtual machine, the authentication component is invoked to perform authentication verification, obtain the key of the encryption component from a trusted device after successful authentication verification, and / or decrypt the encryption component based on the key, so as to continue starting the confidential virtual machine; wherein, the integration operation of the authentication component is performed before the encryption component starts.

[0006] Secondly, this application proposes a startup device, which includes a processor, a memory, and a communication bus; the processor executes the running program stored in the memory to implement the above-mentioned startup method.

[0007] Thirdly, this application proposes a storage medium on which a computer program is stored, which, when executed by a processor, implements the above-described startup method.

[0008] Fourthly, this application proposes a computer program product, including a computer program that implements the above-described startup method when executed by a processor.

[0009] The embodiments of this application have the following beneficial effects: a new authentication component is proposed, which is integrated before the encryption component is started. This authentication component can realize the authentication and startup of encrypted images for different encryption components of confidential virtual machines. The authentication component includes, but is not limited to, authentication verification functions and encryption and decryption functions. Before the startup of different encryption components, the authentication component can be called to realize the authentication verification, key acquisition and / or decryption process. While maintaining the original structure of the confidential virtual machine, it can be customized to meet the settings of different encryption components corresponding to different encryption levels, thereby simultaneously satisfying the confidentiality and universality of encrypted image authentication and startup. Attached Figure Description

[0010] Figure 1 A flowchart illustrating a startup method provided in an embodiment of this application; Figure 2 A structural diagram of an exemplary authentication component provided in an embodiment of this application; Figure 3 An exemplary architecture design diagram of an authentication component provided for embodiments of this application; Figure 4 A flowchart illustrating an exemplary confidential virtual machine encryption method provided in this application embodiment. Figure 1 ; Figure 5 A flowchart illustrating an exemplary confidential virtual machine encryption method provided in this application embodiment. Figure 2 ; Figure 6 A flowchart illustrating an exemplary confidential virtual machine encryption method provided in this application embodiment. Figure 3 ; Figure 7 A schematic diagram of the structure of a starting device provided in an embodiment of this application. Figure 1 ; Figure 8 A schematic diagram of the structure of a starting device provided in an embodiment of this application. Figure 2 .

[0011] It should be noted that the terms "first" and "second" mentioned above are only used to distinguish between different options and do not represent the degree of superiority or inferiority of the options or their priority in the implementation process. Detailed Implementation

[0012] In order to gain a more detailed understanding of the features and technical content of the embodiments of this application, the implementation of the embodiments of this application will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for reference and illustration only and are not intended to limit the embodiments of this application.

[0013] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0014] In the following description, references to "some embodiments" refer to a subset of all possible embodiments. It is understood that "some embodiments" may be the same or different subsets of all possible embodiments and may be combined with each other without conflict. It should also be noted that the terms "first, second, third" used in the embodiments of this application are merely for distinguishing similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0015] The confidential virtual machine uses the Remote Attestation (RA) mechanism to prove its legitimacy and security to a trusted device. After verification by the trusted device, it obtains the key of the corresponding encrypted image and decrypts it, and then starts the system, thereby ensuring the confidentiality and legitimacy of the system startup process. The above process is called the authentication startup of the confidential virtual machine encrypted image.

[0016] Currently, in common confidential virtual machine encrypted image authentication boot schemes, the system kernel (including kernel command-line parameters) and initramfs are stored in plaintext, while only the root file system (root volume) is stored in encrypted form. The confidential virtual machine boots the kernel via a bootloader (e.g., Grub) and mounts the initramfs. Then, a program or script built into the initramfs uses the RA mechanism to obtain the key for the encrypted root file system image file from a trusted device. Finally, it decrypts and mounts the file system, thus completing the system boot process.

[0017] However, the above scheme has a flaw in terms of confidentiality. It requires that the system kernel (including kernel command-line arguments) and the initramfs image file must be stored in plaintext, meaning any entity with access to the system can directly read these contents. It only protects the integrity of system components such as the kernel through measures, so users cannot store confidential information in system components such as the kernel, thus failing to protect confidentiality. This obviously weakens the security guarantee of confidential virtual machines.

[0018] To address the issue of storing the system kernel image file in plaintext in the aforementioned technologies, another solution is proposed: modifying the bootloader to add support for confidential computing. This primarily includes adding network protocol stack functionality, acquiring and processing RA reports, and encryption / decryption algorithms. Before the bootloader loads the operating system kernel, it obtains the key for an encrypted image file containing the kernel, initramfs, and root filesystem from a trusted source via the RA mechanism. The encrypted image is then decrypted and loaded before the subsequent system boot process is executed.

[0019] However, the above solution lacks versatility. It requires significant modifications to the bootloader itself to support the remote authentication and encryption / decryption functions needed for confidential computing technologies. These functions are unnecessary in non-confidential virtual machine scenarios. The coupling of these new functions with the bootloader greatly increases the bootloader's code complexity. Furthermore, if the system only needs to decrypt a separate encrypted image of the initramfs or root filesystem during startup, this solution cannot be supported because it only operates at the bootloader level.

[0020] To address the aforementioned problems, embodiments of this application provide a startup method, such as... Figure 1 As shown, the method may include: S101. Before starting the encryption component of the confidential virtual machine, the authentication component is invoked to perform authentication verification, obtain the key of the encryption component from the trusted device after successful authentication verification, and / or decrypt the encryption component based on the key, so as to continue starting the confidential virtual machine; wherein, the integration operation of the authentication component is performed before the encryption component starts.

[0021] The startup method proposed in this application is applicable to the authentication startup scenario of a confidential virtual machine encrypted image.

[0022] In one embodiment, the authentication component is compiled into the confidential virtual machine when deploying the confidential virtual machine environment.

[0023] In one embodiment, a general authentication component is designed, which can be integrated with the bootloader or system kernel according to user needs. Its main function is to provide encrypted image authentication boot capability for confidential virtual machines. It can select the image components within the confidential virtual machine that need to be encrypted, then integrate the authentication component before the encrypted component boots. It uses its ability to perform RA (Reliability Analysis) with a trusted party to obtain the key, and its decryption capability to decrypt the image of the encrypted component, thereby securely and conveniently executing the authenticated boot of the confidential virtual machine.

[0024] In one embodiment, the authentication component comprises the following parts, see [link to documentation]. Figure 2This includes: Remote Attestation (RA), encryption / decryption algorithms, user signature, and an architecture adaptation layer. RA authentication primarily generates RA reports required for confidential computing and supports remote connections to trusted parties to obtain key information. The encryption / decryption part mainly supports multiple encryption / decryption algorithms for decrypting encrypted image components. The main encryption / decryption algorithms include the Rivest-Shamir-Adleman Algorithm (RSA), Advanced Encryption Standard (AES), the SM1 block cipher algorithm, and the SM2 elliptic curve public-key cryptography algorithm, etc. The specific algorithm is selected based on the actual situation, and this application does not impose specific limitations. The user signature part mainly supports user-injected signatures for subsequent RA verification. The architecture adaptation section is mainly used to adapt to the hardware architecture of different confidential virtual machines, such as Intel Trust Domain Extensions (Intel TDX), AMD Secure Encrypted Virtualization (AMD SEV), and Hygon Secure Virtualization (CSV), to support the representation of confidential virtual machine integrity metrics in RA reports.

[0025] It should be noted that RA is a mechanism through which a confidential virtual machine can provide encrypted and verifiable evidence to a remote trusted device (such as a user, regulator, or other service) to prove its identity, configuration integrity, and operating environment security, thereby gaining the trust of the remote trusted device to operate the confidential virtual machine.

[0026] It should be noted that the authentication component features an innovative architectural design, enabling it to integrate with system components such as the bootloader and operating system (OS) kernel. (See [link to relevant documentation]). Figure 3When the authentication component needs to be integrated with the bootloader, its code is compiled into an authentication component, which is then integrated as a lightweight system kernel between the bootloader and the OS kernel. The bootloader first starts the authentication component, which then completes the RA verification process and obtains the key to the encrypted OS kernel image. Finally, it decrypts the encrypted image and loads the OS kernel. This design transforms the one-stage boot process from bootloader to OS kernel into a two-stage boot process from bootloader to authentication module to OS kernel. When the authentication component needs to be integrated with the OS kernel, its code is compiled into an authentication component and integrated as a kernel module. By utilizing a series of hook functions added to the OS kernel to call the authentication component, it can intercept the OS kernel's boot process. For example, it can jump to the authentication component before the critical file system mount, where it completes the RA verification process, obtains the encrypted file system image key, decrypts the encrypted file system image, and completes the file system mount and subsequent boot process.

[0027] In one embodiment, the encryption component is an encrypted system kernel, and the authentication component is integrated between the bootloader of the confidential virtual machine and the encrypted system kernel.

[0028] In one embodiment, the system kernel can be the OS kernel of a confidential virtual machine.

[0029] In one embodiment, the authentication component can be integrated as a lightweight system kernel, independent of the OS kernel, within the confidential virtual machine's bootloader and the encrypted OS kernel.

[0030] Based on the above embodiments, the process of calling the authentication component to perform authentication verification, obtaining the key of the encryption component from the trusted device after successful authentication verification, and / or decrypting the encryption component based on the key includes: loading the authentication component using a bootloader; performing authentication verification using the authentication component, obtaining the key of the encrypted system kernel from the trusted device after successful authentication verification, and / or decrypting the encrypted system kernel based on the key.

[0031] Furthermore, after the process of calling the authentication component to perform authentication verification, obtaining the key of the encryption component from the trusted device after successful authentication verification, and / or decrypting the encryption component based on the key, the authentication component is used to load and run the decrypted system kernel, so as to continue the startup process of the confidential virtual machine using the system kernel.

[0032] It should be noted that for certain confidential virtual machines, the system kernel may be customized, containing confidential information such as special algorithms and data. In this scenario, the original one-stage boot process of loading and starting the system kernel by the bootloader is extended to a two-stage process. In the first stage, the bootloader loads the authentication component, which generates a RA report and obtains the encrypted image key of the system kernel containing user privacy data from a trusted device. After decryption, the second stage begins, where the authentication component loads and runs the system kernel. See also... Figure 4 The bootloader in the CVM firmware is executed to complete hardware initialization, system booting and main program loading. After that, the bootloader loads the authentication component. The authentication component obtains the key of the encrypted image of the OS kernel from the trusted device through the RA report. The authentication component decrypts and runs the OS kernel. The OS kernel mounts the initramfs and the root file system.

[0033] In another embodiment, the encryption component is an encrypted file system, and the authentication component is integrated into the system kernel, which includes hook functions.

[0034] It should be noted that the authentication component can be integrated into the system kernel as a kernel module.

[0035] Based on the above embodiments, the process of calling the authentication component to perform authentication verification before starting the encryption component of the confidential virtual machine, obtaining the key of the encryption component from the trusted device after successful authentication verification, and / or decrypting the encryption component based on the key includes: calling the authentication component using a hook function before the system kernel starts to a preset stage and the encrypted file system is mounted; using the authentication component to perform authentication verification, obtaining the key of the encrypted file system from the trusted device after successful authentication verification, and / or decrypting the encrypted file system based on the key.

[0036] It should be noted that the preset stage can be a certain stage before the file system is mounted. The specific stage can be selected according to the actual situation. This application embodiment does not make specific limitations.

[0037] Furthermore, after calling the authentication component to perform authentication verification, obtaining the key of the encryption component from the trusted device after successful authentication verification, and / or decrypting the encryption component based on the key, the decrypted file system is mounted, and the startup process of the confidential virtual machine is continued using the system kernel.

[0038] It should be noted that the system kernel used by the user may be based on an open-source community version, while the file system is custom-designed and may store confidential data or drivers. In this scenario, an authentication component can be inserted between the system kernel and the file system using hook functions. When the system kernel boots to a preset stage and is about to mount the file system, the authentication component can be called through the hook function inserted in the system kernel. The authentication component generates a RA report and requests the key for the encrypted image of the trusted device file system, as well as the key to decrypt the encrypted image of the file system. The initramfs can be directly decrypted into memory, while the root file system can be fully decrypted using Linux's dm-crypt mechanism. Finally, the system kernel continues with the subsequent confidential virtual machine boot process. See also Figure 5 The bootloader in the CVM firmware starts the OS kernel. The OS kernel uses hook functions to call the authentication component. The authentication component obtains the keys for the encrypted images of the initramfs and root filesystem from the trusted device through the RA report. The authentication component decrypts the initramfs and mounts the decrypted initramfs. Then, the authentication component decrypts the root filesystem, mounts the decrypted root filesystem, and uses the OS kernel to continue the boot process of the confidential virtual machine. It should be noted that... Figure 5 This is one scenario where both initramfs and the root file system are encrypted. Other scenarios, such as encrypting initramfs, encrypting the root file system, or encrypting other file systems, also fall within the protection scope of this application's embodiments, and will not be elaborated upon here.

[0039] In this embodiment, the file system includes, but is not limited to, at least one of the following: an initial memory file system and a root file system. Specifically, any combination of the above file systems can be encrypted, such as encrypting the initial memory file system, encrypting the root file system, or encrypting both the initial memory file system and the root file system. The specific choice can be made according to the actual situation, and this embodiment does not impose any specific limitations.

[0040] In another embodiment, the encryption component is an encrypted system kernel and an encrypted file system, and the authentication component includes a first authentication component and a second authentication component. The first authentication component is integrated between the bootloader and the encrypted system kernel, and the second authentication component is integrated within the encrypted system kernel.

[0041] Based on the above embodiments, the specific startup method may include: loading a first authentication component using a bootloader; performing authentication verification using the first authentication component, obtaining a first key for the encrypted system kernel from a trusted device after successful authentication verification, and / or decrypting the encrypted system kernel based on the first key to obtain the system kernel; calling a second authentication component using a hook function of the system kernel; performing authentication verification using the second authentication component, obtaining a second key for the encrypted file system from a trusted device after successful authentication verification, and / or decrypting the encrypted file system based on the second key; mounting the decrypted file system, and executing the subsequent startup process of the confidential virtual machine using the system kernel.

[0042] It should be noted that if it is necessary to ensure the confidentiality of both the system kernel and the file system simultaneously, both can be encrypted. First, the bootloader loads the authentication component and decrypts the system kernel. Then, it loads the decrypted system kernel and uses kernel hook functions to load and call the authentication component, thereby decrypting and mounting the encrypted file system. Finally, the system kernel continues with the subsequent boot process. See also... Figure 6 The bootloader in the CVM firmware is executed to complete hardware initialization, system booting, and main program loading. Then, the bootloader loads the first authentication component, which obtains the key for the encrypted image of the OS kernel from the trusted device through the RA report. The first authentication component decrypts and runs the OS kernel. The OS kernel uses hook functions to call the second authentication component. The second authentication component obtains the key for the encrypted image of the initramfs and root file system from the trusted device through the RA report. The authentication component decrypts the initramfs and mounts the decrypted initramfs. Then, the authentication component decrypts the root file system, mounts the decrypted root file system, and uses the OS kernel to continue the boot process of the confidential virtual machine.

[0043] It should be noted that the first authentication component and the second authentication component share the same authentication component code for compilation. However, the first authentication component acts as a lightweight system kernel between the bootloader and the system kernel, while the second authentication component acts as a module within the system kernel.

[0044] Understandably, a new authentication component has been proposed. This component is integrated before the encryption component starts, enabling authentication and startup of encrypted images for different encryption components of the confidential virtual machine. This authentication component includes, but is not limited to, authentication verification and encryption / decryption functions. Before starting different encryption components, this component can be invoked to perform authentication verification, key acquisition, and / or decryption processes. While maintaining the original structure of the confidential virtual machine, it can be customized to meet the settings of different encryption components corresponding to different encryption levels. It supports flexible configuration of the image files of components that require authentication and decryption startup for the confidential virtual machine. Thus, it can simultaneously satisfy the confidentiality and universality of encrypted image authentication startup.

[0045] This application provides a starting device. For example... Figure 7 As shown, the starting device 1 includes: Calling unit 10 is used to call the authentication component to perform authentication verification, obtain the key of the encryption component from the trusted device after successful authentication verification, and / or decrypt the encryption component based on the key before starting the encryption component of the confidential virtual machine, so as to continue starting the confidential virtual machine; wherein, the integration operation of the authentication component is performed before the encryption component starts.

[0046] Optionally, the encryption component is an encrypted system kernel, and the authentication component is integrated between the bootloader of the confidential virtual machine and the encrypted system kernel.

[0047] Optionally, the startup device further includes: a loading unit and a running unit; The loading unit is used to load the authentication component using the bootloader; The calling unit 10 is also used to perform authentication verification using the authentication component, obtain the key of the encrypted system kernel from the trusted device after successful authentication verification, and / or decrypt the encrypted system kernel based on the key. The loading unit and the running unit are used to load and run the decrypted system kernel using the authentication component, so as to continue the startup process of the confidential virtual machine using the system kernel.

[0048] Optionally, the encryption component is an encrypted file system, and the authentication component is integrated into the system kernel, which includes hook functions.

[0049] Optionally, the starting device further includes: a mounting unit and a starting unit; The calling unit 10 is used to call the authentication component using the hook function before the system kernel starts to a preset stage and the encrypted file system is mounted; and to perform authentication verification using the authentication component, obtain the key of the encrypted file system from the trusted device after successful authentication verification, and / or decrypt the encrypted file system based on the key. The mounting unit is used to mount the decrypted file system; The startup unit is used to continue the startup process of the confidential virtual machine using the system kernel.

[0050] Optionally, the encryption component is an encrypted system kernel and an encrypted file system, and the authentication component includes a first authentication component and a second authentication component. The first authentication component is integrated between the bootloader and the encrypted system kernel, and the second authentication component is integrated into the encrypted system kernel. The loading unit is further configured to load the first authentication component using the bootloader; The calling unit 10 is further configured to perform authentication verification using the first authentication component, obtain the first key of the encrypted system kernel from the trusted device after successful authentication verification, and / or decrypt the encrypted system kernel based on the first key to obtain the system kernel; call the second authentication component using the hook function of the system kernel; and perform authentication verification using the second authentication component, obtain the second key of the encrypted file system from the trusted device after successful authentication verification, and / or decrypt the encrypted file system based on the second key. The mounting unit is also used to mount the decrypted file system; The startup unit is also used to execute the startup process of the confidential virtual machine using the system kernel.

[0051] Optionally, the file system includes, but is not limited to, at least one of the following: the initial memory file system and the root file system.

[0052] This application provides a startup device that, before starting the encryption component of a confidential virtual machine, invokes an authentication component to perform authentication verification, obtains the encryption component's key from a trusted device after successful authentication verification, and / or decrypts the encryption component based on the key, in order to continue starting the confidential virtual machine; wherein, the integration operation of the authentication component is performed before the encryption component starts. Therefore, the startup device proposed in this embodiment introduces a new authentication component integrated before the encryption component starts, enabling encrypted image authentication startup for different encryption components of the confidential virtual machine. This authentication component includes, but is not limited to, authentication verification functions and encryption / decryption functions. Before starting different encryption components, the authentication component can be invoked to perform authentication verification, key acquisition, and / or decryption processes. While maintaining the original structure of the confidential virtual machine, it can be customized to meet the settings of different encryption components corresponding to different encryption levels, thereby simultaneously satisfying the confidentiality and universality of encrypted image authentication startup.

[0053] Figure 8 This is a schematic diagram of the composition of a starting device 1 provided in an embodiment of this application. In practical applications, based on the same disclosed concept of the above embodiments, such as... Figure 8 As shown, the startup device 1 in this embodiment includes a processor 11, a memory 12, and a communication bus 13.

[0054] The processor 11 described above can be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), CPU, controller, microcontroller, and microprocessor. It is understood that, for different devices, the electronic device used to implement the above processor function can also be other types, and this embodiment does not specifically limit it.

[0055] In this embodiment, the communication bus 13 is used to realize the connection communication between the processor 11 and the memory 12; when the processor 11 executes the running program stored in the memory 12, it implements the following startup method: Before starting the encryption component of the confidential virtual machine, the authentication component is invoked to perform authentication verification, obtain the key of the encryption component from a trusted device after successful authentication verification, and / or decrypt the encryption component based on the key, so as to continue starting the confidential virtual machine; wherein, the integration operation of the authentication component is performed before the encryption component starts.

[0056] Furthermore, the encryption component is an encrypted system kernel, and the authentication component is integrated between the bootloader of the confidential virtual machine and the encrypted system kernel.

[0057] Furthermore, the processor 11 is also used to load the authentication component using the bootloader; perform authentication verification using the authentication component, obtain the key of the encrypted system kernel from the trusted device after successful authentication verification, and / or decrypt the encrypted system kernel based on the key; load and run the decrypted system kernel using the authentication component, so as to continue the startup process of the confidential virtual machine using the system kernel.

[0058] Furthermore, the encryption component is an encrypted file system, and the authentication component is integrated into the system kernel, which includes hook functions.

[0059] Furthermore, the processor 11 is also configured to: call the authentication component using the hook function before the system kernel boots to a preset stage and mounts the encrypted file system; perform authentication verification using the authentication component; obtain the key of the encrypted file system from a trusted device after successful authentication verification; and / or decrypt the encrypted file system based on the key; mount the decrypted file system; and continue the boot process of the confidential virtual machine using the system kernel.

[0060] Furthermore, the encryption component comprises an encrypted system kernel and an encrypted file system, and the authentication component includes a first authentication component and a second authentication component. The first authentication component is integrated between the bootloader and the encrypted system kernel, and the second authentication component is integrated within the encrypted system kernel. The processor 11 described above is further configured to: load the first authentication component using the bootloader; perform authentication verification using the first authentication component, obtain the first key of the encrypted system kernel from the trusted device after successful authentication verification, and / or decrypt the encrypted system kernel based on the first key to obtain the system kernel; call the second authentication component using the hook function of the system kernel; perform authentication verification using the second authentication component, obtain the second key of the encrypted file system from the trusted device after successful authentication verification, and / or decrypt the encrypted file system based on the second key; mount the decrypted file system, and execute the subsequent startup process of the confidential virtual machine using the system kernel.

[0061] Furthermore, the file system includes, but is not limited to, at least one of the following: an initial memory file system and a root file system.

[0062] This application provides a storage medium storing a computer program thereon. The computer-readable storage medium stores one or more programs, which can be executed by one or more processors and applied in a boot device. The computer program implements the boot method described above.

[0063] Based on the above embodiments, this application provides a computer program product, including a computer program that can be executed by one or more processors, and the computer program implements the startup method described above.

[0064] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0065] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause an image display device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this disclosure.

[0066] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A startup method, characterized in that, The method includes: Before starting the encryption component of the confidential virtual machine, the authentication component is invoked to perform authentication verification, obtain the key of the encryption component from a trusted device after successful authentication verification, and / or decrypt the encryption component based on the key, so as to continue starting the confidential virtual machine; wherein, the integration operation of the authentication component is performed before the encryption component starts.

2. The method according to claim 1, characterized in that, The encryption component is an encrypted system kernel, and the authentication component is integrated between the bootloader of the confidential virtual machine and the encrypted system kernel.

3. The method according to claim 2, characterized in that, The process of invoking the authentication component to perform authentication verification, obtaining the key of the encryption component from the trusted device after successful authentication verification, and / or decrypting the encryption component based on the key includes: The authentication component is loaded using the bootloader. The process of using the authentication component to perform authentication verification, obtaining the key of the encrypted system kernel from the trusted device after successful authentication verification, and / or decrypting the encrypted system kernel based on the key; Following the steps of invoking the authentication component to perform authentication verification, obtaining the key of the encryption component from the trusted device after successful authentication verification, and / or decrypting the encryption component based on the key, the method further includes: The authentication component is used to load and run the decrypted system kernel, so as to continue the startup process of the confidential virtual machine using the system kernel.

4. The method according to claim 1, characterized in that, The encryption component is an encrypted file system, and the authentication component is integrated into the system kernel, which includes hook functions.

5. The method according to claim 4, characterized in that, The process of calling the authentication component to perform authentication verification before starting the encryption component of the confidential virtual machine, obtaining the key of the encryption component from the trusted device after successful authentication verification, and / or decrypting the encryption component based on the key includes: Before the system kernel boots to a preset stage and performs encrypted file system mounting, the authentication component is called using the hook function; The process of using the authentication component to perform authentication verification, obtaining the key of the encrypted file system from a trusted device after successful authentication verification, and / or decrypting the encrypted file system based on the key; Following the steps of invoking the authentication component to perform authentication verification, obtaining the key of the encryption component from the trusted device after successful authentication verification, and / or decrypting the encryption component based on the key, the method further includes: The decrypted file system is mounted, and the system kernel is used to continue the startup process of the confidential virtual machine.

6. The method according to claim 1, characterized in that, The encryption component comprises an encrypted system kernel and an encrypted file system. The authentication component includes a first authentication component and a second authentication component. The first authentication component is integrated between the bootloader and the encrypted system kernel, and the second authentication component is integrated within the encrypted system kernel. The method further includes: The first authentication component is loaded using the bootloader; The process involves using the first authentication component to perform authentication verification, obtaining the first key of the encrypted system kernel from the trusted device after successful authentication verification, and / or decrypting the encrypted system kernel based on the first key to obtain the system kernel. The second authentication component is invoked using a hook function in the system kernel; The process of using the second authentication component to perform authentication verification, obtaining the second key of the encrypted file system from the trusted device after successful authentication verification, and / or decrypting the encrypted file system based on the second key; The decrypted file system is mounted, and the system kernel is used to execute the subsequent startup process of the confidential virtual machine.

7. The method according to any one of claims 4-6, characterized in that, The file system includes, but is not limited to, at least one of the following: the initial memory file system and the root file system.

8. A starting device, characterized in that, The starting device includes a processor, a memory, and a communication bus; when the processor executes the running program stored in the memory, it implements the method as described in any one of claims 1-7.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images