A trusted virtual machine security file sharing method and system

Abstract

The application discloses a kind of trusted virtual machine security file sharing method and system, and key service module is equipped in trusted virtual machine, shared file system is equipped and installs security application program, and file sharing service module for communicating with trusted virtual machine is equipped in external system, method includes file data write-in, and steps are as follows: application program mounts shared file system, and carries out the system call of writing file or appending file;Shared file system carries out the block according to the offset required to write in current write-in file data, calculates the digest value of each file data block after block, obtains signature key from key service module and signs the digest value, forms file metadata;Shared file system sends shared file and file metadata to the file sharing service module of external system together, and the shared file and file metadata received by file sharing service are actually stored.This application can ensure the integrity of trusted virtual machine shared file data.

Description

Technical Field

[0001] This invention relates to the field of data file processing technology, specifically to a trusted virtual machine secure file sharing method and system. Background Technology

[0002] With the development of computer technology and privacy computing, trusted virtual machine technology based on pKVM and DICE security mechanisms provides a secure and isolated execution environment, demonstrating its flexibility and efficiency in the field of privacy computing. Data generated by such trusted virtual machines during runtime is stored in isolated runtime memory.

[0003] For runtime data results of secure applications within a trusted virtual machine, if persistent storage is required, the secure application within the virtual machine must consider the integrity protection of the stored data during the application development phase. This stored data inevitably needs to share storage space with external general-purpose systems. If the shared data is only a small amount, it is easy to fully verify and use it in its own isolated runtime memory. Furthermore, the digest and signature calculation process during persistent storage is relatively efficient, has minimal impact on performance, and ensures data security.

[0004] However, if a large amount of data (such as feature data required for biometric authentication, digital rights management related data, etc.) needs to be shared and stored in a trusted virtual machine, it needs to be stored as a large file on the disk. Performing the same integrity verification on the entire large file in this case will significantly impact program performance. However, sacrificing the integrity protection of the large file for performance reasons will make the shared file data susceptible to tampering by external general systems, leading to security risks when the trusted virtual machine uses this shared file data for secure computation. This makes secure applications vulnerable to attacks and threatens the internal security of the trusted virtual machine's isolated execution environment. Existing virtual machine file sharing technologies, such as 9pfs or virtual disks, do not address these security risks. Therefore, for the integrity and security of shared data files in a trusted virtual machine, a dedicated security mechanism is needed to implement specific protection for the storage and use of shared data files. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a trusted virtual machine secure file sharing method and system that addresses the above-mentioned problems in the prior art, so as to provide an efficient security mechanism to protect the integrity of the shared file data of the trusted virtual machine while efficiently sharing large data files.

[0006] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A secure file-sharing method using a trusted virtual machine, wherein the trusted virtual machine is equipped with a key service module, a shared file system, and several security applications installed, and an external general-purpose host system is equipped with a file-sharing service module that communicates with the trusted virtual machine, the method including file data writing, and the steps are as follows: The application mounts a shared file system and makes system calls to write or append files. The shared file system divides the currently written file data into blocks according to the required write offset, calculates a digest value for each block of file data, obtains a signing key from the key service module, and signs the digest value to form file metadata; The shared file system sends the shared files and file metadata to the file sharing service module of the external general host system, which then stores the received shared files and file metadata.

[0007] Furthermore, after calculating the digest value for each data block of the divided file, the process also includes: The shared file system creates a new Merkle tree or updates an existing one based on the digest values ​​of each file's data blocks; When signing the digest value, the root value of the digest Merkle tree is specifically signed.

[0008] Furthermore, the steps for generating the signature key are as follows: Based on the trusted boot of the trusted virtual machine, the key service derives the required key through the trusted service component using the trusted root or secret seed. The trusted service component uses the secret seed value of the composite device identifier (CDI) of the current trusted computing base (TCB) to derive the key.

[0009] Furthermore, the specific components of the file metadata include: The shared file system generates file metadata in a custom format, including filename, file size, digest Merkle tree offset, digest Merkle tree, signature information, and other necessary information.

[0010] Furthermore, the method also includes file data reading, with the following steps: The application mounts the shared file system and makes system calls to read files; The shared file system communicates with the file sharing service of the external general system based on the read offset bits to obtain shared file data blocks and file metadata; The shared file system performs signature verification on the file metadata. If the signature verification fails, the read operation returns a failure message. If the signature verification passes, the file integrity is further verified. If the integrity verification fails, the read operation returns a failure message. If the integrity verification passes, the data block content read by the application is returned.

[0011] Furthermore, verifying file integrity specifically includes: Confirm whether the digest value of the Merkle tree of the shared file data block was generated by this trusted virtual machine. If so, read the digest information chain of the required data block in the Merkle tree, including the link from the root to the corresponding leaf node. Integrity checks on data blocks are performed using a chain of digest information, including digest value checks from the Merkle tree root to the leaf nodes.

[0012] A trusted virtual machine secure file sharing system, the system being applied to a trusted virtual machine secure file sharing method, the system comprising: A key service module and a shared file system are located in a trusted virtual machine, and a file sharing service module is located in an external general-purpose host system that communicates with the trusted virtual machine; The key service module is based on the trusted startup process and trusted root of the trusted virtual machine and is used to generate the keys required for cryptographic algorithms. The shared file system is based on a virtual file system and is used to provide data verification during file read and write operations for security applications, as well as to transmit shared files and file metadata with external general host systems; The file sharing service is based on a virtual machine communication mechanism, which is used by external general-purpose host systems to obtain shared file data from a trusted virtual machine and complete the actual file access process.

[0013] Furthermore, the shared file system includes: a transmission connection module, a file operation module, a file verification module, and a password algorithm module; The transmission connection module is used to connect to the file sharing service in the external communication system, initiate a connection to the specified VSOCK service port, complete the sending and receiving of shared file data and file metadata according to the communication agreement, and interact with the file operation module. The file operation module is used to complete the creation, opening, reading and writing operations of files or directories required by the user-space file system, and to embed verification operations during the file or directory operation process. The file verification module provides the necessary function calls for verification. Through signature, signature verification, and digest calculation, it performs integrity calculations on each data block of the shared file to form the corresponding file metadata. The cryptographic algorithm module provides the necessary signature algorithm, digest algorithm, and cryptographic algorithm encapsulation library, and uses the key provided by the key service module to complete the signing or verification when the signature algorithm is called.

[0014] Furthermore, the file sharing service module includes: a transmission service module and an access service module; The transmission service module is used to provide VSOCK communication on the external communication system side, listen for service on a specified port, wait for the trusted virtual machine to connect, and transfer data with the shared file system in the trusted virtual machine after the connection is successful. At the same time, the data obtained from the trusted virtual machine is handed over to the access service module for processing. The access service module is used to implement the actual storage and retrieval of shared file data. On the one hand, the access service module stores the shared file data and file metadata obtained by the transmission service module from the trusted virtual machine. On the other hand, the access service module provides the stored shared file data and file metadata to the transmission service module, which then sends them to the trusted virtual machine for further calculation.

[0015] Furthermore, both the shared file system and the file sharing service module use the VSOCK communication protocol stack to implement data transmission.

[0016] Compared with the prior art, the advantages of the present invention are as follows: This invention achieves trusted writing and secure storage of shared files by introducing a key service module, a shared file system, and a secure application within a trusted virtual machine. When the application performs a file write operation, the file data is divided into blocks by offset and a digest is calculated. Simultaneously, the trusted key service module signs the digest, generating verifiable file metadata, ensuring data integrity and source credibility. Since the signing operation is completed within the trusted virtual machine, it effectively prevents external hosts or potential attackers from tampering with the shared file content or forging write requests, improving the security and trustworthiness of file sharing across virtualization environments. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of a trusted virtual machine secure file sharing system according to an embodiment of the present invention.

[0018] Figure 2 This is a flowchart illustrating the file data writing process in an embodiment of the present invention.

[0019] Figure 3 This is a flowchart illustrating the file data reading process in an embodiment of the present invention. Detailed Implementation

[0020] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0021] Existing confidential virtual machines (VMs) primarily propose implementation methods and secure usage methods based on them. They typically employ third-party TEEs (Trusted Application Environments) to implement VMs and rely on hardware-based confidentiality protection. Furthermore, existing file-sharing technologies between VMs and external host systems lack any security considerations, requiring applications within the VM to address secure sharing issues independently. If each secure application within a trusted VM implements its own secure sharing mechanism to ensure the integrity of shared files, it leads to problems such as reinventing the wheel and increasing the attack surface of secure applications' TCBs (Trusted Content Blocks).

[0022] Example 1 like Figure 1 As shown in this embodiment, the trusted virtual machine secure file sharing method includes a trusted virtual machine equipped with a key service module, a shared file system, and several security applications installed. An external general-purpose host system has a file sharing service module that communicates with the trusted virtual machine. The method includes writing file data (e.g., ...). Figure 2 (As shown), the steps are as follows: The application mounts a shared file system and makes system calls to write or append files. The shared file system divides the currently written file data into blocks according to the required write offset, calculates a digest value for each block of file data, obtains a signing key from the key service module, and signs the digest value to form file metadata; The shared file system sends the shared files and file metadata to the file sharing service module of the external general host system, which then stores the received shared files and file metadata.

[0023] In this embodiment, after calculating the digest value of each file data block after segmentation, the method further includes: The shared file system creates a new Merkle tree or updates an existing one based on the digest values ​​of each file's data blocks; When signing the digest value, the root value of the digest Merkle tree is specifically signed.

[0024] In this embodiment, the steps for generating the signature key are as follows: Based on the trusted boot of the trusted virtual machine, the key service derives the required key through the trusted service component using the trusted root or secret seed. The trusted service component uses the secret seed value of the composite device identifier (CDI) of the current trusted computing base (TCB) to derive the key.

[0025] In this embodiment, forming file metadata specifically includes: The shared file system generates file metadata in a custom format, including filename, file size, digest Merkle tree offset, digest Merkle tree, signature information, and other necessary information.

[0026] In specific application embodiments, the method of this embodiment fully utilizes the characteristics of Merkle trees, performing security verification only on the data block that needs to be read or written. Compared to the verification process of the entire file, this greatly reduces the performance overhead caused by large file data verification. The core of the read and write steps lies in using Merkle trees to form corresponding read and write steps. The steps for security applications to write data using a shared file system are as follows (corresponding to...). Figure 2 ): S1. The application mounts a shared file system; S2. Application calls system calls such as writing to or appending to files; S3. The shared file system divides the currently written file data into blocks according to the required write offset; S4. The shared file system uses a digest algorithm to calculate a digest value for each file's data block; S5. The shared file system creates a new Merkle tree or updates an existing one based on the digest values ​​of each file's data blocks; S6. The shared file system obtains the signing key from the key service; S7. The shared file system uses a signing key to sign the digest Merkle tree root value; S8. The shared file system generates file metadata in a custom format, including filename, file size, digest Merkle tree offset, digest Merkle tree, signature information, and other necessary information. S9. The shared file system sends shared files and file metadata to the file sharing service of an external general system; S10. The file sharing service will actually store the received shared files and file metadata.

[0027] In this embodiment, the method further includes file data reading, with the following steps: The application mounts the shared file system and makes system calls to read files; The shared file system communicates with the file sharing service of the external general system based on the read offset bits to obtain shared file data blocks and file metadata; The shared file system performs signature verification on the file metadata. If the signature verification fails, the read operation returns a failure message. If the signature verification passes, the file integrity is further verified. If the integrity verification fails, the read operation returns a failure message. If the integrity verification passes, the data block content read by the application is returned.

[0028] In this embodiment, verifying file integrity specifically includes: Confirm whether the digest value of the Merkle tree of the shared file data block was generated by this trusted virtual machine. If so, read the digest information chain of the required data block in the Merkle tree, including the link from the root to the corresponding leaf node. Integrity checks on data blocks are performed using a chain of digest information, including digest value checks from the Merkle tree root to the leaf nodes.

[0029] In a specific application embodiment, the steps for a security application to read data using a shared file system are as follows (corresponding to...). Figure 3 ): T1. The application mounts a shared file system; T2. The application invokes a system call to read a file; T3. The shared file system communicates with the file sharing service of the external general system based on the read offset bits to obtain shared file data blocks and file metadata; T4. The shared file system performs signature verification on file metadata; T5. If the signature verification fails, this read will return a failure message. T6. If the signature verification passes, confirming that the digest value of the Merkle tree was generated by this trusted virtual machine, then read the digest information chain of the required data block in the Merkle tree, including the link from the root to the corresponding leaf node; T7. Use the data block's digest information chain to perform integrity verification on the data block, including digest value verification from the Merkle tree root to the leaf node; T8. If the integrity check fails, the read operation will return a failure message. T9. If the integrity check passes, return the data block content read by the application.

[0030] As can be understood, this embodiment uses a Merkle tree to record the digest values ​​of shared file data blocks and employs a unique key within the trusted virtual machine to sign and authenticate them. This achieves transparent integrity verification during file storage and retrieval operations performed by secure applications using the shared file system. On one hand, for secure applications within the trusted virtual machine, this reduces code intrusion into the application development process while simultaneously ensuring integrity protection during data file sharing. The Merkle tree design also makes the verification process for reading large shared files more efficient. On the other hand, for regular applications using shared files externally, this facilitates their use of the shared file data even when the trusted virtual machine is not running, while also ensuring the security of the shared file usage during subsequent operation of the trusted virtual machine.

[0031] The method in this embodiment is geared towards trusted virtual machines. Trusted virtual machines are based on pKVM and DICE security mechanisms to ensure their trusted boot and secure isolated execution environment. They do not need to rely on third-party TEE systems and can provide integrity protection for trusted virtual machines during file sharing storage without hardware-provided confidentiality protection.

[0032] Example 2 like Figure 1 As shown, the trusted virtual machine secure file sharing system of this embodiment is applied to the method described in Embodiment 1. The system includes: A key service module and a shared file system are located in a trusted virtual machine, and a file sharing service module is located in an external general-purpose host system that communicates with the trusted virtual machine; The key service module is based on the trusted startup process and trusted root of the trusted virtual machine and is used to generate the keys required by cryptographic algorithms (such as signature key pairs). The shared file system is based on a virtual file system (VFS) and is used to provide data verification during file read and write operations for security applications, as well as to transmit shared files and file metadata with external general host systems; The file sharing service is based on a virtual machine communication mechanism, which is used by external general-purpose host systems to obtain shared file data from a trusted virtual machine and complete the actual file access process.

[0033] In specific application embodiments, based on the trusted boot of the trusted virtual machine, the key service module derives the required keys, such as the key pairs required for signature algorithms, through the trusted service component using trusted roots or secret seeds. Preferably, the trusted boot of the trusted virtual machine implements the secure boot process of the virtual machine according to the DICE (Device Identity Composition Engine) security standard mechanism. The trusted service component can then use the CDI (Compound Device Identifier) ​​secret seed value of the current Trusted Computing Base (TCB) to derive the key. In this case, the trusted service component is deeply bound to the DICE security mechanism.

[0034] The shared file system is based on a virtual file system. By implementing the open, read, and write interfaces of the fuse user-space file system, it has the ability to protect integrity during the process of reading and writing shared files, and achieves transparent verification during the process of secure applications handling shared file data.

[0035] In this embodiment, the shared file system includes: a transmission connection module, a file operation module, a file verification module, and a password algorithm module; The transmission connection module is used to connect to the file sharing service in the external communication system, initiate a connection to the specified VSOCK service port, and complete the sending and receiving of shared file data and file metadata according to the communication agreement, as well as the interaction with the file operation module; the communication agreement can be a custom communication protocol or a binder interface call encapsulation, or other optional custom rules; The file operation module is used to complete the creation, opening, reading and writing operations of files or directories required by the user-space file system, and to embed verification operations during the file or directory operation process. The file verification module provides the necessary function calls for verification. It performs integrity calculations on each data block of the shared file through methods such as signing, signature verification, and digest calculation, forming corresponding file metadata. The file metadata is used to store the file size, the Merkle tree required for integrity calculation, the Merkle tree storage location offset, the Merkle tree signature value, and other necessary file information. The cryptographic algorithm module provides a library of cryptographic algorithms such as signature algorithms and digest algorithms, and uses the key provided by the key service module to complete the signing or verification when the signature algorithm is called.

[0036] In this embodiment, the file sharing service module includes: a transmission service module and an access service module; The transmission service module is used to provide VSOCK communication on the external communication system side, listen for service on a specified port, wait for the trusted virtual machine to connect, and transfer data with the shared file system in the trusted virtual machine after the connection is successful. At the same time, the data obtained from the trusted virtual machine is handed over to the access service module for processing. The access service module is used to implement the actual storage and retrieval of shared file data. The stored shared files can be read and used by regular applications. On the one hand, the access service module stores the shared file data and file metadata obtained by the transmission service module from the trusted virtual machine. On the other hand, it provides the stored shared file data and file metadata to the transmission service module, which then sends them to the trusted virtual machine for further calculation.

[0037] In this embodiment, both the shared file system and the file sharing service module use the VSOCK communication protocol stack to implement data transmission. The shared file system uses the VSOCK communication protocol stack to transmit data with the external communication system, acting as a client to connect to the VSOCK communication server in the external communication system. The file sharing service uses the VSOCK communication protocol stack to complete the shared file data transmission between the external communication system and the trusted virtual machine.

[0038] It is understood that the secure file sharing system in this embodiment provides a transparent integrity protection read / write interface for trusted applications in a trusted virtual machine to securely share files. During development, trusted applications do not need to worry about how to ensure data integrity during the reading and writing of shared files, or how to ensure that shared files have not been tampered with, thus protecting the confidential virtual machine and trusted virtual machine from a series of security risks caused by data tampering. They only need to read and write files normally to ensure the integrity and security of the shared files.

[0039] The present invention can implement all or part of the processes in the methods of the above embodiments, or it can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of the above method embodiments. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. Computer-readable media include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. The memory is used to store computer programs and / or modules. The processor implements various functions by running or executing the computer programs and / or modules stored in the memory, and by calling data stored in the memory. The memory may include high-speed random access memory, as well as non-volatile memory, such as hard disks, RAM, plug-in hard disks, smart media cards (SMC), secure digital (SD) cards, flash cards, at least one disk storage device, flash memory device, or other volatile solid-state storage devices.

[0040] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for secure file sharing in a trusted virtual machine, characterized in that, The trusted virtual machine includes a key service module, a shared file system, and several security applications. The external general-purpose host system has a file-sharing service module that communicates with the trusted virtual machine. The method includes file data writing, with the following steps: The application mounts a shared file system and makes system calls to write or append files. The shared file system divides the currently written file data into blocks according to the required write offset, calculates a digest value for each block of file data, obtains a signing key from the key service module, and signs the digest value to form file metadata; The shared file system sends the shared files and file metadata to the file sharing service module of the external general host system, which then stores the received shared files and file metadata.

2. The trusted virtual machine secure file sharing method according to claim 1, characterized in that, After calculating the digest value for each data block of the divided file, the following is also included: The shared file system creates a new Merkle tree or updates an existing one based on the digest values ​​of each file's data blocks; When signing the digest value, the root value of the digest Merkle tree is specifically signed.

3. The trusted virtual machine secure file sharing method according to claim 1, characterized in that, The steps for generating the signature key are as follows: Based on the trusted boot of the trusted virtual machine, the key service derives the required key through the trusted service component using the trusted root or secret seed. The trusted service component uses the secret seed value of the composite device identifier (CDI) of the current trusted computing base (TCB) to derive the key.

4. The trusted virtual machine secure file sharing method according to claim 1, characterized in that, The specific metadata generated for a file includes: The shared file system generates file metadata in a custom format, including filename, file size, digest Merkle tree offset, digest Merkle tree, signature information, and other necessary information.

5. The trusted virtual machine secure file sharing method according to claim 1, characterized in that, The method also includes file data reading, with the following steps: The application mounts the shared file system and makes system calls to read files; The shared file system communicates with the file sharing service of the external general system based on the read offset bits to obtain shared file data blocks and file metadata; The shared file system performs signature verification on the file metadata. If the signature verification fails, the read operation will return a failure message. If the signature verification passes, the file integrity is further verified. If the integrity verification fails, the read operation returns a failure message. If the integrity verification passes, the data block content read by the application is returned.

6. The trusted virtual machine secure file sharing method according to claim 5, characterized in that, Verifying file integrity specifically includes: Confirm whether the digest value of the Merkle tree of the shared file data block was generated by this trusted virtual machine. If so, read the digest information chain of the required data block in the Merkle tree, including the link from the root to the corresponding leaf node. Integrity checks on data blocks are performed using a chain of digest information, including digest value checks from the Merkle tree root to the leaf nodes.

7. A trusted virtual machine secure file sharing system, wherein the system is applied to the method described in any one of claims 1-5, characterized in that, The system includes: A key service module and a shared file system are located in a trusted virtual machine, and a file sharing service module is located in an external general-purpose host system that communicates with the trusted virtual machine; The key service module is based on the trusted startup process and trusted root of the trusted virtual machine and is used to generate the keys required for cryptographic algorithms. The shared file system is based on a virtual file system and is used to provide data verification during file read and write operations for security applications, as well as to transmit shared files and file metadata with external general host systems; The file sharing service is based on a virtual machine communication mechanism, which is used by external general-purpose host systems to obtain shared file data from a trusted virtual machine and complete the actual file access process.

8. The trusted virtual machine secure file sharing system according to claim 7, characterized in that, The shared file system includes: a transmission connection module, a file operation module, a file verification module, and a password algorithm module; The transmission connection module is used to connect to the file sharing service in the external communication system, initiate a connection to the specified VSOCK service port, complete the sending and receiving of shared file data and file metadata according to the communication agreement, and interact with the file operation module. The file operation module is used to complete the creation, opening, reading and writing operations of files or directories required by the user-space file system, and to embed verification operations during the file or directory operation process. The file verification module provides the necessary function calls for verification. Through signature, signature verification, and digest calculation, it performs integrity calculations on each data block of the shared file to form the corresponding file metadata. The cryptographic algorithm module provides the necessary signature algorithm, digest algorithm, and cryptographic algorithm encapsulation library, and uses the key provided by the key service module to complete the signing or verification when the signature algorithm is called.

9. The trusted virtual machine secure file sharing system according to claim 7, characterized in that, The file sharing service module includes: a transmission service module and an access service module; The transmission service module is used to provide VSOCK communication on the external communication system side, listen for service on a specified port, wait for the trusted virtual machine to connect, and transfer data with the shared file system in the trusted virtual machine after the connection is successful. At the same time, the data obtained from the trusted virtual machine is handed over to the access service module for processing. The access service module is used to implement the actual storage and retrieval of shared file data. On the one hand, the access service module stores the shared file data and file metadata obtained by the transmission service module from the trusted virtual machine. On the other hand, the access service module provides the stored shared file data and file metadata to the transmission service module, which then sends them to the trusted virtual machine for further calculation.

10. The trusted virtual machine secure file sharing system according to any one of claims 7-9, characterized in that, Both the shared file system and the file sharing service module use the VSOCK communication protocol stack to implement data transmission.

Images