Apparatus for state-based switching of embedded virtual trusted environments and method thereof
The state-based embedded virtual trust environment switching device addresses the limitations of static Root of Trust systems by dynamically switching between virtual trust environments, integrating with external analysis, and rolling back to previous states, ensuring continuous operation and timely threat response.
Patent Information
- Authority / Receiving Office
- KR · KR
- Patent Type
- Patents
- Current Assignee / Owner
- COONTEC CO LTD
- Filing Date
- 2026-04-02
- Publication Date
- 2026-07-29
AI Technical Summary
Conventional security systems in embedded devices struggle to dynamically respond to new threats or security policy changes during runtime, leading to service interruptions and increased recovery times, especially in real-time systems, due to static Root of Trust structures and limitations in integrating with external threat analysis systems.
A state-based embedded virtual trust environment switching device that dynamically switches between virtual trust environments using state information, allowing for continuous operation by creating a standby environment with a new Root of Trust image and verifying its feasibility before activation, with the option to roll back to a previous environment if necessary, and integrating with external analysis systems for adaptive security.
Enables flexible and rapid response to security threats without system restarts, reduces transition delays, and enhances stability and reliability by managing environment transitions systematically and adaptively, ensuring continuous operation and timely threat response.
Smart Images
Figure 112026040409391-PAT00001_ABST
Abstract
Description
Technology Field
[0001] The present invention relates to embedded security technology, and more specifically, to a state-based embedded virtual trust environment switching device and method that dynamically switches a plurality of virtual trust environments based on state information. Background Technology
[0002] Embedded devices are utilized in various fields, including vehicles, industrial equipment, IoT devices, security terminals, and various control systems. Consequently, security technologies are critically required to ensure reliability throughout the booting process and execution environment. To this end, technologies have traditionally been widely used to establish a Root of Trust (RoT) based on Secure Boot or a Trusted Execution Environment (TEE), thereby ensuring boot integrity and the reliability of the execution environment.
[0003] However, conventional security systems are generally configured based on a static Root of Truth (RoT) structure, which limits their ability to respond immediately to new threats or security policy changes occurring during runtime. For example, even if anomalies or threats are detected in a running system, the existing structure makes it difficult to switch to a new security environment reflecting these changes in real time; consequently, the system relies on responding only in a limited manner while maintaining the current environment or on resetting the entire system.
[0004] In particular, responding to threats by methods such as system rebooting, firmware reinstallation, or environment initialization can lead to service interruptions and increased recovery times, posing a problem that makes it difficult to apply to systems requiring real-time processing. While such approaches may be permissible for general information processing systems, they can act as a critical limitation for embedded or control systems that require continuous operation and immediacy.
[0005] On the other hand, while existing virtualization technology offers the advantage of isolating and operating multiple execution environments, there is a possibility of failure in responding to actual threats due to the environment creation, initialization, boot times, and transition delays required to switch to a new virtualization environment. Furthermore, if the time required for creating and verifying a new environment is inconsistent, it is difficult to predict the total transition time, which can cause greater problems in real-time systems.
[0006] Furthermore, many conventional systems are limited to performing security actions based on internal policies or predefined rules, and often lack sufficient integration with external SIEM (Security Information and Event Management) systems, AI-based threat analysis systems, or advanced security analysis platforms. Consequently, there is a problem in that the latest threat information or external analysis results cannot be rapidly reflected in the execution environment, and the ability to respond to evolving threats is limited. The problem to be solved
[0007] According to one embodiment, a state-based embedded virtual trust environment switching device and method are proposed, which determine whether a standby virtual trust environment can be activated based on state information even while a currently active virtual trust environment is running, dynamically switch to a standby virtual trust environment reflecting a new RoT image, and roll back to the immediately preceding active environment or a recoverable previous environment in the event of an abnormal state.
[0008] In addition, it provides an adaptive security architecture capable of continuously performing threat analysis, response, and environment reconfiguration by linking sensor data and execution events collected during execution with an external analysis system. means of solving the problem
[0009] A state-based embedded virtual trust environment switching device according to one embodiment includes: an external interface unit that receives a new Root of Trust (RoT) image from an external analysis system; a state record unit that stores information regarding a currently active virtual trust environment, state information of a standby virtual trust environment, rollback reference information for a previous virtual trust environment, and a history of switching virtual trust environments; a virtual trust environment creation and switching unit that creates a standby virtual trust environment, configures a standby virtual trust environment reflecting the new RoT image, and performs a switching between the standby virtual trust environment and the active virtual trust environment or a rollback to the previous virtual trust environment; and a virtual trust environment control unit connected to the external interface unit, the state record unit, and the virtual trust environment creation and switching unit, which determines whether the standby virtual trust environment can be activated based on the state information of the virtual trust environment stored in the state record unit even while the currently active virtual trust environment is running, and switches the standby virtual trust environment to a new active virtual trust environment if it is determined that activation is possible.
[0010] The above status record can store information regarding the currently active virtual trust environment, status information of the standby virtual trust environment, the transition history of the virtual trust environment, the error history, and rollback reference information for the previous virtual trust environment.
[0011] The virtual trust environment creation and switching unit above performs a preliminary verification on a standby virtual trust environment reflecting the new RoT image, and the preliminary verification can check at least one of whether the new virtual trust environment can be executed normally, compatibility, resource status, whether there is a resource conflict, whether the security function operates normally, and whether there is a service impact.
[0012] The state of the above virtual trust environment may have any one of the following states: ready state, start state, verification state, execution state, transition state, and error state.
[0013] The virtual trust environment control unit performs the operation, verification, execution, switching, or recovery procedure of a new virtual trust environment based on the current state of the virtual trust environment stored in the state record unit, and determines whether to activate the standby virtual trust environment if the current state is a state in which the standby virtual trust environment can be activated, and the virtual trust environment creation and switching unit can deactivate or remove the existing currently activated virtual trust environment after switching the standby virtual trust environment to a new activated virtual trust environment.
[0014] The virtual trust environment control unit manages the state of the new active virtual trust environment step by step even after the standby virtual trust environment is switched to the new active virtual trust environment, and in the event of an abnormal operation or transition to an error state, determines whether to perform a rollback to the previous active virtual trust environment or the recoverable previous virtual trust environment based on rollback reference information regarding the previous active virtual trust environment or the recoverable previous virtual trust environment stored in the state record unit, and the virtual trust environment creation and switching unit can perform a rollback to the previous virtual trust environment.
[0015] The virtual trust environment creation and transition unit provides at least one of the creation completion status, the result of reflecting the new RoT image, the result of pre-verification, whether the environment transition was successful, or the result of a rollback to the virtual trust environment control unit as a result of processing the environment creation request, and the virtual trust environment control unit may determine whether to perform a subsequent transition procedure or a recovery procedure based on the processing result.
[0016] A state-based embedded virtual trust environment switching device may further include a monitoring and evidence logging unit that collects and records sensor data and execution events from an activated virtual trust environment.
[0017] The above monitoring and evidence recording unit records sensor data and execution events collected in an activated virtual trust environment as raw data, and the virtual trust environment control unit extracts data to be analyzed from the raw data, sorts and structures the data to be analyzed to generate refined data, transmits the refined data to an external analysis system through the external interface unit, and receives a new RoT image generated according to the analysis results of the external analysis system and controls it to be reflected by the virtual trust environment creation and conversion unit.
[0018] A state-based embedded virtual trust environment switching method performed by a computing device according to another embodiment comprises: receiving a new Root of Trust (RoT) image from an external analysis system; storing information regarding a currently active virtual trust environment, state information of a standby virtual trust environment, rollback reference information for a previous virtual trust environment, and a switching history of virtual trust environments in a state record; creating a standby virtual trust environment; configuring a standby virtual trust environment that reflects the new RoT image; determining whether the standby virtual trust environment can be activated based on the state information of the virtual trust environment stored in the state record even while the currently active virtual trust environment is running; and switching the standby virtual trust environment to a new active virtual trust environment if it is determined that activation is possible. Effects of the invention
[0019] According to one embodiment of the present invention, even while the currently active virtual trust environment is running, the possibility of activating a standby virtual trust environment is determined based on the status information of the virtual trust environment, and if activation is possible, the standby virtual trust environment can be dynamically switched to a newly active virtual trust environment. Therefore, the security environment can be updated without relying on system restarts or environment initialization. Accordingly, it is possible to flexibly respond to changing security threats while minimizing service interruptions.
[0020] Furthermore, since a standby virtual trusted environment can be created in advance and configured with the new Root of Trust image, and the transition can be performed after determining the feasibility of activation, response delays can be reduced compared to the method of preparing a new environment from scratch after a threat occurs. Accordingly, the possibility of response failure caused by creation time, initialization time, and boot time, which could be issues during the existing virtualization environment transition process, can be reduced.
[0021] Furthermore, by distinguishing and managing the states of virtual trusted environments and performing startup, verification, execution, transition, or recovery procedures for new virtual trusted environments according to each state, the entire environment transition process can be systematically controlled based on state. Consequently, the feasibility of an environment transition can be determined more precisely, and the stability and predictability of the transition process can be improved.
[0022] Furthermore, since pre-verification regarding feasibility, compatibility, resource status, resource conflicts, the proper operation of security functions, and service impact can be performed on the standby virtual trusted environment reflecting the new Root image, potential errors or non-conformities can be identified in advance prior to transition. Accordingly, this prevents the activation of an inappropriate new environment and improves the transition success rate.
[0023] Furthermore, even after the standby virtual trust environment is transitioned to the new active virtual trust environment, the state of the new active virtual trust environment is managed in stages. Since it is possible to roll back to the immediately preceding active virtual trust environment or a recoverable previous virtual trust environment in the event of abnormal behavior or a transition to an error state, it is possible to respond quickly to unstable situations that occur after the environment transition. Accordingly, stability and recovery reliability after the transition can be further enhanced compared to a structure that simply provides a transition function.
[0024] Furthermore, since the state log can store information regarding the currently active virtual trust environment, the status of the standby virtual trust environment, transition history, error history, and rollback reference information, subsequent procedures can be performed by considering both past history and the current state. Accordingly, sophisticated transition and recovery decisions based on accumulated status and history information, rather than one-off judgments, are possible.
[0025] Furthermore, by recording sensor data and execution events collected from the active virtual trusted environment, refining them, and transmitting them to an external analysis system, and then receiving and reflecting new Root of Trust (RoT) images generated based on the analysis results, an adaptive closed-loop security structure leading to threat analysis, response, and environment reconfiguration can be implemented. Accordingly, compared to conventional methods that rely solely on internal policies, the ability to respond to the latest threats can be enhanced.
[0026] Furthermore, by linking with external analysis systems, Root of Trust images incorporating security threat analysis results or new policies can be rapidly applied to the execution environment. This overcomes the limitations of static trusted environment structures and enables continuous security updates for the running environment. Consequently, it is possible to provide a security structure capable of adaptively responding to changing threat situations.
[0027] Furthermore, since the decision to perform subsequent transition or recovery procedures can be made based on the processing results of each stage—such as the environment creation completion status, the result of reflecting the new RoT image, the results of pre-verification, and the success or failure of the environment transition or rollback—the environment transition process can be verified and controlled step by step. Accordingly, the reliability and operational stability of the entire transition process can be improved. Brief explanation of the drawing
[0029] FIG. 1 is a block diagram illustrating the configuration of a state-based embedded virtual trust environment switching device according to one embodiment. FIG. 2a is a block diagram illustrating the interlocking structure between a virtual trust environment control unit and a status record unit according to one embodiment. FIG. 2b is a block diagram illustrating the interlocking structure between a virtual trust environment control unit and a monitoring and evidence recording unit according to one embodiment. FIG. 3 is a block diagram illustrating the interlocking structure between a virtual trust environment according to one embodiment, a virtual trust environment creation and switching unit, a status recording unit, and a monitoring and evidence recording unit. FIG. 4 is a flowchart illustrating a virtual trust environment switching procedure based on the linkage between a virtual trust environment control unit and a virtual trust environment creation and switching unit according to one embodiment. FIG. 5 is a state transition diagram illustrating the state transition structure of a virtual trust environment according to one embodiment. Specific details for implementing the invention
[0030] The advantages and features of the present invention and the methods for achieving them will become clear by referring to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below but can be implemented in various different forms. These embodiments are provided merely to ensure that the disclosure of the present invention is complete and to fully inform those skilled in the art of the scope of the invention, and the present invention is defined only by the scope of the claims. Throughout the specification, the same reference numerals refer to the same components.
[0031] In describing the embodiments of the present invention, if it is determined that a detailed description of known functions or configurations may unnecessarily obscure the essence of the invention, such detailed description will be omitted. Furthermore, the terms described below are defined considering the functions in the embodiments of the present invention, and these may vary depending on the intentions or conventions of the user or operator. Therefore, such definitions should be based on the content throughout this specification.
[0032] Additionally, each block or each step may represent a module, segment, or part of code containing one or more executable instructions for executing specific logical functions, and it should be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, two blocks or steps described in succession may actually be performed substantially simultaneously, and the blocks or steps may also be performed in the reverse order of the corresponding functions as needed.
[0033] Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings. However, the embodiments of the present invention exemplified below may be modified in various different forms, and the scope of the present invention is not limited to the embodiments described below. The embodiments of the present invention are provided to more completely explain the present invention to those skilled in the art to which this invention pertains.
[0034] FIG. 1 is a block diagram illustrating the configuration of a state-based embedded virtual trust environment switching device according to one embodiment.
[0035] Referring to FIG. 1, a state-based embedded virtual trust environment switching device (hereinafter referred to as the "switching device") (100) according to one embodiment may include an external interface unit (110), a state record unit (120), a monitoring and evidence record unit (130), a virtual trust environment control unit (140), a virtual trust environment creation and switching unit (150), and a virtual trust environment (160). Additionally, the switching device (100) may be linked with an external analysis system (200).
[0036] The switching device (100) may be a computing device. For example, the switching device (100) may be implemented in the form of a server, an embedded control device, a security processing device, or a similar computing device including a processor, memory, a storage device, a communication interface, and a virtualization execution environment.
[0037] The external analysis system (200) can analyze whether there is an abnormality in the security status or execution environment using the data to be analyzed transmitted from the switching device (100), and based on the analysis results, can generate or provide a new image (hereinafter referred to as the 'new RoT image') that reflects Root of Trust (RoT) information. For example, the external analysis system (200) can analyze whether there is a security threat based on sensor data, execution event information, or refined data collected from the virtual trust environment (160), and transmit a new RoT image that reflects a security policy to the switching device (100).
[0038] The external interface unit (110) is configured to provide an interface between the external analysis system (200) and the switching device (100), and can receive a new RoT image from the external analysis system (200) and, if necessary, transmit and receive switching commands, verification requests, processing results, or status information. In one embodiment, the external interface unit (110) can receive a new RoT image from the external analysis system (200) and transmit it to the virtual trust environment control unit (140).
[0039] In one embodiment, the external interface unit (110) may receive a new RoT image and verification information corresponding to the new RoT image and transmit them to the virtual trust environment control unit (140). For example, the external interface unit (110) may receive hash information or signature verification information along with the new RoT image, and the virtual trust environment control unit (140) may use the information to verify the integrity and reliability of the new RoT image.
[0040] Additionally, the external interface unit (110) may receive verification results related to whether to perform a transition of the standby virtual trust environment or information necessary for determining transition approval, and transmit this information to the virtual trust environment control unit (140). Accordingly, the virtual trust environment control unit (140) may determine whether to approve the transition to the new virtual trust environment based on the verification results and information necessary for determining transition approval.
[0041] The virtual trust environment control unit (140) is a component that controls the overall operation of the switching device (100) and can be connected to the external interface unit (110), the status record unit (120), the monitoring and evidence record unit (130), and the virtual trust environment creation and switching unit (150). The virtual trust environment control unit (140) determines whether to switch the virtual trust environment based on a received new RoT image, and can determine whether to perform the switch, suspend the switch, or perform a rollback based on the status information stored in the status record unit (120) and the information recorded in the monitoring and evidence record unit (130).
[0042] The state log (120) may be a configuration that stores and manages state information of a virtual trust environment (160). For example, the state log (120) may store information regarding a currently active virtual trust environment, state information of a standby virtual trust environment, transition history, error history, rollback reference information for a previous virtual trust environment, etc.
[0043] In one embodiment, the state information may be information indicating the current operational stage or transition state of the virtual trust environment. For example, the state information may include any one of the following states: a ready state in which the virtual trust environment is prepared for transition after a new RoT image is reflected; a start state in which actual operation is initiated; a verification state in which feasibility and stability are confirmed; an execution state in which service and security functions are performed; a transition state in which a standby virtual trust environment is transitioned to a new active virtual trust environment; and an error state in which an error occurs.
[0044] The virtual trust environment control unit (140) can determine whether a transition is possible by querying the state information stored in the state record unit (120) and update the state in the state record unit (120) during the transition or after the transition is completed.
[0045] The monitoring and evidence recorder (130) records and manages various information collected from the virtual trust environment (160). For example, the monitoring and evidence recorder (130) can collect and store sensor data, execution events, time information, environment identification information, etc. collected from the virtual trust environment (160). In addition, the monitoring and evidence recorder (130) can provide the collected information to the virtual trust environment control unit (140) or organize and provide it as data in a format necessary for analysis by the external analysis system (200).
[0046] The virtual trust environment creation and switching unit (150) configures a virtual trust environment that reflects a new RoT image and performs a transition between an activated virtual trust environment and a standby virtual trust environment. In one embodiment, the virtual trust environment creation and switching unit (150) can create a standby virtual trust environment that reflects a new RoT image under the control of the virtual trust environment control unit (140), and can switch the standby virtual trust environment to an activated state when verification is completed. Additionally, if an abnormality occurs during the transition process or after the transition, the virtual trust environment creation and switching unit (150) can perform a rollback to the previous virtual trust environment.
[0047] A virtual trust environment (160) may include an active virtual trust environment (161) and a standby virtual trust environment (162). The active virtual trust environment (161) may be an environment that currently performs service and security functions, and the standby virtual trust environment (162) may be an environment that prepares for transition by reflecting a new RoT image. In one embodiment, the virtual trust environment creation and transition unit (150) may perform verification after reflecting a new RoT image in the standby virtual trust environment (162), and if the verification result is satisfactory, the standby virtual trust environment (162) may be transitioned to an active virtual trust environment. At this time, the existing active virtual trust environment (161) may be removed or deactivated.
[0048] As illustrated in FIG. 1, the status record unit (120) and the monitoring and evidence record unit (130) can receive status information and execution event information from the virtual trust environment (160), and the virtual trust environment control unit (140) can determine whether to perform a transition using the status information and execution event information. Additionally, the virtual trust environment creation and transition unit (150) can perform the creation, initialization, transition, and rollback of the standby virtual trust environment (162) according to the control of the virtual trust environment control unit (140).
[0049] In this way, the switching device (100) creates a standby virtual trust environment based on a new RoT image provided by an external analysis system (200), and can determine whether the standby virtual trust environment can be activated based on the status information of the virtual trust environment stored in the status record (120) even while the currently active virtual trust environment is running. Additionally, if the switching device (100) determines that the standby virtual trust environment can be activated, it can dynamically switch the standby virtual trust environment to a new active virtual trust environment, thereby updating the security environment without restarting the system and ensuring stable service continuity.
[0050] FIG. 2a is a block diagram illustrating the interlocking structure between a virtual trust environment control unit and a status record unit according to one embodiment.
[0051] Referring to FIG. 1 and FIG. 2a, a switching device (100) according to one embodiment may include a state recording unit (120) and a virtual trust environment control unit (140). FIG. 2a particularly illustrates a structure in which the state recording unit (120) stores and manages state information of a virtual trust environment, and the virtual trust environment control unit (140) determines whether to switch the virtual trust environment using the state information.
[0052] The status log (120) may be a configuration that stores information related to the status of a virtual trust environment. For example, the status log (120) may store active environment information regarding the currently active virtual trust environment, a standby environment status indicating the ready or operational status of a standby virtual trust environment, and a transition history indicating the previous transition history of the virtual trust environment. Additionally, the status log (120) may also store status information such as an error status, a recovery status, a transition completion status, or a rollback history as needed.
[0053] The virtual trust environment control unit (140) may be configured to perform a state-based transition determination in conjunction with the state record unit (120). For example, the virtual trust environment control unit (140) can check whether the currently active virtual trust environment is in a normal state, whether the standby virtual trust environment is in a ready state for transition, or whether an error occurred during the previous transition process by querying the state information stored in the state record unit (120). Based on the queried state information, the virtual trust environment control unit (140) can determine whether to perform a transition to a new virtual trust environment, whether to suspend the transition, or whether to perform a rollback to a previous virtual trust environment.
[0054] More specifically, the virtual trust environment control unit (140) can receive state information from the state record unit (120) and perform a state-based transition decision, and during the transition process, it can check the current state of the transition target environment by repeatedly performing a state inquiry on the state record unit (120). In addition, the virtual trust environment control unit (140) can update the changed environment state, transition result, or recovery result in the state record unit (120) after the transition is performed. Accordingly, the state record unit (120) is not limited to a simple history storage unit but can function as a reference information storage unit that supports state-based control of the virtual trust environment control unit (140).
[0055] As illustrated in FIG. 2a, the state record unit (120) stores state information such as active environment information, standby environment status, and transition history, and the virtual trusted environment control unit (140) receives state information from the state record unit (120) and can perform state-based transition judgment, state inquiry, and state update. With this configuration, the virtual trusted environment control unit (140) can perform stable environment transition or recovery control by considering the current state and past transition history of the virtual trusted environment together.
[0056] FIG. 2b is a block diagram illustrating the interlocking structure between a virtual trust environment control unit and a monitoring and evidence recording unit according to one embodiment.
[0057] Referring to FIGS. 1 and 2b, a switching device (100) according to one embodiment may include a monitoring and evidence recording unit (130) and a virtual trust environment control unit (140). FIG. 2b particularly illustrates a structure in which the monitoring and evidence recording unit (130) stores various operational information collected from a virtual trust environment, and the virtual trust environment control unit (140) extracts data to be analyzed and generates refined data using the operational information.
[0058] The monitoring and evidence recorder (130) may be a configuration that records and manages various information generated during the operation of the virtual trusted environment. For example, the monitoring and evidence recorder (130) may store sensor data, execution events, time information, and environment identification information. The sensor data may include voltage, temperature, biometric information, or security-related measurements, and the execution events may include event logs, command execution information, or exception occurrence information generated during the operation of the virtual trusted environment.
[0059] The virtual trust environment control unit (140) can receive and process raw data provided from the monitoring and evidence record unit (130). For example, the virtual trust environment control unit (140) can perform an analysis target extraction process to select data necessary for analysis from the raw data, a data sorting process to arrange or sort the extracted data according to criteria, and a data structuring process to convert the sorted data into a form suitable for delivery to an external analysis system.
[0060] In one embodiment, the virtual trust environment control unit (140) can generate refined data through the processes of extracting analysis targets, sorting data, and structuring data. The refined data may be data generated and maintained within the virtual trust environment control unit (140), and may subsequently be output to an external analysis system (200) or utilized for subsequent conversion decisions. That is, the refined data may not be stored in a separate independent component, but may be formed as a result of data processing by the virtual trust environment control unit (140).
[0061] The virtual trust environment control unit (140) can use the refined data to determine abnormal signs in the currently active virtual trust environment or generate analysis data to be transmitted to an external analysis system (200). For example, the virtual trust environment control unit (140) can determine whether there is a security anomaly by comprehensively considering the change pattern of sensor data, the order of occurrence of execution events, the state change at a specific point in time, and environment identification information. In addition, the virtual trust environment control unit (140) can transmit the refined data to an external analysis system (200) so that it can be used as basic data for creating a new security image or determining a transition policy.
[0062] As illustrated in FIG. 2b, the monitoring and evidence recording unit (130) collects and stores raw data, and the virtual trust environment control unit (140) can generate refined data by using the raw data to perform analysis target extraction, data alignment, and data structuring. In this case, the conversion device (100) can transmit the refined data to an external analysis system (200) through an external interface unit (110), and receive a new RoT image generated according to the analysis result of the external analysis system (200) and control it to be reflected by the virtual trust environment creation and conversion unit (150).
[0063] In one embodiment, the virtual trust environment control unit (140) can transmit refined data transmitted from the monitoring and evidence record unit (130) to an external analysis system (200) through an external interface unit (110). For example, the external analysis system (200) can determine whether there is a security threat by analyzing the change pattern of sensor data included in the refined data, the order of occurrence of execution events, the state change at a specific point in time, or the environment identification information. Based on the analysis results, the external analysis system (200) can generate a new RoT image reflecting a threat response policy, and the new RoT image can be transmitted back to the switching device (100) through the external interface unit (110). Accordingly, the virtual trust environment creation and switching unit (150) can configure a standby virtual trust environment reflecting the new RoT image, and the virtual trust environment control unit (140) can determine whether the standby virtual trust environment can be activated based on the state information stored in the state record unit (120), and then control the standby virtual trust environment to dynamically switch to a new activated virtual trust environment.
[0064] Accordingly, the virtual trust environment control unit (140) can process the operational information collected in the virtual trust environment into a form that can be utilized for conversion judgment and external analysis linkage, rather than simply recording it.
[0065] FIG. 3 is a block diagram illustrating the interlocking structure between a virtual trust environment according to one embodiment, a virtual trust environment creation and switching unit, a status recording unit, and a monitoring and evidence recording unit.
[0066] Referring to FIGS. 1 and FIGS. 3, a switching device (100) according to one embodiment may include a virtual trust environment creation and switching unit (150), a virtual trust environment (160), a status recording unit (120), and a monitoring and evidence recording unit (130). FIG. 3 particularly illustrates a structure in which the virtual trust environment creation and switching unit (150) performs a switching of the virtual trust environment (160), and the status recording unit (120) and the monitoring and evidence recording unit (130) record the status and operational information of the virtual trust environment (160).
[0067] A virtual trust environment (160) may include a standby virtual trust environment (162) and an active virtual trust environment (161). The standby virtual trust environment (162) may be an environment preparing for a transition with a new RoT image reflected, and the active virtual trust environment (161) may be an environment performing current service and security functions with a previous RoT image reflected. In one embodiment, the virtual trust environment (160) may include a plurality of virtual trust environments, one of which may be maintained as the currently active virtual trust environment and the other as a standby virtual trust environment for transition when necessary.
[0068] The virtual trust environment creation and conversion unit (150) may be configured to perform conversion of the virtual trust environment (160) under the control of the virtual trust environment control unit (140). For example, the virtual trust environment creation and conversion unit (150) may create a standby virtual trust environment and configure a standby virtual trust environment that reflects the new RoT image. Additionally, the virtual trust environment creation and conversion unit (150) may selectively activate the standby virtual trust environment (162) under the control of the virtual trust environment control unit (140), and accordingly, the standby virtual trust environment (162) may be converted into a new activated virtual trust environment.
[0069] More specifically, the virtual trust environment creation and switching unit (150) can create a standby virtual trust environment (162) in advance according to the command of the virtual trust environment control unit (140), and prepare for environment switching while the standby virtual trust environment reflecting the new RoT image is configured. Subsequently, when the status of the virtual trust environment recorded in the status record unit (120) is confirmed to be in a switchable state, the virtual trust environment creation and switching unit (150) can switch the standby virtual trust environment (162) to a new active state. In addition, after the environment switching is completed, the virtual trust environment that was previously in an active state can be removed so that the virtual trust environment reflecting the new RoT image can operate as a service execution environment.
[0070] The status log (120) may be a configuration that stores and manages status information and history information related to the virtual trust environment (160). For example, the status log (120) may store information regarding the currently active virtual trust environment, status information of the standby virtual trust environment, transition history of the virtual trust environment, error history, and rollback reference information for the previous virtual trust environment. In this case, the information regarding the currently active virtual trust environment may include identification information, operation status, or operational information of the currently active virtual trust environment, and the status information of the standby virtual trust environment may include information related to whether the standby virtual trust environment is ready, information on a newly reflected RoT image, or whether it is possible to activate.
[0071] In one embodiment, the status record unit (120) can receive and record information regarding the currently active virtual trust environment and the standby virtual trust environment from the virtual trust environment (160), and can store the transition history and error history that occur during the environment transition process. The virtual trust environment control unit (140) can determine whether the standby virtual trust environment (162) can be activated by checking the information stored in the status record unit (120), and can control the virtual trust environment creation and transition unit (150) to record the result as a transition history if the environment transition is performed, and to perform a recovery procedure or a rollback procedure based on the error history if an error occurs.
[0072] In one embodiment, the virtual trust environment control unit (140) may use rollback reference information regarding the previous virtual trust environment stored in the state record unit (120) when performing a rollback. For example, the virtual trust environment control unit (140) may control the virtual trust environment creation and transition unit (150) to restore the immediately active virtual trust environment or the recoverable previous virtual trust environment based on the rollback reference information in the event of a failure to transition to the new virtual trust environment or an abnormal state occurring after the transition. Additionally, the virtual trust environment creation and transition unit (150) may maintain a stable service state by restoring the immediately active virtual trust environment or the recoverable previous virtual trust environment corresponding to the rollback reference information back to an active state.
[0073] The monitoring and evidence record unit (130) may be configured to record and manage various operational information collected during the operation of the virtual trust environment (160). For example, the monitoring and evidence record unit (130) may record sensor data collected from various sensors constituting the virtual trust environment (160), such as voltage, temperature, and biological information. Additionally, the monitoring and evidence record unit (130) may store time information or environment identification information related to the sensor data.
[0074] In one embodiment, sensor data recorded in the monitoring and evidence record unit (130) can be refined by the virtual trust environment control unit (140), and the refined data can be transmitted to an external analysis system. Accordingly, operational information collected during the operation of the virtual trust environment (160) is not limited to simple recording, but can be utilized as basic data for subsequent security analysis and the creation of a new RoT image through an external analysis system.
[0075] As illustrated in FIG. 3, the virtual trust environment creation and conversion unit (150) performs an environment conversion command for the virtual trust environment (160), and the virtual trust environment (160) can convert the standby virtual trust environment (162) into a new active virtual trust environment according to the command. In addition, the status information of the virtual trust environment (160) can be transmitted to and recorded in the status record unit (120), and various sensor data collected from the virtual trust environment (160) can be transmitted to and stored in the monitoring and evidence record unit (130). With this configuration, the conversion device (100) can organically perform the creation of a standby virtual trust environment, the configuration of a standby virtual trust environment reflecting a new RoT image, and the dynamic conversion of the standby virtual trust environment into a new active virtual trust environment.
[0076] FIG. 4 is a flowchart illustrating a virtual trust environment switching procedure based on the linkage between a virtual trust environment control unit and a virtual trust environment creation and switching unit according to one embodiment.
[0077] Referring to FIGS. 1 and FIGS. 4, a switching device (100) according to one embodiment may include a virtual trust environment control unit (140) and a virtual trust environment creation and switching unit (150). When a new RoT image is received, the virtual trust environment control unit (140) determines whether dynamic switching of the virtual trust environment based on the new RoT image is possible, and the virtual trust environment creation and switching unit (150) may perform the creation of a new virtual trust environment, configuration of a standby virtual trust environment reflecting the new RoT image, pre-verification, environment switching, and rollback according to a request or command from the virtual trust environment control unit (140).
[0078] Specifically, when a new RoT image is received, the virtual trust environment control unit (140) verifies the integrity of the new RoT image, and if it is determined that a transition to a new virtual trust environment is necessary, it may transmit a request for environment creation to the virtual trust environment creation and transition unit (150) (S110). That is, step S110 is a step performed by the virtual trust environment control unit (140) and may be a step of requesting the creation of a new virtual trust environment.
[0079] The virtual trust environment creation and switching unit (150) can create a new virtual trust environment in accordance with the environment creation request (S110) (S115). For example, the virtual trust environment creation and switching unit (150) can allocate resources necessary for the operation of the new virtual trust environment and configure an initial environment so that the new virtual trust environment can be operated in a standby state.
[0080] Subsequently, the virtual trust environment creation and transition unit (150) can configure a standby virtual trust environment with a new RoT image reflected in the created standby virtual trust environment (S120). For example, the virtual trust environment creation and transition unit (150) can prepare the standby virtual trust environment for transition to a state reflecting the new security configuration by reflecting the security configuration of the standby virtual trust environment based on the new RoT image.
[0081] Next, the virtual trust environment creation and conversion unit (150) can perform a preliminary verification on a standby virtual trust environment that reflects a new RoT image (S130). For example, the virtual trust environment creation and conversion unit (150) can check the feasibility of the new virtual trust environment, whether there is a resource conflict, whether the security function is operating normally, or whether a service connection is possible.
[0082] In one embodiment, the pre-verification step (S130) may examine not only the feasibility of the new virtual trust environment but also compatibility with the existing environment, resource usage status, and the impact of the environment transition on the current service. For example, the virtual trust environment creation and transition unit (150) may determine whether the new virtual trust environment can operate in parallel or as an alternative without conflict with the currently active virtual trust environment, whether sufficient resources required for the transition have been secured, and whether the environment transition has an impact on the current service within an acceptable range.
[0083] Additionally, the virtual trust environment control unit (140) can determine whether a standby virtual trust environment can be activated based on the status information of the virtual trust environment stored in the status record unit (120), even while the currently active virtual trust environment is running. For example, the virtual trust environment control unit (140) can determine whether the standby virtual trust environment can be switched to a new active virtual trust environment by considering the operational status of the currently active virtual trust environment and the status information of the standby virtual trust environment together.
[0084] When the virtual trust environment control unit (140) determines that the standby virtual trust environment can be activated, it can control the virtual trust environment creation and conversion unit (150) to perform an environment conversion. Accordingly, the virtual trust environment creation and conversion unit (150) can convert the standby virtual trust environment into a new activated virtual trust environment (S140). In this case, the existing currently activated virtual trust environment may be deactivated or removed.
[0085] On the other hand, the virtual trust environment control unit (140) can manage the state of the new active virtual trust environment step by step even after the standby virtual trust environment is switched to the new active virtual trust environment. For example, the virtual trust environment control unit (140) can sequentially check the start state, verification state, execution state, transition state, or error state of the new active virtual trust environment.
[0086] At this time, if an abnormal operation occurs or the newly activated virtual trust environment transitions to an error state, the virtual trust environment control unit (140) can determine whether to perform a rollback to the previous active virtual trust environment or a recoverable previous virtual trust environment based on the rollback reference information stored in the state record unit (120). Accordingly, the virtual trust environment creation and transition unit (150) can perform a rollback to the previous active virtual trust environment or a recoverable previous virtual trust environment (S150).
[0087] That is, the environment creation request step (S110) may be a request step for creating a new virtual trust environment, and the environment creation step (S115) may be a step for actually creating a new virtual trust environment in accordance with the request. The standby virtual trust environment configuration step (S120) may be a step for configuring a standby virtual trust environment in which a new RoT image is reflected in the created standby virtual trust environment, and the pre-verification step (S130) may be a step for verifying the executableness and stability of the new virtual trust environment. The environment switching step (S140) may be a step for switching the standby virtual trust environment to a new active virtual trust environment after determining whether the standby virtual trust environment can be activated while the currently active virtual trust environment is running, and the rollback step (S150) may be a step for restoring to the previous virtual trust environment in the event of a switching failure or an abnormal state.
[0088] In one embodiment, the virtual trust environment creation and transition unit (150) may provide at least one of the following to the virtual trust environment control unit (140) as a result of processing an environment creation request: a creation completion status, a new RoT image reflection result, a pre-verification result, whether the environment transition was successful, or a rollback result (S160). For example, the creation completion status may indicate whether the standby virtual trust environment was created successfully, and the new RoT image reflection result may indicate whether the new RoT image was reflected successfully in the standby virtual trust environment. Additionally, the pre-verification result may include a verification result regarding the feasibility, compatibility, resource status, resource conflict, normal operation of security functions, or service impact of the standby virtual trust environment. The environment transition success result may indicate whether the standby virtual trust environment was successfully transitioned to a new active virtual trust environment, and the rollback result may indicate whether recovery to the immediate active virtual trust environment or a recoverable previous virtual trust environment was successfully performed.
[0089] The virtual trust environment control unit (140) can determine whether to continue the subsequent transition procedure or to perform the recovery procedure based on the processing results. For example, the virtual trust environment control unit (140) can control the virtual trust environment creation and transition unit (150) to continue the pre-verification procedure only when the creation completion status and the new RoT image reflection result are normal, and to transition the standby virtual trust environment to the new active virtual trust environment when the pre-verification result satisfies the conditions for transition. On the other hand, if any of the processing results are confirmed to be abnormal, the virtual trust environment control unit (140) can control the subsequent transition procedure to stop or retry, and, if necessary, control the rollback procedure to the previous active virtual trust environment or the previous recoverable virtual trust environment.
[0090] Accordingly, the switching device (100) can improve the stability and recovery reliability of the virtual trust environment switching by sequentially collecting processing results occurring at each stage of environment creation, new RoT image reflection, pre-verification, environment switching, and rollback, and dynamically determining subsequent procedures based on the processing results.
[0091] As such, FIG. 4 illustrates a structure in which a virtual trust environment control unit (140) and a virtual trust environment creation and switching unit (150) interact with each other to perform procedures ranging from a request for preparation of a new virtual trust environment to the creation of an actual environment, configuration of a standby virtual trust environment reflecting a new RoT image, pre-verification, environment switching, and rollback, and even after the standby virtual trust environment is switched to a new active virtual trust environment, the state of the new active virtual trust environment is managed step by step, and in the event of an abnormal operation or error state transition, a rollback to the previous active virtual trust environment or a recoverable previous virtual trust environment is possible.
[0092] Accordingly, the switching device (100) determines whether a standby virtual trust environment can be activated based on the status information of the virtual trust environment stored in the status record (120) even while the currently active virtual trust environment is running, and if it is determined that activation is possible, the standby virtual trust environment is switched to a new active virtual trust environment, thereby improving the dynamic stability and reliability of the virtual trust environment switching.
[0093] FIG. 5 is a state transition diagram illustrating the state transition structure of a virtual trust environment according to one embodiment.
[0094] Referring to FIGS. 1 and FIGS. 5, in a switching device (100) according to one embodiment, a virtual trust environment may have any one of a ready state (171), a start state (172), a verification state (173), an execution state (174), a switching state (175), and an error state (176). The switching device (100) may perform a procedure to start, verify, execute, switch, or recover a new virtual trust environment depending on the current state of the virtual trust environment.
[0095] The ready state (171) may be a state in which a virtual trust environment reflecting a new RoT image is prepared for transition. For example, the ready state (171) may be a state in which the new virtual trust environment is waiting for a creation request or a subsequent transition procedure. The virtual trust environment in this ready state (171) may start actual operation in a subsequent step.
[0096] The start state (172) may be a state in which the prepared virtual trust environment begins actual operation. For example, in the start state (172), initialization for operating the new virtual trust environment may be performed, or the loading of the new RoT image and resource allocation may proceed. That is, the start state (172) may be an initial startup state for performing subsequent verification procedures.
[0097] The verification state (173) may be a state for verifying whether the new virtual trust environment is operational. For example, in the verification state (173), the operational feasibility of the new virtual trust environment, whether there are resource conflicts, whether security functions are functioning normally, or whether service connectivity is possible may be verified. Accordingly, the verification state (173) may be a state for verifying the stability of the new virtual trust environment prior to the actual environment transition.
[0098] The execution state (174) may be a state in which the currently active virtual trust environment performs service and security functions. For example, the virtual trust environment in the execution state (174) may be a current operating environment that responds to external requests or performs security functions. In one embodiment, only one of the plurality of virtual trust environments may be maintained as the execution state (174).
[0099] The transition state (175) may be a state in which the standby virtual trust environment is switched to a new active virtual trust environment, and the existing currently active virtual trust environment is deactivated or removed. Accordingly, the transition state (175) may be an intermediate state in which the running environment is changed to a new environment.
[0100] An error state (176) may be a state in which an error occurs during the creation, startup, verification, execution, or transition process of a virtual trust environment. For example, if a failure occurs in creating a new virtual trust environment, reflecting a RoT image, verification, or transitioning the environment, the virtual trust environment may transition to an error state (176). When an error state (176) occurs, the transition device (100) may stop the transition procedure for the virtual trust environment and, if necessary, perform a recovery to the previous virtual trust environment.
[0101] In one embodiment, even after the standby virtual trust environment is switched to the new active virtual trust environment, the switching device (100) can manage the state of the new active virtual trust environment step by step. For example, the switching device (100) can sequentially check which state the new active virtual trust environment is in among the verification state (173), execution state (174), switching state (175), and error state (176), and perform subsequent procedures according to each state.
[0102] Additionally, if abnormal operation occurs in the newly activated virtual trust environment or transitions to an error state (176), the switching device (100) can determine whether to roll back to the immediately prior active virtual trust environment or a recoverable previous virtual trust environment based on rollback reference information stored in the state record (120). Accordingly, the switching device (100) can perform a stable recovery procedure even after the new environment is activated.
[0103] As illustrated in FIG. 5, the virtual trust environment can transition from the ready state (171) to the start state (172) in a normal flow, and then transition through the verification state (173) to the execution state (174). Additionally, if an environment transition is required, it can transition from the execution state (174) to the transition state (175). On the other hand, if an error occurs at any stage of the ready state (171), start state (172), verification state (173), execution state (174), and transition state (175), the virtual trust environment can transition to an error state (176).
[0104] As such, FIG. 5 illustrates a state transition structure configured such that a virtual trust environment sequentially passes through a ready state, a start state, a verification state, an execution state, and a transition state, and transitions to an error state when an error occurs in each state. Accordingly, the transition device (100) can perform a stable environment transition procedure based on the current state of the virtual trust environment and perform a recovery procedure when an error occurs.
[0105] The present invention has been described above with reference to its embodiments. Those skilled in the art will understand that the present invention may be embodied in modified forms without departing from its essential characteristics. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the claims, not by the foregoing description, and all variations within the scope of equivalents should be interpreted as being included in the present invention.
Claims
Claim 1 A state-based embedded virtual trust environment switching device comprises: an external interface unit that receives a new Root of Trust (RoT) image from an external analysis system; a state record unit that stores information regarding a currently active virtual trust environment, state information of a standby virtual trust environment, rollback reference information for a previous virtual trust environment, and a switching history of virtual trust environments; a virtual trust environment creation and switching unit that creates a standby virtual trust environment, configures a standby virtual trust environment reflecting the new RoT image, and performs a switching between the standby virtual trust environment and the active virtual trust environment or a rollback to the previous virtual trust environment; and a virtual trust environment control unit connected to the external interface unit, the state record unit, and the virtual trust environment creation and switching unit, which determines whether the standby virtual trust environment can be activated based on the state information of the virtual trust environment stored in the state record unit even while the currently active virtual trust environment is running, and if it is determined that activation is possible, switches the standby virtual trust environment to a new active virtual trust environment.A state-based embedded virtual trust environment switching device comprising: a virtual trust environment creation and switching unit; wherein the virtual trust environment creation and switching unit provides at least one of a creation completion status, a new RoT image reflection result, a pre-verification result, whether the environment switching was successful, or a rollback result to the virtual trust environment control unit as a processing result for an environment creation request; wherein the virtual trust environment control unit controls the virtual trust environment creation and switching unit to continue performing a pre-verification procedure if the creation completion status and the new RoT image reflection result are normal, controls the virtual trust environment creation and switching unit to switch the standby virtual trust environment to the new active virtual trust environment if the pre-verification result satisfies conditions for switching, and controls the virtual trust environment creation and switching unit to stop or retry a subsequent switching procedure, or to perform a rollback procedure to the immediately preceding active virtual trust environment or a recoverable previous virtual trust environment if any of the processing results are confirmed to be abnormal. Claim 2 A state-based embedded virtual trust environment switching device according to claim 1, wherein the state recorder stores information regarding the currently active virtual trust environment, state information of the standby virtual trust environment, the switching history of the virtual trust environment, the error history, and rollback reference information for the previous virtual trust environment. Claim 3 A state-based embedded virtual trust environment switching device according to claim 1, wherein the virtual trust environment creation and switching unit performs a preliminary verification on a standby virtual trust environment reflecting the new RoT image, and the preliminary verification checks at least one of whether the standby virtual trust environment reflecting the new RoT image is executable normally, compatibility, resource status, whether there is a resource conflict, whether the security function operates normally, and whether there is a service impact. Claim 4 A state-based embedded virtual trust environment switching device according to claim 1, characterized in that the state of the virtual trust environment has any one of a ready state, a start state, a verification state, an execution state, a switching state, and an error state. Claim 5 In claim 4, the virtual trust environment control unit performs a procedure for driving, verifying, executing, switching, or recovering a new virtual trust environment based on the current state of the virtual trust environment stored in the state record unit, and determines whether to activate the standby virtual trust environment if the current state is a state in which the standby virtual trust environment can be activated, and the virtual trust environment creation and switching unit is characterized by deactivating or removing the existing currently activated virtual trust environment after switching the standby virtual trust environment to a new activated virtual trust environment. Claim 6 A state-based embedded virtual trust environment switching device according to claim 1, wherein the virtual trust environment control unit manages the state of the new active virtual trust environment step by step even after the standby virtual trust environment is switched to the new active virtual trust environment, and determines whether to perform a rollback to the previous active virtual trust environment or the recoverable previous virtual trust environment based on rollback reference information regarding the previous active virtual trust environment or the recoverable previous virtual trust environment stored in the state record unit when an abnormal operation occurs or transitions to an error state, and the virtual trust environment creation and switching unit performs a rollback to the previous virtual trust environment. Claim 7 delete Claim 8 In claim 1, the state-based embedded virtual trust environment switching device further comprises a monitoring and evidence recording unit that collects and records sensor data and execution events from an activated virtual trust environment. Claim 9 A state-based embedded virtual trust environment switching device according to claim 8, wherein the monitoring and evidence recording unit records sensor data and execution events collected in an activated virtual trust environment as raw data, and the virtual trust environment control unit extracts data to be analyzed from the raw data, sorts and structures the data to be analyzed to generate refined data, transmits the refined data to an external analysis system through the external interface unit, and receives a new RoT image generated according to the analysis result of the external analysis system and controls it to be reflected by the virtual trust environment creation and switching unit. Claim 10 A state-based embedded virtual trust environment switching method performed by a computing device comprises: receiving a new Root of Trust (RoT) image from an external analysis system; storing information regarding a currently active virtual trust environment, state information of a standby virtual trust environment, rollback reference information for a previous virtual trust environment, and a switching history of the virtual trust environment in a state record; creating a standby virtual trust environment; configuring a standby virtual trust environment in which the new RoT image is reflected; checking at least one of a creation completion state, a new RoT image reflection result, a pre-verification result, whether the environment switching is successful, or a rollback result as a processing result for the standby virtual trust environment; continuing to perform a pre-verification procedure if the creation completion state and the new RoT image reflection result are normal; determining whether the standby virtual trust environment can be activated based on the state information of the virtual trust environment stored in the state record even while the currently active virtual trust environment is running; and switching the standby virtual trust environment to a newly active virtual trust environment if the pre-verification result satisfies the conditions for switching. A state-based embedded virtual trust environment switching method characterized by including the step of, if any of the above processing results are identified as abnormal, stopping or retrying the subsequent switching procedure, or performing a rollback procedure to the immediately preceding active virtual trust environment or a recoverable previous virtual trust environment.