Implementation method and apparatus for virtual machine, and computer-readable storage medium

Abstract

Provided in the present application are an implementation method and apparatus for a virtual machine, and a computer-readable storage medium, all of which can be applied to a computing device, wherein hardware resources of the computing device are divided into an REE side and a TEE side, and the computing device comprises a first hypervisor. The method comprises the following steps: a processor of a computing device running a first hypervisor at EL3, so as to start a first virtual machine, wherein the first virtual machine is deployed on a TEE side. It can be understood that after the first virtual machine is started, the processor can subsequently run the first virtual machine to process user data. The method can greatly reduce the risk of a virtual machine in a computing device being attacked, thus improving the security of user data in the virtual machine.

Description

Virtual machine implementation method, device, and computer-readable storage medium

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on July 31, 2023, with application number 202310963299.X, and priority to the Chinese patent application entitled “Virtual Machine Implementation Method, Device and Computer-Readable Storage Medium”, all contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of virtualization technology, and in particular to a virtual machine implementation method, device, and computer-readable storage medium. Background Art

[0003] A virtual machine (VM) is a complete computer system emulated through software, with full hardware system functionality, running in a completely isolated environment. Any tasks that can be performed on a computing device (such as a server) can also be performed in a VM. When creating a VM on a computing device, a portion of the physical machine's hard drive and memory capacity is used as the VM's hard drive and memory capacity. Each VM has its own independent hard drive and operating system, and users can operate the VM just as they would on a computing device.

[0004] Currently, virtual machines in computing devices are managed by a hypervisor in the host operating system kernel, such as the kernel-based virtual machine (KVM). Once the host operating system kernel is compromised by an attacker, the attacker will be able to control the virtual machines running in the host operating system kernel, posing a security threat to user data in the virtual machines.

[0005] Summary of the Invention

[0006] The present application provides a virtual machine implementation method, apparatus, and computer-readable storage medium, which can greatly reduce the risk of virtual machines in computing devices being attacked and improve the security of user data in the virtual machines.

[0007] In a first aspect, a virtual machine implementation method is provided, which is applied to a computing device, wherein the hardware resources of the computing device are divided into a rich execution environment (REE) side and a trusted execution environment (TEE) side, and the computing device includes a first virtual machine manager. The method specifically includes the following steps: a processor of the computing device runs the above-mentioned first virtual machine manager at an exception level (EL3) to start a first virtual machine, and the first virtual machine is deployed on the TEE side.

[0008] It can be understood that in the above solution, after the processor starts the first virtual machine, it can run the first virtual machine to process user data. Since the processor runs the first virtual machine manager under EL3 to start the first virtual machine, and the first virtual machine is deployed on the TEE side, the virtual machine can be isolated from the host operating system kernel (located on the REE side) through the first virtual machine manager. In other words, the virtual machine is protected by the first virtual machine manager under EL3 and can avoid being accessed by the host operating system kernel on the REE side. Therefore, even if an attacker breaks into the host operating system kernel, the attacker cannot control the virtual machine through the virtual machine manager in the host operating system kernel, such as KVM, thereby protecting the security of the virtual machine in the computing device, and further protecting the security of the user data in the virtual machine.

[0009] In a possible implementation, after the processor starts the first virtual machine, the method further includes the following steps:

[0010] The processor obtains the encrypted user data on the REE side;

[0011] The processor runs the first virtual machine manager under EL3 to obtain the decryption key stored on the TEE side, and uses the decryption key to decrypt the encrypted user data to obtain the user data;

[0012] The processor runs the first virtual machine to process user data.

[0013] In this implementation, since user data is encrypted on the REE side and the decryption key is stored on the TEE side, the processor can only obtain the decryption key by running the first virtual machine manager under EL3. The software on the REE side (such as the host operating system kernel and the virtual machine manager in the host operating system kernel) cannot obtain the decryption key stored on the TEE side. Therefore, even if an attacker breaks through the software on the REE side and steals the encrypted data, he cannot decrypt the plaintext of the user data. This can meet the requirement of preventing user data from being stolen by software on the REE side, further improving user data security.

[0014] In one possible implementation, before starting the first virtual machine, the above method also includes the following steps: the above processor obtains a creation instruction carrying configuration information of the first virtual machine to be created on the REE side, and then the processor runs the first virtual machine manager under EL3, and creates the first virtual machine on the TEE side according to the configuration information carried by the above creation instruction.

[0015] By implementing this implementation, a virtual machine can be created on the TEE side, facilitating the subsequent use of the virtual machine to securely process user data.

[0016] In one possible implementation, the method further includes the following steps: the processor simulates and obtains first data on the REE side, then writes the first data into a first virtual machine manager, executes the first virtual machine manager at EL3 to inject the first data into the first virtual machine, and finally executes the first virtual machine based on the first data. The first data includes one or any combination of the following: a virtual interrupt of the first virtual machine, a virtual clock used by the first virtual machine, and memory-mapped input / output (MMIO) information used by the first virtual machine.

[0017] By implementing this implementation, the virtual interrupt, virtual clock, and MMIO information required for the operation of the first virtual machine can be simulated on the REE side, facilitating the subsequent secure processing of user data using the virtual machine.

[0018] In addition, in this implementation, the processor simulates the virtual interrupt of the first virtual machine, the virtual clock used by the first virtual machine, and the MMIO information used by the first virtual machine on the REE side, instead of using the first virtual machine manager for simulation, which can make the trusted computing base (TCB) of the first virtual machine manager relatively thin.

[0019] In a possible implementation, the processor starts the first virtual machine when the first virtual machine manager running under EL3 determines that the first virtual machine is a secure virtual machine.

[0020] Specifically, the processor can run the first virtual machine manager under EL3 to provide the configuration information of the first virtual machine (such as the virtual processor core type, the number of virtual processor cores, the memory address, etc.), the name of the application (APP) installed on the first virtual machine, and the hash value of the image of the first virtual machine, etc., to the user on the REE side for security measurement, that is, the user determines whether the first virtual machine is a secure virtual machine that meets the user's expectations, or an unsecure virtual machine that poses a security threat. If the processor runs the first virtual machine manager under EL3 and obtains feedback from the user that the first virtual machine is a secure virtual machine that meets the user's expectations, the processor determines that the first virtual machine is a secure virtual machine and starts the first virtual machine. Otherwise, the processor determines that the first virtual machine is an unsecure virtual machine and does not start the first virtual machine.

[0021] By implementing this implementation, the processor starts the virtual machine only when it determines that the virtual machine is safe, which can avoid using an unsafe virtual machine to process user data. This can not only improve the security of the virtual machine, but also improve the security of user data in the virtual machine.

[0022] In a possible implementation, the processor starts the first virtual machine when the first virtual machine manager running under EL3 determines that the computing device is a secure device.

[0023] Specifically, the processor can run a first virtual machine manager at EL3 to provide the computing device's certificate to a user on the REE side for a legitimacy check, allowing the user to determine whether the computing device is a secure device that meets their expectations or a non-secure device that poses a security threat. If the processor, running the first virtual machine manager at EL3, obtains feedback from the user confirming that the computing device is a secure device that meets their expectations, the processor determines that the computing device is a secure device and starts the first virtual machine. Otherwise, the processor determines that the computing device is a non-secure device and does not start the first virtual machine.

[0024] By implementing this implementation method, the processor starts the virtual machine only when it determines that the computing device is secure, which can avoid using an unsafe computing device to run the virtual machine to process user data. This can not only improve the security of the virtual machine, but also improve the security of user data in the virtual machine.

[0025] In a possible implementation, the method further includes the following steps: the processor obtains a first management command for the life cycle of the first virtual machine on the REE side, then runs the first virtual machine manager under EL3, and performs one or any combination of the following operations on the first virtual machine according to the first management command: power on, power off, specification change, migration, and release.

[0026] By implementing this implementation method, the life cycle of the virtual machine on the TEE side can be managed.

[0027] In one possible implementation, the method further includes the following steps: the processor obtains a second management command for the first virtual machine on the REE side, then runs the first virtual machine manager under EL3, and performs one or any combination of the following operations on the first virtual machine according to the second management command: installing an application, starting an application, shutting down an application, upgrading an application, uninstalling an application, and migrating an application.

[0028] By implementing this implementation method, it is possible to manage applications on the virtual machine on the TEE side.

[0029] In a possible implementation, the method further includes the following steps: when an exception occurs in the first virtual machine, the processor runs the first virtual machine manager under EL3 to establish the context of the first virtual machine, and handles the exception of the first virtual machine. After handling the exception of the first virtual machine, the context of the first virtual machine is restored to the first virtual machine to resume operation of the first virtual machine.

[0030] By implementing this implementation method, it is possible to handle exceptions that occur in the virtual machine on the TEE side.

[0031] In a possible implementation, when the exception occurring in the first virtual machine is a page fault exception, an MMIO operation exception, or a data abort synchronization exception, the processor runs the first virtual machine manager to handle the exception occurring in the first virtual machine, including:

[0032] The processor runs the first virtual machine manager to receive a page fault exception handling instruction, an MMIO operation exception handling instruction, or a data abort synchronization exception handling instruction sent by the first virtual machine, wherein the page fault exception handling instruction, the MMIO operation exception handling instruction, or the data abort synchronization exception handling instruction is a secure monitor call (SMC) type instruction, and the MMIO operation exception is an exception caused when the first virtual machine performs an MMIO operation;

[0033] The processor runs the first virtual machine manager to handle the page fault exception according to the page fault exception handling instruction;

[0034] Alternatively, the processor runs the first virtual machine manager to handle the MMIO operation exception according to the MMIO operation exception handling instruction;

[0035] Alternatively, the processor runs the first virtual machine manager to process the data termination synchronization exception according to the data termination synchronization exception processing instruction.

[0036] In a possible implementation, the method further includes the following steps: the processor runs the first virtual machine manager under EL3 to perform one or any combination of the following operations: creating, changing or destroying a first-level page table of the first virtual machine, wherein the first-level page table of the first virtual machine refers to a page table that maps the virtual address (VA) of the first virtual machine to a physical address (PA) allocated to the first virtual machine in the computing device.

[0037] By implementing this implementation method, the memory of the virtual machine on the TEE side can be managed.

[0038] In order to improve the flexibility of the solution, in one possible implementation, the above method can manage the memory of the virtual machine on the TEE side in the following manner: the above processor runs the above first virtual machine manager under EL3 to perform one or any combination of the following operations: create, change or destroy the secondary page table of the first virtual machine, wherein the secondary page table of the first virtual machine refers to mapping the VA of the first virtual machine to an intermediate physical address (IPA), and mapping the IPA to a page table of the PA allocated to the first virtual machine in the computing device.

[0039] In one possible implementation, the REE side includes a second virtual machine manager, the first virtual machine is deployed with a virtualized input / output (VirtIO) front-end driver, the second virtual machine manager is deployed with a VirtIO back-end driver, the first virtual machine manager is deployed with a memory synchronization module, the TEE side includes a first memory for data transmission between the VirtIO front-end driver and the VirtIO back-end driver, the REE side includes a second memory, and the memory synchronization module includes a mapping relationship between the first memory and the second memory; the method further includes the following steps:

[0040] The processor runs a memory synchronization module to synchronize first data in the first memory to the second memory according to a mapping relationship between the first memory and the second memory, where the first data is data that the VirtIO front-end driver needs to send to the VirtIO back-end driver;

[0041] or,

[0042] The processor runs a memory synchronization module to synchronize second data in the second memory to the first memory according to a mapping relationship between the first memory and the second memory, where the second data is data from the VirtIO backend driver that the VirtIO frontend driver needs to receive.

[0043] By implementing this implementation, the virtual machine on the TEE side can perform I / O communication through the VirtIO front-end driver and the VirtIO back-end driver.

[0044] In a second aspect, a virtual machine implementation apparatus is provided, which can be applied to a computing device, wherein hardware resources of the computing device are divided into a REE side and a TEE side, the computing device including a first virtual machine manager, the apparatus including: a processing module;

[0045] The processing module is used to run a first virtual machine manager under EL3 to start a first virtual machine, and the first virtual machine is deployed on the TEE side.

[0046] In a possible implementation, the apparatus further includes an acquisition module;

[0047] The above-mentioned acquisition module is used to obtain encrypted user data on the REE side; the above-mentioned processing module is also used to run the first virtual machine manager under EL3, obtain the decryption key stored on the TEE side, and use the decryption key to decrypt the encrypted user data to obtain the user data; the above-mentioned processing module is also used to run the first virtual machine to process the above-mentioned user data.

[0048] In one possible implementation, the acquisition module is also used to obtain a creation instruction on the REE side, where the creation instruction carries configuration information of the first virtual machine to be created; the processing module is also used to run the first virtual machine manager under EL3, and create the first virtual machine on the TEE side according to the configuration information carried by the creation instruction.

[0049] In one possible implementation, the acquisition module is further configured to simulate obtaining first data on the REE side, where the first data includes one or any combination of the following: a virtual interrupt of the first virtual machine, a virtual clock used by the first virtual machine, and MMIO information used by the first virtual machine; the processing module is further configured to write the first data into the first virtual machine manager; the processing module is further configured to run the first virtual machine manager under EL3 and inject the first data into the first virtual machine; and the processing module is further configured to run the first virtual machine based on the first data.

[0050] In one possible implementation, the processing module is also used to run the first virtual machine manager under EL3, determine whether the first virtual machine is a secure virtual machine, and start the first virtual machine if it is determined that the first virtual machine is a secure virtual machine; and not start the first virtual machine if it is determined that the first virtual machine is a non-secure virtual machine.

[0051] In one possible implementation, the processing module is also used to run the first virtual machine manager under EL3 to determine whether the computing device is a secure device. If the computing device is determined to be a secure device, the first virtual machine is started; if the computing device is determined to be a non-secure device, the first virtual machine is not started.

[0052] In one possible implementation, the acquisition module is further used to acquire a first management command for the life cycle of the first virtual machine on the REE side; the processing module is further used to run the first virtual machine manager under EL3, and perform one or any combination of the following operations on the first virtual machine according to the first management command: power on, power off, specification change, migration, and release.

[0053] In one possible implementation, the first acquisition module is further used to obtain a second management command for the first virtual machine on the REE side; the processing module is further used to run the first virtual machine manager under EL3, and perform one or any combination of the following operations on the first virtual machine according to the second management command: install, start, shut down, upgrade, uninstall and migrate applications.

[0054] In one possible implementation, the processing module is further used to: when an exception occurs in the first virtual machine, run the first virtual machine manager under EL3 to establish the context of the first virtual machine, handle the exception that occurs in the first virtual machine, and after handling the exception that occurs in the first virtual machine, restore the context of the first virtual machine to the first virtual machine to resume the operation of the first virtual machine.

[0055] In one possible implementation, when the exception occurring in the first virtual machine is a page fault exception, an MMIO operation exception, or a data abort synchronization exception, the processing module is configured to run the first virtual machine manager at EL3, receive a page fault exception handling instruction, an MMIO operation exception handling instruction, or a data abort synchronization exception handling instruction sent by the first virtual machine, and handle the page fault exception occurring in the first virtual machine according to the page fault exception handling instruction, or handle the MMIO operation exception occurring in the first virtual machine according to the MMIO operation exception handling instruction, or handle the data abort synchronization exception occurring in the first virtual machine according to the data abort synchronization exception handling instruction. The page fault exception handling instruction, the MMIO operation instruction, or the data abort synchronization exception handling instruction is an SMC-type instruction, and the MMIO operation exception is an exception caused when the first virtual machine performs an MMIO operation.

[0056] In one possible implementation, the processing module is further used to run the first virtual machine manager under EL3 and perform one or any combination of the following operations: creating, changing, or destroying a first-level page table of the first virtual machine, where the first-level page table of the first virtual machine is a page table that maps the VA of the first virtual machine to the PA allocated to the first virtual machine in the computing device.

[0057] In one possible implementation, the REE side includes a second virtual machine manager, a VirtIO front-end driver is deployed in the first virtual machine manager, a VirtIO back-end driver is deployed in the second virtual machine manager, a memory synchronization module is deployed in the first virtual machine manager, the TEE side includes a first memory for data transmission between the VirtIO front-end driver and the VirtIO back-end driver, the REE side includes a second memory, and the memory synchronization module includes a mapping relationship between the first memory and the second memory; the processing module is used to run the memory synchronization module to synchronize first data in the first memory to the second memory according to the mapping relationship between the first memory and the second memory, where the first data is data that the VirtIO front-end driver needs to send to the VirtIO back-end driver, or the processing module is used to run the memory synchronization module to synchronize second data in the second memory to the first memory according to the mapping relationship between the first memory and the second memory, where the second data is data that the VirtIO front-end driver needs to receive from the VirtIO back-end driver.

[0058] Regarding the relevant beneficial effects and descriptions of the virtual machine implementation device provided by the second aspect and any implementation method of the second aspect, please refer to the relevant beneficial effects and descriptions of the aforementioned first aspect and any implementation method of the first aspect, and will not be repeated here.

[0059] In a third aspect, a computing device is provided, comprising a processor and a memory; the processor is configured to execute instructions stored in the memory, so that the computing device implements the method provided in the first aspect or any possible implementation of the first aspect.

[0060] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores instructions, and the instructions are used to implement the method provided in the first aspect or any possible implementation of the first aspect.

[0061] In a fifth aspect, a computer program product is provided, comprising a computer program, which, when read and executed by a computing device, enables the computing device to perform the method provided in the first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] FIG1 is a schematic diagram of a virtual machine usage scenario involved in this application;

[0063] FIG2 is a schematic diagram of the hardware architecture of an ARM processor provided in this application;

[0064] FIG3 is a schematic diagram of the structure of a computing device provided by the present application;

[0065] FIG4A is a schematic diagram of the structure of a virtual machine implementation method provided by the present application;

[0066] FIG4B is a flow chart of a data processing method provided by the present application;

[0067] FIG5 is a schematic structural diagram of a first virtual machine manager provided by the present application;

[0068] FIG6 is a schematic diagram of the creation and operation process of a confidential virtual machine from the perspective of a second virtual machine manager provided by this application;

[0069] FIG7 is a schematic diagram of the structure of another computing device provided by the present application;

[0070] FIG8 is a schematic structural diagram of a virtual machine implementation device exemplified in the present application;

[0071] FIG9 is a schematic structural diagram of another computing device provided in this application. DETAILED DESCRIPTION

[0072] The technical solution provided in this application will be described below in conjunction with the accompanying drawings.

[0073] In order to make the technical solution provided by this application clearer, the relevant terms are first explained.

[0074] (1) A virtual machine (VM) is a complete computer system that is simulated by software and has complete hardware system functions and runs in a completely isolated environment. Any work that can be done in a computing device (such as a server) can also be done in a virtual machine. When creating a virtual machine in a computing device, part of the hard disk and memory capacity of the physical machine is used as the hard disk and memory capacity of the virtual machine. Each virtual machine has an independent hard disk and operating system, and the user of the virtual machine can operate the virtual machine just like using a computing device.

[0075] (2) Ordinary virtual machines refer to the virtual machines included in the REE side.

[0076] (3) Confidential virtual machine refers to the virtual machine included on the TEE side, which can also be called a trusted virtual machine, etc.

[0077] (4) Input / output (I / O) devices refer to hardware that can transmit data to and from computing devices. The most common I / O devices include keyboards, mice, block devices (such as disks), and network devices (such as network cards and modems).

[0078] (5) Memory-mapped input / output (MMIO): This is part of the peripheral component interconnect (PCI) specification. I / O devices are placed in memory space rather than I / O space. From the processor's perspective, memory-mapped I / O allows the processor to access I / O devices as if they were memory.

[0079] (6) Virtualized input / output (VirtIO) can be understood as a set of programs for virtualizing general I / O devices. Specifically, VirtIO includes a front-end driver program and a back-end driver program. The front-end driver and the back-end driver program can work together to simulate a series of virtualized I / O devices for use by virtual machines, such as VirtIO-BLK and VirtIO-NET. Among them, VirtIO-BLK is a virtualized storage device. In fact, VirtIO-BLK is a virtualization program for creating disks (disks are I / O devices). Virtual disks can be created through VirtIO-BLK; VirtIO-NET is a virtualized network device. Similarly, VirtIO-NET is a virtualization program for creating network devices. Virtualized network devices (such as virtualized network interface controllers (VNICs)) can be created through VirtIO-NET.

[0080] (7) Secure monitor call (SMC) is a mechanism for communication between the normal world and the secure world, providing a secure and efficient communication method for TEE on the advanced RISC machines (ARM) platform.

[0081] Next, we will introduce the application scenarios involved in this application.

[0082] The present application involves a scenario in which a tenant uses a virtual machine to process business. Please refer to Figure 1, which is a schematic diagram of a virtual machine usage scenario involved in the present application. As shown in Figure 1, a computing device 100 (such as a server) includes a hardware layer and a software layer. The hardware layer is a conventional configuration of the computing device 100, where PCI devices may be, for example, network cards, graphics processing units (GPUs), embedded neural network processing units (NPUs), offload cards, etc., which can be inserted into the PCI / high-speed serial computer expansion bus standard (Peripheral Component Interconnect Express, PCIE) slots of the server. The software layer includes a host operating system kernel (also referred to as the host kernel) installed and running on the computing device 100. A virtual machine manager (hypervisor) (such as KVM) is provided in the host operating system kernel. The function of the virtual machine manager is to realize computing virtualization, network virtualization and storage virtualization of the virtual machine, and is responsible for managing the virtual machine.

[0083] Computing virtualization refers to providing part of the processor and memory of the computing device 100 to the virtual machine, network virtualization refers to providing part of the functions of the network card (such as bandwidth) to the virtual machine, and storage virtualization refers to providing part of the disk to the virtual machine.

[0084] The virtual machine manager can also achieve logical isolation between different virtual machines and manage virtual machines, such as creating virtual machines, simulating virtual hardware for virtual machines based on the hardware layer (hardware simulation function), deleting virtual machines, forwarding and / or processing network packets between all virtual machines running on the computing device 100 (for example, virtual machine 1 and virtual machine 2) or forwarding network packets between the virtual machines on the computing device 100 and the external network (virtual switching function), processing I / O generated by virtual machines, etc.

[0085] The operating environments (such as virtual machine applications, operating systems, and virtual hardware) in different virtual machines are completely isolated. Communication between virtual machine 1 and virtual machine 2 requires forwarding network packets through the virtual machine manager.

[0086] Tenants can remotely log in to the virtual machine and operate the virtual machine to install, configure, and uninstall applications in the virtual machine operating system environment.

[0087] As shown in Figure 1, virtual machines are managed by a virtual machine manager (VM) in the host operating system kernel, such as KVM. Once the host operating system kernel is compromised by an attacker, the attacker will be able to manipulate the VM manager to manage the virtual machine, posing a security threat to user data in the virtual machine.

[0088] Therefore, how to protect the security of user data in virtual machines and meet users' security requirements for virtual machines has become an urgent problem to be solved in this field.

[0089] In order to solve the above problems, the present application provides a computing device and a virtual machine implementation method.

[0090] To facilitate understanding of the computing device and virtual machine implementation method provided by this application, the following first introduces the security zone (TrustZone) technology involved in this application.

[0091] As ARM processor performance continues to improve, computing devices running on them have brought significant convenience to people's lives. At the same time, computing devices carry increasing amounts of user data, and users are increasingly concerned about the security of their computing devices. TrustZone technology is currently the mainstream system-level solution for ARM processors.

[0092] TrustZone technology, a security extension first introduced in ARMv6, divides a computing device's hardware resources into two worlds: the REE side (also known as the normal world) and the TEE side (also known as the secure world). As a hardware security feature, TrustZone operates on the TEE side.

[0093] The REE side doesn't necessarily mean that the operating system (OS) or software running on it is malicious, but rather that the security environment it inhabits is less secure than the TEE side. When the processor operates on the REE side, access to TEE resources (such as registers, memory, cache, and peripherals) is prohibited. Any attempt by the processor to access these resources will result in a system crash. For example, TrustZone can configure the trustzone address space controller (TZASC) and trustzone memory adapter (TZMA) registers to set sensitive memory as secure memory, preventing access from the REE side. When the processor operates on the TEE side, it can access resources on both the TEE and REE sides. Because the TEE side has higher privileges than the REE operating system, TrustZone can serve as a root of trust, providing a higher level of security protection for the REE operating system.

[0094] Taking ARMv8.0 as an example, Figure 2 depicts the ARM hardware architecture. The left side shows the REE architecture, and the right side shows the TEE architecture. The REE has four levels of privilege: exception level 0 (EL0), EL1, EL2, and EL3. The TEE has three levels of privilege: secure exception level 0 (SEL0), SEL1, and EL3. EL0 can also be called the user mode layer, EL1 can also be called the kernel mode layer, EL2 can also be called the virtual machine manager layer, and EL3 can also be called the secure monitor layer. Levels with larger numerical values ​​have higher privileges, while levels with smaller numerical values ​​have lower privileges. Exception levels can be understood as privilege levels.

[0095] User applications run in EL0 on the REE side, while the operating system or some privileged functions run in EL1 on the REE side. For example, the operating system of a virtual machine runs in EL1. Virtual machine managers such as KVM run in EL2. ARM trusted firmware runs in EL3. ARM trusted firmware (ATF) is the first component that runs when the processor boots. It is the low-level firmware officially provided by ARM. This firmware unifies ARM low-level interface standards, such as the power status control interface (PSCI), trusted board boot requirements (TBBR), and SMC operations for switching between secure and normal world states.

[0096] Under EL3, the processor has the highest privilege level and can access not only all resources on the TEE side, but also all resources on the REE side.

[0097] The above is an introduction to the TrustZone technology. Next, we will introduce the computing device provided by this application. The computing device provided by this application is mainly a computing device running the ARM processor shown in Figure 2 above.

[0098] Please refer to Figure 3, which is a schematic diagram of a computing device 300 provided in this application. As shown in Figure 3, the hardware resources of the computing device 300 are divided into a REE side and a TEE side. The TEE side includes one or more confidential virtual machines. In Figure 3, the TEE side includes one confidential virtual machine as an example. The REE side can include one or more ordinary virtual machines. In Figure 3, the REE side includes two ordinary virtual machines as an example.

[0099] As shown in FIG3 , the computing device 300 also includes a virtual machine manager for managing the confidential virtual machine on the TEE side. In order to distinguish this virtual machine manager from the virtual machine manager deployed in the host kernel of the computing device 100 shown in FIG1 , in the following embodiments, the virtual machine manager for managing the confidential virtual machine on the TEE side is referred to as the first virtual machine manager, and the virtual machine manager deployed in the host kernel for managing the ordinary virtual machine on the REE side is referred to as the second virtual machine manager. In a specific implementation, the virtual machine manager on the TEE side may also be referred to as a trustzone management monitor (TMM) or a trustzone virtual machine manager, etc. This application does not specifically limit the name of the virtual machine manager on the TEE side.

[0100] The first virtual machine manager is used to deploy the confidential virtual machine on the TEE side of the computing device 300 and to start the confidential virtual machine. It can be understood that after starting the confidential virtual machine, the processor can run the confidential virtual machine to process user data.

[0101] The first virtual machine manager can also manage the lifecycle of confidential virtual machines, such as starting and shutting down, resizing, migrating, and releasing them. The first virtual machine manager can also manage apps installed on confidential virtual machines, such as installing, starting, shutting down, upgrading, uninstalling, and migrating apps. The first virtual machine manager can also perform other management operations on confidential virtual machines, which are described in detail below.

[0102] As can be seen from Figure 3, the confidential virtual machine is similar to an ordinary virtual machine, including an operating system kernel and an APP. Among them, the operating system kernel in the confidential virtual machine can be a rich operating system (rich OS) kernel such as Linux, or it can be another type of operating system kernel. In other words, the operating system in the confidential virtual machine can be a rich operating system such as Linux, or it can be another type of operating system. This application does not limit this. It can be understood that when the operating system in the confidential virtual machine is a Linux operating system, the confidential virtual machine can be migrated from an ordinary Linux virtual machine. It can also be understood that when the operating system in the confidential virtual machine is a rich operating system such as Linux operating system, since the rich operating system is more powerful, when the tenant installs an APP (such as an artificial intelligence (AI) application with high requirements for the operating environment) in the confidential virtual machine, it can be installed directly without modifying the APP, and zero-modification installation of the APP can be achieved.

[0103] In a specific embodiment of the present application, as shown in FIG3 , the processor of the computing device 300 runs a first virtual machine manager at EL3. It is understood that since the processor runs the first virtual machine manager at EL3, the first virtual machine manager has the corresponding permissions of EL3 and can access resources on both the TEE side and the REE side. In one possible embodiment, the first virtual machine manager is deployed in the ARM trusted firmware.

[0104] In a possible embodiment, as shown in FIG3 , the REE side may further include a shadow of the confidential virtual machine. The shadow of the confidential virtual machine may be used by the processor to save the context of the confidential virtual machine when the processor stops running the confidential virtual machine and runs other programs. When the processor finishes executing other programs and resumes running the confidential virtual machine, the processor restores the context of the confidential virtual machine saved in the shadow of the confidential virtual machine to the confidential virtual machine, thereby resuming the operation of the confidential virtual machine.

[0105] It should be understood that the computing device 300 is only an example provided in the embodiment of the present application, and the computing device 300 may have more or fewer components than those shown in FIG. 3 , or may have different configurations of components.

[0106] The following describes the process of implementing a virtual machine by the computing device 300 shown in FIG. 3 in conjunction with the flowchart of a virtual machine implementation method provided by the present application shown in FIG. 4A .

[0107] S401: The processor runs the first virtual machine manager under EL3 to create a first confidential virtual machine on the TEE side.

[0108] Specifically, the processor of the computing device 300 can obtain configuration information of the first confidential virtual machine to be created on the REE side, then run the first virtual machine manager under EL3, and create the first confidential virtual machine on the TEE side according to the configuration information of the first confidential virtual machine. The configuration information includes specifications of the first confidential virtual machine to be created, such as the size of the memory, the type of the memory, the size of the memory, the type of the memory, the type of the processor core, the number of processor cores, the computing speed of the processor core, the number of cores of the processor core, the network bandwidth, the operating system kernel and the file system, etc. When creating the first confidential virtual machine, the processor can provide the first confidential virtual machine with virtual hardware resources that match the configuration information based on the configuration information. For example, based on the memory information included in the configuration information, the processor can allocate memory matching the memory information from the memory resources on the TEE side for use by the first confidential virtual machine, simulate a virtual processor core matching the processor core information for use by the first confidential virtual machine based on the processor core information included in the configuration information, and load the operating system kernel and file system included in the configuration information into the memory corresponding to the first confidential virtual machine, thereby achieving the creation of the first confidential virtual machine.

[0109] The processor may obtain the configuration information of the first confidential virtual machine on the REE side by referring to either of the following methods 1 or 2:

[0110] In Method 1, the configuration information can be entered by the user on the interface of computing device 300. The user can enter the required processor core type, number of processor cores, computing power requirements, memory type, number of memories, memory size, memory type, network bandwidth requirements, and so on based on their needs. In this case, the first confidential virtual machine can be considered customized. After obtaining the configuration information entered by the user, computing device 300 stores it in memory on the REE side. Subsequently, the processor running the first virtual machine manager at EL3 retrieves the configuration information from the REE side memory.

[0111] In method 2, the user can select the configuration information from a variety of possible configurations provided by the interface of computing device 300. This means that the user can only select from a variety of configurations and cannot independently determine the processor core type, number of processor cores, required computing power of the processor cores, memory type, number of memories, memory size, memory type, network bandwidth requirements, and so on based on their needs. In this case, the first confidential virtual machine can be understood as being provided by specification, and the user can only select the appropriate specification from a limited set of specifications. After obtaining the user-selected configuration information, computing device 300 stores it in memory on the REE side. Subsequently, the processor running the first virtual machine manager at EL3 retrieves the configuration information from the REE side memory.

[0112] It should be noted that the above-mentioned method 1 and method 2 are merely examples of how the processor obtains the configuration information of the first confidential virtual machine on the REE side. For example, the processor can obtain part of the configuration information of the first confidential virtual machine through the above-mentioned method 1, and obtain another part of the configuration information of the first confidential virtual machine through the above-mentioned method 2. This application does not specifically limit this.

[0113] S402: The processor runs the first virtual machine manager under EL3 to start the first confidential virtual machine.

[0114] It can be understood that after the processor starts the confidential virtual machine, the processor can run the first confidential virtual machine to process user data.

[0115] The following describes the process of the processor running the first confidential virtual machine to process user data in conjunction with the flowchart of a data processing method exemplified in this application as shown in Figure 4B.

[0116] As shown in FIG4B , the method includes the following steps:

[0117] S410: The processor obtains user data on the REE side.

[0118] User data can be facial images to be recognized, voice signals to be recognized, text data to be recognized, etc. It can also be models to be trained and training data, or data to be encrypted and stored. This application does not specifically limit user data.

[0119] S420: The processor runs the first confidential virtual machine on the TEE side to process the user data.

[0120] In a specific implementation, user data can be input into the computing device 300 by the user through an interface provided by the computing device 300. After obtaining the user data input by the user, the computing device 300 stores the user data in the memory on the REE side. The subsequent processor runs the first confidential virtual machine to read and process the user data from the memory on the REE side.

[0121] In this embodiment, when the user data is a facial image to be subjected to facial recognition / a voice signal to be subjected to voice recognition / text data to be subjected to text recognition, the processor runs the first confidential virtual machine on the TEE side to recognize the facial image / voice signal / text data to obtain the corresponding recognition result, and then provides the recognition result to the user on the REE side. When the user data is a model to be trained and training data, the processor runs the first confidential virtual machine on the TEE side to train the model using the training data to obtain a trained model, and then provides the trained model to the user on the REE side. In other words, the first confidential virtual machine on the TEE side communicates with the external network of the computing device 300 through the REE side. It can be understood that this can improve the security of the first confidential virtual machine.

[0122] When the user data is data to be encrypted and stored, the processor runs the first confidential virtual machine on the TEE side to encrypt the data and then stores it in the corresponding location.

[0123] In a possible embodiment, in S410, the user data obtained by the processor on the REE side is encrypted data. Before the processor executes S420, the processor will run the first virtual machine manager under EL3 to obtain the decryption key stored on the TEE side for decrypting the encrypted data, and then use the decryption key to decrypt the encrypted data to obtain the plaintext of the user data. The processor then runs the first confidential virtual machine to process the user data. In other words, the user data exists in an encrypted state on the REE side, and the decryption key is stored on the TEE side. The host operating system kernel and software (such as KVM, ordinary virtual machines, etc.) on the REE side cannot obtain the decryption key stored on the TEE side. Therefore, even if the attacker breaks through the host operating system kernel and software on the REE side and steals the encrypted data, it cannot decrypt the plaintext of the user data. This can meet the requirement that user data is not stolen by the host operating system kernel and software on the REE side, further improving user data security.

[0124] In a specific embodiment of the present application, after creating the first confidential virtual machine, the computing device 300 may also manage the first confidential virtual machine. The management content is as follows:

[0125] ① Manage the life cycle of the first confidential virtual machine.

[0126] The processor of the computing device 300 can obtain the first management command for the life cycle of the first confidential virtual machine on the REE side, and then run the first virtual machine manager under EL3 to perform one or any combination of the following operations on the first confidential virtual machine according to the first management command: power on, power off, change specifications, migrate, and release (destruction).

[0127] Specifically, before releasing the first confidential virtual machine, the processor may first determine whether the first confidential virtual machine is in a non-operating state. If the processor determines that the first confidential virtual machine is in a non-operating state, the processor may release the first confidential virtual machine. If the processor determines that the first confidential virtual machine is in an operating state, the processor may wait until the first confidential virtual machine completes its operation before releasing the first confidential virtual machine. The specific process of the processor releasing the first confidential virtual machine may include erasing context information of the first confidential virtual machine, erasing content related to the first confidential virtual machine in the memory of the computing device 300, and releasing resources occupied by the first confidential virtual machine, such as memory.

[0128] ② Manage the APP on the first confidential virtual machine.

[0129] The processor of the computing device 300 can obtain the second management command for the first confidential virtual machine on the REE side, and then run the first virtual machine manager under EL3 to perform one or any combination of the following operations on the first confidential virtual machine according to the second management command: install, start, shut down, upgrade, uninstall and migrate APP.

[0130] ③ Manage the memory of the first confidential virtual machine.

[0131] The processor of the computing device 300 can run the first virtual machine manager at EL3 to create, modify, or destroy a first-level page table or a second-level page table of the first confidential virtual machine to manage the memory of the first confidential virtual machine. The first-level page table of the first confidential virtual machine refers to a page table that maps the virtual address (VA) of the first confidential virtual machine to a physical address (PA), and the second-level page table of the first confidential virtual machine refers to a page table that maps the VA of the first confidential virtual machine to an intermediate physical address (IPA), and maps the IPA to the PA allocated to the first confidential virtual machine in the computing device.

[0132] ④ Handle the exceptions that occur in the first confidential virtual machine and manage the context of the first confidential virtual machine.

[0133] When an exception occurs in the first confidential virtual machine, the processor of the computing device 300 may execute the first virtual machine manager at EL3 to establish a context for the first confidential virtual machine, then handle the exception that occurred in the first virtual machine. After handling the exception, the processor may restore the established context of the first confidential virtual machine to the first confidential virtual machine to resume operation of the first confidential virtual machine. The exception that occurs in the first confidential virtual machine may include a page fault exception, an MMIO operation exception, a wait for interrupt (WFI), a wait for event (WFE), executing a hypervisor call (HVC) instruction, executing an SMC instruction, reading or writing a system register, an instruction abort, a data abort (such as a data abort sync exception), an interrupt request (IRQ) and a fast interrupt request (FIQ), a power management instruction exit from the power management interface (PSCI), and a system error exit. An MMIO operation refers to an operation in which the first confidential virtual machine accesses an I / O device through MMIO technology, and an MMIO operation exception refers to an exception caused by the first confidential virtual machine performing an MMIO operation.

[0134] In a possible embodiment, when the exception occurring in the first confidential virtual machine is a page fault exception, an MMIO operation exception, or a data termination synchronization exception, the process in which the processor runs the first virtual machine manager at EL3 to handle the exception occurring in the first confidential virtual machine may specifically be: the processor runs the first virtual machine manager at EL3, receives a page fault exception handling instruction, an MMIO operation exception handling instruction, or a data termination synchronization exception handling instruction sent by the first confidential virtual machine, and then, the processor runs the first virtual machine manager at EL3 to handle the page fault exception occurring in the first confidential virtual machine according to the page fault exception handling instruction, or, the processor runs the first virtual machine manager at EL3 to handle the MMIO operation exception occurring in the first confidential virtual machine according to the MMIO operation exception handling instruction, or, the processor runs the first virtual machine manager at EL3 to handle the data termination synchronization exception occurring in the first confidential virtual machine according to the data termination synchronization exception handling instruction. Here, the page fault exception handling instruction, the MMIO operation exception handling instruction, or the data termination synchronization exception handling instruction is an SMC type instruction.

[0135] ⑤ Before running the first confidential virtual machine, check the security of the first confidential virtual machine and the security of the computing device 300.

[0136] In a possible embodiment, the processor can provide the configuration information of the first confidential virtual machine (such as the type of virtual processor cores, the number of virtual processor cores, memory address, etc.), the version information of the operating system installed on the first confidential virtual machine, and the APP name, etc. to the user on the REE side for security check by running the first virtual machine manager under EL3, that is, the user determines whether the first confidential virtual machine is a secure virtual machine that meets his or her expectations, or a non-secure virtual machine that poses a security threat. When the processor runs the first virtual machine manager under EL3 and obtains feedback from the user that the first confidential virtual machine is a secure virtual machine that meets his or her expectations, the processor determines that the first confidential virtual machine is a secure virtual machine and starts the first confidential virtual machine. Otherwise, the processor determines that the first confidential virtual machine is a non-secure virtual machine and does not start the first confidential virtual machine. Optionally, the processor can also check the security of the first confidential virtual machine in other ways, which is not specifically limited in this application.

[0137] In one possible embodiment, the processor can run a first virtual machine manager at EL3 and provide the certificate of the computing device 300 to the user on the REE side for a legitimacy check. This allows the user to determine whether the computing device 300 is a secure device that meets their expectations or a non-secure device that poses a security threat. If the processor runs the first virtual machine manager at EL3 and obtains feedback from the user confirming that the computing device is a secure device that meets their expectations, the processor determines that the computing device is a secure device and starts the first virtual machine. Otherwise, the processor determines that the computing device is a non-secure device and does not start the first virtual machine. Optionally, the processor may also check the security of the computing device 300 through other means, which are not specifically limited in this application.

[0138] Optionally, if the processor detects that the configuration information of the first confidential virtual machine, the operating system kernel version installed on the first confidential virtual machine, the APP name, etc. have been changed during the operation of the first confidential virtual machine, the processor can re-determine the security of the changed first confidential virtual machine. If it is determined that the changed first confidential virtual machine is safe, the processor can start and run the changed first confidential virtual machine, otherwise it will refuse to start the changed first confidential virtual machine.

[0139] Optionally, if the processor detects that the certificate of the computing device 300 has expired or detects that there is a security risk in the computing device 300 while the processor is running the first confidential virtual machine, the processor can remind the user on the REE side that the certificate of the computing device 300 has expired or provide the user with information that there is a security risk in the computing device 300, allowing the user to determine whether to continue using the computing device 300 to run the first confidential virtual machine.

[0140] It can be understood that running the first confidential virtual machine after checking the security of the first confidential virtual machine and the security of the computing device 300, and continuing to monitor the security of the first confidential virtual machine and the computing device 300 during the operation of the first confidential virtual machine, can improve the security of the first confidential virtual machine, thereby improving the security of user data stored or used in the first confidential virtual machine.

[0141] ⑥ Manage the various virtualization functions of the first confidential virtual machine.

[0142] Before running the first confidential virtual machine on the TEE side, the processor of the computing device 300 may also obtain one or any combination of the following on the REE side or the TEE side: a virtual interrupt of the first confidential virtual machine, a virtual clock for use by the first confidential virtual machine, and memory-mapped input / output (MMIO) information for use by the first confidential virtual machine, and then inject this information into the first confidential virtual machine. Thereafter, the first virtual machine is run based on this information. The virtual clock can be used by the first confidential virtual machine to measure time intervals, which can be used for task scheduling, and the MMIO information can be used by the first confidential virtual machine to access I / O devices in the same way as memory.

[0143] It can be understood that if the processor obtains the virtual interrupt of the first confidential virtual machine, the virtual clock and MMIO information used by the first confidential virtual machine on the REE side, rather than obtaining this information on the TEE side, the trusted computing base (TCB) on the TEE side can be made thinner.

[0144] In one possible embodiment, as shown in FIG5 , the first virtual machine manager includes a virtual interrupt register 10, a virtual clock register 20, and an MMIO register 30. The virtual interrupt register 10 is used to store virtual interrupts of the first confidential virtual machine simulated by the processor, the virtual clock register 20 is used to store a virtual clock simulated by the processor for use by the first confidential virtual machine, and the MMIO register 30 is used to store MMIO information simulated by the processor for use by the first confidential virtual machine. The process by which the processor injects virtual interrupts, virtual clocks, and MMIO information into the first confidential virtual machine may be as follows: the processor triggers an interrupt using a corresponding register in the first virtual machine manager running at EL3 to generate an interrupt signal, and sends the interrupt signal to the first confidential virtual machine. Upon receiving the interrupt signal, the first confidential virtual machine reads the interrupt information to be processed from the corresponding register in the first virtual machine manager based on the interrupt signal. It is understood that since the processor runs the first virtual machine manager at EL3, the instructions executed by the first virtual machine manager when reading the interrupt information to be processed from the corresponding register in the first virtual machine manager based on the interrupt signal are SMC-type instructions.

[0145] In a possible embodiment, as shown in FIG5 , the first virtual machine manager further includes a virtual machine management module 40, a memory management module 50, an exception handling module 60, and a remote attestation module 70. The virtual machine management module 40 is used to perform the operations of creating and starting the first confidential virtual machine on the TEE side as described in S401 and S402 above, the operations of managing the life cycle of the first confidential virtual machine as described in ① above, and the operations of managing the APP on the first confidential virtual machine as described in ② above; the memory management module 50 is used to perform the operations of managing the memory of the first confidential virtual machine as described in ③ above; the exception handling module 60 is used to perform the operations of handling exceptions of the first confidential virtual machine as described in ④ above. Optionally, the exception handling module 60 can also be used to perform the operations of managing the context of the first confidential virtual machine as described in ④ above; the remote attestation module 70 is used to perform the operations of checking the security of the first confidential virtual machine and checking the security of the computing device 300 as described in ⑤ above. For details, please refer to the relevant description above. For the sake of brevity of the specification, it will not be elaborated here.

[0146] It should be understood that the names of the various modules in the first virtual machine manager shown in Figure 5 are merely examples. For example, the virtual machine management module 40 can also be called the first confidential virtual machine management module, the remote attestation module 70 can also be called the security check module, etc., and should not be regarded as specific limitations on the names of the various modules in the first virtual machine manager.

[0147] In a specific implementation, the operations performed by the processor of the computing device 300 on the REE side may be implemented by the processor running a second virtual machine manager on the REE side.

[0148] It should be noted that in addition to performing the above operations, the processor of the computing device 300 can also perform other operations, such as creating, modifying and destroying the secondary page table on the REE side, such as simulating virtualized I / O devices such as virtual disks, VNICs, etc. for use by the first confidential virtual machine. This application does not specifically limit the operations that the processor of the computing device 300 can perform.

[0149] To facilitate a clearer understanding of the process of creating and running the first confidential virtual machine, the following describes the process of creating and running the first confidential virtual machine from the perspective of a second virtual machine manager such as KVM, as shown in FIG6 .

[0150] As shown in Figure 6, the process includes the following steps:

[0151] S601: The second virtual machine manager obtains a creation instruction, where the creation instruction carries configuration information of a first confidential virtual machine to be created. The configuration information includes memory information allocated to the first confidential virtual machine, virtual processor core information used by the first confidential virtual machine, an operating system kernel, and a file system.

[0152] The configuration information may also include other content, which is not specifically limited in this application.

[0153] S602: The second virtual machine manager calls the memory partitioning interface provided by the first virtual machine manager, and passes the memory information carried by the creation instruction to the first virtual machine manager, so that the first virtual machine manager divides the memory for use by the first confidential virtual machine in the memory resources on the TEE side based on the memory information.

[0154] S603: The second virtual machine manager calls the virtual processor core creation interface provided by the first virtual machine manager, and passes the virtual processor core information carried in the creation instruction to the first virtual machine manager, so that the first virtual machine manager simulates a virtual machine processor core for use by the first confidential virtual machine based on the virtual processor core information.

[0155] S604: The second virtual machine manager calls the communication interface provided by the first virtual machine manager to pass the operating system kernel and file system for use by the first confidential virtual machine to the first virtual machine manager, so that the first virtual machine manager stores the operating system kernel and file system for use by the first confidential virtual machine in the above-mentioned memory for use by the first confidential virtual machine.

[0156] S605: The second virtual machine manager calls the virtual machine running interface provided by the first virtual machine manager, and passes the virtual interrupt, virtual clock and MMIO information of the first confidential virtual machine to the first virtual machine manager, so that the first virtual machine manager injects the virtual interrupt, virtual clock and MMIO information into the first confidential virtual machine and starts running the first confidential virtual machine.

[0157] S606: The second virtual machine manager receives the exception handling instruction from the first confidential virtual machine forwarded by the first virtual machine manager.

[0158] S607: The second virtual machine manager handles the exception that occurs in the first confidential virtual machine according to the exception handling instruction.

[0159] S608: After processing the exception of the first confidential virtual machine, the second virtual machine manager calls the virtual machine running interface provided by the first virtual machine manager again, so that the first virtual machine manager resumes the running of the first confidential virtual machine.

[0160] In a specific embodiment of the present application, when the processor of the computing device 300 needs to simulate a virtualized I / O device for use by the first confidential virtual machine, it can be achieved through VirtIO technology.

[0161] When the computing device 300 simulates a virtualized I / O device for use by the first confidential virtual machine using VirtIO technology, as shown in FIG7 , the operating system kernel of the first confidential virtual machine on the TEE side includes a VirtIO front-end driver, and the second virtual machine manager, such as KVM, includes a VirtIO back-end driver. In addition to the various modules shown in FIG5 , the first virtual machine manager may also include a memory synchronization module. The memory resources on the TEE side include a first memory (VRING) (not shown in FIG7 ) for data transmission between the VirtIO front-end driver and the VirtIO back-end driver. The memory resources on the REE side include a second memory (not shown in FIG7 ) that is mapped to the first memory. The second memory can be regarded as a shadow memory of the first memory, and the second memory is generally the same size as the first memory.

[0162] In computing device 300 shown in FIG7 , specifically, the processor of computing device 300 can run the VirtIO backend driver to create a virtualized I / O device. Then, after starting the first confidential virtual machine, the processor can run the VirtIO front-end driver in the first confidential virtual machine to load the virtualized I / O device, thereby emulating the virtualized I / O device. In this way, computing device 300 can implement I / O communication for the first confidential virtual machine using VirtIO technology.

[0163] The memory synchronization module is used to synchronize data (hereinafter referred to as first data) in the first memory that the VirtIO front-end driver needs to send to the VirtIO back-end driver during I / O communication operations of the first confidential virtual machine implemented by the computing device 300 using VirtIO technology, and to synchronize data (hereinafter referred to as second data) in the second memory that the VirtIO back-end driver needs to send to the VirtIO front-end driver. The first data can also be understood as data on the external network that the first confidential virtual machine needs to transmit to the computing device 300, and the second data can also be understood as data on the external network that the first confidential virtual machine needs to receive from the computing device 300.

[0164] It can be seen that in the computing device 300 and the virtual machine implementation method provided in the present application, since the processor of the computing device 300 runs the first virtual machine manager under EL3 to start the first confidential virtual machine, and the first confidential virtual machine is deployed on the TEE side, the virtual machine can be isolated from the host operating system kernel (located on the REE side) through the first virtual machine manager. In other words, the virtual machine is protected by the first virtual machine manager under EL3 and can avoid being accessed by the host operating system kernel on the REE side. Therefore, even if the attacker breaks into the host operating system kernel, the attacker cannot control the virtual machine through the virtual machine manager in the host operating system kernel, such as KVM, thereby protecting the security of the virtual machine in the computing device, and then protecting the security of user data in the virtual machine.

[0165] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0166] The above describes in detail the virtual machine implementation method provided by the present application. Based on the same inventive concept, the following further introduces the virtual machine implementation apparatus and computing device provided by the present application.

[0167] It should be understood that the unit modules within the virtual machine implementation device may be divided into various types. Each module may be a software module, a hardware module, or partly a software module and partly a hardware module. This application does not limit this. When the virtual machine implementation device includes multiple unit modules, each of the multiple unit modules may be deployed on the same computing device.

[0168] Referring to Figure 8, Figure 8 is a schematic diagram of the structure of a virtual machine implementation device 800 exemplified in this application, which can be applied to the computing device 300 shown in Figure 3 in which the hardware resources are divided into the REE side and the TEE side. As shown in Figure 8, the virtual machine implementation device 800 includes: a processing module 810. The functions of each module of the virtual machine implementation device 800 are exemplarily introduced below. It should be understood that the functions of each module described below are only functions that the virtual machine implementation device 800 can have in some embodiments of this application, and this application does not limit the functions of each module.

[0169] The processing module 810 is configured to run a first virtual machine manager under EL3 to start a first virtual machine, where the first virtual machine is deployed on the TEE side.

[0170] In this embodiment, the first virtual machine can be understood as the above-mentioned first confidential virtual machine.

[0171] In some possible embodiments, as shown in FIG8 , the apparatus 800 further includes an acquisition module 820 ;

[0172] The acquisition module 820 is used to obtain encrypted user data on the REE side;

[0173] The processing module 810 is further configured to run the first virtual machine manager under EL3, obtain the decryption key stored on the TEE side, and use the decryption key to decrypt the encrypted user data to obtain the user data in plain text;

[0174] The processing module 810 is further configured to run the first virtual machine to process the above-mentioned user data plaintext.

[0175] In some possible embodiments, the acquisition module 820 is further used to acquire a creation instruction on the REE side, where the creation instruction carries configuration information of the first virtual machine to be created; the processing module 810 is further used to run the first virtual machine manager under EL3, and create the first virtual machine on the TEE side according to the configuration information carried by the creation instruction.

[0176] In some possible embodiments, the acquisition module 820 is further configured to simulate obtaining first data on the REE side, where the first data includes one or any combination of the following: a virtual interrupt of the first virtual machine, a virtual clock used by the first virtual machine, and MMIO information used by the first virtual machine; the processing module 810 is further configured to write the first data into the first virtual machine manager; the processing module 810 is further configured to run the first virtual machine manager under EL3 and inject the first data into the first virtual machine; and the processing module 810 is further configured to run the first virtual machine according to the first data.

[0177] In some possible embodiments, the above-mentioned processing module 810 is also used to run the first virtual machine manager under EL3, determine whether the first virtual machine is a secure virtual machine, and start the first virtual machine if it is determined that the first virtual machine is a secure virtual machine; if it is determined that the first virtual machine is a non-secure virtual machine, do not start the first virtual machine.

[0178] In some possible embodiments, the processing module 810 is further configured to run a first virtual machine manager under EL3 to determine whether the computing device is a secure device, and to start the first virtual machine if the computing device is determined to be a secure device; and not to start the first virtual machine if the computing device is determined to be a non-secure device.

[0179] In some possible embodiments, the acquisition module 820 is further used to acquire a first management command for the life cycle of the first virtual machine on the REE side; the processing module 810 is further used to run the first virtual machine manager under EL3, and perform one or any combination of the following operations on the first virtual machine according to the first management command: power on, power off, specification change, migration, and release.

[0180] In some possible embodiments, the first acquisition module 820 is further used to obtain a second management command for the first virtual machine on the REE side; the processing module 810 is further used to run the first virtual machine manager under EL3, and perform one or any combination of the following operations on the first virtual machine according to the second management command: install, start, shut down, upgrade, uninstall and migrate applications.

[0181] In some possible embodiments, the processing module 810 is further used to: when an exception occurs in the first virtual machine, run the first virtual machine manager under EL3 to establish the context of the first virtual machine, handle the exception that occurs in the first virtual machine, and after handling the exception that occurs in the first virtual machine, restore the context of the first virtual machine to the first virtual machine to resume the operation of the first virtual machine.

[0182] In some possible embodiments, when the exception occurring in the first virtual machine is a page fault exception, an MMIO operation exception, or a data abort synchronization exception, the processing module 810 is configured to run the first virtual machine manager at EL3, receive a page fault exception handling instruction, an MMIO operation exception handling instruction, or a data abort synchronization exception handling instruction sent by the first virtual machine, and handle the page fault exception occurring in the first virtual machine according to the page fault exception handling instruction, or handle the MMIO operation exception occurring in the first virtual machine according to the MMIO operation exception handling instruction, or handle the data abort synchronization exception occurring in the first virtual machine according to the data abort synchronization exception handling instruction. The page fault exception handling instruction, the MMIO operation instruction, or the data abort synchronization exception handling instruction is an SMC-type instruction, and the MMIO operation exception is an exception caused when the first virtual machine performs an MMIO operation.

[0183] In some possible embodiments, the processing module 810 is further used to run the first virtual machine manager under EL3 and perform one or any combination of the following operations: creating, changing or destroying the first-level page table of the first virtual machine, where the first-level page table of the first virtual machine is a page table that maps the VA of the first virtual machine to the PA allocated to the first virtual machine in the computing device.

[0184] In some possible embodiments, the REE side includes a second virtual machine manager, a VirtIO front-end driver is deployed in the first virtual machine manager, a VirtIO back-end driver is deployed in the second virtual machine manager, a memory synchronization module is deployed in the first virtual machine manager, the TEE side includes a first memory for data transmission between the VirtIO front-end driver and the VirtIO back-end driver, the REE side includes a second memory, and the memory synchronization module includes a mapping relationship between the first memory and the second memory; the processing module 810 is used to run the memory synchronization module to synchronize first data in the first memory to the second memory according to the mapping relationship between the first memory and the second memory, where the first data is data that the VirtIO front-end driver needs to send to the VirtIO back-end driver, or the processing module 810 is used to run the memory synchronization module to synchronize second data in the second memory to the first memory according to the mapping relationship between the first memory and the second memory, where the second data is data that the VirtIO front-end driver needs to receive from the VirtIO back-end driver.

[0185] Specifically, the specific implementation of various operations performed by the virtual machine implementation device 800 can refer to the description in the relevant content of the above virtual machine implementation method embodiment, and for the sake of brevity of the specification, it will not be repeated here.

[0186] 9, which is a schematic diagram of the structure of another computing device 300 provided by the present application, the computing device 300 includes: a processor 310, a memory unit 320, a communication interface 330, a storage 340, an input device 350, and an output device 360, wherein the processor 310, the memory unit 320, the communication interface 330, the storage 340, the input device 350, and the output device 360 ​​can be interconnected via a bus 370.

[0187] The processor 310 can read the program code (including instructions) stored in the memory unit 320 and execute the program code stored in the memory unit 320, so that the computing device 300 performs the steps in the virtual machine implementation method provided by the above method embodiment.

[0188] The processor 310 can have a variety of specific implementation forms. For example, the processor 310 can be at least one central processing unit (CPU), as shown in Figure 9, including CPU0 and CPU1. The processor 310 can also be a graphics processing unit (GPU), etc. The processor 310 can also be a single-core processor or a multi-core processor. The processor 310 can be a combination of a CPU and a hardware chip. The above-mentioned hardware chip can be implemented as an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The above-mentioned PLD can be implemented as a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The processor 310 can also be implemented solely using a logic device with built-in processing logic, such as an FPGA or a digital signal processor (DSP).

[0189] The memory unit 320 is used to store the kernel, program code, and program data generated when the processor 310 executes the program code stored in the memory unit 320. The program code includes code from the acquisition module 820 and code from the processing module 810, and the program data includes user data, configuration information of the first confidential virtual machine, and processing results obtained by the first confidential virtual machine on the user data.

[0190] The communication interface 330 may be a wired interface (e.g., an Ethernet interface, a fiber optic interface, or other types of interfaces (e.g., an InfiniBand (IB) interface)) or a wireless interface (e.g., a cellular network interface or a wireless local area network interface) for communicating with other computing devices or apparatuses. When the communication interface 330 is a wired interface, the communication interface 330 may employ a protocol suite above the Transmission Control Protocol / Internet Protocol (TCP / IP), such as the Remote Function Call (RFC) protocol, the Simple Object Access Protocol (SOAP) protocol, the Simple Network Management Protocol (SNMP) protocol, the Common Object Request Broker Architecture (CORBA) protocol, and distributed protocols, etc.

[0191] Memory 340 may be a non-volatile memory, such as read-only memory (ROM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Memory 340 may also be a volatile memory, such as random access memory (RAM), which is used as an external cache.

[0192] The input device 350 may include a mouse and a keyboard, etc. The user may input data or instructions to the computing device 300 through the input device 350 , such as the aforementioned data to be processed, configuration information of the confidential virtual machine, the first management instruction, the second management instruction, etc.

[0193] The output device 360 ​​may include a display, and the computing device 300 may provide data to the user through the display, such as providing the user with the results of processing the data to be processed by the confidential virtual machine as described above. The display may include a cathode ray tube display (CRT), a plasma display panel (PDP), a liquid crystal display (LCD), etc. Taking the LCD display as an example, the liquid crystal display includes a liquid crystal panel and a backlight module, wherein the liquid crystal display panel includes a polarizing film, a glass substrate, a black matrix, a color filter, a protective film, a common electrode, a calibration layer, a liquid crystal layer (liquid crystal, spacer, sealant), a capacitor, a display electrode, a prism layer, and a light-scattering layer. The backlight module includes: an illumination light source, a reflector, a light guide plate, a diffuser, a brightness enhancement film (prism sheet), and a frame, etc.

[0194] Bus 370 can be a PCIE or extended industry standard architecture (EISA) bus, etc. Bus 370 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, FIG9 shows only one thick line, but this does not mean that there is only one bus or only one type of bus.

[0195] It should be understood that the computing device 300 of the embodiment of the present application may correspond to the computing device including the virtual machine implementation device 800 in the embodiment of the present application, and may correspond to executing the corresponding subjects in the method shown in Figures 4A, 4B, and 6 in the embodiment of the present application, and the operations and / or functions of each module in the computing device 300 are respectively for implementing the corresponding processes of the method shown in Figures 4A, 4B, and 6. For the sake of brevity, they will not be repeated here.

[0196] It should be understood that computing device 300 is only an example provided for an embodiment of the present application, and computing device 300 may have more or fewer components than those shown in FIG. 9 , may combine two or more components, or may have different configuration implementations of components.

[0197] The present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed, some or all of the steps of the virtual machine implementation method described in the above embodiment can be implemented.

[0198] The present application also provides a computer program product. When the computer program product is read and executed by a computer, it can implement some or all of the steps of the virtual machine implementation method recorded in the above method embodiment.

[0199] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0200] In the above embodiments, it can be implemented in whole or in part by software, hardware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium.

[0201] The above is only a specific embodiment of the present application. Those skilled in the art may conceive of changes or substitutions based on the specific embodiment provided in this application, and all such changes or substitutions shall fall within the scope of protection of this application.

Claims

1. A virtual machine implementation method, characterized in that: Applied to a computing device, the hardware resources of the computing device are divided into a rich execution environment (REE) side and a trusted execution environment (TEE) side, the computing device includes a first virtual machine manager, and the method includes: The processor of the computing device runs the first virtual machine manager at exception level EL3 to start a first virtual machine, and the first virtual machine is deployed on the TEE side.

2. The method according to claim 1, characterized in that After starting the first virtual machine, the method further includes: The processor obtains encrypted user data at the REE side; The processor runs the first virtual machine manager under the EL3 to obtain the decryption key stored on the TEE side, and uses the decryption key to decrypt the encrypted user data to obtain the user data; The processor runs the first virtual machine to process the user data.

3. The method according to claim 1 or 2, characterized in that: Before starting the first virtual machine, the method further includes: The processor obtains a creation instruction on the REE side, where the creation instruction carries configuration information of the first virtual machine to be created; The processor runs the first virtual machine manager under the EL3, and creates the first virtual machine on the TEE side according to the configuration information carried by the creation instruction.

4. The method according to claim 2 or 3, characterized in that: The method further comprises: The processor simulates and obtains first data at the REE side, where the first data includes one or any combination of the following: a virtual interrupt of the first virtual machine, a virtual clock used by the first virtual machine, and memory mapped input and output MMIO information used by the first virtual machine; The processor writes the first data into the first virtual machine manager; The processor runs the first virtual machine manager under the EL3 to inject the first data into the first virtual machine; The processor runs the first virtual machine, including: The processor runs the first virtual machine according to the first data.

5. The method according to any one of claims 1 to 4, characterized in that: The processor starts the first virtual machine, including: When the processor runs the first virtual machine manager under the EL3 and determines that the first virtual machine is a secure virtual machine, the processor starts the first virtual machine.

6. The method according to any one of claims 1 to 5, characterized in that: The processor starts the first virtual machine, including: When the processor runs the first virtual machine manager under the EL3 and determines that the computing device is a secure device, the processor starts the first virtual machine.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: The processor obtains, on the REE side, a first management command for the life cycle of the first virtual machine; The processor runs the first virtual machine manager under the EL3, and performs one or any combination of the following operations on the first virtual machine according to the first management command: power on, power off, change specifications, migrate, and release.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: The processor obtains, on the REE side, a second management command for the first virtual machine; The processor runs the first virtual machine manager under the EL3, and performs one or any combination of the following operations on the first virtual machine according to the second management command: installing an application, starting the application, shutting down the application, upgrading the application, uninstalling the application, and migrating the application.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: When an exception occurs in the first virtual machine, the processor runs the first virtual machine manager under the EL3 to establish the first virtual machine. The context of the virtual machine; The processor runs the first virtual machine manager under the EL3 to process an exception that occurs in the first virtual machine; When the processor has processed the exception that occurred in the first virtual machine, the processor runs the first virtual machine manager under the EL3 to restore the context of the first virtual machine to the first virtual machine, so as to resume the operation of the first virtual machine.

10. The method according to claim 9, characterized in that When the exception occurring in the first virtual machine is a page fault exception, an MMIO operation exception, or a data termination synchronization exception, the processor runs the first virtual machine manager to process the exception occurring in the first virtual machine, including: The processor runs the first virtual machine manager to receive a page fault exception handling instruction, an MMIO operation exception handling instruction, or a data termination synchronization exception handling instruction sent by the first virtual machine, wherein the page fault exception handling instruction, the MMIO operation exception handling instruction, or the data termination synchronization exception handling instruction is an instruction of a safe mode calling SMC type, and the MMIO operation exception is an exception caused when the first virtual machine performs an MMIO operation; The processor runs the first virtual machine manager to process the page fault exception according to the page fault exception processing instruction; Alternatively, the processor runs the first virtual machine manager to handle the MMIO operation exception according to the MMIO operation exception handling instruction; Alternatively, the processor runs the first virtual machine manager to process the data termination synchronization exception according to the data termination synchronization exception processing instruction.

11. The method according to any one of claims 1 to 10, characterized in that: The method further comprises: The processor runs the first virtual machine manager under the EL3 to perform one or any combination of the following operations: create, change or destroy a first-level page table of the first virtual machine, where the first-level page table of the first virtual machine is a page table that maps the virtual address VA of the first virtual machine to the physical address PA allocated to the first virtual machine in the computing device.

12. The method according to any one of claims 1 to 11, characterized in that: The REE side includes a second virtual machine manager, the first virtual machine is deployed with a virtualized input and output VirtIO front-end driver, the second virtual machine manager is deployed with a VirtIO back-end driver, the first virtual machine manager is deployed with a memory synchronization module, the TEE side includes a first memory for data transmission between the VirtIO front-end driver and the VirtIO back-end driver, the REE side includes a second memory, and the memory synchronization module includes a mapping relationship between the first memory and the second memory; The method further comprises: The processor runs the memory synchronization module to synchronize first data in the first memory to the second memory according to a mapping relationship between the first memory and the second memory, wherein the first data is data that the VirtIO front-end driver needs to send to the VirtIO back-end driver; or, The processor runs the memory synchronization module to synchronize second data in the second memory to the first memory according to a mapping relationship between the first memory and the second memory, where the second data is data from the VirtIO backend driver that the VirtIO front-end driver needs to receive.

13. A computing device, characterized in that: The computing device comprises a processor and a memory; the processor of the computing device is configured to execute instructions stored in the memory of the computing device, so that the computing device executes the method according to any one of claims 1 to 12.

14. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device, the computing device performs the method according to any one of claims 1 to 12.

Images