Command processing method and related device
By configuring a cryptographic module in the processor, and using virtual device identifiers and memory key information to encrypt and decrypt virtual machine command data, security risks during virtual machine operation are resolved, and secure data storage and transmission are achieved.
Patent Information
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- HYGON INFORMATION TECH CO LTD
- Filing Date
- 2025-06-11
- Publication Date
- 2026-06-04
AI Technical Summary
Existing virtual machines pose security risks when running virtual devices, especially since virtual devices cannot decrypt encrypted data in memory, which leads to the risk of command data being stolen during transmission.
By configuring a cryptographic module in the processor, the target command data is encrypted and decrypted using virtual device identifiers and memory key information. This ensures that the command data is stored encrypted in memory and decrypted when needed, thus achieving secure data transmission and execution.
It improves data security during virtual machine calls to virtual devices, prevents the risk of virtual machine managers stealing command data, and ensures the security of encrypted storage and decryption processing of data.
Smart Images
Figure CN2025100423_04062026_PF_FP_ABST
Abstract
Description
Command processing methods and related equipment
[0001] Related applications
[0002] This application claims priority to Chinese Patent Application No. 202411749135.8, filed on November 29, 2024, entitled "Command Processing Method and Related Apparatus", the entire contents of which are incorporated herein by reference. Technical Field
[0003] This invention relates to the field of virtual machine security, specifically to a command processing method and related devices. Background Technology
[0004] With the development of new technologies such as cloud computing and big data, virtualization technology is being used more and more widely. Through virtualization, a physical host can be virtualized into multiple virtual machines (VMs), thereby efficiently utilizing the host's hardware resources. Specifically, in virtualization, peripheral resources can be virtualized into virtual devices and allocated to VMs, thus achieving efficient utilization of these resources.
[0005] However, existing virtual machines pose security risks when running virtual devices. Summary of the Invention
[0006] In view of this, embodiments of the present invention provide a command processing method and related equipment to improve the data security of virtual machines during the running of virtual devices.
[0007] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions.
[0008] In a first aspect, embodiments of the present invention provide a command processing method applied to a processor, comprising:
[0009] Obtain encrypted command information sent by the virtual machine manager. The encrypted command information includes the memory address of the target command data and the virtual device identifier of the target virtual device. The memory is used to encrypt the target command data based on a memory key corresponding to the target virtual machine.
[0010] Based on the virtual device identifier, determine the memory key information corresponding to the target virtual machine;
[0011] Based on the memory key information and the memory address of the target command data, the plaintext of the target command data is decrypted.
[0012] The target command is executed in plaintext based on the target command data to obtain the command result of the target command.
[0013] Optionally, determining the memory key information corresponding to the target virtual machine based on the virtual device identifier specifically involves determining the memory key information based on the device attribute information of the virtual device preset in the processor.
[0014] Optionally, after executing the target command in plaintext based on the target command data to obtain the command result of the target command, the method further includes:
[0015] Based on the memory key information, the command result of the target command is encrypted and stored in memory;
[0016] The result acquisition notification message of the command is fed back to the virtual machine manager, so that the virtual machine manager forwards the result acquisition notification message to the target virtual machine.
[0017] Optionally, the step of encrypting the command result of the target command and storing it in memory based on the memory key information includes:
[0018] Determine the virtual device identifier of the target virtual device corresponding to the command result;
[0019] Based on the virtual device identifier, determine the memory key information of the target virtual machine corresponding to the command result;
[0020] Using the memory key corresponding to the memory key information, the command result of the target command is encrypted and stored in memory.
[0021] Optionally, before obtaining the encrypted information of the command sent by the virtual machine manager, the method further includes:
[0022] Based on the virtual device creation request sent by the virtual machine manager, the target virtual device is created, and the virtual device identifier of the target virtual device is returned to the virtual machine manager.
[0023] After the virtual machine manager allocates the target virtual device to the target virtual machine, a correspondence is established between the virtual device identifier and the memory key information of the target virtual machine based on the allocation information fed back by the virtual machine manager.
[0024] Optionally, based on the allocation information fed back by the virtual machine manager, a correspondence is established between the virtual device identifier and the memory key information of the target virtual machine, including:
[0025] The allocation information is recorded in the device attribute information corresponding to the target virtual device;
[0026] Query and obtain the memory key information of the target virtual device;
[0027] The memory key information is recorded in the device attribute information corresponding to the target virtual device.
[0028] Secondly, embodiments of the present invention provide a command processing method applied to a virtual machine manager, comprising:
[0029] Obtain the initial information of the command sent by the target virtual machine; wherein, the initial information of the command includes the memory address of the target command data, and the memory encrypts the target command data based on the memory key corresponding to the target virtual machine;
[0030] Configure the virtual device identifier of the target virtual device for the command initial information, and use the command initial information and the virtual device identifier as command encryption information;
[0031] The encrypted command information is sent to the processor so that the processor executes the command processing method as described in the first aspect.
[0032] Optionally, configuring the virtual device identifier of the target virtual device for the command initialization information includes:
[0033] Determine the virtual machine identifier of the target virtual machine that issued the initial information for the command;
[0034] Based on the virtual machine identifier, query the virtual device identifier of the virtual device configured to the target virtual machine;
[0035] The virtual device identifier is configured as a tag in the command initialization information to form the command encryption information.
[0036] Optionally, after sending the command encryption information to the processor so that the processor executes the command processing method as described in the first aspect, the method further includes:
[0037] Obtain the notification message from the processor and forward it to the target virtual machine.
[0038] Optionally, before obtaining the initial information of the command sent by the target virtual machine, the method further includes:
[0039] A virtual device creation request is sent to the processor, so that the processor creates a target virtual device based on the virtual device creation request and returns the virtual device identifier of the target virtual device;
[0040] Assign the target virtual device to the target virtual machine and record the assignment information between the target virtual device and the target virtual machine;
[0041] The allocation information is fed back to the processor so that the processor can establish a correspondence between the virtual device identifier and the memory key information of the target virtual machine based on the allocation information.
[0042] Thirdly, embodiments of the present invention provide a command processing method applied to a target virtual machine, the target virtual machine being allocated a target virtual device, comprising:
[0043] The target command data is written into memory; wherein the memory encrypts the target command data based on a memory key corresponding to the target virtual machine;
[0044] Send command initialization information to the virtual machine manager, the command initialization information including the memory address of the target command data; cause the virtual machine manager to configure the virtual device identifier of the target virtual device for the command initialization information, use the command initialization information and the virtual device identifier as command encryption information, send the command encryption information to the processor, and cause the processor to execute the command processing method as described in the first aspect.
[0045] Optionally, after sending the initial command information to the virtual machine manager, the method further includes:
[0046] Get the results and notification messages from the virtual machine manager;
[0047] Based on the results, a notification message is obtained, and the command results stored in memory are retrieved.
[0048] Fourthly, embodiments of the present invention provide a processor configured with a cryptographic module, the cryptographic module being used to execute the command processing method as described in the first aspect above.
[0049] Optionally, the cryptographic module is configured with device information storage logic, which is used to store device attribute information of the target virtual device. The device attribute information of the target virtual device establishes a correspondence between the virtual device identifier and the memory key information of the target virtual machine.
[0050] Optionally, the cryptographic module is configured with command processing logic, which is used to execute a target command to obtain the command result of the target command.
[0051] Fifthly, embodiments of the present invention provide a virtual machine manager configured with a command forwarding module, the command forwarding module being used to execute the command processing method as described in the second aspect above.
[0052] Optionally, it may also include a virtual identity configuration module, which records configuration information of virtual machines and virtual devices.
[0053] In a sixth aspect, embodiments of the present invention provide a virtual machine configured with a command processing device, the command processing device being used to execute the command processing method as described in the third aspect above, with the virtual machine as the target virtual machine.
[0054] In a seventh aspect, embodiments of the present invention provide a computing device, comprising: the processor described in the fourth aspect, the virtual machine manager described in the fifth aspect, and the virtual machine described in the sixth aspect.
[0055] Eighthly, embodiments of the present invention provide a computer program product including one or more computer-executable instructions, wherein when the one or more computer-executable instructions are executed, they implement the command processing method as described in the first, second, or third aspects.
[0056] This invention provides a command processing method and related devices. The command processing method applied to a processor includes: acquiring command encryption information sent by a virtual machine manager, the command encryption information including the memory address of target command data and a virtual device identifier of a target virtual device; wherein the memory encrypts the target command data based on a memory key corresponding to the target virtual machine; determining memory key information corresponding to the target virtual machine based on the virtual device identifier; decrypting the plaintext of the target command data based on the memory key information and the memory address of the target command data; and sending the plaintext of the target command data to the target virtual device, so that the target virtual device executes the target command and returns the command result of the target command.
[0057] As can be seen, in this embodiment of the invention, when the target command data is written into memory, the memory encrypts the target command data based on the memory key corresponding to the target virtual machine. In the command processing flow, the memory key information of the allocated target virtual machine is determined through the virtual device identifier in the command encryption information, thereby achieving decryption of the target command data. In other words, this embodiment of the invention adds an additional encryption and decryption process for command data, enabling the storage of command data in an encrypted manner. Furthermore, when the command data needs to be used, it can be decrypted using the memory key information. This allows the command data stored in memory by the virtual machine in this embodiment of the invention to adapt to the memory encryption mechanism, improving the data security of the virtual machine during the process of calling virtual devices. Attached Figure Description
[0058] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0059] Figure 1 is a schematic diagram of an optional architecture for a computing device using virtualization technology;
[0060] Figure 2 is a schematic diagram of an optional architecture of a computing device using virtualization technology provided in an embodiment of the present invention;
[0061] Figure 3 is a schematic diagram of an optional flowchart of the command processing method provided in an embodiment of the present invention;
[0062] Figure 4 is an optional flowchart of step S120 provided in an embodiment of the present invention;
[0063] Figure 5 is a schematic diagram of another optional flow of the command processing method provided in an embodiment of the present invention;
[0064] Figure 6 is an optional flowchart of step S170 provided in an embodiment of the present invention;
[0065] Figure 7 is an optional flowchart of the virtual device configuration method provided in an embodiment of the present invention. Detailed Implementation
[0066] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.
[0067] As an optional example of the disclosure of the embodiments of the present invention, Figure 1 exemplarily shows a schematic diagram of an optional architecture of a computing device using virtualization technology. It should be noted that this block diagram is shown for the purpose of facilitating the understanding of the disclosure of the embodiments of the present invention, and the embodiments of the present invention are not limited to the architecture shown in Figure 1.
[0068] Referring to Figure 1, the virtual architecture may include: host 1, virtual machine manager 2, and peripheral devices 3.
[0069] In this setup, host 1 can be understood as a physical host, including a processor and memory. Virtual Machine Monitor 2 runs on the hardware provided by host 1. In an optional example, the processor in host 1 can run a host operating system and configure the Virtual Machine Monitor (VMM) 2 through the host operating system. Through virtualization technology, the processor in host 1 can also virtualize multiple virtual machines (VMs), which are then configured and managed by Virtual Machine Monitor 2 for resources such as memory and peripherals.
[0070] To ensure the security and independence of data between virtual machines, secure virtualization technology can configure corresponding keys for virtual machines. The virtual machine's memory data is then encrypted using its corresponding key before being stored in the host machine's memory, and decrypted using the same key when the virtual machine needs to access it. In some scenarios, virtual machines generated using secure virtualization technology with encryption mechanisms can be called CVMs (Confidential Virtual Machines).
[0071] Peripheral device 3 provides peripheral resources to the host, enabling host 1 to allocate and use resources based on these resources. Peripheral device 3 can be, for example, a cryptographic card (such as a PCI cryptographic card, where PCI stands for Peripheral Component Interconnect), a GPU (Graphics Processing Unit), a GPGPU (Graphics Processing Unit for General Purpose Computing), or an accelerator card for AI (Artificial Intelligence) and deep learning. In some optional implementations, the host can configure the peripheral device as a virtual device based on real-time needs, and configure the virtual device as available peripheral resources for the virtual machine.
[0072] However, the inventors believe that virtual machines pose security risks when running virtual devices.
[0073] This is because virtualization technology allows virtual devices to pass directly into the virtual machine. Based on this pass-through mechanism (DMA, or Direct Memory Access), when enabling a virtual device to execute a specific command, the corresponding command data needs to be directly transferred from memory to the virtual device within the virtual machine, so that the virtual device can execute the corresponding command based on the command data.
[0074] However, virtual devices, such as PCI cryptographic cards, typically lack the ability to decrypt encrypted data in memory, thus only accepting plaintext command data. In this case, to accommodate the command data requirements of peripheral devices, even in scenarios where the virtual machine is allocated memory with encryption mechanisms, the virtual machine must use unencrypted memory to store the corresponding command data (e.g., a special memory segment with memory encryption disabled to store the command data, ensuring the command data is in plaintext). This inevitably exposes the corresponding command data to security risks.
[0075] In view of this, embodiments of the present invention provide a command processing method and related devices. The command processing method applied to a processor includes: acquiring command encryption information sent by a virtual machine manager, the command encryption information including the memory address of target command data and a virtual device identifier of a target virtual device; wherein the memory encrypts the target command data based on a memory key corresponding to the target virtual machine; determining memory key information corresponding to the target virtual machine based on the virtual device identifier; decrypting the plaintext of the target command data based on the memory key information and the memory address of the target command data; and sending the plaintext of the target command data to the target virtual device, so that the target virtual device executes the target command and returns the command result of the target command.
[0076] As can be seen, in this embodiment of the invention, when the target command data is written into memory, the memory encrypts the target command data based on the memory key corresponding to the target virtual machine. In the command processing flow, the memory key information of the allocated target virtual machine is determined through the virtual device identifier in the command encryption information, thereby achieving decryption of the target command data. In other words, this embodiment of the invention adds an additional encryption and decryption process for command data, enabling the storage of command data in an encrypted manner. Furthermore, when the command data needs to be used, it can be decrypted using the memory key information. This allows the command data stored in memory by the virtual machine in this embodiment of the invention to adapt to the memory encryption mechanism, improving the data security of the virtual machine during the process of calling virtual devices.
[0077] The command processing scheme provided in the embodiments of the present invention will be described in detail below.
[0078] Referring to Figure 2, a schematic diagram of an optional architecture of a computing device based on virtualization technology is shown. As shown in Figure 2, the architecture virtualizes multiple virtual machines based on virtualization technology, including: a virtual machine layer 11 consisting of multiple virtual machines, a virtual machine manager 12, and a processor (Central Processing Unit, CPU) 13.
[0079] The processor 13 is equipped with a cryptographic module. This module can virtualize multiple virtual devices based on the needs of the virtual devices and allocate them to virtual machines. This allows the virtual machine to treat the assigned virtual device as a peripheral device exclusively used by the virtual machine, enabling it to execute corresponding commands by accessing the virtual device's resources based on requests. In some examples, a virtual device can also be called a Virtual Cryptographic Module (VCM). One physical cryptographic module can virtualize multiple VCMs, and one VCM can be allocated to a single virtual machine. A virtual cryptographic module can provide complete cryptographic module functionality, allowing the virtual machine to perceive itself as having an independent cryptographic module.
[0080] It should be noted that the cryptographic module is located in the processor 13, but the virtual device virtualized by it provides a calling interface to the virtual machine so that the virtual machine can execute corresponding commands based on the resources provided by the cryptographic module. Therefore, from the perspective of the virtual machine, the calling and function implementation of the virtual device are implemented in the manner of a peripheral device, so the virtual device virtualized by the cryptographic module can be regarded as a peripheral device.
[0081] In this embodiment, a virtual machine is used as an example. This virtual machine can be called the target virtual machine, its corresponding virtual device can be called the target virtual device, the command it issues that needs to be executed by the target virtual device can be called the target command, and the command data corresponding to the target command can be called the target command data. It is understood that the target virtual device is the virtual device allocated to the target virtual machine. Specifically, when the target virtual device needs to execute the target command, the target command data is first written into memory. The memory can encrypt the target command data based on the memory key corresponding to the target virtual machine, and send the initial command information, including the memory address of the target command data, to the virtual machine manager.
[0082] Furthermore, the virtual machine manager 12 in this virtual architecture is further configured with a command forwarding module and a virtual identifier configuration module, so as to configure the virtual device identifier of the target virtual machine for the corresponding command initial information when forwarding command initial information.
[0083] In this embodiment, the virtual device is configured with a virtual device identifier, so that the memory key information corresponding to the target virtual machine can be obtained based on the virtual device identifier, and the plaintext of the target command data can be decrypted based on the memory key information and the memory address of the target command data, thereby sending the plaintext of the target command data to the target virtual device.
[0084] Correspondingly, the configured target virtual device executes the target command, and the cryptographic module further encrypts the command result of the target command based on the memory key corresponding to the target virtual machine and stores it in memory, and feeds back the result information of the command result to the target virtual machine.
[0085] Based on the optional architecture of the aforementioned computing devices, this embodiment of the invention further provides a command processing method. This method can be applied to computing devices with the aforementioned architecture, as well as to other computing devices with different architectures capable of implementing the method. Figure 3 shows an optional flowchart of the command processing method provided by this embodiment of the invention, used to execute when a target virtual machine issues a target command to a target virtual device. Referring to Figure 3, the method includes the following steps:
[0086] Step S100: The target virtual machine writes the target command data into memory;
[0087] The target virtual machine can be understood as any virtualized virtual machine. This virtual machine interacts with its configured virtual devices based on memory for command and data exchange. The virtual machine encrypts its memory data based on secure virtualization technology. That is, the memory data stored in memory is encrypted and stored based on the key corresponding to the virtual machine, and the memory data is decrypted and read based on the key when it needs to be read.
[0088] In summary, the virtual device corresponding to the target virtual machine, that is, the virtual device configured to the target virtual machine, can be called the target virtual device, the command issued by the target virtual device that needs to be executed can be called the target command, and the command data corresponding to the target command can be called the target command data.
[0089] Understandably, when the target virtual device needs to execute a target command, the target command data is first written into memory, and the memory can encrypt the target command data based on the memory key corresponding to the target virtual machine. In some alternative examples, the target command data stored in memory can also be called an Encrypted Command Buffer (ECB).
[0090] It's important to note that the target virtual machine (i.e., the virtual machine itself) acts as the client; it doesn't need to know the corresponding memory key. The host hardware determines the target virtual machine's memory key based on a pre-defined mechanism within its low-level processing logic and uses that key for data encryption and decryption. Consequently, the target virtual machine doesn't need to know the specific encryption information and may not even be aware that its memory data has been encrypted.
[0091] Similarly, the virtual machine manager only acts as the resource configuration and management entity, and does not need to know the memory key corresponding to the target virtual machine (i.e., the virtual machine), thus maximizing the data security of the target virtual machine.
[0092] It is understandable that when a virtual machine uses unencrypted memory to store the corresponding command data (i.e., the command data is in plaintext), there is a risk that the corresponding command data may be stolen by the virtual machine manager. The solution proposed in this embodiment of the invention can solve this problem.
[0093] Step S110: The target virtual machine sends initial command information to the virtual machine manager;
[0094] The initial command information includes at least the memory address of the target command data, and corresponding processing is performed based on this memory address. In the example where the target command data stored in memory is used as an encrypted command block, the memory address of the target command data is the same as the memory address of the encrypted command block.
[0095] Accordingly, the virtual machine manager can obtain the initial command information sent by the target virtual machine. In an optional example, the initial command information sent by the target virtual machine can be obtained by the command forwarding module in the virtual machine manager.
[0096] Step S120: The virtual machine manager configures the virtual device identifier of the target virtual device for the command initial information, and uses the command initial information and the virtual device identifier as command encryption information;
[0097] The virtual device identifier (also known as VID) can be understood as identification information used to indicate the virtual device. When a virtual device is assigned to a corresponding virtual machine, the virtual device is bound to the virtual machine based on the virtual device identifier. This allows the virtual machine to be identified based on the virtual device identifier, and thus the memory key information of the corresponding virtual machine can be obtained.
[0098] It is understandable that after configuring the virtual machine and virtual device (i.e., binding the virtual device to the virtual machine), the virtual device identifier of the target virtual device corresponding to the target virtual machine can be determined based on the issuer of the command initialization information, i.e., the target virtual machine. In an optional example, the command initialization information may also carry the identity information of the target virtual machine or the virtual device. Therefore, the virtual device identifier can be determined based on the identity information of the target virtual machine or the virtual device carried in the command initialization information, and the virtual device identifier can be further configured into the command initialization information, thereby using the command initialization information and the virtual device identifier as command encryption information.
[0099] In an optional example, referring to the optional flowchart of step S120 shown in Figure 4, step S120 may include the following process:
[0100] Step S121: Determine the virtual machine identifier of the target virtual machine that issued the initial information of the command;
[0101] In summary, the virtual machine manager can identify the virtual machine identifier of the target virtual machine based on the issuer of the command initialization information. Alternatively, the command initialization information may also carry the identity information of the target virtual machine, and the virtual machine identifier of the target virtual machine can be identified based on the identity information of the target virtual machine.
[0102] Step S122: Based on the virtual machine identifier, query the virtual device identifier of the virtual device configured to the target virtual machine;
[0103] It should be noted that the virtual machine manager can record configuration information between virtual machines and virtual devices (such as binding information between virtual machines and virtual devices), so the virtual device identifier of the target virtual device configured to the target virtual machine can be determined by querying.
[0104] In a specific example, the virtual identity configuration module may record the configuration information of the virtual machine and the virtual device. Accordingly, step S122 can be obtained by the command forwarding module in the virtual machine manager from the virtual identity configuration module.
[0105] Step S123: Configure the virtual device identifier as a tag in the command initial information to form the command encryption information.
[0106] In an optional example, the virtual device identifier can be labeled (i.e. added) to the command initialization information to form the command encryption information.
[0107] Understandably, because the target command data is encrypted and stored in memory, the virtual machine manager cannot parse and retrieve its contents, thus protecting the data security of the virtual device.
[0108] In an optional example, step S120 can be performed by the command forwarding module in the virtual machine manager.
[0109] Referring to Figure 3, step S130 is executed: the virtual machine manager sends the encrypted command information to the processor.
[0110] The command encryption information includes at least the memory address of the target command data and the virtual device identifier of the target virtual device, which enables the processor to determine the memory key based on the information, thereby realizing the decryption of memory data under the pass-through mechanism.
[0111] Correspondingly, the processor can obtain the encrypted command information sent by the virtual machine manager. In an optional example, the encrypted command information can be sent to the processor's cryptographic module by the command forwarding module in the virtual machine manager.
[0112] Step S140: The processor determines the memory key information corresponding to the target virtual machine based on the virtual device identifier;
[0113] Since the command encryption information contains a virtual device identifier, the memory key information of the corresponding target virtual machine can be determined based on the virtual device identifier.
[0114] In a specific example, the memory key information can be determined based on the device attribute information of a virtual device preset within the processor. The device attribute information of the target virtual device establishes a correspondence between the virtual device identifier and the memory key information of the target virtual machine. Specifically, the device attribute information of the virtual device can be the context of the virtual device, which may store relevant configuration information of the virtual machine configured for the target virtual device. For example, for the target virtual device, the context of the target virtual device at least includes the memory key information of the target virtual machine. In a specific example, the memory key information can be a memory key identifier; taking MEK as an example, the memory key identifier is the ID of MEK.
[0115] In an optional example, step S140 can be performed by a cryptographic module within the processor. Specifically, the cryptographic module can be configured with device information storage logic, and this device information storage logic can be used to store device attribute information of the target virtual device, thereby enabling the cryptographic module to determine the memory key information of the target virtual machine based on the information stored in the device information storage logic.
[0116] Step S150: The processor decrypts the plaintext of the target command data based on the memory key information and the memory address of the target command data.
[0117] After determining the specific memory key information, the decryption of the target command data can be performed.
[0118] In an optional example, the processor's cryptographic module may be configured with command processing logic, which can be used to decrypt the plaintext of the target command data based on the memory key information and the memory address of the target command data. The memory key information may, for example, be an identifier (i.e., ID) of a memory encryption key (MEK).
[0119] In a further optional example, the processor may also be configured with a key management module for managing memory keys, such as recording the correspondence between memory key information and memory keys, thereby determining the specific memory key based on the memory key information.
[0120] Step S160: The processor executes the target command based on the plaintext of the target command data to obtain the command result of the target command;
[0121] It is understood that after decrypting the target command data, the plaintext of the target command data can be determined, and the command processing logic of the cryptographic module can then execute the target command based on this plaintext to obtain the command result of the target command. In a specific example, executing the target command may, for example, involve using a target virtual device to perform cryptographic operations on the data to be processed in the target command data, such as encryption or decryption operations. Here, the target command is the command corresponding to the target command data.
[0122] In the example that supports memory encryption, the processor pre-configures the corresponding memory key for the virtual machine. When different virtual machines access memory, the processor automatically uses the corresponding memory key to encrypt and decrypt memory data. For example, the encryption and decryption engine uses the corresponding memory key based on the virtual machine identifier (ASID) of the virtual machine to encrypt and decrypt memory data. Different virtual machines correspond to different virtual machine identifiers and different memory keys. The command processing method of this embodiment of the invention enables the interaction of the corresponding virtual device to adapt to the memory encryption scheme, thereby improving the security of command data.
[0123] In a further example, embodiments of the present invention also provide a command result processing flow. Specifically, referring to Figure 5, which shows another optional flow diagram of the command processing method provided by an embodiment of the present invention, the command result processing flow further includes:
[0124] Step S170: Based on the memory key information, the processor encrypts the command result of the target command and stores it in memory;
[0125] After receiving the command result from the target virtual device, the command processing logic of the cryptographic module can further encrypt the command result and store it in memory based on the memory key information.
[0126] In a specific example, referring to the optional flowchart of step S170 shown in Figure 6, step S170 may include:
[0127] Step S171: Determine the virtual device identifier of the target virtual device corresponding to the command result;
[0128] Understandably, the processor can determine the specific virtual device identifier based on the command result.
[0129] Step S172: Based on the virtual device identifier, determine the memory key information of the target virtual machine corresponding to the command result;
[0130] Specifically, the memory key information of the target virtual machine can be determined based on the device attribute information of the virtual device preset within the processor. For details, please refer to the description of step S140.
[0131] Step S173: Using the memory key corresponding to the memory key information, encrypt the command result of the target command and store it in memory.
[0132] After determining the memory key information, a corresponding memory key can be determined based on the memory key information, and then the command result of the target command can be encrypted and stored in memory using the memory key.
[0133] Step S170 can be executed based on the command processing logic in the cryptographic module.
[0134] Referring to Figure 5, step S180 is executed, whereby the processor sends a notification message about the result of the command to the virtual machine manager.
[0135] Specifically, the result acquisition notification message of the command result is fed back to the virtual machine manager, so that the virtual machine manager forwards the result acquisition notification message to the target virtual machine.
[0136] The result acquisition notification message is used to indicate that the command result of the target command has been acquired, so that the target virtual machine can read the corresponding command result in a preset memory page after receiving the result acquisition notification message.
[0137] Step S180 can be executed based on the command processing logic in the cryptographic module.
[0138] Step S190: The virtual machine manager forwards the result and obtains the notification message to the target virtual machine;
[0139] Step S190 can be executed based on the command forwarding module in the virtual machine manager.
[0140] Step S200: The target virtual machine obtains a notification message based on the result and retrieves the command result stored in memory;
[0141] Understandably, in examples that support memory encryption, the processor will pre-configure the corresponding memory key for the virtual machine. When the virtual machine accesses memory, the processor will automatically use the corresponding memory key to encrypt and decrypt the memory data. After the target virtual machine obtains the result notification message, it can directly access the command result based on the normal memory access process.
[0142] In a further optional example, embodiments of the present invention also provide a virtual device configuration method adapted to the aforementioned command processing scheme, used to configure virtual devices for virtual machines and to provide a basis for the command processing method provided in the embodiments of the present invention. Specifically, the virtual device configuration method is executed before the command processing method of the present invention. Referring to the optional flowchart of the virtual device configuration method shown in FIG7, the virtual device configuration method includes:
[0143] Step S300: The virtual machine manager sends a virtual device creation request to the processor;
[0144] A virtual device creation request is sent to request the processor to create a virtual device. Specifically, taking the creation of a target virtual device for a target virtual machine as an example, the virtual device creation request is used to request the processor to create the target virtual device.
[0145] In a specific example, the cryptographic module in the processor can provide a virtual device creation interface for the virtual machine manager. The virtual machine manager can send a virtual device creation request by calling the virtual device creation interface, so that the processor can start the virtual device creation process.
[0146] It should be noted that the creation of a virtual device can be performed before or after the creation process of the target virtual machine. When the creation process is performed after the creation process of the target virtual machine, the identity information of the target virtual machine can be sent to the processor at the same time, so that the processor can record the corresponding configuration information or establish the corresponding relationship information based on the identity information.
[0147] Step S310: Based on the virtual device creation request, the processor creates a target virtual device and sends the virtual device identifier of the target virtual device back to the virtual machine manager;
[0148] The target virtual device is a dedicated resource allocated to the target virtual machine, but it can be regarded as an independent device on the target virtual machine side.
[0149] The processor can create a target virtual device based on the virtual device creation request, and after creation, feed back the virtual device identifier of the target virtual device to the virtual machine manager so that the virtual machine manager can bind the target virtual device to the target virtual machine and record the corresponding binding relationship.
[0150] It should be noted that the process of creating a target virtual device includes creating device attribute information for the target virtual device, and then recording the attribute information of the target virtual device based on the device attribute information.
[0151] In an optional example, the device attribute information of the target virtual device may include at least the configuration information of the target virtual device and the target virtual machine, as well as the memory key information of the corresponding target virtual machine. It is understood that when the target virtual device is created but the configuration relationship between the target virtual device and the target virtual machine has not yet been established, the corresponding configuration information and memory key information in the device attribute information of the target virtual device may be invalid or blank, and will be written after the configuration relationship between the target virtual device and the target virtual machine is established.
[0152] Step S320: The virtual machine manager allocates the target virtual device to the target virtual machine and records the allocation information between the target virtual device and the target virtual machine;
[0153] Specifically, by recording the allocation information between the target virtual device and the target virtual machine, an information basis is provided for configuring the virtual device identifier of the target virtual device in the initial information of the command sent to the target virtual machine in the command processing flow.
[0154] In a specific example, the virtual machine manager can achieve the allocation described in this step by binding the target virtual device to the target virtual machine. Accordingly, the allocation information can be the binding information between the target virtual device and the target virtual machine. By binding the target virtual device to the target virtual machine, the target virtual machine can legally use the exclusive resources configured for it.
[0155] In a specific example, the cryptographic module in the processor can provide a virtual device binding interface for the virtual machine manager. The virtual machine manager can send the allocation information (e.g., binding information) between the target virtual device and the target virtual machine by calling this virtual device binding interface.
[0156] The virtual identifier configuration module can record the allocation information of the target virtual device and the target virtual machine to provide information support for the command processing method provided in this embodiment of the invention. In a specific example set, the virtual machine manager can record this allocation information based on the target virtual device identifier.
[0157] In an optional example, the virtual machine manager can allocate a target virtual device to the target virtual machine when the target virtual machine starts up, or it can allocate a target virtual device to the target virtual machine when the target virtual machine is created. This embodiment of the invention does not impose specific limitations here.
[0158] Step S330: The virtual machine manager sends the allocation information back to the processor;
[0159] Step S340: Based on the allocation information, the processor establishes a correspondence between the virtual device identifier and the memory key information of the target virtual machine.
[0160] By establishing a correspondence between the virtual device identifier and the memory key information of the target virtual machine, information support is provided for the step in the command processing flow that determines the memory key information of the target virtual machine based on the virtual device identifier.
[0161] In a specific example, the allocation information can be recorded in the device attribute information corresponding to the target virtual device, and the memory key information of the target virtual machine can be queried and obtained. Then, the memory key information can be recorded in the device attribute information corresponding to the target virtual device, thereby establishing the correspondence between the virtual device identifier and the memory key information of the target virtual machine.
[0162] The processor can record the configuration information and memory key information into the device information storage logic used to store the device attribute information of the target virtual device, thereby providing information support for the command processing method provided in this embodiment of the invention.
[0163] It is understood that the resource overhead of creating virtual devices in this embodiment of the invention mainly includes the memory occupied by the virtual device attribute information and the virtual device identifier configured for the virtual device. With memory resources becoming increasingly abundant, the resources consumed in this scheme are obviously negligible.
[0164] It should be noted that some conventional peripheral device virtualization technologies, such as SRIOV (Single Root I / O Virtualization) applied to PCI devices, require hardware resource support from the peripheral device, which limits the data of the peripheral devices that can be created. In contrast, the embodiments of the present invention can expand the number of virtual devices with less resources, thus reducing the limitation on the number of virtual devices that can be created.
[0165] Furthermore, in some conventional peripheral device virtualization technologies, a virtual device appears as an independent peripheral device on the bus, thus requiring the configuration of a corresponding device number and the occupation of corresponding bus resources during interaction. However, the embodiments of the present invention execute corresponding commands based on the cryptographic module inside the processor, thus eliminating the need to occupy bus resources. In other words, compared to other methods, the command processing method of the embodiments of the present invention can reduce resource consumption.
[0166] This invention also provides a virtual machine, which is configured with a command processing device. The command processing device is used to execute the command processing method applied to the target virtual machine in the foregoing embodiments, with the virtual machine as the target virtual machine.
[0167] This invention also provides a computing device, the optional architecture of which can be referred to FIG2, including: a processor provided in this invention, a virtual machine manager provided in this invention, and a virtual machine provided in this invention.
[0168] This invention also provides a computer program product that may include one or more computer-executable instructions, which, when executed, implement the command processing method described above.
[0169] The foregoing describes multiple embodiments of the present invention. The optional methods described in each embodiment can be combined and cross-referenced without conflict, thereby extending to a variety of possible embodiments. These can all be considered as embodiments disclosed or made public by the present invention.
[0170] While the embodiments of the present invention have been disclosed above, the present invention is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the present invention; therefore, the scope of protection of the present invention should be determined by the scope defined in the claims.
Claims
1. A command processing method applied to a processor, comprising: Obtain encrypted command information sent by the virtual machine manager. The encrypted command information includes the memory address of the target command data and the virtual device identifier of the target virtual device. The memory is used to encrypt the target command data based on a memory key corresponding to the target virtual machine. Based on the virtual device identifier, determine the memory key information corresponding to the target virtual machine; Based on the memory key information and the memory address of the target command data, the plaintext of the target command data is decrypted. The target command is executed in plaintext based on the target command data to obtain the command result of the target command.
2. The command processing method of claim 1, wherein, The step of determining the memory key information corresponding to the target virtual machine based on the virtual device identifier specifically involves determining the memory key information based on the device attribute information of the virtual device preset in the processor.
3. The command processing method of claim 1, wherein, After executing the target command in plaintext based on the target command data to obtain the command result of the target command, the method further includes: Based on the memory key information, the command result of the target command is encrypted and stored in memory; The result acquisition notification message of the command is fed back to the virtual machine manager, so that the virtual machine manager forwards the result acquisition notification message to the target virtual machine.
4. The command processing method of claim 3, wherein, The step of encrypting the command result of the target command and storing it in memory based on the memory key information includes: Determine the virtual device identifier of the target virtual device corresponding to the command result; Based on the virtual device identifier, determine the memory key information of the target virtual machine corresponding to the command result; Using the memory key corresponding to the memory key information, the command result of the target command is encrypted and stored in memory.
5. The command processing method of claim 1, wherein, Before obtaining the encrypted information of the command sent by the virtual machine manager, the process also includes: Based on the virtual device creation request sent by the virtual machine manager, the target virtual device is created, and the virtual device identifier of the target virtual device is returned to the virtual machine manager. After the virtual machine manager allocates the target virtual device to the target virtual machine, a correspondence is established between the virtual device identifier and the memory key information of the target virtual machine based on the allocation information fed back by the virtual machine manager.
6. The command processing method according to claim 5, wherein, Based on the allocation information fed back by the virtual machine manager, a correspondence is established between the virtual device identifier and the memory key information of the target virtual machine, including: The allocation information is recorded in the device attribute information corresponding to the target virtual device; Query and obtain the memory key information of the target virtual device; The memory key information is recorded in the device attribute information corresponding to the target virtual device.
7. A command processing method applied to a virtual machine manager, comprising: Obtain the initial information of the command sent by the target virtual machine; wherein, the initial information of the command includes the memory address of the target command data, and the memory encrypts the target command data based on the memory key corresponding to the target virtual machine; Configure the virtual device identifier of the target virtual device for the command initial information, and use the command initial information and the virtual device identifier as command encryption information; The encrypted command information is sent to the processor so that the processor executes the command processing method as described in claim 1.
8. The command processing method of claim 7, wherein, The step of configuring the virtual device identifier of the target virtual device for the initial information of the command includes: Determine the virtual machine identifier of the target virtual machine that issued the initial information for the command; Based on the virtual machine identifier, query the virtual device identifier of the virtual device configured to the target virtual machine; The virtual device identifier is configured as a tag in the command initialization information to form the command encryption information.
9. The command processing method according to claim 7, wherein, After sending the encrypted command information to the processor so that the processor executes the command processing method as described in claim 1, the method further includes: Obtain the notification message from the processor and forward it to the target virtual machine.
10. The command processing method according to claim 7, wherein, Before obtaining the initial information of the command sent by the target virtual machine, the process also includes: A virtual device creation request is sent to the processor, so that the processor creates a target virtual device based on the virtual device creation request and returns the virtual device identifier of the target virtual device; Assign the target virtual device to the target virtual machine and record the assignment information between the target virtual device and the target virtual machine; The allocation information is fed back to the processor so that the processor can establish a correspondence between the virtual device identifier and the memory key information of the target virtual machine based on the allocation information.
11. A command processing method applied to a target virtual machine, the target virtual machine being allocated a target virtual device, comprising: The target command data is written into memory; wherein the memory encrypts the target command data based on a memory key corresponding to the target virtual machine; Send initial command information to the virtual machine manager, the initial command information including the memory address of the target command data; cause the virtual machine manager to configure the virtual device identifier of the target virtual device for the initial command information; use the initial command information and the virtual device identifier as command encryption information; send the command encryption information to the processor; and cause the processor to execute the command processing method as described in claim 1.
12. The command processing method of claim 11, wherein, After sending the initial command information to the virtual machine manager, the process also includes: Get the results and notification messages from the virtual machine manager; Based on the results, a notification message is obtained, and the command results stored in memory are retrieved.
13. A processor, wherein, The system is equipped with a cryptographic module, which is used to execute the command processing method as described in any one of claims 1-6.
14. The processor according to claim 13, wherein, The cryptographic module is configured with device information storage logic, which is used to store device attribute information of the target virtual device. The device attribute information of the target virtual device establishes a correspondence between the virtual device identifier and the memory key information of the target virtual machine.
15. The processor according to claim 13, wherein, The cryptographic module is configured with command processing logic, which is used to execute the target command to obtain the command result of the target command.
16. A virtual machine manager, wherein, The system is equipped with a command forwarding module, which is used to execute the command processing method as described in any one of claims 7-10.
17. The virtual machine manager of claim 16, wherein, Also includes: The virtual identity configuration module records the configuration information of the virtual machine and the virtual device.
18. A virtual machine, wherein, The device is equipped with a command processing unit, which is used to execute the command processing method as described in any one of claims 11-12, with the virtual machine as the target virtual machine.
19. A computing device comprising: The processor according to any one of claims 13-15, the virtual machine manager according to any one of claims 16-17, and the virtual machine according to claim 18.
20. A computer program product comprising one or more computer-executable instructions, wherein the one or more computer-executable instructions, when executed, implement the command processing method as described in any one of claims 1-12.