CN107392030A - A kind of method and device for detecting virtual machine and starting safety - Google Patents

Abstract

The invention discloses a kind of method for detecting virtual machine and starting safety, the metric of virtual machine add-in is measured by virtual TPM module corresponding to virtual machine, and metric and benchmark metric value are contrasted by security centre, whether the add-in of final confirmation virtual machine is correct, if correct, virtual machine can be with clean boot.Each virtual machine has a corresponding virtual TPM module in the present invention, can be when several virtual machines need to start simultaneously, the add-in of each virtual machine is detected respectively, it is non-interference to the metrics process of each virtual machine, improve detection efficiency, after detection virtual machine add-in is correct, the security of virtual machine and whole system is ensure that, is advantageous to improve the performance of system operation.

Description

A method and device for detecting virtual machine startup security

technical field

The invention relates to the field of virtual machines, in particular to a method and device for detecting the safety of starting a virtual machine.

Background technique

With the development of cloud computing technology, the unified representation and logical abstraction of IT resources have been realized. It has the characteristics of on-demand allocation and dynamic expansion, which reduces the cost of IT operations.

A virtual machine is an aspect of the application of cloud computing technology. It refers to a special software that can create an environment between the computer platform and the end user, and the end user operates the software based on the environment created by the software. Operate independently of each other without interfering with each other.

However, in the actual application process of the existing virtual machine software, since the hardware resources supporting the running of the virtual machine are not visible locally, they are vulnerable to tampering and attacks during data transmission or loading, resulting in that the virtual machine cannot be safely started.

Contents of the invention

The purpose of the present invention is to provide a method for detecting the safety of virtual machine startup, which solves the problem that the virtual machine cannot be safely started, and ensures the safety of the virtual machine when it is started. Another purpose of the present invention is to provide a method for detecting virtual machine Activate the safe device.

In order to solve the above-mentioned technical problems, the present invention provides a method for detecting the safety of starting a virtual machine, including:

When the auxiliary module detects that the virtual machine starts an add-on, the virtual TPM management module searches for and starts the virtual TPM module corresponding to the virtual machine, wherein the virtual TPM module is a module pre-created by the virtual TPM management module, and every Each of the virtual machines has a corresponding TPM module; the virtual TPM module measures the measurement value of the virtual machine add-on; when the add-on of the virtual machine is started, the virtual TPM module will The metric value is sent to the security center; the security center judges whether the metric value conforms to a preset benchmark metric value, and if so, generates a judging result of the startup security of the virtual machine.

Among them, before the auxiliary module detects the virtual machine startup add-on, it also includes:

When creating the virtual machine, the virtual TPM management module uses the TPM simulation module as a template to create the virtual TPM module corresponding to the virtual machine, and saves the data of the virtual TPM module to the local disk in an encrypted manner .

Among them, before the auxiliary module monitors the virtual machine startup add-on, it also includes:

The virtual TPM module measures the add-on of the virtual machine, obtains and sends the measured value to the security center as a reference measured value.

Among them, after starting the virtual TPM module, it also includes:

The virtual TPM manager saves the data of the virtual TPM module to the local disk in an encrypted manner according to a preset period.

Wherein, the virtual TPM management module searching whether there is a corresponding virtual TPM module in the virtual machine includes:

The virtual TPM management module searches for the corresponding virtual TPM module according to the identification information of the virtual machine.

Wherein, the measurement value of the virtual TPM module measuring the virtual machine add-on includes:

The virtual TPM module obtains the measurement value after performing Hash algorithm operation on the data of the virtual machine add-on.

The present invention also provides a system for detecting virtual machine startup safety, including:

A virtual TPM management module, configured to search and start a virtual TPM module corresponding to the virtual machine when the auxiliary module detects that the virtual machine starts an add-on, wherein the virtual TPM module is the virtual TPM management module A pre-created module, and each virtual machine has a corresponding TPM module;

The virtual TPM module is used for the virtual TPM to measure the measurement value of the virtual machine add-on; when the virtual machine add-on is started, the virtual TPM module sends the measurement value to the security center;

The security center judges whether the metric value conforms to a preset benchmark metric value, and if so, generates a judging result of the startup security of the virtual machine.

Wherein, the virtual TPM management module is also used for:

Before the auxiliary module detects that the virtual machine starts the add-on, when creating the virtual machine, the virtual TPM management module uses the TPM simulation module as a template to create the virtual TPM module corresponding to the virtual machine, and uses the encrypted save the data of the virtual TPM module to the local disk.

Wherein, the virtual TPM management module is also used for:

After starting the virtual TPM, the virtual TPM management module saves the data of the virtual TPM module to the local disk in an encrypted manner according to a preset period.

Wherein, the virtual TPM module is used for:

The virtual TPM module obtains the measurement value after performing Hash algorithm operation on the data of the virtual machine add-on.

A method for detecting the startup safety of a virtual machine provided by the present invention, when the virtual machine is started, the virtual TPM module corresponding to the virtual machine is searched through the virtual TPM management module, and the virtual TPM module is used to measure the add-on of the virtual machine, and the obtained measurement Value is compared with the preset benchmark measurement value, so as to realize the judgment of whether the add-on of the virtual machine is attacked and tampered with, and each virtual machine in the present invention has a corresponding virtual TPM module, if multiple virtual machines are in When it is necessary to start at the same time, each virtual TPM module can measure the add-ons of each virtual machine at the same time, so as to judge whether the virtual machine can be started safely, and improve the efficiency of detecting the virtual machine before the virtual machine is started. Moreover, the detection program of the present invention is simple and effective, can relatively accurately guarantee the safety when the virtual machine is started, and improves the use performance of the virtual machine.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions of the prior art, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only For some embodiments of the present invention, those skilled in the art can also obtain other drawings based on these drawings without any creative work.

Fig. 1 is a flow chart of a specific embodiment of detecting virtual machine startup security provided by the present invention;

FIG. 2 is a flow chart of a specific embodiment of creating a virtual TPM module corresponding to a virtual machine provided by the present invention;

FIG. 3 is a structural block diagram of a system for detecting virtual machine startup security provided by an embodiment of the present invention.

detailed description

In order to enable those skilled in the art to better understand the solution of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. Apparently, the described embodiments are only some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

A flow chart of a specific implementation of detecting virtual machine startup security provided by the present invention, as shown in Figure 1, the method may include:

Step S101: When the auxiliary module detects that the virtual machine starts an add-on, the virtual TPM management module searches for and starts the virtual TPM module corresponding to the virtual machine.

Specifically, the TPM, also known as the root of trust platform, is a physical chip that can be used to detect the security of certain devices or programs. The virtual TPM module is a pre-module created by the virtual TPM management module according to the TPM of the entity, which can detect the security of some virtual devices in a virtual environment, and each virtual machine corresponds to a virtual TPM module for measurement The add-on measurement value of the virtual machine, if there are multiple virtual machines that need to be started within a certain period of time, you can use their own virtual TPM modules without affecting each other, which is conducive to improving detection efficiency.

It should be noted that the functions of the virtual TPM management module can be implemented by an independent function module, or a built-in function of a certain function module, but when the virtual TPM management module has When the function belongs to a built-in function of a certain functional module, the functional module may also need to complete some other functional operations, which will affect the operation of related functions in the present invention, thereby affecting the detection efficiency before the virtual machine is started, thus Affects the startup efficiency of virtual machines in the entire system. Therefore, a more preferred solution is to use the virtual TPM management module as an independent functional module to implement related operations in the present invention, but this is not a necessary technical feature of the present invention.

Step S102: The virtual TPM module measures the measurement value of the virtual machine add-on.

Step S103: when the add-on of the virtual machine is started, the virtual TPM module sends the measurement value to the security center.

Specifically, data related to add-ons of virtual machines, such as file systems, operating systems, and other similar data are generally stored in hardware resources, but hardware resources are not visible to local virtual machines. If the data is attacked or tampered with, if the virtual machine starts as usual, it will fail to start or fail to work normally after starting, and even cause virus invasion to the device. Therefore, when you need to start the virtual machine , it is necessary to measure the data in the add-on item by item, and finally determine whether the virtual machine can be safely started according to the measured value.

In addition, in a specific embodiment of the present invention, the virtual TPM module may specifically include three parts: a virtual feasible measurement root, a virtual trusted storage root, and a virtual trusted reporting root. Because the add-on of the virtual machine has multiple data items, the virtual trusted measurement root needs to measure the multiple data of the virtual machine add-on item by item, and the measurement value of each item of data obtained is stored in the virtual trusted storage root until all After the data measurement of the add-on is completed, the virtual trusted reporting root extracts the measurement values of various data from the virtual trusted storage root and sends them to the security center. But this is not a necessary technical solution of the present invention, and similar technical solutions are not listed here one by one.

Step S104: The security center judges whether the metric value conforms to a preset benchmark metric value, if yes, then determines that the virtual machine can be safely started, and if not, then the virtual machine cannot be safely started.

Specifically, if the measurement value does not meet the preset baseline measurement value, it means that the add-on data of the virtual machine may change compared with the original one. If the virtual machine is started, there will be a risk of failure, so the virtual machine cannot be started safely , otherwise, the virtual machine can be started safely.

The security center can be set on the same device as the virtual machine, or it can be set on a remote device. Generally, several devices installed with virtual machines are equipped with a security center, and the benchmark measurement value is stored on the device where the security center is located. In addition, a virtual machine may also be installed on the device.

Based on the above-mentioned embodiment, in another specific embodiment of the present invention, before the virtual machine is started, for the creation process of the virtual TPM module corresponding to each virtual machine, refer to FIG. A flow chart of a specific implementation of a machine corresponding to a virtual TPM module, the method may include:

Step S201: The auxiliary module detects the operation of creating a virtual machine.

It should be noted that the auxiliary module can specifically include a monitoring module and a data path module. The monitoring module is mainly used to monitor the actions of the virtual machine, for example, creating, starting, shutting down, suspending and migrating the virtual machine. When a new change occurs, relevant devices can be notified in time to take relevant countermeasures, and the data path module mounts the corresponding virtual TPM module to the virtual environment when the virtual machine needs to be started for use by the virtual machine.

Step S202: the auxiliary module sends a message indicating that there is an operation of creating a virtual machine to the virtual TPM management module.

Step S203: The virtual TPM management module uses the TPM simulator as a template to create a virtual TPM module corresponding to the newly created virtual machine.

It should be noted that in some special cases, when the auxiliary module detects that the virtual machine needs to be started, it sends a message to the virtual TPM management module, but due to some reasons, such as the corresponding virtual TPM The TPM module cannot find the corresponding virtual TPM module, or the found virtual TPM module is unavailable. This is because the system will default to the virtual machine as a newly created virtual machine, and the virtual TPM management module will also recreate the corresponding virtual management module. But the probability of this special case happening is very small.

Step S204: The virtual TPM management module stores the data of the newly created virtual TPM module to the local disk.

Considering that after the virtual TPM module measures the measurement value of the virtual machine, a security center needs to compare the measurement value with the baseline measurement value. The baseline measurement value can be set before creating the virtual machine, and the virtual machine has been created according to the needs. It is calculated in advance, and another relatively simple way is that after the virtual machine and the corresponding virtual TPM are created, it is generally considered that the security of the newly created virtual machine is good, so it can be sent to the security center with the virtual TPM module As a benchmark metric value, the above embodiments of the present invention can be further improved, specifically including:

Step S205: the virtual TPM module measures the add-on of the virtual machine, and obtains a metric value of the virtual machine.

Step S206: the virtual TPM module sends the metric value of the virtual machine to the security center as a reference metric value.

It should be noted that in the present invention, it is not necessary that the virtual TPM module measures the metric value of the newly-built virtual machine as the benchmark metric value, and the benchmark metric value can also be obtained in other ways, so the above-mentioned solution is not a necessary technical feature of the present invention .

Based on the foregoing embodiments, considering the data security issues of the virtual TPM module, a specific embodiment of the present invention may include:

After starting the virtual TPM module, the virtual TPM manager saves the data of the virtual TPM module to the local disk in an encrypted manner according to a preset period.

Generally, before the virtual machine is started, the virtual TPM module needs to be started, and the corresponding virtual TPM module will not be turned off until the virtual machine is shut down, so as to measure the virtual machine at any time. The considered data of the virtual TPM module may be tampered with, so the data in the local disk may be refreshed periodically to ensure the accuracy of the data. As for the setting of the cycle time, it can be set according to actual application needs.

Based on the above embodiments, another specific embodiment of the present invention may include:

When the virtual TPM management module searches whether the virtual machine has a corresponding virtual TPM module, the virtual TPM management module searches for the corresponding virtual TPM module according to the identification information of the virtual machine.

Specifically, each virtual machine has its own unique number, so that the number corresponding to each virtual TPM module facility can be changed according to the number, or the storage location of each virtual TPM module can be set according to the number.

Based on any of the above embodiments, in a specific embodiment of the present invention, it may include:

When the virtual TPM module measures the measurement value of the virtual machine add-on, the virtual TPM module obtains the measurement value after performing Hash algorithm operation on the data of the virtual machine add-on.

Because the Hash algorithm operation is unique to different data operations, the Hash algorithm is used in the present invention to perform operations on the data of the virtual machine add-in, and a relatively accurate data can be obtained, but this is not the only implementation of the present invention. The present invention can also be realized by adopting other algorithms, as long as the operation result meets the requirement of accuracy.

The system for detecting startup security of a virtual machine provided by an embodiment of the present invention is introduced below. The system for detecting startup security of a virtual machine described below and the method for detecting startup security of a virtual machine described above can be referred to in correspondence.

FIG. 3 is a structural block diagram of a system for detecting virtual machine startup security provided by an embodiment of the present invention. With reference to FIG. 3 , the system for detecting virtual machine startup security may include:

Virtual TPM management module 100, virtual TPM module 200 and security center 300;

The virtual TPM management module 100 is configured to search and start the virtual TPM module corresponding to the virtual machine when the auxiliary module detects that the virtual machine starts an add-on, wherein the virtual TPM module is the virtual TPM management module pre-built modules;

The virtual TPM module 200 is used for the virtual TPM to measure the metric value of the virtual machine add-on; when the virtual machine add-on is started, the virtual TPM module sends the metric value to the security center;

The security center 300 is configured to judge whether the metric value conforms to a preset benchmark metric value, and if yes, send a startup command to the virtual machine.

As a specific implementation manner, the system for detecting virtual machine startup safety provided by the present invention may further include:

The virtual TPM management module 100 is also configured to create a virtual machine corresponding to the virtual machine by using the TPM simulation module as a template when creating the virtual machine before the auxiliary module detects that the virtual machine starts an add-on. The virtual TPM module saves the data of the virtual TPM module to a local disk in an encrypted manner.

As a specific implementation manner, the system for detecting virtual machine startup safety provided by the present invention may further include:

The virtual TPM management module 100 is further configured to save the data of the virtual TPM module to a local disk in an encrypted manner according to a preset period after starting the virtual TPM.

Optionally, the virtual TPM module 200 is used for:

The virtual TPM module obtains the measurement value after performing Hash algorithm operation on the data of the virtual machine add-on.

The system for detecting virtual machine startup security in this embodiment is used to implement the aforementioned method for detecting virtual machine startup security. Therefore, the specific implementation of the system for detecting virtual machine startup security can be seen in the implementation of the method for detecting virtual machine startup security mentioned above. In the example part, for example, the virtual TPM management module 100 is used to implement step S101 in the method for detecting virtual machine startup security, the virtual TPM module 200 is used to implement the above steps S102 and S103, and the virtual TPM module 300 is used to implement the above steps S104. Therefore, for the specific implementation manners, reference may be made to the descriptions of the corresponding partial embodiments, and details are not repeated here.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

Professionals can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of the two. In order to clearly illustrate the possible For interchangeability, in the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be directly implemented by hardware, software modules executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other Any other known storage medium.

The method and device for detecting the startup security of a virtual machine provided by the present invention have been introduced in detail above. In this paper, specific examples are used to illustrate the principle and implementation of the present invention, and the descriptions of the above embodiments are only used to help understand the method and core idea of the present invention. It should be pointed out that for those skilled in the art, without departing from the principles of the present invention, some improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims (10)

1. A method for detecting virtual machine startup safety, characterized in that, comprising: When the auxiliary module detects that the virtual machine starts an add-on, the virtual TPM management module searches for and starts the virtual TPM module corresponding to the virtual machine, wherein the virtual TPM module is a module pre-created by the virtual TPM management module, and every Each of the virtual machines corresponds to one of the virtual TPM modules; the virtual TPM module measures a metric value of the virtual machine add-on; When the add-on of the virtual machine is started, the virtual TPM module sends the measurement value to the security center; The security center judges whether the metric value conforms to a preset benchmark metric value, and if so, generates a judging result of the startup security of the virtual machine. 2. The method according to claim 1, further comprising: before the auxiliary module detects that the virtual machine starts the add-on: When creating the virtual machine, the virtual TPM management module uses the TPM simulation module as a template to create the virtual TPM module corresponding to the virtual machine, and saves the data of the virtual TPM module to the local disk in an encrypted manner . 3. The method according to claim 2, further comprising: before the auxiliary module detects that the virtual machine starts the add-on: The virtual TPM module measures the add-on of the virtual machine, obtains and sends the measured value to the security center as the reference measured value. 4. The method according to claim 1, further comprising: after starting the virtual TPM module: The virtual TPM manager saves the data of the virtual TPM module to a local disk in an encrypted manner at a preset period. 5. The method according to claim 1, wherein the searching and starting the virtual TPM module corresponding to the virtual machine by the virtual TPM management module comprises: The virtual TPM management module searches for the corresponding virtual TPM module according to the identification information of the virtual machine. 6. The method according to any one of claims 1 to 5, wherein the measurement of the virtual machine add-on by the virtual TPM module comprises: The virtual TPM module obtains the measurement value after performing Hash algorithm operation on the data of the virtual machine add-on. 7. A system for detecting virtual machine startup safety, characterized in that, comprising: a virtual TPM management module, a virtual TPM module and a safety center; Wherein, the virtual TPM management module is configured to search and start the virtual TPM module corresponding to the virtual machine when the auxiliary module monitors the startup add-on of the virtual machine, wherein the virtual TPM module is the virtual TPM module of the virtual machine. A module pre-created by the TPM management module, and each virtual machine corresponds to one virtual TPM module; The virtual TPM module is used for the virtual TPM to measure the measurement value of the virtual machine add-on; when the virtual machine add-on is started, the virtual TPM module sends the measurement value to the security center; The security center is configured to judge whether the metric value conforms to a preset benchmark metric value, and if so, generate a judging result of the startup security of the virtual machine. 8. The system according to claim 7, wherein the virtual TPM management module is also used for: Before the auxiliary module detects that the virtual machine starts the add-on, when creating the virtual machine, the virtual TPM module corresponding to the virtual machine is created using the TPM simulation module as a template, and the virtual TPM is stored in an encrypted manner Module data to local disk. 9. The system according to claim 7, wherein the virtual TPM management module is also used for: After starting the virtual TPM, save the data of the virtual TPM module to the local disk in an encrypted manner according to a preset period. 10. The system according to any one of claims 7 to 9, wherein the virtual TPM module is specifically used for: The virtual TPM module obtains the measurement value after performing Hash algorithm operation on the data of the virtual machine add-on.