Background technology
Intel Virtualization Technology is born in the sixties in 20th century the earliest, is proposed, and this technology is applied to System 370 systems of IBM by IBM Corporation.Along with the widespread use of Intel Virtualization Technology, thing followed safety problem is also varied.Although Intel Virtualization Technology can guarantee certain security, such as being isolated from each other between each virtual machine operating on physical platform, do not interfere with each other.But solve the safety problem that computer system faces because this is not basic.On the contrary, because VMM (Virtual Machine Monitor, monitor of virtual machine) has super authority, make the attack of VMM become a large potential safety hazard of system.
Half virtual be Cambridge University propose concept, what accompany with it is the research and development of Xen hypervisor project.Xen hypervisor is system-level virtual tool, for realizing dummy machine system in terminal.
Fig. 1 is the structural representation of Xen hypervisor virtual machine, and in Fig. 1, the bottom is hardware resource, and the VMM of Xen hypervisor runs on hardware resource, hardware resource is managed, and virtual several virtual hardware environments that dissolves.On the VMM of Xen hypervi sor, move multiple Guest OS (child-operation system), be expressed as DomU, Guest OS is the operating system in the disk partition being arranged on virtual machine or except parent-operation system or master operating system.Run on the application layer of DomU without the user application of revising.Inner nuclear layer operation at DomU has front-end equipment to drive, and user application is driven hardware resource is operated by front-end equipment.And front-end equipment driving does not really operate hardware resource, it drives to realize by rear end equipment hardware resource is operated.Rear end equipment drives and is arranged in VMO, and VMO is expressed as DomO in Fig. 1.VMO is a special Guest OS, is also referred to as privileged Guest OS.Being called as privileged Guest OS is all to move in the application layer of VMO because of VMM hypervisor interfaces interface program, part resource manager, Guest OS supervisor control program, is also that VMO is the Guest OS that has administration authority; VMO can directly conduct interviews to peripherals, is also that it has the authority of managing and operating all peripherals.
In the kernel of VMO, having moved a rear end equipment drives, for what accept to send from other Guest OS, hardware resource is carried out to operation requests, hand to the device drives in VMO, complete the operation to hardware resource by device drives, and the operating result returning from device drives is returned to front-end equipment driving.
In such Intel Virtualization Technology framework, keep the isolation between each system by Xen hypervisor, each VM (virtual machine) operates in the memory headroom of oneself, VM self perception is less than the existence of other VM, think and oneself monopolize whole physical platform, corresponding application program operates on VM kernel.Xen hypervisor isolates different VM, makes the various safety problems of one of them VM can not have influence on other VM in identical platform.But still there is following safety problem in such framework.
Because VMO is authorized as franchise Guest OS by Xen hypervisor, can be directly and hardware carry out alternately, just may cause so the leakage of other VM information to the attack of VMO.
The VMM of Xen hypervisor also has privilege, the VMM of Xen hypervisor itself runs on the privilege level of CPU, by the operating system non-privilege level that runs on a bank, the safety problem of Xen hypervisor itself is also referred to as a large potential safety hazard of whole system.
Reliable computing technology is born in last century end, is exactly in order to improve the credibility of terminal system from basis at the beginning of birth.The IT enterprises such as IBM (International Business Machines Corporation), HP (Hewlett-Packard), Intel (Intel), Microsoft (Microsoft) have been set up (the Trusted ComputingPlatform Alliance of credible calculating platform alliance, TCPA), nearly 190 of members.TCPA has defined the credible platform module (TPM) with safe storage and encryption function, is devoted to the credible calculating of data security, comprises development crypto chip, special CPU, mainboard or operating system security kernel.Subsequently, this tissue credible computation organization (Trusted Computing Group, TCG) that renames, continues to advance the development of credible calculating.
Credible computation organization has proposed the standard of a series of promotion computer system securities, comprises TPM (Trusted Platform Module) safety chip standard, and TPM chip is by implant this chip in terminal, sets up the credible of terminal.Here TPM safety chip role is from computer starting, the module of terminal system is before control system, its integrality need to be through excess vol, the tolerance here refers to does Hash operation to program, and be kept at register PCR (the PlatformConfiguration Register of TPM inside, platform configuration storer) in, judge by the cryptographic hash reading in PCR whether terminal system is tampered, determine that whether this terminal is credible.
But for various reasons, the use of TPM chip is greatly limited, show several aspects below.There is the problem that TPM is supported, because existing most of computer system is not considered the support to reliable computing technology at the beginning of design.The complicacy of TPM chip design itself, according to the standard of TCG, TPM chip probably need to be at general more than 120 power functions of self inside solidification.And in actual use, especially, in the use of mobile terminal, cost and portability are very important indexs.And the labyrinth of TPM itself has limited its being widely used in this equipment to a great extent.Support to Intel Virtualization Technology is not provided.TPM standard and TPM chip all do not relate to the support to Intel Virtualization Technology.
Summary of the invention
For addressing the above problem, the invention provides the method and the device that create trusted environments for virtual machine system of multicore processor, can create trusted context for dummy machine system, solve the insincere problem of system of computer network terminal.
The invention discloses a kind of method that creates trusted environments for virtual machine system of multicore processor, comprising:
Step 1 isolates a core from polycaryon processor, the TPM chip simulator of operation customization on described core;
Step 2, in the time creating trusted context, described TPM chip simulator is measured monitor of virtual machine.
Described step 2 is further,
Step 21, in the time creating trusted context, described TPM chip simulator carries out Hash operation to the code of virtual machine monitor, and preserves the cryptographic hash calculating.
Described step 1 is further,
Step 31 isolates a core from polycaryon processor, on described core, moves customizing operating system;
Step 32, the TPM chip simulator of operation customization in described customizing operating system.
Between described step 1 and described step 2, also comprise:
Step 41, operation virtual tool carries out virtual, starts privileged child-operation system; In polycaryon processor, be application core for virtual machine provides the core of service.
The simulator of TPM chip described in described step 2 also comprises before monitor of virtual machine is measured:
Step 51, closes described virtual tool;
Step 52, closes the application core in polycaryon processor dummy machine system, forbids virtual memory, and forbids direct memory storage;
Step 53, carries out initialization to the hardware of polycaryon processor dummy machine system;
After described step 2, also comprise:
Step 54, recovers pent application core and is prohibited virtual memory and forbidden direct memory storage; And start described virtual tool and set up virtual machine.
The invention also discloses a kind of device that creates trusted environments for virtual machine system of multicore processor,
Comprise in the time creating trusted context the TPM chip simulator that monitor of virtual machine is measured;
Described TPM chip simulator operates on the core isolating in polycaryon processor.
Described TPM chip simulator is further used for, in the time creating trusted context, the code of virtual machine monitor being carried out to Hash operation, and preserves the cryptographic hash calculating.
The described core isolating from polycaryon processor moves customizing operating system; Described TPM chip simulator operates in described customizing operating system.
Virtual instrument is moving before establishment trusted context, and starts privileged child-operation system; In polycaryon processor, be application core for virtual machine provides the core of service.
Described device also comprises:
Disabled module, for closing described virtual tool before described TPM chip simulator is measured; Close the application core in polycaryon processor dummy machine system, forbid virtual memory, and forbid direct memory storage;
Security initialization module, for after completing in described disabled module and closing and forbid, carries out initialization to the hardware of polycaryon processor dummy machine system, starts described TPM chip simulator after completing initialization;
Recover module, for after the complete described cryptographic hash of described TPM chip simulator storage, recover pent application core and forbidden virtual memory, and forbidden direct memory storage; And start described virtual tool and carry out the foundation of dummy machine system.
Beneficial effect of the present invention is, in dummy machine system, realize TPM simulator (TPM FunctionModule), because TPM simulator can be according to the demand for security customization of concrete dummy machine system, do not really want all to realize the standard of TCG, thereby can under the prerequisite that guarantees trusted end-user, reduce the cost of mobile device; By recording the start-up course of virtual tool, before the control of virtual tool catcher system, the integrality of virtual tool is measured, and preserve tolerance result, and then guarantee the credibility of start-up course; Carry out safety compute by isolate a core from the multinuclear of processor, can improve the utilization factor of whole processor, and strengthen the safety of dummy machine system; After starting at dummy machine system, create trusted context, making BIOS is no longer a part for credible base, has dwindled trusted computing base, and less credible base more can guarantee the safety of system, and then increases dummy machine system security.
Embodiment
Below in conjunction with accompanying drawing, the present invention is described in further detail.
The present invention create trusted environments for virtual machine system of multicore processor method flow process as shown in Figure 2.
Step S100 isolates a core from polycaryon processor, the TPM chip simulator of operation customization on described core.
In multi-core CPU, isolate the TPM chip simulator that one of them core moves customization, can guarantee that the operation of TPM chip simulator is not subject to the impact of other cores, other core perception are less than the existence of TPM chip simulator.
Step S200, in the time creating trusted context, described TPM chip simulator is measured VMM (monitor of virtual machine).
By said method, TPM chip simulator operates in the environment of isolation, on the one hand its to external world sightless characteristic guaranteed the robustness of itself; On the other hand, the starting state that it also can register system, whether the start-up course of authentication system is tampered.
After dummy machine system startup finishes, set up the dummy machine system of credible startup, the dummy machine system of described credible startup refers to from initial trust initial point, dummy machine system module or assembly that each has started, its integrality has all been passed through tolerance, namely hash computing.
Described tolerance realizes by calculating cryptographic hash, and described TPM chip simulator carries out Hash operation to the code of virtual machine monitor, and preserves the cryptographic hash calculating.
Creating trusted context can be to create in the time that dummy machine system starts, and now directly VMM is measured.Also can after starting, dummy machine system create trusted context in the time there is security threat.
The concrete implementing procedure that creates trusted context after dummy machine system starts is as described below.
Virtual instrument is Xen hypervisor or Vmware.
Step S201 isolates a core from polycaryon processor, the TPM chip simulator of operation customization on described core.
From polycaryon processor, isolate a core, on described core, move customizing operating system; The TPM chip simulator of operation customization in described customizing operating system.
Customizing operating system for virtual instrument provides can telecommunications services, record the information of virtual instrument and virtual machine activation process thereof.
Provide for virtual instrument at customizing operating system can the process of telecommunications services in, the communication process of the two is to read or fill message is realized by the identical file in disk.Like this, the operating system of customization both can record the information of virtual instrument start-up, also can realize hiding virtual instrument.
Step S202, operation virtual tool carries out virtual, starts privileged child-operation system; In polycaryon processor, be application core for virtual machine provides the core of service.
Step S203, closes described virtual tool.
Step S204, closes the application core in polycaryon processor dummy machine system, forbids virtual memory, and forbids direct memory storage.
Step S205, carries out initialization to the hardware of polycaryon processor dummy machine system.
Step S206, TPM chip simulator carries out Hash operation to the code of virtual machine monitor, and preserves the cryptographic hash calculating.
Step S207, recovers pent application core and forbidden virtual memory, and forbidden direct memory storage; And start described virtual tool and set up virtual machine.
Embodiment
The present invention create trusted environments for virtual machine system of multicore processor method embodiment as shown in Figure 3.Comprise four core processors at this dummy machine system, wherein virtual tool is Xen hypervisor.
The wherein band arrow line expression property of solid line tolerance, dotted line represent the storage to metric with arrow line.
In polycaryon processor, isolate one of them core, core 1 moves customizing operating system, and the TPM chip simulator of operation customization thereon, by this customizing operating system and the binding of TPM chip simulator, externally provide TPM function interface simultaneously, make its TPM safety chip that is virtually reality like reality.Like this simulating TPM safety chip in multiple nucleus system arbitrarily, for the credible of system provides support.
In the virtualized environment of Xen hypervisor, Xen hypervisor VMM runs directly on hardware, the virtual machine (being called Domain) of the multiple mutual isolation of the upper operation of VMM, wherein there is a franchise DomO, be called GuestOS, be in charge of other DomU on whole Xen hypervisor.In the time that dummy machine system is attacked or is injected into wooden horse, whole system is faced with serious security threat., thereby need to create trusted context.Create described in being implemented as follows of trusted context.
Step S301, starts customizing operating system, operation TPM chip simulator.
Step S302, starts Xen Hypersior and DomO.
After DomO starts and finishes, continue startup system, system is now not credible startup, in the time that a certain moment, certain Domain was higher to safety requirements, carries out step S303.
Step S303, sends credible reconstruction order Sec-restart, XenHypersior cycle power then by DomO.
Step S304, security initialization program brings into operation, and security initialization program is carried out a series of action, comprises and closes interruption, forbids virtual memory, forbids DMA (directly memory storage), and close application core by IPI instruction, make to apply core in dormant state.
Step S305, security initialization program initialization system hardware.
Step S306, in the final stage of security initialization program operation, TPM chip simulator is measured Xen hypervisor VMM by security initialization program, and security initialization program sends to TPM chip simulator to preserve result.
Step S307, recovers other just at the application core of dormancy by IPI instruction, and previous forbidden function in open system, as interruption, DMA, gives Xen Hypersior by control.
Step S308, Xen Hypersior brings into operation, and then the startup of DomainO and DomainU is just based upon on safe Xen Hypersior.
In order to guarantee that said process is not destroyed, series of steps is above all that atomic form is carried out.Through this process of tolerance before loading, for Xen hypervisor VMM has set up the execution environment of a safety.In the present invention, do not use real TPM chip, utilize the function of general multi-core CPU simulation TPM chip, wherein metrics process is exactly the process that code to each object or memory address carry out hash.In the process starting most in system, by TPM chip simulator, utilize its hash function, safe loading procedure and Xen hypervisor are moved, and record its hash value, during for authentic authentication.
The present invention is a kind of technology of strick precaution, and its guarantees that each link of system is controllable, be all complete do not have destroyed.Always need a source owing to trusting to transmit, the node that namely must be trusted, so from the beginning, just set up the execution environment of a believable isolation, guarantee that Xenhypervisor operates in this reliable environment, and trust chain is handed on one by one, until the application that user needs moves, like this, from bottom to upper strata, be a complete system not being tampered, make user know the situation of the platform oneself using.
The device that the present invention creates trusted environments for virtual machine system of multicore processor comprises in the time creating trusted context, the TPM chip simulator that monitor of virtual machine is measured; Described TPM chip simulator operates in polycaryon processor and isolates on a core.
Described TPM chip simulator is further used for, in the time creating trusted context, the code of virtual machine monitor being carried out to Hash operation, and preserves the cryptographic hash calculating.
The described core isolating from polycaryon processor moves customizing operating system; Described TPM chip simulator operates in described customizing operating system.
Virtual instrument is moving before establishment trusted context, and starts privileged child-operation system; In polycaryon processor, be application core for virtual machine provides the core of service.
Preferably described in embodiment, device also comprises: disabled module, security initialization module and recovery module.
Disabled module, for closing described virtual tool before TPM chip simulator is measured; Close the application core in polycaryon processor dummy machine system, forbid virtual memory, and forbid direct memory storage;
Security initialization module, for after completing in described disabled module and closing and forbid, carries out initialization to the hardware of polycaryon processor dummy machine system, starts described TPM chip simulator after completing initialization;
Recover module, for after the complete described cryptographic hash of described TPM chip simulator storage, recover pent application core and forbidden virtual memory, and forbidden direct memory storage; And start described virtual tool and carry out the foundation of dummy machine system.
The hardware with the dummy machine system of the polycaryon processor of trusted context is realized as shown in Figure 4.
Internal memory comprises two parts, TPM environment internal memory and Xen hypervisor internal memory, the core of polycaryon processor is also divided into two large classes, core 1 and core 2 are to core 4, be respectively TPM chip simulator and Xenhypervisor service is provided, TPM chip simulator and Xen hypervisor isolate by access control mechanisms, Xen hypervisor and on virtual machine service is externally provided, TPM chip simulator is responsible for the Creditability Problems of whole system.
Those skilled in the art is not departing under the condition of the definite the spirit and scope of the present invention of claims, can also carry out various modifications to above content.Therefore scope of the present invention is not limited in above explanation, but determined by the scope of claims.