为保护虚拟机运行环境及上层服务软件的完整性、安全性,提出了一种基于信任扩展的可信虚拟执行环境的构建方法.首先,建立物理平台配置寄存器(PCR,platform configuration register)与虚拟PCR的映射关系,以此实现虚拟可信平台模块(vTPM)与底层可信计算基的绑定；其次,利用本地vTPM管理器签发证书,完成可信证书链在虚拟机中的延伸.通过物理平台至虚拟平台的信任扩展,虚拟机可以有效地利用TPM提供的相关功能(如远程证明、密封存储等),完成平台环境的证明及私密信息的安全存储,从而构建了可信虚拟执行环境.最后,实现了原型系统并进行了测试,测试结果证明本系统可以有效地实现虚拟平台的密封存储和远程证明等功能.%A method to build trusted virtual execution environment based on trust extension was proposed to ensure the integrity and security of virtual machine and service software. Firstly, to establish mapping of virtual PCR(vPCR) to hardware TPM's PCR, it would be realized to link the vTPM to its TCB. Secondly, using vTPM to issue certificate, trusted certificate chain could be extended. Because of trust extension from hardware to virtual platform, TPM functions (such as remote attestation, sealed storage, etc) were available to applications running in the virtual computing environment. Finally, a prototype system and the results show the system was effective in realizing sealed storage, remote attestation etc.
展开▼
