SECURITY-ENHANCED DEVICE BASED ON VIRTUALIZATION AND THE METHOD THEREOF

• US 20150220709A1
• Filed: 01/16/2015
• Published: 08/06/2015
• Est. Priority Date: 02/06/2014
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: JUNG, Young Woo, KIM, Hag Young
• Application Number:
  US14/599,278
• Publication Number:
  US 20150220709A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

Disclosed is an electronic device for supporting enhanced security including: a processor; a memory; a virtual machine monitor; a first virtual machine in which a host operating system is operated; and a second virtual machine in which a security operating system is operated. Each operating system may access only system resources allocated through the virtual machine monitor.

Claims

1. An electronic device for supporting enhanced security, comprising:

a processor;

a memory;

a virtual machine monitor;

a first virtual machine in which a host operating system is operated; and

a second virtual machine in which a security operating system is operated,

wherein each operating system accesses only system resources allocated through the virtual machine monitor.

2. The electronic device of claim 1, wherein the virtual machine monitor supports an event channel and a shared memory, and

the host operating system communicates with the security operating system through the event channel.

3. The electronic device of claim 2, wherein when an authentication request is issued from an application operated on the host operating system, the host operating system transfers an event for the authentication request to the security operating system through the event channel.

4. The electronic device of claim 3, wherein the host operating system stores information associated with the authentication request in the shared memory.

5. The electronic device of claim 4, wherein the security operating system accesses information stored in the shared memory.

6. The electronic device of claim 5, wherein the host operating system allocates a portion of an area of the virtual memory of the host operating system to the shared memory and informs the virtual machine monitor of the allocation, and

the security operating system maps the shared memory to some of the area of the virtual memory of the security operating system.

7. The electronic device of claim 1, wherein the second virtual machine includes at least one authentication module and at least one authentication credential, and

the authentication module uses the authentication credential to generate encrypted authentication information.

8. The electronic device of claim 7, wherein the encrypted authentication information is transferred to the first virtual machine through the virtual machine monitor.

9. The electronic device of claim 8, wherein the encrypted authentication information is used for authentication of the electronic device through an authentication server positioned outside the electronic device.

10. The electronic device of claim 1, wherein the host operating system requests the security information of the security operating system through the virtual machine monitor, and

the security operating system transfers the security information generated in response to the request to the host operating system through the virtual machine monitor.

11. An authentication performing method using a host operating system and a security operating system which are driven on different virtual machines, comprising:

transferring an authentication request from the host operating system to the security operating system through the virtual machine monitor;

generating encrypted authentication information in response to the authentication request; and

transferring the generated authentication information to the host operating system through the virtual machine monitor,

wherein the host operating system uses the authentication information for authentication by an authentication server.

12. The method of claim 11, wherein the transferring of the authentication request includes:

storing information for authentication in a shared memory area; and

transferring an authentication request event to the security operating system through an event channel.

13. The method of claim 12, wherein the generating of the encrypted authentication information includes:

acquiring, by the authentication module of the security operating system, the information for authentication stored in the shared memory area; and

generating, by the authentication module, the encrypted authentication information using authentication credential corresponding to the information for authentication.

14. The method of claim 13, wherein the transferring of the authentication information includes:

storing the generated authentication information in a shared memory area; and

transferring an event for the authentication information to the host operating system through the event channel.

15. The method of claim 12, wherein the host operating system allocates a portion of an area of the virtual memory of the host operating system to the shared memory and informs the virtual machine monitor of the allocation, and

the security operating system maps the shared memory to some of the area of the virtual memory of the security operating system.