Host virtual machine assisting booting of a fully-encrypted user virtual machine on a cloud environment

• US 9,317,316 B2
• Filed: 12/13/2012
• Issued: 04/19/2016
• Est. Priority Date: 12/28/2011
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Liu, Xinbao
• Primary Examiner(s): Lee, Thomas
• Assistant Examiner(s): POUDEL, SANTOSH RAJ
• Application Number:
  US13/714,003
• Publication Number:
  US 20130173900A1
• Time in Patent Office: 1,223 Days
• Field of Search: 713/2
• US Class Current: 1/1
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06

Abstract

The disclosure provides a key transmission method and device of a virtual machine under full disk encryption during pre-boot. The method includes: pre-booting the virtual machine, where the virtual machine is in a full disk encryption state; during the pre-boot, establishing, by the virtual machine, a transmission channel with a cloud platform, where the cloud platform is configured to provide a key; requesting, by the virtual machine, the key from the cloud platform through the transmission channel, and receiving the key sent by the cloud platform; and decrypting, by the virtual machine, an operation system by using the key, and booting the operation system. In embodiments of the present disclosure, key transmission may be implemented during a pre-boot phase of the virtual machine, so as to boot the virtual machine.

Claims

1. A key transmission method of a user virtual machine, comprising:

sending, by the user virtual machine, a key request message to a host virtual machine through a transmission channel in a hypervisor, wherein the transmission channel in the hypervisor is allocated to the user virtual machine, a host operating system of the host virtual machine is not encrypted, and the user virtual machine is under full disk encryption during a pre-boot;

sending, by the host virtual machine, the key request message to a cloud platform through an IP connection channel between the host virtual machine and the cloud platform, wherein the host virtual machine finishes booting the host operating system, obtains an IP address to establish the IP connection channel with the cloud platform without obtaining an IP address of the user virtual machine before the user virtual machine is booted, and wherein the cloud platform is configured to provide a key;

receiving, by the host virtual machine, the key from the cloud platform through the IP connection channel;

sending, by the host virtual machine, the key to the user virtual machine through the transmission channel in the hypervisor;

receiving, by the user virtual machine, the key sent by the host virtual machine; and

decrypting, by the user virtual machine, a user operating system by using the key and booting the user operating system.

2. The method according to claim 1,

wherein the key request message carries identification information of the user virtual machine;

and

the key is determined by the cloud platform according to the identification information of the user virtual machine.

3. The method according to claim 1, wherein sending the key request message to the host virtual machine through the transmission channel in the hypervisor comprises:

sending, by the user virtual machine, the key request message to the host virtual machine through sharing memory in the hypervisor.

4. The method according to claim 1, wherein before the user virtual machine is pre-booted, the method further comprises:

after a previous normal boot of the user operating system, sending, by the user virtual machine, another key request message carrying identification information of the user virtual machine to the cloud platform through the transmission channel in the hypervisor, receiving a key determined according to the identification information of the user virtual machine and sent by the cloud platform, and performing full disk encryption processing on data of the user virtual machine by using the key.

5. A cloud server, wherein the cloud server comprises a memory and a processor:

the memory having program routines stored therein, the program routines configuring the processor to include;

a user virtual machine sending a key request message to a host virtual machine through a transmission channel in a hypervisor, wherein the transmission channel in the hypervisor is allocated to the user virtual machine, a host operating system of the host virtual machine is not encrypted, and the user virtual machine is under full disk encryption during a pre-boot; and

the host virtual machine sending the key request message to a cloud platform through an IP connection channel between the host virtual machine and the cloud platform, wherein the host virtual machine finishes booting a host operating system, obtains an IP address to establish the IP connection channel with the cloud platform without obtaining an IP address of the user virtual machine before the user virtual machine is booted, receiving the key from the cloud platform through the IP connection channel, and sending the key to the user virtual machine through the transmission channel in the hypervisor;

wherein the user virtual machine receives the key sent by the host virtual machine and decrypts a user operating system by using the key and boots the user operating system.

6. The cloud server according to claim 5, wherein after a previous normal boot of the user operating system, the user virtual machine further sending another key request message carrying identification information of the user virtual machine to the cloud platform through the transmission channel in the hypervisor, receiving the key determined according to the identification information of the user virtual machine and sent by the cloud platform, and performing full disk encryption processing on data of the user virtual machine by using the key.

7. The cloud server according to claim 5, wherein the key request message carries identification information of the user virtual machine, and the key is determined by the cloud platform according to the identification information of the user virtual machine.