# US 2014/0157004 A1 · Apparatus and method for encryption in virtualized environment using auxiliary medium > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157004 A1 - Document ID: US20140157004A1 - Status: Published application - Kind: A1 - Application number: 14/081,237 - Filed: 2013-11-15 - Published: 2014-06-05 - Earliest claimed: 2012-11-30 - Assignees: Electronics and Telecommunications Research Institute - Applicants: Electronics and Telecommunications Research Institute - Inventors: Sung-Jin PARK; Tae-Min AHN; Cheol-Oh KANG; Jeong-Seok LIM - Web page: https://patentgrep.com/patent/US20140157004A1 ## CPC - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - G06F 2009/45587: {Isolation or security of virtual machine instances} - H04L 2209/127: Trusted platform modules [TPM] - H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An apparatus and method for encryption in a virtualized environment using an auxiliary medium. The apparatus for encryption in a virtualized environment using an auxiliary medium includes a hypervisor unit for acquiring data for encryption from an auxiliary medium, and encrypting and providing protection target data of an application program using the data for encryption in response to an encryption request from the application program. A hypercall unit provides a virtualization interface between the application program and the hypervisor unit. ## Claims ### Claim 1 An apparatus for encryption in a virtualized environment using an auxiliary medium, comprising: a hypervisor unit for acquiring data for encryption from an auxiliary medium, and encrypting and providing protection target data of an application program using the data for encryption in response to an encryption request from the application program; and a hypercall unit for providing a virtualization interface between the application program and the hypervisor unit. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the hypervisor unit comprises: an information acquisition unit for exchanging an internal key with the auxiliary medium; and an information provision unit for encrypting and providing the protection target data in response to the encryption request from the application program. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the exchange of the internal key uses a Diffie-Hellman algorithm. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the information acquisition unit receives the data for encryption from the auxiliary medium, with the data for encryption being encrypted using the internal key, decrypts the encrypted data for encryption using the internal key, and then acquires the data for encryption. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein the information acquisition unit is configured to check integrity of the encrypted data for encryption, and if integrity of the encrypted data for encryption is found to be maintained as a result of the integrity check, decrypt the encrypted data for encryption using the internal key, and then acquire the data for encryption. ### Claim 6 (depends on 5) The apparatus of claim 5, wherein the information acquisition unit stores the data for encryption in a separate memory page. ### Claim 7 (depends on 6) The apparatus of claim 6, wherein the hypervisor unit further comprises an external access detection unit configured to, when external access to the memory page is gained, deny external access. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the auxiliary medium comprises a processor for exchanging the internal key and encrypting the data for encryption using the internal key. ### Claim 9 (depends on 8) The apparatus of claim 8, wherein the auxiliary medium includes the data for encryption stored in an environment in which a connection to a network is not made. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the auxiliary medium comprises a tamper-resistant sensor. ### Claim 11 A method for encryption in a virtualized environment using an auxiliary medium, comprising: acquiring data for encryption from an auxiliary medium; and encrypting and providing protection target data of an application program using the data for encryption in response to an encryption request from the application program. ### Claim 12 (depends on 11) The method of claim 11, wherein acquiring the data for encryption comprises exchanging an internal key with the auxiliary medium. ### Claim 13 (depends on 12) The method of claim 12, wherein the exchange of the internal key uses a Diffie-Hellman algorithm. ### Claim 14 (depends on 13) The method of claim 13, wherein acquiring the data for encryption is configured to receive the data for encryption from the auxiliary medium, with the data for encryption being encrypted using the internal key, decrypt the encrypted data for encryption using the internal key, and then acquire the data for encryption. ### Claim 15 (depends on 14) The method of claim 14, wherein: acquiring the data for encryption further comprises checking integrity of the encrypted data for encryption, and acquiring the data for encryption is configured to, if integrity of the encrypted data for encryption is found to be maintained as a result of the integrity check, decrypt the encrypted data for encryption using the internal key, and then acquire the data for encryption. ### Claim 16 (depends on 15) The method of claim 15, wherein acquiring the data for encryption is configured to store the data for encryption in a separate memory page. ### Claim 17 (depends on 16) The method of claim 16, further comprising, when external access to the memory page is gained, denying external access. ### Claim 18 (depends on 17) The method of claim 17, wherein the auxiliary medium comprises a processor for exchanging the internal key and encrypting the data for encryption using the internal key. ### Claim 19 (depends on 18) The method of claim 18, wherein the auxiliary medium includes the data for encryption stored in an environment in which a connection to a network is not made. ### Claim 20 (depends on 19) The method of claim 19, wherein the auxiliary medium comprises a tamper-resistant sensor.