Hardware root of trust agent interaction method based on secure virtualization and network device

A network device, comprising a main service processor and a hardware root of trust, wherein the main service processor comprises a hardware root of trust agent program, a hardware root of trust driver program, and a trusted execution environment manager;

• the trusted execution environment manager is configured to:
• receive a first invoking request instruction, and forward the first invoking request instruction to the hardware root of trust agent program, wherein the first invoking request instruction is used to invoke the hardware root of trust, and the trusted execution environment manager is configured to manage the hardware root of trust agent program and the hardware root of trust driver program;
• the hardware root of trust agent program is configured to:
• construct a second invoking request instruction based on the first invoking request instruction, and forward the second invoking request instruction to the hardware root of trust driver program, wherein the second invoking request instruction is an instruction that is of a specific data structure and that is identifiable by the hardware root of trust driver program;
• and
• the hardware root of trust driver program is configured to send a drive instruction to the hardware root of trust based on the second invoking request instruction, wherein the drive instruction instructs the hardware root of trust to perform a high-security operation.

A network device, comprising a main service processor and a hardware security module, wherein the main service processor is used in a secure virtualization system at a secure-exception level 2, and the main service processor comprises a hardware security module agent program, a hardware security module driver program, and a secure partition manager;

• the secure partition manager is configured to:
• receive a first invoking request instruction, and forward the first invoking request instruction to the hardware security module agent program, wherein the first invoking request instruction is used to invoke the hardware security module, and the secure partition manager is configured to manage the hardware security module agent program and the hardware security module driver program;
• the hardware security module agent program is configured to:
• construct a second invoking request instruction based on the first invoking request instruction, and forward the second invoking request instruction to the hardware security module driver program, wherein the second invoking request instruction is an instruction that is of a specific data structure and that is identifiable by the hardware security module driver program;
• and
• the hardware security module driver program is configured to send a drive instruction to the hardware security module based on the second invoking request instruction, wherein the drive instruction instructs the hardware security module to perform a high-security operation.