US 9,317,316 B2Granted

Host virtual machine assisting booting of a fully-encrypted user virtual machine on a cloud environment

AssigneeHuawei Technologies Co., Ltd.

InventorXinbao Liu

Life of this patent

Estimating the term…

Loading patent…

Abstract

The disclosure provides a key transmission method and device of a virtual machine under full disk encryption during pre-boot. The method includes: pre-booting the virtual machine, where the virtual machine is in a full disk encryption state; during the pre-boot, establishing, by the virtual machine, a transmission channel with a cloud platform, where the cloud platform is configured to provide a key; requesting, by the virtual machine, the key from the cloud platform through the transmission channel, and receiving the key sent by the cloud platform; and decrypting, by the virtual machine, an operation system by using the key, and booting the operation system. In embodiments of the present disclosure, key transmission may be implemented during a pre-boot phase of the virtual machine, so as to boot the virtual machine.

Claims7

Dependent claims

A key transmission method of a user virtual machine, comprising:

sending, by the user virtual machine, a key request message to a host virtual machine through a transmission channel in a hypervisor, wherein the transmission channel in the hypervisor is allocated to the user virtual machine, a host operating system of the host virtual machine is not encrypted, and the user virtual machine is under full disk encryption during a pre-boot;
sending, by the host virtual machine, the key request message to a cloud platform through an IP connection channel between the host virtual machine and the cloud platform, wherein the host virtual machine finishes booting the host operating system, obtains an IP address to establish the IP connection channel with the cloud platform without obtaining an IP address of the user virtual machine before the user virtual machine is booted, and wherein the cloud platform is configured to provide a key;
receiving, by the host virtual machine, the key from the cloud platform through the IP connection channel;
sending, by the host virtual machine, the key to the user virtual machine through the transmission channel in the hypervisor;
receiving, by the user virtual machine, the key sent by the host virtual machine;
and
decrypting, by the user virtual machine, a user operating system by using the key and booting the user operating system.

4 more elements

A cloud server, wherein the cloud server comprises a memory and a processor:

the memory having program routines stored therein, the program routines configuring the processor to include:
a user virtual machine sending a key request message to a host virtual machine through a transmission channel in a hypervisor, wherein the transmission channel in the hypervisor is allocated to the user virtual machine, a host operating system of the host virtual machine is not encrypted, and the user virtual machine is under full disk encryption during a pre-boot;
and
the host virtual machine sending the key request message to a cloud platform through an IP connection channel between the host virtual machine and the cloud platform, wherein the host virtual machine finishes booting a host operating system, obtains an IP address to establish the IP connection channel with the cloud platform without obtaining an IP address of the user virtual machine before the user virtual machine is booted, receiving the key from the cloud platform through the IP connection channel, and sending the key to the user virtual machine through the transmission channel in the hypervisor;
wherein the user virtual machine receives the key sent by the host virtual machine and decrypts a user operating system by using the key and boots the user operating system.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/714,003Filed 13 Dec 2012 · continuation
Priority: 28 Dec 2011
Published: US 2013/0173900 A14 Jul 2013
Granted: 19 Apr 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 9/45558
Hypervisors; Virtual machine monitors: hypervisor-specific management and integration aspects
G06F 9/4406
Bootstrapping: loading of operating system
G06F 21/575
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
H04L 9/08
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: key distribution or…