Chinese Academy of Sciences

Congwu Li

Jingqiang Lin

Jiwu Jing

Zhan Wang

Bingyu Li

Wuqiong Pan

Quanwei Cai

Kaijie Zhu

Luning Xia

Lingchen Zhang

Qiongqiao Wang

Bo Luo

A system and method for providing cryptographic operation service in a virtualization environment. In the system, a configuration subsystem provides an interface for an administrator and a common user to input information about a virtual cryptographic device. A key file storage subsystem stores a key file and protects it with the protection password. A virtual machine operating subsystem obtains a corresponding key file from the storage subsystem according to the input of the configuration subsystem, creates a virtual device for a guest virtual machine, and finally operates the guest virtual machine to provide cryptographic computing service for the guest virtual machine. Thus the administrator/the common user can specify a key file and input a protection password for a guest virtual machine via the corresponding interface to facilitate the creation of a virtual cryptographic device, and can manage the virtual cryptographic device in a user-friendly and centralized manner. The guest virtual machine on a virtualization management platform can request for a secure cryptographic operation service, thereby alleviating the key security problem in virtualization environment.

System and method for providing cryptographic operation service in virtualization environment

The present invention discloses a method and a system for checking revocation status of digital certificates in a virtualization environment. The method includes: 1) Setting up multiple virtual machines in a host computer; setting up a certificate revocation list manager within the virtual machine monitor of the host computer; 2) The certificates relying party in the virtual machines sends a service request for checking certificate revocation status to the certificate revocation list manager; 3) The certificate revocation list manager searches locally for the CRL file corresponding to the service request for checking certificate revocation status: a) If such a corresponding CRL file exists, the CRL file is returned to the certificate relying party in the virtual machines; or, the certificate revocation list manager checks whether the corresponding certificate serial number exists in the CRL file, then returns the result; b) if the corresponding CRL file does not exist, the corresponding CRL file is downloaded and verified according to the configuration file; then the CRL file is returned to the certificate relying party in the virtual machines; or, the certificate revocation list manager checks whether the corresponding certificate serial number exists in the CRL file, then returns the result. The present invention greatly improves the efficiency of checking revocation status of certificates.

Method and system for checking revocation status of digital certificates in a virtualization environment

Growing community of inventors

Beijing, China

Congwu Li