WO2014089968A1

WO2014089968A1 - Virtual machine system data encryption method and device

Info

Publication number: WO2014089968A1
Application number: PCT/CN2013/079696
Authority: WO
Inventors: 刘新保
Original assignee: 华为技术有限公司
Priority date: 2012-12-14
Filing date: 2013-07-19
Publication date: 2014-06-19
Also published as: CN103873245B; CN103873245A

Abstract

Provided are a virtual machine system data encryption method and device. The virtual machine system data encryption method comprises: terminal equipment receiving a first message which is sent by a network encryption gateway and has been subjected to transport-layer encryption processing, and performing transport-layer decryption processing on the first message which has been subjected to the transport-layer encryption processing; the terminal equipment extracting application data from the decrypted first message, and performing hardware encryption processing on the application data through a hardware encryption module arranged on the terminal equipment, wherein the application data are data generated by a virtual machine in a virtual machine system; and the terminal equipment generating a second message according to the encrypted application data, subjecting the second message to transport-layer encryption processing, and sending to the network encryption gateway the second message which has been subjected to the transport-layer encryption processing.The virtual machine system data encryption method and device provided in the embodiments of the present invention realize encryption support for application data of a plurality of virtual machines on a physical server.

Description

Virtual machine system data encryption method and device

[01] Technical Field

[02] The embodiments of the present invention relate to communication technologies, and in particular, to a virtual machine system data encryption method and device.

BACKGROUND

[04] With the development of computer technology, virtualization technology has been widely promoted and applied. Desktop virtualization is the installation of a virtual machine system on a physical server that implements the data center. The virtual machine system simulates the hardware resources required for the operation of the operating system. The operating system runs on top of these virtual hardware resources, so that multiple operating systems can share the hardware resources of the physical server, thereby improving resource utilization.

[05] Encryption is an important means of ensuring the security of data. A dongle is a dedicated plug-in cryptographic device that provides encryption services for PCs (Personal Computers). An encryption card is inserted on the PC, and the encryption card can encrypt data on the PC or data flowing from the PC to ensure data security. Data encryption by encryption card is safer because the key is not stored in the memory. However, for a physical server with a virtual machine system installed, when the encryption card is inserted on the physical server, there is no virtualization technology for the encryption card in the prior art, which results in only one virtual machine on the physical server at the same time. The exclusive encryption card for encryption services requires a solution.

[06]

[07] Summary of the invention

The embodiment of the invention provides a method and device for encrypting data of a virtual machine system, so as to implement encryption support for application data of multiple virtual machines on a physical server.

[09] In a first aspect, an embodiment of the present invention provides a data encryption method for a virtual machine system, including:

[10] The terminal device receives the first packet after the transport layer encryption process sent by the network encryption gateway, and performs the transport layer decryption process on the first text that has been encrypted by the transport layer;

[11] The terminal device extracts application data from the decrypted first packet, and performs hardware encryption processing on the application data by using a hardware encryption module set on the terminal device, where the application data is a virtual machine. Data generated by virtual machines in the system;

[12] The terminal device generates a second packet according to the encrypted application data, performs a transport layer encryption process on the second packet, and sends a second packet that is encrypted by the transport layer to the network encryption gateway. . [13] In a first possible implementation manner, the first packet includes a key identifier used to identify a key;

[14] The terminal device extracts application data from the decrypted first packet, and performs hardware encryption processing on the application data by using a hardware encryption module set on the terminal device, specifically:

[15] The terminal device extracts the application data and the key identifier from the decrypted first packet, and sends the application data and the key identifier to the hardware encryption module. The hardware encryption module determines a key according to the key identifier, encrypts the application data by using the key, and returns the encrypted application data to the terminal device.

[16] In combination with the first aspect or the first possible implementation manner of the first aspect, in a second possible implementation manner, the terminal device receives a first report that is sent by the network encryption gateway and is subjected to the transport layer encryption process. Text, specifically:

[17] The terminal device receives, by using the virtual desktop proxy client module of the terminal device, a virtual channel established by the virtual desktop proxy module of the virtual machine via the network encryption gateway, and receiving the network encrypted gateway. Decoding the first message after being encrypted by the transport layer;

[18] The terminal device sends the second packet that is encrypted by the transport layer to the network encryption gateway, specifically:

[19] The terminal device sends the second packet encrypted by the transport layer to the network encryption gateway through the virtual channel.

[20] In combination with the second possible implementation manner of the first aspect, in a third possible implementation manner, the terminal device uses a virtual desktop proxy client module of the terminal device and a virtual desktop of the virtual machine The method further includes: before the receiving, by the proxy module, the virtual channel of the network encryption gateway, the first packet sent by the network encryption gateway after the encryption process is performed by the network encryption gateway, the method further includes:

[21] The virtual desktop proxy client module of the terminal device establishes the virtual channel with a virtual desktop proxy module of the virtual machine.

[22] In a fourth possible implementation manner, the method further includes:

[23] the terminal device receives a third "3" message sent by the network encryption gateway after being encrypted by the transport layer, and performs a transport layer decryption process on the third "3" message that has been encrypted by the transport layer;

[24] the terminal device extracts the encrypted application data from the decrypted first packet, and performs hardware decryption processing on the encrypted application data by using a hardware encryption module set on the terminal device. The encrypted application data is data generated by a virtual machine in the virtual machine system and encrypted by the hardware encryption module hardware of the terminal device;

[25] The terminal device generates a fourth packet according to the decrypted application data, performs a transport layer encryption process on the fourth packet, and sends a fourth packet that is encrypted by the transport layer to the network encryption gateway. .

[26] In a second aspect, a data encryption method for a virtual machine system is provided in the embodiment of the present invention, including:

[27] The virtual machine generates a first packet according to the received application data sent by the application in the virtual machine, and sends the first packet to the network encryption gateway;

[28] The virtual machine receives the second packet after the transport layer decryption process sent by the network encryption gateway, and extracts the encrypted application data in the second packet after the transport layer decryption process, The encrypted application data is sent to the application, where the encrypted application data is obtained by performing hardware encryption processing on the application processing by the terminal device.

[29] In a first possible implementation manner, the virtual machine generates a first packet according to the application data that is sent by the application in the virtual machine, which is specifically:

[30] The virtual machine generates the text according to the received application data and the key identifier sent by the application, where the key identifier is used to identify a key.

In combination with the second aspect or the first possible implementation manner of the second aspect, in a second possible implementation manner, the virtual machine sends the first packet to a network encryption gateway, specifically:

[32] The virtual machine sends the first packet to the virtual channel through the network encryption gateway established by the virtual desktop proxy module of the virtual machine and the virtual desktop proxy client module of the terminal device The network encryption gateway;

[33] The virtual machine receives the second packet that is sent by the network encryption gateway and is decrypted by the transport layer, and is specifically:

[34] The virtual machine receives, by using the virtual channel, the second text after the transport layer decryption process sent by the network encryption gateway.

[35] In conjunction with the second possible implementation of the second aspect, in a third possible implementation, before the sending, by the virtual machine, the first packet to the network encryption gateway, the method further includes:

[36] The virtual desktop proxy module of the virtual machine establishes the virtual channel with a virtual desktop proxy client module of the terminal device. [37] In a fourth possible implementation manner, the method further includes:

[38] The virtual machine generates a third packet according to the received encrypted application data sent by the application in the virtual machine, and sends the third packet to the network encryption gateway;

[39] The virtual machine receives the fourth packet after the transport layer decryption process sent by the network encryption gateway, and extracts the decrypted application data in the fourth packet after the transport layer decryption process, The decrypted application data is sent to the application, where the decrypted application data is obtained by the terminal device performing hardware decryption processing on the encrypted application processing.

[40] In a third aspect, an embodiment of the present invention provides a terminal device, including:

[41] a transport layer decryption module, configured to receive a first “text” sent by the network encryption gateway after the transport layer encryption process, and perform the transport layer decryption process on the text encrypted by the transport layer;

[42] an encryption service module, configured to be connected to the transport layer decryption module, configured to extract application data from the decrypted first packet, and perform hardware encryption on the application data by using a hardware encryption module set on the terminal device. Processing, where the application data is data generated by a virtual machine in a virtual machine system;

[43] The transport layer encryption module is connected to the cryptographic service module, configured to generate a second packet according to the encrypted application data, perform a transport layer encryption process on the second packet, and encrypt the transport layer. The second packet is sent to the network encryption gateway.

[44] In a first possible implementation manner, the first packet includes a key identifier used to identify the key;

[45] The cryptographic service module is specifically configured to extract the application data and the key identifier from the decrypted first packet, and send the application data and the key identifier to the hardware The encryption module, the hardware encryption module determines a key according to the key identifier, encrypts the application data by using the key, and returns the encrypted application data to the terminal device.

[46] In combination with the third aspect or the first possible implementation manner of the third aspect, in a second possible implementation manner, the terminal device further includes:

[47] a virtual desktop proxy client module, configured to establish a virtual channel with the virtual desktop proxy module of the virtual machine via the network encryption gateway;

[48] The transport layer decryption module is configured to receive, by using the virtual channel, the first packet that is sent by the network encryption gateway and is encrypted by the transport layer;

[49] The transport layer encryption module is specifically configured to pass the second packet after the transport layer is encrypted. The virtual channel is sent to the network encryption gateway.

[50] In a third possible implementation, the transport layer decryption module is further configured to receive a third “3” message sent by the network encryption gateway after the transport layer encryption process, and encrypt the transport layer The processed third packet is subjected to a transport layer decryption process;

[51] The cryptographic service module further extracts the encrypted application data from the decrypted first packet, and performs hardware decryption processing on the encrypted application data by using a hardware encryption module set on the terminal device, where The encrypted application data is data generated by a virtual machine in the virtual machine system and encrypted by the hardware encryption module hardware of the terminal device;

[52] The transport layer encryption module is further configured to generate a fourth packet according to the decrypted application data, perform a transport layer encryption process on the fourth packet, and send the fourth packet after the transport layer encryption process to The network encryption gateway.

[53] In a fourth aspect, an embodiment of the present invention provides a virtual machine, including:

[54] a sending processing module, configured to generate a first packet according to the received application data sent by the application in the virtual machine, and send the first packet to a network encryption gateway;

[55] The receiving processing module is configured to receive the second packet that is sent by the network encryption gateway and is subjected to the decryption process by the transport layer, and extract the encrypted application data in the second packet that has been decrypted by the transport layer. And sending the encrypted application data to the application, where the encrypted application data is obtained by performing hardware encryption processing on the application processing by the terminal device.

[56] In a first possible implementation manner, the sending processing module is configured to generate the first packet according to the received application data and a key identifier sent by the application, where the secret The key identifier is used to identify the key.

[57] In combination with the fourth aspect or the first possible implementation manner of the fourth aspect, in a second possible implementation manner, the virtual machine further includes:

[58] a virtual desktop proxy module, configured to establish, by the virtual desktop proxy client module of the terminal device, a virtual channel through the network encryption gateway;

[59] The sending processing module is specifically configured to send the first packet to the network encryption gateway by using the virtual channel;

[60] The receiving processing module is configured to receive, by using the virtual channel, a second packet that is sent by the network encryption gateway and is decrypted by the transport layer. [61] In a third possible implementation, the sending processing module is further configured to generate a third packet according to the received encrypted application data sent by the application in the virtual machine, where the Three messages are sent to the network encryption gateway;

[62] The receiving processing module is further configured to receive a fourth packet that is sent by the network encryption gateway and that is decrypted by the transport layer, and extract the decrypted information in the fourth packet that has undergone the decryption process by the transport layer. And applying the decrypted application data to the application, where the decrypted application data is obtained by the terminal device performing hardware decryption processing on the encrypted application processing.

[63] In a fifth aspect, an embodiment of the present invention provides a terminal device, including: a processor, a communication interface, a memory, and a bus:

[64] wherein the processor, the communication interface, and the memory complete communication with each other through the bus;

[65] the communication interface is configured to receive a first packet sent by the network encryption gateway after being encrypted by the transport layer, and send a second packet that is encrypted by the transport layer to the network encryption gateway;

[66] the memory, configured to store an instruction;

[106] the processor is configured to execute an instruction stored in the memory, wherein the processor is configured to perform a transport layer decryption process on the text encrypted by the transport layer, The application data is extracted by the decrypted first packet, and the application data is subjected to hardware encryption processing by using a hardware encryption module set on the terminal device, where the application data is data generated by a virtual machine in the virtual machine system. And generating a second packet according to the encrypted application data, and performing a transport layer encryption process on the second packet.

[68] In a sixth aspect, an embodiment of the present invention provides a computer node for a virtual machine, including: a processor, a communication interface, a memory, and a bus:

[69] wherein the processor, the communication interface, and the memory complete communication with each other through the bus;

[70] the communication interface is configured to send the first packet to the network encryption gateway, and receive the second text sent by the network encryption gateway after being decrypted by the transport layer;

[71] the memory is configured to store an instruction;

[72] the processor is configured to execute an instruction stored in the memory, wherein the processor is configured to generate an application data according to the received application data sent by the application in the virtual machine The first message is sent; the encrypted application data in the second packet after the decryption process of the transport layer is extracted, and the encrypted application data is sent to the application, where the encrypted The application data is obtained by performing hardware encryption processing on the application processing by the terminal device.

[73] According to the foregoing technical solution, a data encryption method and device for a virtual machine system provided by an embodiment of the present invention, after receiving a first packet sent by a network encryption gateway and being encrypted by a transport layer, the terminal device passes through a transport layer. The first packet after the encryption process is subjected to a transport layer decryption process, and the application data is extracted from the decrypted first packet, and the application data is subjected to hardware encryption processing by using a hardware encryption module set on the terminal device, where the application data is virtualized. The data generated by the virtual machine in the machine system generates a second packet according to the encrypted application data, performs a transport layer encryption process on the second packet, and sends the second packet encrypted by the transport layer to the network encryption gateway. The application data generated by the virtual machine is encrypted by the terminal device provided with the hardware encryption module, and the encryption data of the application data of the plurality of virtual machines on the physical server is supported without inserting the encryption card on the physical server. Moreover, the encryption process fully utilizes the processing capabilities of the terminal device, reducing the load on the virtual machine.

[74]

[75] BRIEF DESCRIPTION OF THE DRAWINGS

[76] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below, and obviously, in the following description The drawings are some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive labor.

1 is a flowchart of a method for encrypting data of a first virtual machine system according to an embodiment of the present invention;

2 is a flowchart of a second virtual machine system data encryption method according to an embodiment of the present invention;

3 is a flowchart of a third virtual machine system data encryption method according to an embodiment of the present invention;

4 is a flowchart of a fourth virtual machine system data encryption method according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a first terminal device according to an embodiment of the present invention; FIG.

6 is a schematic structural diagram of a second terminal device according to an embodiment of the present invention;

7 is a schematic structural diagram of a first virtual machine according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a second virtual machine according to an embodiment of the present invention; FIG.

9 is a schematic structural diagram of a third terminal device according to an embodiment of the present invention; FIG. 10 is a schematic structural diagram of a computer node for a virtual machine according to an embodiment of the present invention.

[87]

[88] Specific implementation

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. The embodiments are a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

FIG. 1 is a flowchart of a method for encrypting data of a first virtual machine system according to an embodiment of the present invention. As shown in FIG. 1 , the data encryption method of the virtual machine system provided in this embodiment may be specifically applied to a data encryption process in a virtual machine system, where the virtual machine system may include at least one physical server, and each physical server is configured with At least two virtual machines, the following uses one of the virtual machines as an example to describe the virtual machine system data encryption method. The data encryption method of the virtual machine system provided in this embodiment specifically includes:

[91] Step C10: The terminal device receives the message after the transport layer encryption process sent by the network encryption gateway, and performs the transport layer decryption process on the text encrypted by the transport layer;

[92] Step C20: The terminal device extracts application data from the decrypted first packet, and performs hardware encryption processing on the application data by using a hardware encryption module set on the terminal device, where the application data is Data generated for virtual machines in a virtual machine system;

[93] Step C30: The terminal device generates a second packet according to the encrypted application data, performs a transport layer encryption process on the second packet, and sends the second packet after the transport layer encryption process to the Network encryption gateway.

Specifically, the terminal device may be an object that the virtual machine system provides a service service. For example, the virtual machine system may be used for, but not limited to, providing a virtual desktop service for the user, and the user may use the terminal device to transmit the protocol through the desktop. The virtual machine in the virtual machine system is accessed, and the terminal device sends operation information such as the user's mouse and keyboard to the virtual machine, and the virtual machine sends the virtual desktop information to the terminal device. The virtual machine system can also provide users with other business services such as mail service and storage service. The terminal device may specifically be an electronic device such as a smart phone, a tablet computer, and a notebook computer.

[95] The network encryption gateway can be set at the exit of the virtual machine system, which is virtual in the virtual machine system. The message sent by the machine is encrypted by the transport layer. An application is run on the virtual machine to implement the corresponding service. The application data is specifically generated by the application in the business process. When the application needs to encrypt the application data, the virtual machine generates the first packet by using the application data. The first packet is sent to the network encryption gateway, and the network encryption gateway performs the transport layer encryption processing on the first packet, and the transport layer encryption is also implemented in the manner of hardware encryption to ensure the reliability of the transport layer encryption. The network encryption gateway sends the first packet that has been encrypted by the transport layer to the terminal device. Because the packets sent by the VM are in plain text, the network layer encryption gateway encrypts the first packet to ensure the security of the application data.

[96] A hardware encryption module is disposed on the terminal device, and the hardware encryption module may be an encryption chip or a USB (Universal Serial BUS) encryption device, and the hardware encryption module stores a key and/or a digital certificate. . Receiving, by the network encryption gateway, the first packet that has been encrypted by the transport layer, performing the transport layer decryption process, extracting the application data from the decrypted first packet, and then using the driver interface function of the hardware encryption module The application data is sent to the hardware encryption module, and the hardware encryption module encrypts the application data by using the key and/or the digital certificate, and then returns the encrypted application data to the terminal device, and the terminal device generates the second packet by using the encrypted application data. The second packet is then encrypted by the transport layer. When the second packet is encrypted by the transport layer, the second packet may be hardware-encrypted by the hardware encryption module of the terminal device, and the mobile terminal sends the second packet encrypted by the transport layer to the network encryption gateway, and the network encrypts the network. The gateway decrypts the received second packet and sends it to the virtual machine. The virtual machine extracts application data from the second packet, where the application data is application data encrypted by the terminal device hardware, and correspondingly processes the application data, and the processing may be, for example, forwarding application data or writing application data. Operations such as disks.

[97] When multiple virtual machines in a virtual machine system need to encrypt application data at the same time, the application data can be encrypted by the terminal device by the above method. The terminal devices corresponding to each virtual machine can be the same terminal device or different terminal devices.

[98] The virtual machine system data encryption method provided by the embodiment, the terminal device receives the first >3⁄4 text sent by the network encryption gateway after the transport layer encryption process, and performs the first >3⁄4 text after the transport layer encryption process. The transport layer decryption process extracts application data from the decrypted first packet, and performs hardware encryption processing on the application data through a hardware encryption module set on the terminal device, where the application data is data generated by the virtual machine in the virtual machine system. And generating a second packet according to the encrypted application data, performing a transport layer encryption process on the second packet, and transmitting the second packet encrypted by the transport layer to the network encryption gateway. Encrypting application data generated by the virtual machine by using a terminal device provided with a hardware encryption module, Encryption support for application data of multiple virtual machines on a physical server is implemented without inserting an encryption card on the physical server. Moreover, the encryption process takes full advantage of the processing capabilities of the terminal device and reduces the load on the virtual machine.

[99] In this embodiment, the first identifier includes a key identifier for identifying a key. Correspondingly, in step C20, the terminal device extracts application data from the decrypted first packet. Performing hardware encryption processing on the application data by using a hardware encryption module set on the terminal device, which may be:

[100] The terminal device extracts the application data and the key identifier from the decrypted first packet, and sends the application data and the key identifier to the hardware encryption module. The hardware encryption module determines a key according to the key identifier, encrypts the application data by using the key, and returns the encrypted application data to the terminal device.

[101] Specifically, the number of keys stored in the hardware encryption module of the terminal device may be multiple, and each key has a unique key identifier, and the data provided by the application has a key in addition to the application data that needs to be encrypted. The virtual machine generates the first packet by using the application data and the key identifier.

[102] The terminal device sends the application data and the key identifier extracted from the first packet to the hardware encryption module, and the hardware encryption module determines the corresponding key according to the key identifier, and encrypts the application data by using the key. Return to the terminal device.

In this embodiment, in step C10, the terminal device receives the message that is sent by the network encryption gateway and is encrypted by the transmission layer, and may be specifically:

[104] The terminal device receives, by using the virtual desktop proxy client module of the terminal device, a virtual channel established by the virtual desktop proxy module of the virtual machine via the network encryption gateway, and receiving the network encrypted gateway. Decoding the first message after being encrypted by the transport layer;

[105] Step C30, the terminal device sends the second packet that is encrypted by the transport layer to the network encryption gateway, which may be:

[106] The terminal device sends the second packet encrypted by the transport layer to the network encryption gateway through the virtual channel.

Specifically, the virtual machine system is, for example, a system for providing virtual desktop services, and a virtual desktop agent (Virtual Desktop Agent, VDA for short) module is disposed in the virtual machine of the virtual machine system, and correspondingly, the terminal device is provided with Virtual Desktop Agent Client module. In the virtual desktop service, the virtual desktop proxy module of the virtual machine establishes a virtual channel with the virtual desktop proxy client module of the terminal device, and the virtual channel encrypts the gateway via the network. Virtual machine and The interaction of the terminal device can be implemented through the virtual channel. When the desktop cloud replaces the traditional desktop office, the original encryption service is guaranteed to be lost, and the original encryption program does not need to be changed. The hardware encryption module on the terminal device can be reused to provide the transmission layer encryption capability of the terminal device and the desktop cloud data center, that is, the virtual machine system, which saves the cost of deploying the network encryption machine on the terminal device side and enables the access location of the desktop terminal. flexible.

[108] In this embodiment, the terminal device receives the virtual channel established by the virtual desktop proxy client module of the terminal device and the virtual desktop proxy module of the virtual device via the network encryption gateway, and receives the Before the first packet sent by the transport layer is encrypted by the network encryption gateway, the method further includes:

[109] The virtual desktop proxy client module of the terminal device establishes the virtual channel with a virtual desktop proxy module of the virtual machine.

[110] Specifically, the process of establishing a virtual channel may be initiated by the virtual desktop proxy client module of the terminal device to the virtual desktop proxy module of the virtual machine, or may be virtual desktop proxy module of the virtual machine to the virtual desktop of the terminal device. The proxy client module initiates the request.

2 is a flow chart of a second method for encrypting data of a virtual machine system according to an embodiment of the present invention. As shown in FIG. 2, in this embodiment, the virtual machine system data encryption method may further include:

[112] Step C40: The terminal device receives the third>3⁄4 text sent by the network encryption gateway after the transport layer encryption process, and performs the transport layer decryption on the third>3⁄4 text after the transport layer encryption process. deal with;

[113] Step C50: The terminal device extracts the encrypted application data from the decrypted first packet, and performs hardware decryption processing on the encrypted application data by using a hardware encryption module set on the terminal device. The encrypted application data is data generated by a virtual machine in the virtual machine system and encrypted by the hardware encryption module hardware of the terminal device;

[114] Step C60: The terminal device generates a fourth packet according to the decrypted application data, performs a transport layer encryption process on the fourth packet, and sends a fourth packet after the transport layer encryption process to the Network encryption gateway.

Specifically, the terminal device may further decrypt the encrypted application data sent by the virtual machine through the hardware encryption module. The encrypted application data is generated by the application of the previous virtual machine, and the data is processed by the hardware encryption module of the terminal device.

[116] When an application on a virtual machine needs to decrypt encrypted application data, the virtual machine will add The third application packet is generated by the dense application data, and the third packet is sent to the network encryption gateway, and the network encryption gateway performs the transport layer encryption processing on the third packet, and then sends the third packet to the terminal device. The terminal device receives the third packet that is sent by the network encryption gateway and is encrypted by the transport layer, and performs a transport layer decryption process. The transport layer decryption process may also be implemented by using a hardware encryption module set on the terminal device. Extracting the encrypted application data from the decrypted third message, and transmitting the encrypted application data to the hardware encryption module through a driver interface function of the hardware encryption module, and the hardware encryption module passes the encrypted application data through the secret After the key and/or the digital certificate is decrypted, the decrypted application data is returned to the terminal device, and the terminal device generates a fourth packet by using the decrypted application data, and the fourth packet is encrypted by the transport layer and then sent to the network encryption gateway. The network encryption gateway decrypts the received fourth packet and sends it to the virtual machine. The virtual machine extracts the decrypted application data from the fourth packet, and performs corresponding processing on the application data, and the processing may be, for example, an operation of forwarding the application data or writing the application data to the disk.

[117] When multiple virtual machines in the virtual machine system need to decrypt the application data at the same time, the application data can be decrypted by the terminal device by the above method.

[118] Of course, in the decryption process, the interaction between the terminal device and the virtual machine can also be implemented through the above virtual channel, and the specific implementation process is not described herein.

FIG. 3 is a flowchart of a third virtual machine system data encryption method according to an embodiment of the present invention. As shown

As shown in FIG. 3, the data encryption method of the virtual machine system provided in this embodiment may be implemented in conjunction with the data encryption method of the virtual machine system applied to the terminal device according to any embodiment of the present invention. The specific implementation process is not described herein. The data encryption method of the virtual machine system provided in this embodiment specifically includes:

[120] Step S10: The virtual machine generates a first packet according to the application data sent by the application in the virtual machine, and sends the first packet to the network encryption gateway.

[121] Step S20: The virtual machine receives the second packet after the transport layer decryption process sent by the network encryption gateway, and extracts the encrypted application in the second packet after the transport layer decryption process. Data, the encrypted application data is sent to the application, where the encrypted application data is obtained by performing hardware encryption processing on the application processing by the terminal device.

[122] The virtual machine system data encryption method provided by the embodiment, the virtual machine generates a first packet according to the application data sent by the application in the received virtual machine, and sends the first packet to the network encryption gateway to receive the network. The second packet sent by the encryption layer after being decrypted by the transport layer, extracts the encrypted application data in the second packet after being decrypted by the transport layer, and sends the encrypted application data to the application, where the encryption is performed. After the application data is the terminal device to perform hardware encryption processing on the application processing. Arrived. Encryption of application data generated by the virtual machine by the terminal device provided with the hardware encryption module eliminates the need to insert an encryption card on the physical server, thereby implementing encryption support for application data of multiple virtual machines on the physical server. Moreover, the encryption process takes full advantage of the processing capabilities of the terminal device and reduces the load on the virtual machine.

[123] In this embodiment, in step S10, the virtual machine generates a first packet according to the application data sent by the application program in the virtual machine, which may be:

[124] The virtual machine generates the text according to the received application data and a key identifier sent by the application, where the key identifier is used to identify a key.

[125] When a plurality of keys are stored in the hardware encryption module of the terminal device, the key identification is not transmitted by the setting of the key identifier, and the security of the key is ensured.

In this embodiment, in step S10, the virtual machine sends the first packet to the network encryption gateway, which is specifically:

[127] The virtual machine sends the first packet to the virtual channel that is established by the virtual desktop proxy module of the virtual machine and the virtual desktop proxy client module of the terminal device via the network encryption gateway. The network encryption gateway;

[128] Step S20, the virtual machine receives the second 艮 message sent by the network encryption gateway after being decrypted by the transport layer, specifically:

[129] The virtual machine receives, by using the virtual channel, the second text after the transport layer decryption process sent by the network encryption gateway.

[130] In this embodiment, in step S10, before the virtual machine sends the first packet to the network encryption gateway, the method may further include:

[131] The virtual desktop proxy module of the virtual machine establishes the virtual channel with a virtual desktop proxy client module of the terminal device.

FIG. 4 is a flowchart of a fourth method for encrypting data of a virtual machine system according to an embodiment of the present invention. As shown in FIG. 4, the virtual machine system data encryption method may further include:

[133] Step S30: The virtual machine generates a third packet according to the encrypted application data sent by the application in the virtual machine, and sends the third packet to the network encryption gateway.

[134] Step S40: The virtual machine receives the fourth packet after the transport layer decryption process sent by the network encryption gateway, and extracts the decrypted application in the fourth packet after the transport layer decryption process. Data, the decrypted application data is sent to the application, where the decrypted application data is obtained by the terminal device performing hardware decryption processing on the encrypted application processing.

FIG. 5 is a schematic structural diagram of a first terminal device according to an embodiment of the present invention. As shown in FIG. 5, the terminal device 81 provided in this embodiment may implement various steps of the data encryption method for the virtual machine system applied to the terminal device according to any embodiment of the present invention. The specific implementation process is not described herein. The terminal device 81 provided in this embodiment specifically includes a transport layer decryption module 11, an encryption service module 12, and a transport layer encryption module 13. The transport layer decryption module 11 is configured to receive a first packet after the transport layer encryption process sent by the network encryption gateway, and perform the transport layer decryption process on the first packet that has been encrypted by the transport layer; The service module 12 is connected to the transport layer decryption module 11 for extracting application data from the decrypted first packet, and performing hardware encryption processing on the application data by using the hardware encryption module 14 provided on the terminal device 81. The application data is data generated by a virtual machine in the virtual machine system; the transport layer encryption module 13 is connected to the encryption service module 12, and configured to generate a second packet according to the encrypted application data, The second packet is subjected to a transport layer encryption process, and the second packet after the transport layer is encrypted is sent to the network encryption gateway.

[136] The terminal device 81 provided by this embodiment, the transport layer decryption module 11 receives the first packet after the transport layer encryption process sent by the network encryption gateway, and performs the transport layer on the first packet after the transport layer encryption process. The decryption process, the cryptographic service module 12 extracts application data from the decrypted first message, and performs hardware encryption processing on the application data through the hardware encryption module 14 provided on the terminal device 81, wherein the application data is virtual in the virtual machine system. The data generated by the machine, the transport layer encryption module 13 generates a second packet according to the encrypted application data, performs a transport layer encryption process on the second packet, and sends the second packet encrypted by the transport layer to the network encryption gateway. The application data generated by the virtual machine is encrypted by the terminal device 81 provided with the hardware encryption module 14, and the encryption data of the application data of the plurality of virtual machines on the physical server is realized without inserting the encryption card on the physical server. Moreover, the encryption process takes full advantage of the processing capabilities of the terminal device 81, reducing the load on the virtual machine.

[137] In this embodiment, the first identifier includes a key identifier for identifying a key, and the encryption service module 12 is specifically configured to extract the identifier from the decrypted first packet. Sending the application data and the key identifier to the hardware encryption module 14 by using the data and the key identifier, the hardware encryption module 14 determines a key according to the key identifier, and passes the key The application data is encrypted, and the encrypted application data is returned to the terminal device 81.

FIG. 6 is a schematic structural diagram of a second terminal device according to an embodiment of the present invention. As shown in FIG. 6, in the embodiment, the terminal device 81 further includes a virtual desktop proxy client module 15, the virtual The desktop proxy client module 15 is configured to establish a virtual channel with the virtual desktop proxy module of the virtual machine via the network encryption gateway; correspondingly, the transport layer decryption module 11 is specifically configured to receive the The first packet after the transport layer encryption process is sent by the network encryption gateway; the transport layer encryption module 13 is configured to send the second packet that is encrypted by the transport layer to the virtual channel through the virtual channel. The network encryption gateway.

[139] In this embodiment, the transport layer decryption module 11 is further configured to receive a third >3⁄4 text sent by the network encryption gateway after the transport layer encryption process, and the encrypted layer is processed by the transport layer. The third packet performs a transport layer decryption process; the cryptographic service module 12 further extracts the encrypted application data from the decrypted first packet, and the hardware encryption module 14 provided on the terminal device 81 pairs the The encrypted application data is subjected to a hardware decryption process, where the encrypted application data is data generated by a virtual machine in the virtual machine system and is hardware-encrypted by the hardware encryption module 14 of the terminal device 81; The layer encryption module 13 is further configured to generate a fourth packet according to the decrypted application data, perform a transport layer encryption process on the fourth packet, and send the fourth packet after the transport layer encryption process to the network encryption gateway. .

FIG. 7 is a schematic structural diagram of a first virtual machine according to an embodiment of the present invention. As shown in FIG. 7, the virtual machine 82 provided in this embodiment may implement various steps of the data encryption method of the virtual machine system applied to the virtual machine provided by any embodiment of the present invention. The specific implementation process is not described herein. The virtual machine 82 provided in this embodiment specifically includes a sending processing module 21 and a receiving processing module 22. The sending processing module 21 is configured to generate a first packet according to the received application data sent by the application in the virtual machine 82, and send the first packet to a network encryption gateway; the receiving processing module 22 And the second packet received by the network encryption gateway after being decrypted by the transport layer, and the encrypted application data in the second packet after being decrypted by the transport layer is extracted, and the encrypted The application data is sent to the application, where the encrypted application data is obtained by performing hardware encryption processing on the application processing by the terminal device.

Specifically, in an actual implementation process, the application in the virtual machine 82 can send the application data to the sending processing module 21 by calling an API (Application Programming Interface) of the sending processing module 21.

[142] The virtual machine 82 provided by the embodiment, the sending processing module 21 generates a first packet according to the application data sent by the application program in the received virtual machine 82, and sends the first packet to the network encryption gateway, and receives the processing. The module 22 receives the second packet sent by the network encryption gateway after being decrypted by the transport layer, and extracts the encrypted application data in the second packet after being decrypted by the transport layer, and then encrypts the encrypted packet. The application data is sent to the application, where the encrypted application data is obtained by the terminal device performing hardware encryption processing on the application processing. The application data generated by the virtual machine 82 is encrypted by the terminal device provided with the hardware encryption module, and the encryption data of the application data of the plurality of virtual machines 82 on the physical server is realized without inserting the encryption card on the physical server. Moreover, the encryption process takes full advantage of the processing capabilities of the terminal device, reducing the load on the virtual machine 82.

In the embodiment, the sending processing module 21 is specifically configured to generate the first packet according to the received application data and the key identifier sent by the application, where the key identifier is used. To identify the key.

FIG. 8 is a schematic structural diagram of a second virtual machine according to an embodiment of the present invention. As shown in FIG. 8, in the embodiment, the virtual machine 82 further includes a virtual desktop proxy module 23, and the virtual desktop proxy module 23 is configured to establish a virtual desktop proxy client module with the terminal device. a virtual channel of the network encryption gateway; correspondingly, the sending processing module 21 is specifically configured to send the first packet to the network encryption gateway by using the virtual channel; the receiving processing module 22 is specifically configured to pass The virtual channel receives the second packet sent by the network encryption gateway after being decrypted by the transport layer.

In the embodiment, the sending processing module 21 is further configured to generate a third packet according to the received encrypted application data sent by the application in the virtual machine 82, and send the third packet. The message is sent to the network encryption gateway; the receiving processing module 22 is further configured to receive the fourth packet that is sent by the network encryption gateway and is decrypted by the transport layer, and extract the fourth packet that has been decrypted by the transport layer. The decrypted application data is sent to the application by the decrypted application data, wherein the decrypted application data is obtained by the terminal device performing hardware decryption processing on the encrypted application processing.

FIG. 9 is a schematic structural diagram of a third terminal device according to an embodiment of the present invention. As shown in FIG. 9 , the terminal device 700 provided in this embodiment may implement various steps of a method for encrypting a virtual machine system data applied to a terminal device according to any embodiment of the present disclosure. The specific implementation process is not described herein. The terminal device 700 provided in this embodiment specifically includes: a processor 710, a communication interface 720, a memory 730, and a communication bus 740: wherein the processor 710, the communication interface 720, and the memory 730 are completed by using the communication bus 740. The communication interface 720 is configured to receive a first “text” sent by the network encryption gateway after the transport layer encryption process, and send the second message after the transport layer encryption process to the network encryption. a gateway 730, configured to store an instruction; the processor 710 is configured to execute an instruction stored in the memory 730, where The processor 710 is configured to perform the transport layer decryption process on the text encrypted by the transport layer, extract the application data from the decrypted first packet, and use the hardware encryption module set on the terminal device. And performing hardware encryption processing on the application data, where the application data is data generated by a virtual machine in the virtual machine system; generating a second packet according to the encrypted application data, and performing a transport layer on the second packet Encryption processing.

FIG. 10 is a schematic structural diagram of a computer node for a virtual machine according to an embodiment of the present invention. As shown in FIG. 10, the computer node 800 for the virtual machine provided in this embodiment may implement various steps of the virtual machine system data encryption method applied to the virtual machine provided by any embodiment of the present invention, and the specific implementation process is not Let me repeat. The computer node 800 for a virtual machine provided by this embodiment specifically includes: a processor 810, a communication interface 820, a memory 830, and a communication bus 840: wherein the processor 810, the communication interface 820, and the memory 830 pass through The communication bus 840 performs communication with each other; the communication interface 820 is configured to send the first packet to the network encryption gateway, and receive the second packet sent by the network encryption gateway after being decrypted by the transport layer; The memory 830 is configured to store an instruction; the processor 810 is configured to execute an instruction stored in the memory 830, wherein the processor 810 is configured to be used according to the received virtual machine Applying the application data sent by the application to generate the first packet; extracting the encrypted application data in the second packet after being decrypted by the transport layer, and transmitting the encrypted application data to the application a program, where the encrypted application data is obtained by performing hardware encryption processing on the application processing by the terminal device.

[148] It will be understood by those skilled in the art that all or part of the steps of implementing the foregoing method embodiments may be performed by hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed. The foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

[149] Finally, it should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting thereof; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art will understand that: The technical solutions described in the foregoing embodiments may be modified, or some of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. .

Claims

Claim

A virtual machine system data encryption method, comprising:

The terminal device receives the first packet after the transport layer encryption process sent by the network encryption gateway, and performs the transport layer decryption process on the first text that has been encrypted by the transport layer;

The terminal device extracts application data from the decrypted first packet, and performs hardware encryption processing on the application data by using a hardware encryption module set on the terminal device, where the application data is in a virtual machine system. Data generated by the virtual machine;

The terminal device generates a second packet according to the encrypted application data, performs a transport layer encryption process on the second packet, and sends a second packet that is encrypted by the transport layer to the network encryption gateway.

The method for encrypting data of a virtual machine system according to claim 1, wherein: the first packet includes a key identifier for identifying a key;

The terminal device extracts application data from the decrypted first packet, and performs hardware encryption processing on the application data by using a hardware encryption module set on the terminal device, specifically:

The terminal device extracts the application data and the key identifier from the decrypted first packet, and sends the application data and the key identifier to the hardware encryption module, where the hardware encryption The module determines a key according to the key identifier, encrypts the application data by using the key, and returns the encrypted application data to the terminal device.

The method for encrypting a data of a virtual machine system according to claim 1 or 2, wherein: the terminal device receives the first packet sent by the network encryption gateway after being encrypted by the transport layer, specifically:

The terminal device receives the transmitted transmission sent by the network encryption gateway by using a virtual channel of the network encryption gateway established by the virtual desktop proxy client module of the terminal device and the virtual desktop proxy module of the virtual machine. The first packet after the layer encryption process;

Sending, by the terminal device, the second packet that is encrypted by the transport layer to the network encryption gateway, specifically:

And transmitting, by the terminal device, the second packet that is encrypted by the transport layer to the network encryption gateway by using the virtual channel.

The virtual machine system data encryption method according to claim 3, wherein the terminal is Receiving, by the virtual desktop proxy client module of the terminal device, a virtual channel that is established by the virtual desktop proxy module of the virtual device and the virtual desktop proxy module of the virtual device, and receiving the transport layer encryption sent by the network encryption gateway Before the processed first packet, the method further includes:

The virtual desktop proxy client module of the terminal device establishes the virtual channel with a virtual desktop proxy module of the virtual machine.

The method for encrypting data of a virtual machine system according to claim 1, wherein the method further comprises:

Receiving, by the network encryption gateway, a third "3" message sent by the network encryption gateway after the encryption process of the transport layer, performing a transport layer decryption process on the third "3" message after the encryption process by the transport layer; the terminal device Extracting the encrypted application data from the decrypted first packet, and performing hardware decryption processing on the encrypted application data by using a hardware encryption module set on the terminal device, where the encrypted application data is The data generated by the virtual machine in the virtual machine system and encrypted by the hardware encryption module of the terminal device;

The terminal device generates a fourth packet according to the decrypted application data, performs a transport layer encryption process on the fourth packet, and sends a fourth packet that is encrypted by the transport layer to the network encryption gateway.

6. A virtual machine system data encryption method, comprising:

The virtual machine generates a first packet according to the received application data sent by the application in the virtual machine, and sends the first packet to the network encryption gateway;

The virtual machine receives the second packet sent by the network encryption gateway after the transport layer decryption process, and extracts the encrypted application data in the second packet after the transport layer decryption process, and the encryption is performed. The application data is sent to the application, where the encrypted application data is obtained by performing hardware encryption processing on the application processing by the terminal device.

The virtual machine system data encryption method according to claim 6, wherein the virtual machine generates a first message according to the received application data sent by the application in the virtual machine, which is:

The virtual machine generates the text according to the received application data and a key identifier sent by the application, where the key identifier is used to identify a key.

The method for encrypting a data of a virtual machine system according to claim 6 or 7, wherein: the virtual machine sends the first packet to a network encryption gateway, specifically: Transmitting, by the virtual machine, the first packet to the network by using a virtual channel of the network encryption gateway established by the virtual desktop proxy module of the virtual machine and the virtual desktop proxy client module of the terminal device Encryption gateway

The virtual machine receives the second packet that is sent by the network encryption gateway and is decrypted by the transport layer, and is specifically:

The virtual machine receives, by using the virtual channel, a second text that is sent by the network encryption gateway and is decrypted by the transport layer.

The method for encrypting a data of a virtual machine system according to claim 8, wherein the method further includes: before the virtual machine sends the first packet to a network encryption gateway, the method further includes:

The virtual desktop proxy module of the virtual machine establishes the virtual channel with a virtual desktop proxy client module of the terminal device.

The method for encrypting a data of a virtual machine system according to claim 6, wherein the method further comprises:

The virtual machine generates a third packet according to the received encrypted application data sent by the application in the virtual machine, and sends the third packet to the network encryption gateway;

The virtual machine receives the fourth packet sent by the network encryption gateway after being decrypted by the transport layer, and extracts the decrypted application data in the fourth packet after being decrypted by the transport layer, and decrypts the decrypted application data. The application data is sent to the application, where the decrypted application data is obtained by the terminal device performing hardware decryption processing on the encrypted application processing.

1 1 . A terminal device, comprising:

a transport layer decryption module, configured to receive a first "text" sent by the network encryption gateway after the transport layer encryption process, and perform the transport layer decryption process on the text encrypted by the transport layer; the encryption service module, and the a transport layer decryption module connection, configured to extract application data from the decrypted first packet, and perform hardware encryption processing on the application data by using a hardware encryption module set on the terminal device, where the application data is The data generated by the virtual machine in the virtual machine system; the transport layer encryption module is connected to the cryptographic service module, configured to generate a second packet according to the encrypted application data, and perform transport layer encryption processing on the second packet And transmitting, by the transport layer, the second packet that is encrypted by the transport layer to the network encryption gateway.

The terminal device according to claim 11, wherein: the first packet is included in the packet a key identifier to identify the key;

The cryptographic service module is configured to: extract the application data and the key identifier from the decrypted first packet, and send the application data and the key identifier to the hardware encryption module, The hardware encryption module determines a key according to the key identifier, encrypts the application data by using the key, and returns the encrypted application data to the terminal device.

The terminal device according to claim 1 or 12, further comprising: a virtual desktop proxy client module, configured to establish a virtual connection with the virtual desktop proxy module of the virtual machine via the network encryption gateway aisle;

The transport layer decryption module is configured to receive, by using the virtual channel, the first packet that is sent by the network encryption gateway and is encrypted by the transport layer;

The transport layer encryption module is configured to send the second packet that is encrypted by the transport layer to the network encryption gateway by using the virtual channel.

14. The terminal device according to claim 11, wherein:

The transport layer decryption module is further configured to receive a third>3⁄4 text sent by the network encryption gateway after the transport layer encryption process, and perform the transport layer decryption processing on the third>3⁄4 text after the transport layer encryption process ;

The cryptographic service module further extracts the encrypted application data from the decrypted first packet, and performs hardware decryption processing on the encrypted application data by using a hardware encryption module set on the terminal device, where The encrypted application data is data generated by a virtual machine in the virtual machine system and encrypted by the hardware encryption module hardware of the terminal device;

The transport layer encryption module is further configured to generate a fourth packet according to the decrypted application data, perform a transport layer encryption process on the fourth packet, and send the fourth packet after the transport layer encryption process to the network. Encryption gateway.

15. A virtual machine, comprising:

a sending processing module, configured to generate a first packet according to the received application data sent by the application in the virtual machine, and send the first packet to a network encryption gateway;

a receiving processing module, configured to receive a second packet sent by the network encryption gateway after being decrypted by the transport layer, and extract the encrypted application data in the second packet after being decrypted by the transport layer, The encrypted application data is sent to the application, where the encrypted application is The data is obtained by the terminal device performing hardware encryption processing on the application processing.

The virtual machine according to claim 15, wherein: the sending processing module is configured to generate the first text according to the received application data and a key identifier sent by the application, where The key identifier is used to identify the key.

The virtual machine according to claim 15 or 16, further comprising: a virtual desktop proxy module, configured to establish a virtual channel with the virtual desktop proxy client module of the terminal device via the network encryption gateway ;

The sending processing module is specifically configured to send the first packet to the network encryption gateway by using the virtual channel;

The receiving processing module is configured to receive, by using the virtual channel, a second packet that is sent by the network encryption gateway and is decrypted by the transport layer.

18. The virtual machine of claim 15 wherein:

The sending processing module is further configured to generate a third packet according to the received encrypted application data sent by the application in the virtual machine, and send the third packet to a network encryption gateway; The module is further configured to receive the fourth packet that is sent by the network encryption gateway and that is decrypted by the transport layer, and extract the decrypted application data in the fourth packet that has been decrypted by the transport layer, and decrypt the The application data is sent to the application, where the decrypted application data is obtained by the terminal device performing hardware decryption processing on the encrypted application processing.

19. A terminal device, comprising: a processor, a communication interface, a memory, and a bus:

Wherein the processor, the communication interface and the memory complete communication with each other through the bus;

The communication interface is configured to receive a first packet that is sent by the network encryption gateway and that is encrypted by the transport layer, and send the second packet that is encrypted by the transport layer to the network encryption gateway; For storing instructions;

The processor is configured to execute an instruction stored in the memory, wherein the processor is configured to perform a transport layer decryption process on the text encrypted by the transport layer, from the decrypted Extracting the application data in the first packet, performing hardware encryption processing on the application data by using a hardware encryption module set on the terminal device, where the application data is in a virtual machine system The data generated by the virtual machine generates a second packet according to the encrypted application data, and performs a transport layer encryption process on the second packet.

20. A computer node for a virtual machine, comprising: a processor, a communication interface, a memory, and a bus:

The communication interface is configured to send the first packet to the network encryption gateway, and receive the second text sent by the network encryption gateway after being decrypted by the transport layer;

The memory is configured to store an instruction;

The processor is configured to execute an instruction stored in the memory, wherein the processor is configured to generate the first report according to the received application data sent by an application in the virtual machine Extracting the encrypted application data in the second packet after the decryption process of the transport layer, and sending the encrypted application data to the application, where the encrypted application data is a terminal The device performs hardware encryption processing on the application processing.