WO2021057024A1

WO2021057024A1 - Method and system for protecting virtual machine image in cloud environment

Info

Publication number: WO2021057024A1
Application number: PCT/CN2020/087164
Authority: WO
Inventors: 刘海伟; 吴保锡
Original assignee: 苏州浪潮智能科技有限公司
Priority date: 2019-09-25
Filing date: 2020-04-27
Publication date: 2021-04-01
Also published as: CN110806919A; CN110806919B

Abstract

A method and system for protecting a virtual machine image in a cloud environment, the method comprising: adding a first password when creating a virtual machine image file; creating DEK plaintext and DEK ciphertext according to the first password; using the DEK plaintext to encrypt the virtual machine image file; simultaneously storing the DEK ciphertext and the encrypted virtual machine image file in a storage pool; when reading the encrypted virtual machine image file, acquiring a second password and the DEK ciphertext; determining whether the second password is the same as the first password; if yes, then a trusted platform module acquiring the DEK plaintext according to the DEK ciphertext; and using the DEK plaintext to decrypt the virtual machine image file. The system comprises a key management module and a virtual machine image module. By means of the present application, the data security level of a virtual data center may be improved, and data security is effectively improved.

Description

Method and system for protecting virtual machine image in cloud environment

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on September 25, 2019, the application number is 201910912822.X, and the title is "A method and system for protecting virtual machine images in a cloud environment", and its entire contents Incorporated in this application by reference.

Technical field

This application relates to the field of computer security technology, and in particular to a method and system for protecting virtual machine images in a cloud environment.

Background technique

With the development of cloud computing and big data, more and more enterprises and research institutes use cloud computing technology to deploy virtual data centers, and virtual data centers deployed by cloud computing technology are flexible in deployment and can save costs. However, compared with traditional data centers, how to improve data security is an important issue for virtual data centers. Especially for virtual machine images in a cloud environment, operations such as backups provided by virtualization management software can easily spread sensitive data, certificates, and information, which can lead to data security issues.

Currently, for virtual machine images, cloud computing vendors usually use the same encrypted storage method for data storage. Specifically, in a cloud environment, all virtual machine disk images use one encryption and decryption key, that is, the encryption keys of tenant A and tenant B are the same.

However, the same encryption storage method currently shares an encryption and decryption key. When there are internal threats from cloud computing vendors or cloud administrators, the confidentiality of the tenant's virtual machine image cannot be guaranteed, that is, the data center. The security is not high enough.

Summary of the invention

This application provides a method and system for protecting a virtual machine image in a cloud environment, so as to solve the problem of insufficient data security in a data center due to the method of protecting a virtual machine image in a cloud environment in the prior art.

In order to solve the above technical problems, the embodiments of the present application disclose the following technical solutions:

A method for protecting a virtual machine image in a cloud environment, the method comprising:

When creating a virtual machine image file, add a first password, where the first password is a password set by the tenant;

Create DEK (Data Encrypted Key) plain text and DEK cipher text based on the trusted platform module according to the first password;

Use the DEK plaintext to encrypt the virtual machine image file to obtain the encrypted virtual machine image file;

Simultaneously storing the DEK ciphertext and the encrypted virtual machine image file in the storage pool;

When reading the encrypted virtual machine image file, obtain a second password and a DEK ciphertext, where the second password is the password entered by the current tenant;

Determine whether the second password is the same as the first password;

If yes, the trusted platform module obtains the DEK plaintext according to the DEK ciphertext;

Use the DEK plaintext to decrypt the virtual machine image file.

Optionally, the method of creating DEK plaintext and DEK ciphertext based on the trusted platform module according to the first password includes:

According to the first password, DEK plaintext and RSA public-private key pairs are created based on the trusted platform module; among them, RSA is composed of Ron Rivest, Adi Shamir and Leonard Leonard Adleman (Leonard Adleman) is composed of the initial letters of the surnames of the three people. In 1977, the three people jointly proposed the RSA encryption algorithm;

The DEK plaintext is encrypted by using the RSA public and private key to obtain the DEK ciphertext.

Optionally, the trusted platform module is a TPM (Trusted Platform Module, Trusted Platform Module) chip.

Optionally, the method for encrypting the virtual machine image file is AES (Advanced Encryption Standard, Advanced Encryption Standard) encryption, and the method for decrypting the virtual machine image file is AES decryption.

Optionally, after storing the DEK ciphertext and the encrypted virtual machine image file in the storage pool at the same time, and after using the DEK plaintext to decrypt the virtual machine image file, the method further includes:

Delete the DEK plaintext.

A system for protecting virtual machine images in a cloud environment, the system comprising:

The key management module is used to add a first password when creating a virtual machine image file, and, according to the first password, create DEK plaintext and DEK ciphertext based on the trusted platform module, and combine the DEK plaintext and DEK ciphertext The text is sent to the virtual machine mirroring module, and the first password is the password set by the tenant;

The virtual machine image module is used to encrypt the virtual machine image file by using the DEK plaintext, obtain the encrypted virtual machine image file, and store the DEK ciphertext and the encrypted virtual machine image file in the storage pool at the same time;

The virtual machine image module is also used to obtain a second password and DEK cipher text when reading the encrypted virtual machine image file, and to send the second password and DEK cipher text to the key management module at the same time , Wherein the second password is the password entered by the current tenant;

The key management module is also used to determine whether the second password is the same as the first password, and when the second password is the same as the first password, call the trusted platform module to obtain the DEK according to the DEK ciphertext Plaintext, and send the DEK plaintext to the virtual machine mirroring module;

The virtual machine image module is also used to decrypt the virtual machine image file by using the DEK plaintext.

Optionally, the key management module includes:

The password adding unit is used to add a first password when creating a virtual machine image file, where the first password is a password set by the tenant;

The key creation unit is configured to create DEK plaintext and DEK ciphertext based on the trusted platform module according to the first password;

The first sending unit is configured to send the DEK plaintext and DEK ciphertext to the virtual machine mirroring module;

A judging unit for judging whether the second password is the same as the first password, and the second password is the password entered by the current tenant;

The DEK plaintext obtaining unit is configured to call the trusted platform module to obtain the DEK plaintext according to the DEK ciphertext when the second password is the same as the first password;

The first sending unit is further configured to send the DEK plaintext to the virtual machine mirroring module after obtaining the DEK plaintext according to the DEK ciphertext.

Optionally, the virtual machine mirroring module includes:

The encryption unit is used to encrypt the virtual machine image file by using the DEK plaintext to obtain the encrypted virtual machine image file;

The storage unit is configured to store the DEK ciphertext and the encrypted virtual machine image file in the storage pool at the same time;

The obtaining unit is configured to obtain the second password and the DEK ciphertext when reading the encrypted virtual machine image file;

The second sending unit is configured to send the second password and the DEK ciphertext to the key management module at the same time;

The decryption unit is configured to use the DEK plaintext to decrypt the virtual machine image file.

Optionally, the encryption unit is an AES encryption unit, and the decryption unit is an AES decryption unit.

Optionally, the key management module further includes: a first deletion unit configured to delete the DEK plaintext after storing the DEK ciphertext and the encrypted virtual machine image file in the storage pool at the same time;

The virtual machine image module further includes: a second deletion unit, configured to use the DEK plaintext to delete the DEK plaintext after decrypting the virtual machine image file.

The technical solutions provided by the embodiments of the present application may include the following beneficial effects:

This application provides a method for protecting virtual machine images in a cloud environment. The method takes corresponding steps to improve data security when creating virtual machine image files and reading virtual machine image files. When creating virtual machine image files, first Add the first password, then create DEK plaintext and DEK ciphertext based on the trusted platform module according to the first password, then use DEK plaintext to encrypt the virtual machine image file, and finally store the DEK ciphertext and encrypted virtual machine image file to storage at the same time Pool. When reading the encrypted virtual machine image file, first obtain the second password and the DEK ciphertext, and then determine whether the second password is the same as the first password. When the two are the same, the trusted platform module obtains the DEK plaintext according to the DEK ciphertext , And then use DEK plaintext to decrypt the virtual machine image file. In this embodiment, the first password set by the tenant is added when the virtual machine image file is created. When the virtual machine image file is loaded, the virtual machine disk image can be obtained only when the second password entered by the current tenant is the same as the first password The content of the virtual machine image can be obtained instead of only the DEK ciphertext. Therefore, the setting of the first password can greatly improve the security of the data center in the cloud environment.

In addition, after storing the DEK ciphertext and the encrypted virtual machine image file in the storage pool at the same time in this embodiment, it also includes deleting the DEK plaintext. And, after using the DEK plaintext to decrypt the virtual machine image file, after obtaining the DEK plaintext of the virtual machine image file, it also includes deleting the DEK plaintext. By deleting the DEK plaintext in time, data leakage can be prevented, which is conducive to further improving the security of data in the data center.

This application also provides a system for protecting virtual machine images in a cloud environment. The system mainly includes two parts: a key management module and a virtual machine image module. When creating a virtual machine image file, the first password can be added through the key management module, and DEK plaintext and DEK ciphertext can be created based on the trusted platform module, and both are sent to the virtual machine image module. Through the virtual machine mirroring module, the DEK plaintext can be used to encrypt the virtual machine image file, and the DEK ciphertext and the encrypted virtual machine image file can be stored in the storage pool at the same time. When reading the virtual machine image file, the DEK ciphertext and the second password entered by the current tenant are obtained through the virtual machine image file module, and both are sent to the key management module at the same time, and the key management module determines whether the second password is the same as When the first password is the same, and when the two are the same, the trusted platform module is called to obtain the DEK plaintext according to the DEK ciphertext, and the DEK plaintext is sent to the virtual machine mirroring module. In this embodiment, two parts: the key management module and the virtual machine mirroring module are set, and through the key management module, the first password can be added when creating the virtual machine image file. The virtual machine mirroring management module can be used to read Obtain the second password when encrypting the virtual machine image file, and compare the second password with the first password, which can greatly improve the confidentiality of the virtual machine image data in the cloud environment, that is, greatly improve the data center data security .

It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the application.

Description of the drawings

The drawings here are incorporated into the specification and constitute a part of the specification, show embodiments that conform to the application, and are used together with the specification to explain the principle of the application.

In order to more clearly describe the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, those of ordinary skill in the art are In other words, other drawings can be obtained based on these drawings without creative work.

FIG. 1 is a schematic flowchart of a method for protecting a virtual machine image in a cloud environment provided by an embodiment of the application;

FIG. 2 is a schematic structural diagram of a system for protecting virtual machine images in a cloud environment provided by an embodiment of the application.

detailed description

In order to enable those skilled in the art to better understand the technical solutions in the application, the following will clearly and completely describe the technical solutions in the embodiments of the application in conjunction with the drawings in the embodiments of the application. Obviously, the described The embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work should fall within the protection scope of this application.

In order to better understand the present application, the embodiments of the present application will be explained in detail below with reference to the accompanying drawings.

Example one

Referring to FIG. 1, FIG. 1 is a schematic flowchart of a method for protecting a virtual machine image in a cloud environment provided by an embodiment of the application. As can be seen from Figure 1, the method for protecting virtual machine images in a cloud environment in this embodiment mainly includes the following processes:

S01: When creating a virtual machine image file, add a first password, where the first password is a password set by the tenant.

In this embodiment, the first password set in advance by the tenant is added when the virtual machine image file is created. When the virtual machine image file is loaded, the virtual machine disk can be obtained only when the second password entered by the current tenant is the same as the first password. The contents of the image, instead of just obtaining the contents of the virtual machine image through the DEK ciphertext. Therefore, the setting of the first password can greatly improve the confidentiality of virtual machine images in the cloud environment, thereby improving the security of data center data.

S02: Create DEK plaintext and DEK ciphertext based on the trusted platform module according to the first password.

In this embodiment, DEK plaintext and DEK ciphertext are used for virtual machine image encryption. Specifically, step S02 further includes the following process:

S021: Create a DEK plaintext and RSA public-private key pair based on the trusted platform module according to the first password;

S022: Use the RSA public and private keys to encrypt the DEK plaintext to obtain the DEK ciphertext.

In this embodiment, the trusted platform module may use a TPM chip. According to the above steps S021 and S022, when creating DEK plaintext and DEK ciphertext based on the trusted platform module, first call the command TPM2_GetRandom of the TPM chip to generate random numbers as DEK plaintext; Then, according to the first password entered by the tenant, call the command TPM2_Create of the TPM chip to create an RSA public-private key pair, namely: Rsa_pri and Rsa_pub, where Rsa_pub is the public key, which can be saved outside the TPM chip; finally, the TPM chip command TPM2_RSA_Encypt is called, and the above DEK plaintext is encrypted to obtain DEK ciphertext.

Continuing to refer to FIG. 1, it can be seen that after creating the DEK plaintext and the DEK ciphertext, step S03 is executed: using the DEK plaintext to encrypt the virtual machine image file to obtain the encrypted virtual machine image file.

In this embodiment, the method of using DEK plaintext to encrypt the virtual machine image file is AES encryption. That is: through the AES encryption method, use DEK plaintext as the AES key for the created virtual machine image file, and perform AES encryption to obtain the encrypted virtual machine image file.

After the encrypted virtual machine image file is obtained, step S04 is executed: the DEK ciphertext and the encrypted virtual machine image file are stored in the storage pool at the same time.

The storage pool in this embodiment refers to a storage pool in a cloud environment, which is used to store virtual machine image files.

Through the above steps S01-S04, after the virtual machine image file is created, perform step S06: When reading the encrypted virtual machine image file, obtain the second password and DEK ciphertext, where the second password is the password entered by the current tenant .

S07: Determine whether the second password is the same as the first password.

If the second password is the same as the first password, step S08 is executed: the trusted platform module obtains the DEK plaintext according to the DEK ciphertext.

If the second password is different from the first password, it means that the second password entered by the current tenant is incorrect, and step S06 is returned to obtain the second password again.

S09: Use DEK plaintext to decrypt the virtual machine image file.

Corresponding to step S03, the method for decrypting the virtual machine image file in this embodiment is AES decryption. The specific AES decryption method adopts the method in the prior art, and will not be repeated here.

From the above steps S06-S09, when loading the virtual machine image file, first obtain the DEK ciphertext matched by the virtual machine image file and the second password entered by the current tenant; then call the TPM2_RSA_Decrypt command of the TPM chip according to the current tenant Enter the second password to decrypt the DEK ciphertext; when the second password is the same as the first password, it is determined that the second password entered by the current tenant is correct. At this time, the DEK ciphertext is decrypted to obtain the DEK plaintext; the decrypted DEK plaintext is used for the virtual The machine image file is decrypted by AES, and finally the plaintext of the virtual machine image is obtained.

Further, in this embodiment, after step S04, it further includes step S05: deleting DEK plaintext. After step S09, it also includes step S10: deleting DEK plaintext.

Setting steps S05 and S10 can effectively prevent malicious administrators from illegally snooping sensitive data of tenants in public cloud or hybrid cloud environments, which helps protect the confidentiality of virtual machine image files in the cloud environment, thereby effectively improving the data in the virtual data center The security level greatly improves the security of data center data.

In summary, the method for protecting virtual machine images in a cloud environment in this embodiment mainly focuses on creating virtual machine image files and reading virtual machine image files to enhance the confidentiality of virtual machine image files. The data security level of the virtual data center is improved by adding the first password in the stage of creating the virtual machine image file, and judging the consistency between the second password entered by the current tenant and the first password in the stage of reading the encrypted virtual machine image file.

Example two

Refer to FIG. 2 on the basis of the embodiment shown in FIG. 1. FIG. 2 is a schematic structural diagram of a system for protecting virtual machine images in a cloud environment provided by an embodiment of the application. It can be seen from FIG. 2 that the system in this embodiment mainly includes two parts: a key management module and a virtual machine mirroring module. Among them, the key management module is used to add the first password when creating the virtual machine image file, and, according to the first password, create DEK plaintext and DEK ciphertext based on the trusted platform module, and send the DEK plaintext and DEK ciphertext To the virtual machine mirroring module, the first password is the password set by the tenant. The virtual machine image module is used to encrypt the virtual machine image file by using the DEK plaintext, obtain the encrypted virtual machine image file, and simultaneously store the DEK ciphertext and the encrypted virtual machine image file in the storage pool. The virtual machine image module is also used to obtain the second password and the DEK ciphertext when reading the encrypted virtual machine image file, and to send the second password and the DEK ciphertext to the key management module at the same time, where the second password The password entered for the current tenant. The key management module is also used to determine whether the second password is the same as the first password, and when the second password is the same as the first password, call the trusted platform module to obtain the DEK plaintext according to the DEK ciphertext, and send the DEK plaintext to Virtual machine mirroring module. The virtual machine image module is also used to decrypt the virtual machine image file by using DEK plaintext.

Further, the key management module further includes: a password adding unit, a key creating unit, a first sending unit, a judgment unit, and a DEK plaintext obtaining unit. Among them, the password adding unit is used to add the first password when creating the virtual machine image file, the first password is the password set by the tenant; the key creation unit is used to create DEK plaintext and DEK based on the trusted platform module according to the first password The ciphertext; the first sending unit is used to send the DEK plaintext and the DEK ciphertext to the virtual machine mirroring module; the judging unit is used to judge whether the second password is the same as the first password, and the second password is the password entered by the current tenant; DEK plaintext The obtaining unit is used for when the second password is the same as the first password, calling the trusted platform module to obtain the DEK plaintext according to the DEK ciphertext; the first sending unit is also used for obtaining the DEK plaintext according to the DEK ciphertext, and then sending the DEK plaintext to the virtual Machine mirroring module.

Among them, the key creation unit includes: DEK plaintext and RSA public-private key pair creation subunit, and DEK ciphertext creation subunit. DEK plaintext and RSA public-private key pair creation subunit, used to create DEK plaintext and RSA public-private key pair based on the trusted platform module according to the first password; DEK ciphertext creation subunit, used to perform DEK plaintext using RSA public-private key pair Encrypt and get DEK ciphertext. After the DEK plaintext and RSA public-private key pair creation subunit creates the RSA public-private key pair, the RSA public key can be saved outside the TPM chip, for example, on the disk of the key management module.

The virtual machine mirroring module includes: an encryption unit, a storage unit, an acquisition unit, a second sending unit, and a decryption unit. Among them, the encryption unit is used to use DEK plaintext to encrypt the virtual machine image file to obtain the encrypted virtual machine image file; the storage unit is used to store the DEK ciphertext and the encrypted virtual machine image file in the storage pool at the same time; the acquisition unit uses When reading the encrypted virtual machine image file, obtain the second password and the DEK cipher text; the second sending unit is used to send the second password and the DEK cipher text to the key management module at the same time; the decryption unit is used to use the DEK plain text, Decrypt the virtual machine image file.

In this embodiment, the encryption unit is an AES encryption unit, and the decryption unit is an AES decryption unit.

Further, in this embodiment, the key management module is also provided with a first deletion unit for deleting the DEK plaintext after storing the DEK ciphertext and the encrypted virtual machine image file in the storage pool at the same time. The virtual machine mirroring module also includes a second deleting unit for deleting the DEK plaintext after decrypting the virtual machine image file by using the DEK plaintext.

The working principle and working method of the system for protecting virtual machine images in the cloud environment in this embodiment have been described in detail in the embodiment shown in FIG. 1 and will not be repeated here. For parts that are not described in detail in this embodiment, reference may also be made to the embodiment shown in FIG. 1, and the two embodiments may refer to each other.

The above are only specific implementations of the application, so that those skilled in the art can understand or implement the application. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the application. Therefore, this application will not be limited to the embodiments shown in this document, but should conform to the widest scope consistent with the principles and novel features disclosed in this document.

Claims

A method for protecting a virtual machine image in a cloud environment, wherein the method includes:

When creating a virtual machine image file, add a first password, where the first password is a password set by the tenant;

Create DEK plaintext and DEK ciphertext based on the trusted platform module according to the first password;

Use the DEK plaintext to encrypt the virtual machine image file to obtain the encrypted virtual machine image file;

Simultaneously storing the DEK ciphertext and the encrypted virtual machine image file in the storage pool;

When reading the encrypted virtual machine image file, obtain a second password and a DEK ciphertext, where the second password is the password entered by the current tenant;

Determine whether the second password is the same as the first password;

If yes, the trusted platform module obtains the DEK plaintext according to the DEK ciphertext;

Use the DEK plaintext to decrypt the virtual machine image file.
The method for protecting a virtual machine image in a cloud environment according to claim 1, wherein the method for creating DEK plaintext and DEK ciphertext based on the trusted platform module according to the first password comprises:

Create a DEK plaintext and RSA public-private key pair based on the trusted platform module according to the first password;

The DEK plaintext is encrypted by using the RSA public and private key to obtain the DEK ciphertext.
The method for protecting a virtual machine image in a cloud environment according to claim 1, wherein the trusted platform module is a TPM chip.
The method for protecting a virtual machine image in a cloud environment according to claim 1, wherein the method for encrypting the virtual machine image file is AES encryption, and the method for decrypting the virtual machine image file is AES decryption .
The method for protecting a virtual machine image in a cloud environment according to claim 1, wherein after storing the DEK ciphertext and the encrypted virtual machine image file in a storage pool at the same time, and using the DEK plaintext After decrypting the virtual machine image file, the method further includes:

Delete the DEK plaintext.
A system for protecting virtual machine images in a cloud environment, wherein the system includes:

The key management module is used to add a first password when creating a virtual machine image file, and, according to the first password, create DEK plaintext and DEK ciphertext based on the trusted platform module, and combine the DEK plaintext and DEK ciphertext The text is sent to the virtual machine mirroring module, and the first password is the password set by the tenant;

The virtual machine image module is used to encrypt the virtual machine image file by using the DEK plaintext, obtain the encrypted virtual machine image file, and store the DEK ciphertext and the encrypted virtual machine image file in the storage pool at the same time;

The virtual machine image module is also used to obtain a second password and DEK cipher text when reading the encrypted virtual machine image file, and to send the second password and DEK cipher text to the key management module at the same time , Wherein the second password is the password entered by the current tenant;

The key management module is also used to determine whether the second password is the same as the first password, and when the second password is the same as the first password, call the trusted platform module to obtain the DEK according to the DEK ciphertext Plaintext, and send the DEK plaintext to the virtual machine mirroring module;

The virtual machine image module is also used to decrypt the virtual machine image file by using the DEK plaintext.
The system for protecting virtual machine images in a cloud environment according to claim 6, wherein the key management module comprises:

The password adding unit is used to add a first password when creating a virtual machine image file, where the first password is a password set by the tenant;

The key creation unit is configured to create DEK plaintext and DEK ciphertext based on the trusted platform module according to the first password;

The first sending unit is configured to send the DEK plaintext and DEK ciphertext to the virtual machine mirroring module;

A judging unit for judging whether the second password is the same as the first password, and the second password is the password entered by the current tenant;

The DEK plaintext obtaining unit is configured to call the trusted platform module to obtain the DEK plaintext according to the DEK ciphertext when the second password is the same as the first password;

The first sending unit is further configured to send the DEK plaintext to the virtual machine mirroring module after obtaining the DEK plaintext according to the DEK ciphertext.
The system for protecting virtual machine mirroring in a cloud environment according to claim 6, wherein the virtual machine mirroring module comprises:

The encryption unit is used to encrypt the virtual machine image file by using the DEK plaintext to obtain the encrypted virtual machine image file;

The storage unit is configured to store the DEK ciphertext and the encrypted virtual machine image file in the storage pool at the same time;

The obtaining unit is configured to obtain the second password and the DEK ciphertext when reading the encrypted virtual machine image file;

The second sending unit is configured to send the second password and the DEK ciphertext to the key management module at the same time;

The decryption unit is configured to use the DEK plaintext to decrypt the virtual machine image file.
The system for protecting virtual machine images in a cloud environment according to claim 8, wherein the encryption unit is an AES encryption unit, and the decryption unit is an AES decryption unit.
The system for protecting virtual machine images in a cloud environment according to any one of claims 6-9, wherein the key management module further comprises: a first deletion unit configured to encrypt the DEK After the text and the encrypted virtual machine image file are stored in the storage pool at the same time, delete the DEK plain text;

The virtual machine image module further includes: a second deletion unit, configured to use the DEK plaintext to delete the DEK plaintext after decrypting the virtual machine image file.