CN106844003B

CN106844003B - Virtual machine mirror image verification method and device

Info

Publication number: CN106844003B
Application number: CN201611216844.5A
Authority: CN
Inventors: 雷波; 王运兵; 苗新亮; 李林啸; 唐中乾; 周艳; 籍帅; 夏凡
Original assignee: CETC 30 Research Institute
Current assignee: CETC 30 Research Institute
Priority date: 2016-12-26
Filing date: 2016-12-26
Publication date: 2020-05-08
Anticipated expiration: 2036-12-26
Also published as: CN106844003A

Abstract

The invention relates to the field of virtualization systems, and provides a method and a device for verifying a virtual machine mirror image, aiming at the problems in the prior art. By adopting the thought of partition check, the virtual machine mirror image is read, written and checked at the same time, and the problem of long time for waiting for the completion of the mirror image check when the virtual machine is started is solved. The invention comprises the following steps: when the virtual machine writes data into the virtual machine image file, calculating a corresponding check value for a sector in which the data is written; forming a check value table according to the sector address and the check value corresponding to the sector address; step 2: when the virtual machine reads a file from a sector of a virtual machine image file, calculating a sector data check value according to data stored in the sector; and step 3: the virtual machine compares the sector data check value obtained in the step 2 with the check value corresponding to the same sector address in the check value table in the step 1, if the sector data check value is the same as the sector address in the check value table, the virtual machine passes the check and transmits the sector data to the virtual machine; otherwise, the check fails.

Description

Virtual machine mirror image verification method and device

Technical Field

The invention relates to the field of virtualization systems, in particular to a method and a device for verifying a virtual machine mirror image.

Background

In a cloud computing and virtualization system, in order to ensure the integrity of a virtual machine image, a mode of calculating a check value of the image and performing check detection before starting the virtual machine is generally adopted, and the mode needs to calculate the check value of the image in a centralized time and compare the check value with an original recorded check value, so that the time for waiting starting the virtual machine is greatly increased, and the user experience is low.

Disclosure of Invention

The technical problem to be solved by the invention is as follows: aiming at the problems in the prior art, a virtual machine image verification method and device are provided. By adopting the thought of partition check, the virtual machine mirror image is read, written and checked at the same time, and the problem of long time for waiting for the completion of the mirror image check when the virtual machine is started is solved.

The technical scheme adopted by the invention is as follows:

a method for verifying a virtual machine image comprises the following steps:

step 1: when the virtual machine writes data into the virtual machine image file, calculating a corresponding check value for a sector in which the data is written; forming a check value table according to the sector address and the check value corresponding to the sector address;

step 2: when the virtual machine reads a file from a sector of a virtual machine image file, calculating a sector data check value according to data stored in the sector;

and step 3: the virtual machine compares the sector data check value obtained in the step 2 with the check value corresponding to the same sector address in the check value table in the step 1, if the sector data check value is the same as the sector address in the check value table, the virtual machine passes the check and transmits the sector data to the virtual machine; otherwise, the check fails.

Further, a method for checking a virtual machine image further includes step 4: and (5) repeating the step (3), finishing reading all sector data and transmitting corresponding data to the virtual machine.

Furthermore, a check value is calculated for the sector of the virtual image file written with the data, and a check value table is updated in real time. And finishing the functions of reading, writing and checking the virtual machine at the same time.

A virtual machine image verification apparatus includes:

the sector check value generating module is used for calculating a corresponding check value for a sector in which data is written when the virtual machine writes the data into the virtual machine image file; forming a check value table according to the sector address and the check value corresponding to the sector address;

the read data check value generation module is used for calculating a sector data check value according to data stored in a sector when a file is read from the sector of the virtual machine image file;

the verification module is used for comparing the sector data check value of the read data check value generation module with the check value corresponding to the same sector address in the check value table, if the sector data check value is the same as the check value, the verification is passed, and the sector data are transmitted to the virtual machine; otherwise, the check fails.

Furthermore, the virtual machine mirror image verification device further comprises a data reading module, which is used for repeatedly comparing the sector data verification value with the verification value corresponding to the same sector address in the verification value table through the verification module, completing the reading of all sector data, and transmitting the corresponding data to the virtual machine.

Furthermore, a check value is calculated for the sector of the virtual image file written with the data, and a check value table is updated in real time.

In summary, due to the adoption of the technical scheme, the invention has the beneficial effects that:

when reading sector data from the virtual machine image file, the invention achieves the purpose of checking whether the whole image file is tampered by checking whether the sector is tampered, avoids the tampered dirty data from influencing the safety of the virtual machine, and can be used for safety enhancement of the virtual machine;

the invention can effectively reduce the time for checking the mirror image file before the virtual machine is started;

after the method and the device are adopted, the time for discovering the falsification of the mirror image file is delayed until the falsified sector is read, but the falsified data can still be effectively prevented from entering the virtual machine instead of before the virtual machine is started, so that the safety of the virtual machine is ensured.

Drawings

The invention will now be described, by way of example, with reference to the accompanying drawings, in which:

FIG. 1 is a schematic block diagram of a virtual machine image checking method.

Detailed Description

All of the features disclosed in this specification, or all of the steps in any method or process so disclosed, may be combined in any combination, except combinations of features and/or steps that are mutually exclusive.

Any feature disclosed in this specification may be replaced by alternative features serving equivalent or similar purposes, unless expressly stated otherwise. That is, unless expressly stated otherwise, each feature is only an example of a generic series of equivalent or similar features.

The design idea of the invention is as follows:

1. when data is written into the mirror image file, a check value is calculated for each sector of the data to be written, and a check value table is formed;

2. when reading data from the mirror image file, calculating a sector data check value for each read sector data;

3. the centralized checking of the whole image large file is changed into the checking of the scattered data according to the sector, and whether the sector is falsified or not is checked when the sector data is read, so that the purpose of checking whether the whole image file is falsified or not is achieved, and the condition that the falsified dirty data influences the safety of the virtual machine is avoided.

The sector data check value and the check value in the check value table are calculated by the same method.

The first embodiment is as follows: as shown in fig. 1, when writing data into a virtual machine image file, a virtual machine calculates a check value according to a sector and records the check value; the same action is performed when writing data for each sector. When the virtual machine reads data from the mirror image file, reading the data and verifying the data according to the sector, then calculating the verification value of the sector data to obtain a sector data verification value 1, comparing the sector data verification value 1 with the sector data verification value generated when the sector is written, if the sector data verification value is the same as the sector data verification value, passing the verification, transmitting the sector data to the virtual machine, and finishing the sector data reading action; the same action is repeated for each sector as data is read.

The invention is not limited to the foregoing embodiments. The invention extends to any novel feature or any novel combination of features disclosed in this specification and any novel method or process steps or any novel combination of features disclosed.

Claims

1. A method for verifying a virtual machine image is characterized by comprising the following steps:

and step 3: the virtual machine compares the sector data check value obtained in the step 2 with the check value corresponding to the same sector address in the check value table in the step 1, if the sector data check value is the same as the sector address in the check value table, the virtual machine passes the check and transmits the sector data to the virtual machine; otherwise, the verification fails;

and 4, step 4: and (5) repeating the step (3), finishing reading all sector data and transmitting corresponding data to the virtual machine.

2. The method according to claim 1, wherein the verification value is calculated for the sector of the virtual image file to which the data is written, and the verification value table is updated in real time.

3. A verification apparatus for virtual machine images, comprising:

the verification module is used for comparing the sector data check value of the read data check value generation module with the check value corresponding to the same sector address in the check value table, if the sector data check value is the same as the check value, the verification is passed, and the sector data are transmitted to the virtual machine; otherwise, the verification fails;

and the data reading module is used for repeatedly comparing the sector data check value with the check value corresponding to the same sector address in the check value table through the verification module, completing the reading of all sector data and transmitting the corresponding data to the virtual machine.

4. A virtual machine image verification apparatus according to claim 3, wherein the verification value is calculated for the sector of the virtual image file to which data is written, and the verification value table is updated in real time.