CN117519597A

CN117519597A - Virtual disk management and control method, device, electronic equipment and readable storage medium

Info

Publication number: CN117519597A
Application number: CN202311576143.2A
Authority: CN
Inventors: 姜新利
Original assignee: Beijing Topsec Technology Co Ltd; Beijing Topsec Network Security Technology Co Ltd; Beijing Topsec Software Co Ltd
Current assignee: Beijing Topsec Technology Co Ltd; Beijing Topsec Network Security Technology Co Ltd; Beijing Topsec Software Co Ltd
Priority date: 2023-11-23
Filing date: 2023-11-23
Publication date: 2024-02-06

Abstract

The application provides a virtual disk management and control method, a device, electronic equipment and a readable storage medium, wherein the method comprises the following steps: a login request is sent to a management and control service platform so that the management and control service platform can verify a target virtual disk based on current equipment information and file identification, wherein the login request carries the current equipment information and the file identification of an image file of the target virtual disk; receiving a current file key sent by the management and control service platform; and decrypting the image file of the target virtual disk through the current file key so as to mount the target virtual disk.

Description

Virtual disk management and control method, device, electronic equipment and readable storage medium

Technical Field

The present disclosure relates to the field of computer technologies, and in particular, to a virtual disk management and control method, an apparatus, an electronic device, and a readable storage medium.

Background

In most application scenarios, the virtual disk image file key needs to be maintained by a client user, and the key input by the client user is needed to be used, so that the processing mode is relatively low in efficiency and complex in operation.

Disclosure of Invention

The invention aims to provide a virtual disk management and control method, a device, an electronic device and a computer readable storage medium, which can simplify the use of a virtual disk and improve the decryption efficiency of the virtual disk.

In a first aspect, the present invention provides a virtual disk management and control method, including: a login request is sent to a management and control service platform, wherein the login request carries current equipment information and a file identifier of an image file of a target virtual disk, and the login request is used for the management and control service platform to verify the target virtual disk based on the current equipment information and the file identifier; after successful login, receiving a current file key sent by the management and control service platform; and decrypting the image file of the target virtual disk through the current file key so as to mount the target virtual disk.

In the embodiment, the management and control service platform manages the key of the virtual disk, and when the management and control service platform needs to be used, the decryption key is acquired from the management and control service platform, so that the user does not need to manually input the key, the user operation is reduced, and the convenience of disk use is improved. Furthermore, as the management and control service platform uniformly manages the keys of the virtual disk, the risk of key leakage can be reduced, and the use safety of the virtual disk can be improved.

In an alternative embodiment, the method further comprises: acquiring hardware data of current equipment, wherein the hardware data comprises one or more of a hard disk serial number, a CPU identifier and a main board identifier; and calculating based on the hardware data to obtain current equipment information.

In an alternative embodiment, the method further comprises: acquiring a file header of an image file of a target virtual disk; and analyzing the file header to obtain a file identifier.

In an alternative embodiment, the method further comprises: receiving a key rotation instruction issued by the management and control service platform, wherein the key rotation instruction carries a current file key and an updated file key; decrypting an image file of the target virtual disk by using the current file key; encrypting an image file of the target virtual disk by using the updated file key; and sending a key rotation result to the management and control service platform so that the management and control service platform can replace the current file key by using the updated file key.

In the above embodiment, the key of the virtual disk may be periodically rotated, so as to further improve the security of virtual disk management.

In an optional embodiment, the receiving the key rotation instruction issued by the management and control service platform includes: receiving a key rotation instruction issued by the management and control service platform in each key rotation period; or after sending the rotation request to the management and control service platform, receiving a key rotation instruction issued by the management and control service platform.

In the above embodiment, the key rotation instruction may be triggered in various manners, so that flexibility of key rotation may be improved.

In an alternative embodiment, the method further comprises:

a magnetic disk management and control request is sent to a management and control service platform, wherein the magnetic disk management and control request carries current equipment information and a file identifier so that the management and control service platform can correlate based on the current equipment information and the file identifier;

receiving a current file key sent by the management and control service platform;

creating an image file of the target virtual disk, and recording the file identification in the image file;

and encrypting the image file of the target virtual disk by using the current file key, and sending an encryption result to the management and control service platform.

In the above embodiment, the new virtual disk may be registered to the management and control service platform based on the hardware information and the disk information, so as to facilitate use and management of the virtual disk.

In an alternative embodiment, the disk management request includes: a registration request and a disk new request;

the sending of the magnetic coil control request to the management and control service platform comprises the following steps:

sending a registration request to the management and control service platform, wherein the registration request carries the current equipment information;

receiving a registration result of successful registration of the management and control service platform, wherein the registration result carries mark information;

generating the file identifier according to the marking information and the current equipment information;

and sending a disk new request to the management and control service platform, wherein the disk new request carries the file identifier.

In the above embodiment, the management and control service platform may provide the marking information based on the registration request, and generate the file identifier based on the personalized marking information, so that the marking information obtained by each virtual disk and the file identifier generated based on the marking information are personalized, and the virtual disk is better marked.

In an alternative embodiment, the marking information is a time stamp; the generating the file identifier according to the marking information and the current equipment information comprises the following steps: and generating the file identification according to the timestamp and the current equipment information.

In the above embodiment, the marking information may be a time stamp, and the personalized marking of the virtual disk is achieved through simpler information, so that the operation is not complicated under the condition that the reliability of the virtual disk is ensured.

In a second aspect, the present invention provides a virtual disk management and control method, including: receiving a login request sent by a management and control client, wherein the login request carries current equipment information and a file identifier of an image file of a target virtual disk; verifying the target virtual disk based on the current equipment information and the file identification; and if verification is successful, inquiring a current file key corresponding to the target virtual disk through the file identifier, and sending the current file key to the management and control client so that the management and control client can decrypt the image file of the target virtual disk according to the current file key to mount the target virtual disk.

In an optional embodiment, the verifying the target virtual disk based on the current device information and the file identifier includes: inquiring whether the current equipment information and the file identification exist or not; if so, verifying whether the current equipment information and the file identifier are in a binding relationship; and if the current equipment information and the file identifier are in a binding relationship, the verification is successful.

In an alternative embodiment, the method further comprises: generating an updated file key after the key rotation is triggered; a key rotation instruction is sent to the management and control client, wherein the key rotation instruction carries a current file key and an updated file key, and the key rotation instruction is used for the management and control client to decrypt an image file of the target virtual disk by using the current file key and encrypt the image file of the target virtual disk by using the updated file key; receiving a key rotation result sent by the management and control client; and replacing the current file key with the updated file key.

In an alternative embodiment, the key rotation is triggered by: receiving a login request of the management and control client, wherein the login request carries current equipment information and a file identifier of an image file of a target virtual disk; after the management and control client side successfully logs in, judging whether the key rotation period is expired; and if the key rotation period expires, triggering the key rotation of the target virtual disk.

In an alternative embodiment, the key rotation is triggered by: receiving a key rotation request sent by the management and control client, wherein the key rotation request carries current equipment information and a file identifier of an image file of a target virtual disk; and triggering the key rotation of the target virtual disk after the verification of the file identification based on the current equipment information and the image file of the target virtual disk is successful.

In an alternative embodiment, the method further comprises: receiving a disk control request sent by the control client, wherein the disk control request carries current equipment information and a file identifier; after the initial verification of the current equipment information and the file identification is successful, generating a current file key of the target virtual disk, and sending the current file key to the management and control client so that the management and control client records the file identification in an image file of the target virtual disk after the image file is created; encrypting an image file of the target virtual disk by using the current file key; and after receiving the encrypted information sent by the management and control client, correlating the current equipment information with the file identifier.

the receiving the disk management and control request sent by the management and control client side includes: receiving a registration request sent by the management and control client, wherein the registration request carries the current equipment information; if the current equipment information is not registered, obtaining current marking information; sending a registration result to the management and control client, wherein the registration result carries the marking information;

And receiving a disk new request sent by the management and control client, wherein the disk new request carries a file identifier, and the file identifier is generated by the management and control client according to the marking information and the current equipment information.

In a third aspect, the present invention provides a virtual magnetic coil control apparatus, comprising:

the management and control service platform is used for verifying the target virtual disk based on the current equipment information and the file identification;

the first receiving module is used for receiving the current file key sent by the management and control service platform after successful login;

and the mounting module is used for decrypting the image file of the target virtual disk through the current file key so as to mount the target virtual disk.

In a fourth aspect, the present invention provides a virtual magnetic coil control apparatus, comprising:

the second receiving module is used for receiving a login request sent by the management and control client, wherein the login request carries current equipment information and a file identifier of an image file of the target virtual disk;

The verification module is used for verifying the target virtual disk based on the current equipment information and the file identification;

and the inquiring module is used for inquiring a current file key corresponding to the target virtual disk through the file identification if verification is successful, and sending the current file key to the management and control client so that the management and control client can decrypt the image file of the target virtual disk according to the current file key to mount the target virtual disk.

In a fifth aspect, the present invention provides an electronic device, comprising: a processor, a memory storing machine-readable instructions executable by the processor, which when executed by the processor perform the steps of the method of any of the preceding embodiments, when the electronic device is running.

In a sixth aspect, the present invention provides a computer readable storage medium having stored thereon a computer program which, when executed by a processor, performs the steps of the method according to any of the preceding embodiments.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the embodiments will be briefly described below, it being understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered limiting the scope, and that other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a schematic diagram of an operating environment of a virtual disk management and control method according to an embodiment of the present application;

fig. 2 is a schematic block diagram of an electronic device according to an embodiment of the present application;

FIG. 3 is a flowchart of a virtual disk management and control method according to an embodiment of the present disclosure;

fig. 4 is a schematic functional block diagram of a virtual magnetic coil control device according to an embodiment of the present application;

FIG. 5 is a flowchart of another virtual disk management method according to an embodiment of the present disclosure;

fig. 6 is a schematic functional block diagram of another virtual magnetic coil control device according to an embodiment of the present application;

FIG. 7 is a flowchart of a method for managing and controlling a virtual disk according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

It should be noted that: like reference numerals and letters denote like items in the following figures, and thus once an item is defined in one figure, no further definition or explanation thereof is necessary in the following figures. Meanwhile, in the description of the present application, the terms "first", "second", and the like are used only to distinguish the description, and are not to be construed as indicating or implying relative importance.

At present, a disk-level encryption method is adopted, and files which can be stored on a virtual disk are encrypted through a virtual disk driver. The data is stored on the computer equipment in the form of ciphertext, and the virtual disk technology can effectively encrypt the data of a user so as to prevent sensitive information from being attacked maliciously by hackers and improve the security of the data stored in the virtual disk.

However, in the application scenario of virtual disk usage, the virtual disk image file key needs to be maintained by the client user, and the user needs to input the key through the client to encrypt and decrypt the virtual disk image file. In addition, the virtual disk image file uses the same key for a long time, so that the security of the virtual disk is insufficient.

Based on the above study, the virtual disk management and control method, device, electronic equipment and readable storage medium provided by the application can simplify the use of the virtual disk and improve the decryption efficiency of the virtual disk.

For the convenience of understanding the present embodiment, first, a detailed description will be given of an operating environment for executing a virtual disk management and control method disclosed in the embodiments of the present application.

Fig. 1 is a schematic diagram of an operating environment of a virtual disk management and control method according to an embodiment of the present application. The virtual disk management method may include a server 110 and a terminal device 120 in an operating environment, where the server 110 is communicatively connected to one or more terminal devices 120 through a network for data communication or interaction. The server 110 may be a web server, database server, or the like. The terminal device 120 may be a personal computer (personal computer, PC), tablet, smart phone, personal digital assistant (personal digital assistant, PDA), or the like.

In this embodiment, a management and control service platform may be running in the server 110, and management and control of the key of the virtual disk may be implemented through the management and control service platform.

In this embodiment, a management and control client may be running in the terminal device 120, and the management and control service platform may be accessed through the management and control client to obtain or apply for the key of the virtual disk.

As shown in fig. 2, a block schematic diagram of the electronic device is shown. The electronic device 200 may include a memory 211, a processor 213. It will be appreciated by those of ordinary skill in the art that the configuration shown in fig. 2 is merely illustrative and is not intended to limit the configuration of the electronic device 200. For example, the electronic device 200 may also include more or fewer components than shown in FIG. 2, or have a different configuration than shown in FIG. 2. The electronic device 200 shown in fig. 2 may be an implementation device of the server 110 or the terminal device 120 in the operating environment shown in fig. 1. It will be appreciated that server 110 may comprise the components of electronic device 200 shown in fig. 2, and that terminal device 120 may comprise the components of electronic device 200 shown in fig. 2. Of course, the server 110 and the terminal device 120 may also contain more components than the electronic device 200 shown in fig. 2.

The above-mentioned memory 211 and the processor 213 are electrically connected directly or indirectly to each other to realize data transmission or interaction. For example, the components may be electrically connected to each other via one or more communication buses or signal lines. The processor 213 is configured to execute executable modules stored in the memory.

The Memory 211 may be, but is not limited to, a random access Memory (Random Access Memory, RAM), a Read Only Memory (ROM), a programmable Read Only Memory (Programmable Read-Only Memory, PROM), an erasable Read Only Memory (Erasable Programmable Read-Only Memory, EPROM), an electrically erasable Read Only Memory (Electric Erasable Programmable Read-Only Memory, EEPROM), etc. The memory 211 is configured to store a program, and the processor 213 executes the program after receiving an execution instruction, and a method executed by the electronic device 200 defined by the process disclosed in any embodiment of the present application may be applied to the processor 213 or implemented by the processor 213.

The processor 213 may be an integrated circuit chip with signal processing capabilities. The processor 213 may be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), etc.; but also digital signal processors (digital signal processor, DSP for short), application specific integrated circuits (Application Specific Integrated Circuit, ASIC for short), field Programmable Gate Arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The disclosed methods, steps, and logic blocks in the embodiments of the present application may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The electronic device 200 in the present embodiment may be used to perform each step in each method provided in the embodiments of the present application. The implementation of the virtual disk management method is described in detail below by means of several embodiments.

Please refer to fig. 3, which is a flowchart of a virtual disk management method according to an embodiment of the present application. The virtual disk management and control method provided by the embodiment can be applied to management and control of the client. The administration client may, for example, be run in the terminal device shown in fig. 1. The specific flow shown in fig. 3 will be described in detail.

Step 310, a login request is sent to the management and control service platform.

The login request carries current equipment information and file identification of an image file of the target virtual disk. The login request is used for the management and control service platform to verify the target virtual disk based on the current equipment information and the file identification.

Illustratively, the management and control service platform may verify whether the current device information is registered and whether the current device information has a binding relationship with the file identifier.

If the current device information is registered, for example, the current device information is recorded in a database of the management service platform, it may indicate that the current device information is registered.

For example, if the current device information and the file identifier are stored in association in the database of the management and control service platform, it may be indicated that the current device information has a binding relationship with the file identifier.

Optionally, after the management and control service platform successfully verifies the target virtual disk, the current file key corresponding to the target virtual disk can be queried based on the file identifier.

Optionally, after the management and control service platform successfully verifies the target virtual disk, the current file key corresponding to the target virtual disk can be queried based on the current equipment information.

The method provided in this embodiment may be applied to a client to be managed, which may be started before step 310 is performed. The management and control client is an application program installed on the current equipment and is used for connecting the management and control service platform and assisting the management and control service platform in checking the image file of the virtual disk.

In this embodiment, the hardware data of the current device may be obtained, and calculation may be performed based on the hardware data to obtain the current device information.

The hardware data of the current device may include one or more of a serial number of a hard disk, a CPU identifier, and a motherboard identifier.

Optionally, the serial number of the hard disk, the CPU identifier and the main board identifier information can be spliced together to perform hash operation, so as to obtain the current equipment information.

Illustratively, the file identity may be obtained by: acquiring a file header of an image file of a target virtual disk; and analyzing the file header to obtain the file identification.

In this embodiment, the file identifier may be a unique identifier.

Step 320, receiving the current file key sent by the management and control service platform.

In this embodiment, after the management and control client successfully logs in the management and control service platform, the current file key sent by the management and control service platform is received.

And 330, decrypting the image file of the target virtual disk through the current file key to mount the target virtual disk.

In the method of the embodiment, the management and control service platform manages the key of the virtual disk, and when the management and control service platform needs to be used, the decryption key is acquired from the management and control service platform, so that the user does not need to manually input the key, the user operation is reduced, and the convenience of disk use is improved. Furthermore, as the management and control service platform uniformly manages the keys of the virtual disk, the risk of key leakage can be reduced, and the use safety of the virtual disk can be improved.

In order to improve the reliability of the virtual disk key, the virtual disk key may be rotated. Based on this requirement, the virtual disk management method may further include steps 340 to 370.

Step 340, the receiving management and control service platform issues a key rotation instruction.

The key rotation instruction carries a current file key and an updated file key.

In this embodiment, the key rotation instruction may be triggered after the management and control client logs in to the management and control service platform and the management and control service platform successfully verifies the management and control client. The login manner of the management and control client to the management and control service platform is the same as that provided in step 310, so the description in step 310 may be referred to specifically, and will not be repeated here.

The key rotation may be triggered in different ways in this embodiment.

Alternatively, the receiving management and control service platform may issue a key rotation instruction at each key rotation period.

Optionally, after sending the rotation request to the management and control service platform, the management and control service platform may receive a key rotation instruction issued by the management and control service platform.

Step 350, decrypting the image file of the target virtual disk using the current file key.

Step 360 encrypts the image file of the target virtual disk using the update file key.

And step 370, sending a key rotation result to the management and control service platform so that the management and control service platform can replace the current file key by using the updated file key.

In this embodiment, the management and control service platform receives the key rotation result sent by the management and control client, if the key rotation is successful, the management and control service platform may set the updated file key as the current file key, set the previous current file key as the history file key, and send the updated current file key to the management and control client during the current valid key rotation period.

By rotating the key of the virtual disk, the security and reliability of the key can be improved, and further the files stored in the virtual disk can be safer.

In this embodiment, before the management and control service platform is used to manage and control the key of the virtual disk, a request may be sent to the management and control service platform, so that the management and control service platform manages the key of the virtual disk. Based on this, the method of the present embodiment may further include: step 380 to step 3020.

Step 380, sending a magnetic coil control request to the control service platform.

The disk management and control request carries current equipment information and a file identifier, so that the management and control service platform can be associated based on the current equipment information and the file identifier.

For example, the administration client may be started before sending a magnetic administration control request to the administration service platform.

For example, the registration process may be initiated to the management and control service platform after the management and control client is successfully connected to the management and control service platform by the management and control client when the management and control client is installed in the current device for the first time.

Step 390, receiving the current file key sent by the management and control service platform.

The current file password may be used to decrypt the image file of the target virtual disk when the target virtual disk is subsequently used.

Illustratively, the current file key may be a symmetric key, and the encryption and decryption may be implemented using a symmetric encryption algorithm when the current file key is used to encrypt and decrypt the image file of the target virtual disk.

Step 3010, create an image file of the target virtual disk, and record the file identification in the image file.

Alternatively, the file identification may be written into the file header of the image file of the target virtual disk.

The image file of the target virtual disk may include a file header portion and a file content portion, where the file header portion includes at least the file identifier described above and the file content portion is used to store data. Alternatively, the header portion may or may not be encrypted, as it does not store sensitive data or key information.

And 3020, encrypting the image file of the target virtual disk by using the current file key, and sending an encryption result to the management and control service platform.

Alternatively, the image file of the target virtual disk may be encrypted using a symmetric encryption algorithm using the current file key. For example, only the file content portion of the image file of the target virtual disk may be encrypted, and the file header portion may not be encrypted.

In this embodiment, when the encryption result is received as successful encryption, the management and control service platform may bind the file identifier with the current device information, so that when the virtual disk is used subsequently, the binding relationship of the virtual disk may be checked based on the current device information and the file identifier. The file identity is also associated with the current file key so that the current file key can be queried based on the file identity.

In this embodiment, after the file identifier is bound to the current device information, it may be defined that the target virtual disk can only be used on the terminal device corresponding to the current device information.

Optionally, after step 3020, the management and control client may further receive a binding result of the management and control platform, and if the binding is successful, the image file of the target virtual disk is created successfully; if the binding fails, the image file of the target virtual disk is deleted.

Through the flow, the related information of the target virtual disk to be managed can be recorded in the management and control service platform, and the key for management and control can be adaptively generated through the management and control service platform.

In this embodiment, the disk management request may include: registration request and disk new request. Based on this, step 380 may include steps 381 through 384.

Step 381, a registration request is sent to the management and control service platform.

Wherein the registration request carries current device information.

The current device information may be obtained in the same manner as the current device information in step 310, and will not be described herein.

After receiving the registration request, the management and control service platform can verify whether the current equipment information is registered, and if not, can feed back the successful registration result; if registered, the result that the registration is already performed and the registration cannot be performed again can be fed back.

In step 382, a registration result of successful registration of the management and control service platform is received.

Wherein the registration result carries the marking information. Alternatively, the marking information may be used as distinguishing information for distinguishing the respective virtual disks. For example, the tag information may be a time stamp, a random string, a sequentially generated value, or the like.

Taking the time stamp as an example, the time stamp may be a current time stamp obtained in real time by the management and control service platform.

Optionally, when the registration result is successful, the registration result carries the marking information.

And 383, generating a file identifier according to the marking information and the current equipment information.

Alternatively, the marking information may be a time stamp; the file identification may be generated from the timestamp and the current device information.

Alternatively, the timestamp may be hashed with the current device information, and the obtained result is used as the file identifier.

In step 384, a disk new request is sent to the management and control service platform.

Wherein, the new request of the disk carries the file identification.

By the method, the management of the key of the virtual disk image file can be realized through the three parts of virtual disk image file creation and registration, virtual disk image file checksum use and virtual disk image file key rotation, so that the security of the key and the convenience of virtual disk use can be improved.

Based on the same application conception, the embodiment of the application also provides a virtual magnetic disk management and control device corresponding to the virtual magnetic disk management and control method, and because the principle of solving the problem of the device in the embodiment of the application is similar to that of the embodiment of the virtual magnetic disk management and control method, the implementation of the device in the embodiment of the application can refer to the description in the embodiment of the method, and the repetition is omitted.

Fig. 4 is a schematic functional block diagram of a virtual magnetic coil control device according to an embodiment of the present application. The modules in the virtual magnetic coil control device in the embodiment are used for executing the steps in the method embodiment. The virtual magnetic coil control device comprises: a first sending module 410, a first receiving module 420, and a mounting module 430; wherein the contents of the respective modules are as follows.

A first sending module 410, configured to send a login request to the management and control service platform, where the login request carries current device information and a file identifier of an image file of the target virtual disk, and the login request is used by the management and control service platform to verify the target virtual disk based on the current device information and the file identifier; the first receiving module 420 is configured to receive, after the login is successful, a current file key sent by the management and control service platform; and the mounting module 430 is configured to decrypt the image file of the target virtual disk by using the current file key, so as to mount the target virtual disk.

In a possible implementation manner, the virtual magnetic coil control device provided in this embodiment may further include: the first acquisition module is used for acquiring hardware data of the current equipment, wherein the hardware data comprises one or more of a hard disk serial number, a CPU identifier and a main board identifier; and the first calculation module is used for calculating based on the hardware data to obtain the current equipment information.

In a possible implementation manner, the virtual magnetic coil control device provided in this embodiment may further include: the second acquisition module is used for acquiring the file header of the image file of the target virtual disk; the first analysis module is used for analyzing the file header to obtain the file identification.

In a possible implementation manner, the virtual magnetic coil control device provided in this embodiment may further include: the third receiving module is used for receiving and controlling the service platform to issue a key rotation instruction, wherein the key rotation instruction carries a current file key and an updated file key; the first decryption module is used for decrypting the image file of the target virtual disk by using the current file key; the first encryption module is used for encrypting the image file of the target virtual disk by using the updated file key; and the second sending module is used for sending a key rotation result to the management and control service platform so that the management and control service platform can replace the current file key by using the updated file key.

In a possible implementation manner, the third receiving module is configured to receive, at each key rotation period, a key rotation instruction issued by the management and control service platform; or after sending the rotation request to the management and control service platform, receiving the key rotation instruction issued by the management and control service platform.

In a possible implementation manner, the virtual magnetic coil control device provided in this embodiment may further include: the third sending module is used for sending a magnetic disk management and control request to the management and control service platform, wherein the magnetic disk management and control request carries current equipment information and file identification so that the management and control service platform can correlate based on the current equipment information and the file identification; the fourth receiving module is used for receiving the current file key sent by the management and control service platform; the creation module is used for creating an image file of the target virtual disk and recording a file identification in the image file; and the second encryption module is used for encrypting the image file of the target virtual disk by using the current file key and sending an encryption result to the management and control service platform.

In one possible implementation, the disk management request includes: a registration request and a disk new request; the third sending module comprises a registration sending unit, a result receiving unit and an identification generating unit; the registration sending unit is used for sending a registration request to the management and control service platform, wherein the registration request carries current equipment information; the result receiving unit is used for receiving a registration result of successful registration of the management and control service platform, wherein the registration result carries mark information; the identification generating unit is used for generating a file identification according to the marking information and the current equipment information; and sending a disk new request to the management and control service platform, wherein the disk new request carries a file identifier.

In one possible embodiment, the marking information is a time stamp; and the identifier generating unit is used for generating a file identifier according to the timestamp and the current equipment information.

Please refer to fig. 5, which is a flowchart of a virtual disk management method according to an embodiment of the present application. The virtual disk management and control method provided by the embodiment can be applied to a management and control service platform. The administration service platform may, for example, operate in the server shown in fig. 1. The method provided in this embodiment is similar to the method shown in fig. 3, except that the method shown in fig. 3 is based on a method of controlling a client side, and the method provided in this embodiment is based on a method of controlling a service platform. The specific flow shown in fig. 5 will be described in detail.

Step 510, receiving a login request sent by a management client.

The login request carries current equipment information and file identification of an image file of the target virtual disk.

Step 520, verifying the target virtual disk based on the current device information and the file identification.

If the verification is successful, step 530 is performed.

For example, the current device information and file identification may be parsed based on the login request.

Optionally, inquiring whether current equipment information and file identification exist; if so, verifying whether the current equipment information and the file identifier are in a binding relationship; if the current device information and the file identifier are in a binding relationship, the verification is successful.

For example, it may be a priori verified whether the current device information is present in the database, and if not, the login procedure is ended. If so, continuing to verify whether the binding relationship exists between the current device information and the file identifier.

For example, the management and control service platform may query whether the file identity exists in the database, and if not, end the login procedure. If so, continuing to check whether the binding relationship exists between the file identification and the current equipment information. If the binding relation does not exist, ending the login flow; if the binding relationship exists, login can be allowed, and the management and control client successfully logs in the management and control service platform.

And 530, inquiring a current file key corresponding to the target virtual disk through the file identification, and sending the current file key to the management and control client so that the management and control client can decrypt the image file of the target virtual disk according to the current file key to mount the target virtual disk.

Based on the method, the management and control service platform can manage the secret key of the image file of the virtual disk, so that the user can operate and use the virtual disk conveniently, and the safety of the virtual disk can be improved.

In this embodiment, in order to further improve the security and reliability of the key, the virtual disk management method of this embodiment may further include steps 540 to 570.

At step 540, after the key rotation is triggered, an update file key is generated.

Alternatively, the key rotation is triggered by: receiving a login request of a management and control client, and judging whether a key rotation period expires after the management and control client successfully logs in; and if the key rotation period expires, triggering the key rotation of the target virtual disk.

The verification of the login request may be similar to step 510, and may be specifically described in step 510, which is not described herein.

Alternatively, the key rotation is triggered by: and receiving a key rotation request sent by the management and control client, and triggering the key rotation of the target virtual disk after the verification based on the current equipment information and the file identification of the image file of the target virtual disk is successful.

The key rotation request carries current equipment information and file identification of an image file of the target virtual disk.

Illustratively, verification of the file identifier of the image file based on the current device information and the target virtual disk may be similar to verification of the file identifier of the image file of the current device information and the target virtual disk at the time of the login request, and in particular, the verification manner of step 520 may be referred to.

Step 550, a key rotation instruction is sent to the management and control client.

The key rotation instruction is used for decrypting the image file of the target virtual disk by the management and control client side by using the current file key, and encrypting the image file of the target virtual disk by using the updated file key.

Step 560, receiving the key rotation result sent by the management and control client.

Step 570, replace the current file key with the updated file key.

In this embodiment, the key rotation result is that the key rotation is successful, the management and control service platform sets the updated file key as the current file key for decrypting the image file of the target virtual disk later, and sets the previous current file key as the history file key.

In this embodiment, before the management and control service platform is used to manage and control the key of the virtual disk, a request may be sent to the management and control service platform, so that the management and control service platform manages the key of the virtual disk. The virtual disk management and control method may further include:

in step 580, a disk management request sent by the management client is received.

The disk control request carries current equipment information and file identification.

After the initial verification of the current device information and the file identifier is successful, step 590 is performed.

For example, the initial verification of the current device information may be to verify whether the current device information is registered, e.g., the registered current device information may be saved in a database associated with the administration service platform. It may be determined whether the current device information is registered by managing whether the current device information is present in a database associated with the service platform.

After the management and control service platform analyzes the file identifier, the management and control service platform can verify the file identifier initially, and if the file identifier exists in the management and control service platform, the process is ended, and failure information is returned to the management and control client. If the file identification does not exist in the administration service platform, step 590 may be performed.

And 590, generating a current file key of the target virtual disk and sending the current file key to the management and control client.

In this embodiment, the current file key may have a correspondence with the file identifier. For example, the current file key may be stored in association with the file identity. Alternatively, the generation of the current file key may not rely on file identification.

After creating an image file of the target virtual disk, the management and control client records a file identifier in the image file; and encrypts the image file of the target virtual disk using the current file key.

Optionally, after the management and control service platform generates the current file key, the rotation period of the current file key may also be set.

For example, a default key rotation period may be set to one month. Of course, the key rotation period may also be set by circumference. When the key rotation period expires, then generation of a new key may be triggered to replace the current file key, which becomes the historical file key.

And step 5010, when receiving the encrypted message sent by the management and control client, associating the current equipment information with the file identifier.

Illustratively, the management and control service platform establishes a binding relationship between the current device information and the file identifier after receiving the encrypted message sent by the management and control client. The binding relationship has the effect that when the management and control client subsequently uses the image file of the target virtual disk, the file identifier can be sent to the management and control service platform so as to verify the binding relationship between the current equipment information and the file identifier, thereby realizing that the image file of the target virtual disk is only used on the bound terminal equipment.

In this embodiment, the magnetic disk control request includes: registration request and disk new request. Based on this, step 580 may include: step 581 to step 584.

In step 581, a registration request sent by the administration client is received.

Wherein the registration request carries current device information.

If the current device information is not registered, then step 582 is performed. For example, whether the current device information is registered may be determined by whether the current device information exists in a database associated with the administration service platform.

At step 582, current marking information is obtained.

Alternatively, the current tag information may be a current timestamp of the administration service platform. The current tag information may be information such as another character string. For example, a string of characters that is randomly generated.

And 583, sending a registration result to the management and control client.

Wherein the registration result carries the marking information. The marking information may be used by the administration client to generate a file identification for marking the image file of the virtual disk based on the marking information and the current device information.

Step 584, receiving a disk new request sent by the management and control client.

The disk new request carries a file identifier, and the file identifier is generated by the management and control client according to the marking information and the current equipment information.

Fig. 6 is a schematic functional block diagram of a virtual magnetic coil control device according to an embodiment of the present application. The modules in the virtual magnetic coil control device in the embodiment are used for executing the steps in the method embodiment. The virtual magnetic coil control device comprises: a second receiving module 610, a verification module 620, and a query module 630; the contents of each module are as follows:

a second receiving module 610, configured to receive a login request sent by a management client, where the login request carries current device information and a file identifier of an image file of a target virtual disk;

a verification module 620, configured to verify the target virtual disk based on the current device information and the file identifier;

and the query module 630 is configured to query, if verification is successful, a current file key corresponding to the target virtual disk through the file identifier, and send the current file key to the management and control client, so that the management and control client decrypts the image file of the target virtual disk according to the current file key to mount the target virtual disk.

In one possible implementation, the verification module 620 is configured to query whether current device information and file identification exist; if so, verifying whether the current equipment information and the file identifier are in a binding relationship; if the current device information and the file identifier are in a binding relationship, the verification is successful.

In a possible implementation manner, the virtual magnetic coil control device provided in this embodiment further includes:

the first generation module is used for generating an updated file key after the key rotation is triggered;

the fourth sending module is used for sending a key rotation instruction to the management and control client, wherein the key rotation instruction carries a current file key and an updated file key, and the key rotation instruction is used for enabling the management and control client to decrypt an image file of the target virtual disk by using the current file key and encrypt the image file of the target virtual disk by using the updated file key;

the fourth receiving module is used for receiving the key rotation result sent by the management and control client;

and the replacing module is used for replacing the current file key by using the updated file key.

In a possible embodiment, the key rotation is triggered by:

receiving a login request of a management and control client, wherein the login request carries current equipment information and a file identifier of an image file of a target virtual disk;

After the login of the management and control client is successful, judging whether a key rotation period is expired;

and if the key rotation period expires, triggering the key rotation of the target virtual disk.

In a possible embodiment, the key rotation is triggered by:

receiving a key rotation request sent by a management and control client, wherein the key rotation request carries current equipment information and a file identifier of an image file of a target virtual disk;

and triggering the key rotation of the target virtual disk after the verification based on the current equipment information and the file identification of the image file of the target virtual disk is successful.

the receiving module is used for receiving a disk control request sent by the control client, wherein the disk control request carries current equipment information and a file identifier;

the second generation module is used for generating a current file key of the target virtual disk after the initial verification of the current equipment information and the file identification is successful, and sending the current file key to the management and control client so that the management and control client records the file identification in the image file after creating the image file of the target virtual disk; encrypting the image file of the target virtual disk by using the current file key;

And the association module is used for associating the current equipment information with the file identifier after receiving the encrypted information sent by the management and control client.

In one possible implementation, the disk management request includes: a registration request and a disk new request;

the receiving module is used for receiving a registration request sent by the management and control client, wherein the registration request carries current equipment information; if the current equipment information is not registered, obtaining the current marking information; sending a registration result to a management and control client, wherein the registration result carries mark information; and receiving a disk new request sent by the management and control client, wherein the disk new request carries a file identifier which is generated by the management and control client according to the marking information and the current equipment information.

Please refer to fig. 7, which is a flowchart of a virtual disk management method according to an embodiment of the present application. The virtual disk management and control method provided by the embodiment can be applied to a management and control system comprising a management and control client and a management and control service platform. The management and control system may, for example, operate in the operating environment shown in FIG. 1. The method provided in this embodiment is similar to the method shown in fig. 3, except that the method shown in fig. 3 is based on a method of controlling a client side, and the method provided in this embodiment is based on a method of controlling a system. The specific flow shown in fig. 7 will be explained below.

In step 710, the management and control client sends a login request to the management and control service platform.

In step 720, the management and control service platform verifies the target virtual disk based on the current device information and the file identification.

If the verification is successful, step 730 is performed.

Step 730, the management and control service platform queries the current file key corresponding to the target virtual disk through the file identifier.

In step 740, the management and control service platform sends the current file key to the management and control client.

And 750, decrypting the image file of the target virtual disk by the management and control client through the current file key so as to mount the target virtual disk.

For other details about this embodiment, reference may be made to the aforementioned virtual disk management method provided by the management and control client and the virtual disk management method provided by the management and control server, which are not described herein.

In addition, the embodiment of the application further provides a computer readable storage medium, and a computer program is stored on the computer readable storage medium, and when the computer program is executed by a processor, the steps of the virtual disk management method described in the embodiment of the method are executed.

The computer program product of the virtual disk management method provided in the embodiments of the present application includes a computer readable storage medium storing program codes, where the instructions included in the program codes may be used to execute the steps of the virtual disk management method described in the embodiments of the method, and the embodiments of the method may be referred to specifically and not be repeated herein.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other manners as well. The apparatus embodiments described above are merely illustrative, for example, flow diagrams and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In addition, the functional modules in the embodiments of the present application may be integrated together to form a single part, or each module may exist alone, or two or more modules may be integrated to form a single part.

The functions, if implemented in the form of software functional modules and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes. It is noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises the element.

The foregoing description is only of the preferred embodiments of the present application and is not intended to limit the same, but rather, various modifications and variations may be made by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application. It should be noted that: like reference numerals and letters denote like items in the following figures, and thus once an item is defined in one figure, no further definition or explanation thereof is necessary in the following figures.

The foregoing is merely specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the present application, and the changes and substitutions are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A virtual disk management and control method is characterized by comprising the following steps:

a login request is sent to a management and control service platform, wherein the login request carries current equipment information and a file identifier of an image file of a target virtual disk, and the login request is used for the management and control service platform to verify the target virtual disk based on the current equipment information and the file identifier;

After successful login, receiving a current file key sent by the management and control service platform;

and decrypting the image file of the target virtual disk through the current file key so as to mount the target virtual disk.

2. The method according to claim 1, wherein the method further comprises:

acquiring hardware data of current equipment, wherein the hardware data comprises one or more of a hard disk serial number, a CPU identifier and a main board identifier;

and calculating based on the hardware data to obtain current equipment information.

3. The method according to claim 1, wherein the method further comprises:

acquiring a file header of an image file of a target virtual disk;

and analyzing the file header to obtain a file identifier.

4. The method according to claim 1, wherein the method further comprises:

receiving a key rotation instruction issued by the management and control service platform, wherein the key rotation instruction carries a current file key and an updated file key;

decrypting an image file of the target virtual disk by using the current file key;

encrypting an image file of the target virtual disk by using the updated file key;

And sending a key rotation result to the management and control service platform so that the management and control service platform can replace the current file key by using the updated file key.

5. The method of claim 4, wherein the receiving the key rotation instruction issued by the management and control service platform comprises:

receiving a key rotation instruction issued by the management and control service platform in each key rotation period; or,

and after the rotation request is sent to the management and control service platform, receiving a key rotation instruction issued by the management and control service platform.

6. The method according to any one of claims 1-5, further comprising:

7. The method of claim 6, wherein the disk management request comprises: a registration request and a disk new request;

8. The method of claim 7, wherein the marking information is a time stamp; the generating the file identifier according to the marking information and the current equipment information comprises the following steps:

and generating the file identification according to the timestamp and the current equipment information.

9. A virtual disk management and control method is characterized by comprising the following steps:

receiving a login request sent by a management and control client, wherein the login request carries current equipment information and a file identifier of an image file of a target virtual disk;

Verifying the target virtual disk based on the current equipment information and the file identification;

and if verification is successful, inquiring a current file key corresponding to the target virtual disk through the file identifier, and sending the current file key to the management and control client so that the management and control client can decrypt the image file of the target virtual disk according to the current file key to mount the target virtual disk.

10. The method of claim 9, wherein verifying the target virtual disk based on the current device information and the file identification comprises:

inquiring whether the current equipment information and the file identification exist or not;

if so, verifying whether the current equipment information and the file identifier are in a binding relationship;

and if the current equipment information and the file identifier are in a binding relationship, the verification is successful.

11. The method according to claim 9, wherein the method further comprises:

generating an updated file key after the key rotation is triggered;

a key rotation instruction is sent to the management and control client, wherein the key rotation instruction carries a current file key and an updated file key, and the key rotation instruction is used for the management and control client to decrypt an image file of the target virtual disk by using the current file key and encrypt the image file of the target virtual disk by using the updated file key;

Receiving a key rotation result sent by the management and control client;

and replacing the current file key with the updated file key.

12. The method of claim 11, wherein the key rotation is triggered by:

receiving a login request of the management and control client, wherein the login request carries current equipment information and a file identifier of an image file of a target virtual disk;

after the management and control client side successfully logs in, judging whether the key rotation period is expired;

13. The method of claim 11, wherein the key rotation is triggered by:

receiving a key rotation request sent by the management and control client, wherein the key rotation request carries current equipment information and a file identifier of an image file of a target virtual disk;

and triggering the key rotation of the target virtual disk after the verification of the file identification based on the current equipment information and the image file of the target virtual disk is successful.

14. The method according to any one of claims 9-13, wherein the method further comprises:

Receiving a disk control request sent by the control client, wherein the disk control request carries current equipment information and a file identifier;

after the initial verification of the current equipment information and the file identification is successful, generating a current file key of the target virtual disk, and sending the current file key to the management and control client so that the management and control client records the file identification in an image file of the target virtual disk after the image file is created; encrypting an image file of the target virtual disk by using the current file key;

and after receiving the encrypted information sent by the management and control client, correlating the current equipment information with the file identifier.

15. The method of any of claims 9-13, wherein the disk management request comprises: a registration request and a disk new request;

the receiving the disk management and control request sent by the management and control client side includes:

receiving a registration request sent by the management and control client, wherein the registration request carries the current equipment information;

if the current equipment information is not registered, obtaining current marking information;

Sending a registration result to the management and control client, wherein the registration result carries the marking information;

16. A virtual magnetic coil control apparatus, comprising:

17. A virtual magnetic coil control apparatus, comprising:

18. An electronic device, comprising: a processor, a memory storing machine-readable instructions executable by the processor, which when executed by the processor perform the steps of the method of any of claims 1 to 15 when the electronic device is run.

19. A computer-readable storage medium, characterized in that it has stored thereon a computer program which, when executed by a processor, performs the steps of the method according to any of claims 1 to 15.