WO2016106566A1 - 虚拟化系统中加解密的方法、装置和系统 - Google Patents

虚拟化系统中加解密的方法、装置和系统 Download PDF

Info

Publication number
WO2016106566A1
WO2016106566A1 PCT/CN2014/095598 CN2014095598W WO2016106566A1 WO 2016106566 A1 WO2016106566 A1 WO 2016106566A1 CN 2014095598 W CN2014095598 W CN 2014095598W WO 2016106566 A1 WO2016106566 A1 WO 2016106566A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual machine
hard disk
disk image
identifier
encryption
Prior art date
Application number
PCT/CN2014/095598
Other languages
English (en)
French (fr)
Inventor
何伟
吴鸿钟
杨志鹏
任伟峰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2017504166A priority Critical patent/JP6414863B2/ja
Priority to CN201480056793.7A priority patent/CN106063218B/zh
Priority to EP14909378.3A priority patent/EP3160103B1/en
Priority to PCT/CN2014/095598 priority patent/WO2016106566A1/zh
Publication of WO2016106566A1 publication Critical patent/WO2016106566A1/zh
Priority to US15/637,091 priority patent/US9959410B2/en
Priority to US15/935,744 priority patent/US10409990B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45562—Creating, deleting, cloning virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45575—Starting, stopping, suspending or resuming virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances

Definitions

  • the present invention relates to the field of computing, and in particular, to a method, apparatus and system for encryption and decryption in a virtualization system.
  • the cloud computing platform can effectively provide large-scale computing resources to users in the form of virtual machines (VMs) by effectively integrating various interconnected computing resources and implementing multi-level virtualization and abstraction.
  • the virtualization software deployed in the cloud computing host constitutes an environment in which the virtual machine runs, and provides services such as network and storage for the virtual machine.
  • the user's data is stored in the virtual hard disk of the virtual machine.
  • the actual physical storage space of the virtual hard disk is in the hard disk array of the storage server.
  • the storage server organizes the storage space of the virtual hard disk into a large file or a large data block.
  • the data block is called a hard disk image.
  • a hard disk image is a storage entity of virtual machine data, and represents a storage form in which the contents of a virtual machine's disk or hard disk are organized in units of sectors.
  • the cloud computing platform needs to provide reliable security technology to ensure the security of user data in the hard disk image and avoid the leakage of user privacy data containing trade secrets.
  • FIG. 1 a schematic diagram of the structure of the existing virtualization system encryption and decryption technology is implemented.
  • the device mapping and encryption module is included in a virtual machine monitor (VMM) for Map the hard disk image to a virtual block device.
  • the hard disk image is invisible to the user VM.
  • the virtualization software connects the block device to the user VM.
  • the device mapping and encryption module can sense the access of the user VM to the device and encrypt the accessed data in the disk image. Thereby achieving protection of user data.
  • Device mapping and encryption modules need to be separately identified and processed, resulting in complex implementation of the device mapping and encryption module, which has a great impact on the operating system and stability of the cloud computing.
  • the object of the present invention is to provide a method, a device and a system for encrypting and decrypting in a virtualization system, so as to solve the complex implementation and the stability of the system caused by the device mapping and encryption module in the VMM. And other issues.
  • an embodiment of the present invention provides a virtualization system, including a virtual machine monitor VMM and an encryption and decryption virtual machine, where the VMM includes a control module, and the encryption and decryption virtual machine records a hard disk image identifier and a key.
  • the first association relationship, the key includes an encryption key, and the second association relationship between the hard disk image identifier and the hard disk image attribute is recorded in the virtualization system.
  • the control module is configured to obtain data to be written by the user virtual machine, and determine, according to the second association relationship, a hard disk image attribute of the hard disk image of the user virtual machine to be written, if the hard disk image is determined Sending the identifier of the hard disk image to be written and the data to be written to the encryption and decryption virtual machine;
  • the encryption/decryption virtual machine is configured to determine an encryption key corresponding to the identifier of the hard disk image to be written according to the first association relationship, and encrypt the data to be written by using the encryption key. Obtaining encrypted data, and transmitting the encrypted data to the control module;
  • the control module is further configured to write the encrypted data into the hard disk image to be written.
  • the first associated relationship further includes a user virtual machine identifier
  • the control module is specifically configured to send, to the encryption and decryption virtual machine, an identifier of the user virtual machine, an identifier of the hard disk image to be written, and data to be written;
  • the cryptographic virtual machine is configured to obtain the identifier of the user virtual machine and the hard disk image identifier to be written, and determine whether the identifier of the user virtual machine and the Corresponding relationship between the written hard disk image identifiers, if not, returning an encryption failure indication to the control module, and if yes, using the determined encryption key corresponding to the hard disk image identifier to be written to the to-be-written
  • the incoming data is encrypted.
  • the key further includes a decryption key
  • the control module is further configured to obtain a read request triggered by the user virtual machine, read data from the hard disk image to be read, determine that the read data is encrypted data, and send the data to the encryption and decryption virtual machine.
  • a decryption request where the decryption request carries an identifier of the user virtual machine, the encrypted data read, and an identifier of the hard disk image;
  • the encryption and decryption virtual machine is further configured to receive the decryption request, and determine whether the first association relationship includes a correspondence between an identifier of the user virtual machine that sends the read request and an identifier of the hard disk image. If yes, the decryption key corresponding to the identifier of the hard disk image is obtained from the first association relationship, the encrypted data is decrypted by using the decryption key, and the obtained decrypted data is sent to the Control module
  • the control module is further configured to return the decrypted data to the user virtual machine.
  • the control module is further configured to: when the read data is unencrypted data, return the read non-encrypted data to the user virtual machine.
  • system further includes a system management module and a virtual machine management module,
  • the system management module is configured to send a virtual machine startup request to the virtual machine management module, where the virtual machine starts Requesting to carry the identifier of the user virtual machine to be started;
  • the virtual machine management module is configured to receive the virtual machine startup request, start the user virtual machine to be started according to the virtual machine startup request, and send the hard disk image identifier of the activated user virtual machine and its hard disk image attribute Giving the control module;
  • the control module is further configured to receive and record a hard disk image identifier of the activated user virtual machine and a hard disk mirroring attribute thereof, and establish the second association relationship.
  • system further includes a system management module and a virtual machine management module,
  • the system management module is further configured to send a virtual machine creation request to the virtual machine management module, where the virtual machine creation request carries an attribute of a hard disk image of the user virtual machine to be created;
  • the virtual machine management module is further configured to receive the virtual machine creation request, create a user virtual machine, create a hard disk image for the created user virtual machine, allocate a hard disk image identifier, and determine the allocated according to the virtual machine creation request.
  • the hard disk image identifier corresponding to the hard disk image is configured to send a virtual machine creation indication message to the encryption and decryption virtual machine, where the virtual machine creation indication message carries the created user virtual machine identifier, the allocated hard disk image identifier, and The assigned hard disk image identifier corresponding to the hard disk image attribute;
  • the encryption and decryption virtual machine is further configured to receive the virtual machine creation indication message, allocate a key for the created hard disk image, establish an identifier of the created user virtual machine, the allocated hard disk image identifier, and the secret The first association relationship between the keys.
  • the encryption and decryption virtual machine is further configured to send a virtual machine creation response message to the system management module, where the virtual machine creation response message includes the identifier of the created user virtual machine.
  • the system management module is further configured to send a hard disk image addition request message to the virtual machine management module, where the hard disk image increase request message carries the attribute of the user virtual machine identifier and the newly added disk image;
  • the virtual machine management module is further configured to receive the hard disk image addition request message, create a new hard disk image for the user virtual machine, and determine a hard disk image attribute of the new hard disk image according to the hard disk image addition request message. And sending, to the encryption and decryption virtual machine, the user virtual machine identifier, the identifier of the new hard disk image, and the hard disk image attribute of the new hard disk image;
  • the encryption and decryption virtual machine is further configured to allocate a key for the new hard disk image and update the first association relationship.
  • control module is specifically configured to acquire, by the device driver, a write request triggered by the user virtual machine, where the write request carries the to-be-written The data.
  • the key further includes a decryption key
  • the control module is further configured to obtain a read request triggered by the user virtual machine, read data from the hard disk image to be read, determine that the read data is encrypted data, and send the data to the encryption and decryption virtual machine.
  • a decryption request where the decryption request carries an identifier of the user virtual machine, the encrypted data read, and an identifier of the hard disk image;
  • the encryption and decryption virtual machine is further configured to receive the decryption request, determine a decryption key corresponding to the identifier of the hard disk image according to the first association relationship, and decrypt the encrypted data by using the decryption key, The obtained decrypted data is sent to the control module;
  • the control module is further configured to return the decrypted data to the user virtual machine.
  • system further includes a system management module and a virtual machine management module,
  • the system management module is configured to send a virtual machine startup request to the virtual machine management module, where the virtual machine startup request carries an identifier of the user virtual machine to be started;
  • the virtual machine management module is configured to receive the virtual machine startup request, start the user virtual machine to be started according to the virtual machine startup request, and send the hard disk image identifier of the activated user virtual machine and its hard disk image attribute Giving the control module;
  • the control module is further configured to receive and record a hard disk image identifier of the activated user virtual machine and a hard disk mirroring attribute thereof, and establish the second association relationship.
  • the system further includes a system management module and a virtual machine management module ,
  • the system management module is further configured to send a virtual machine creation request to the virtual machine management module, where the virtual machine creation request carries an attribute of a hard disk image of the user virtual machine to be created;
  • the virtual machine management module is further configured to receive the virtual machine creation request, create a user virtual machine, create a hard disk image for the created user virtual machine, allocate a hard disk image identifier, and determine the allocated according to the virtual machine creation request.
  • the hard disk image identifier corresponding to the hard disk image attribute, and the virtual machine creation indication message is sent to the encryption and decryption virtual machine, where the virtual machine creation indication message carries the allocated hard disk image identifier and the allocated hard disk image Identify the corresponding hard disk image attribute;
  • the encryption and decryption virtual machine is further configured to receive the virtual machine creation indication message, allocate a key for the hard disk image identifier, and establish the first association relationship between the hard disk image identifier and the key.
  • the system management module is further configured to send a hard disk image addition request message to the virtual machine management module, where the hard disk image increase request message carries the attribute of the user virtual machine identifier and the newly added disk image;
  • the virtual machine management module is further configured to receive the hard disk image addition request message, create a new hard disk image for the user virtual machine, determine a hard disk image attribute of the new hard disk image, and mirror the new hard disk image. And the hard disk mirroring attribute of the new hard disk image is sent to the encryption and decryption virtual machine;
  • the encryption and decryption virtual machine is further configured to allocate a key for the new hard disk image and update the first association relationship.
  • an embodiment of the present invention provides a method for encrypting and decrypting in a virtualization system, which is applied to a virtualization system, where the virtualization system includes a virtual machine monitor VMM and an encryption and decryption virtual machine, and the VMM includes a control module.
  • the encryption/decryption virtual machine records a first association relationship between the hard disk image identifier and the key, the key includes an encryption key, and the virtualized system records a hard disk image identifier and a hard disk image attribute.
  • the control module acquires the data to be written of the user virtual machine, and determines the hard disk image attribute of the hard disk image of the user virtual machine to be written according to the second association relationship, if the determined hard disk image attribute is encrypted Sending, to the encryption and decryption virtual machine, the identifier of the hard disk image to be written and the data to be written;
  • the control module receives the encrypted data obtained by encrypting the data to be written by using the encryption key by the encryption and decryption virtual machine, wherein the encryption key is the encryption/decryption virtual machine according to the first An encryption key corresponding to the identifier of the hard disk image to be written determined by an association relationship;
  • the control module writes the encrypted data into the hard disk image to be written.
  • the first associated relationship further includes a user virtual machine identifier
  • the key further includes a decryption key
  • the method further includes:
  • the control module acquires a read request triggered by the user virtual machine, reads data from the hard disk image to be read, determines that the read data is encrypted data, and sends a decryption request to the encryption and decryption virtual machine.
  • the identifier of the user virtual machine, the encrypted data read, and the identifier of the hard disk image are carried in the decryption request;
  • the control module receives the decrypted data returned by the encryption and decryption virtual machine, wherein the decrypted data is an identifier of the user virtual machine in the determining the first association relationship by the encryption/decryption virtual machine. After the corresponding relationship between the identifier of the hard disk image and the identifier of the hard disk image is obtained, the encrypted data is decrypted by using a decryption key corresponding to the hard disk image identifier determined according to the first association relationship;
  • the control module returns the decrypted data to the user virtual machine.
  • the control module returns the read non-encrypted data to the user virtual machine when it is determined that the read data is non-encrypted data.
  • system further includes a virtual machine management module
  • method further includes:
  • the control module receives a virtual machine startup indication message sent by the virtual machine management module, where the virtual machine startup indication message carries an identifier of the activated user virtual machine, a hard disk image identifier of the activated user virtual machine, and a hard disk mirroring attribute thereof;
  • the control module records the hard disk image identifier of the activated user virtual machine and its hard disk image attribute, and updates the second association relationship.
  • the acquiring, by the control module, the data to be written by the user virtual machine includes:
  • the control module acquires a write request triggered by the user virtual machine from a device driver, and the write request carries the data to be written.
  • an embodiment of the present invention provides a method for creating a user virtual machine, which is applied to a virtualization system, where the virtualization system includes a VMM, a system management module, and an encryption and decryption virtual machine, where the VMM includes a virtual machine management module.
  • the method includes:
  • the cryptographic virtual machine receives the virtual machine creation indication message sent by the virtual machine management module, where the virtual machine creation indication message carries the identifier of the created user virtual machine, and the hard disk image allocated for the created user virtual machine. And the hard disk mirroring attribute corresponding to the hard disk image identifier that is allocated, where the virtual machine creation indication message is specifically that the virtual machine management module creates a user virtual machine and a hard disk according to the virtual machine creation request sent by the system management module. Sent after mirroring;
  • the encryption/decryption virtual machine allocates a key for the created hard disk image, and establishes an identifier of the created user virtual machine, the allocated hard disk image identifier, and a first association relationship between the keys;
  • the cryptographic virtual machine sends a virtual machine creation response message to the system management module, where the virtual machine creation response message includes the identifier of the created user virtual machine.
  • the cryptographic virtual machine receives the hard disk image addition indication message sent by the virtual machine management module, where the hard disk image addition indication message carries the user virtual machine identifier, and the virtual machine management module is the user virtual machine new The hard disk mirroring identifier and the hard disk mirroring attribute thereof, wherein the hard disk mirroring instruction message is specifically configured by the virtual machine management module to create a new hard disk image for the user virtual machine according to the hard disk image adding request sent by the system management module.
  • the encryption/decryption virtual machine allocates a key to the newly added hard disk image, and updates the user virtual machine identifier, the newly added hard disk image identifier, and a key allocated for the newly added hard disk image to the The first relationship.
  • the VMM includes a control module, and the method further includes:
  • the encryption/decryption virtual machine receives an encryption request sent by the control module, where the encryption request carries an identifier of the user virtual machine, an identifier of the hard disk image to be written, and the data to be written, and determines the first Whether the relationship between the identifier of the user virtual machine and the identifier of the hard disk image to be written is included in an association relationship, and if not, returning an encryption failure indication to the control module, and if yes, according to the first association Determining an encryption key corresponding to the identifier of the hard disk image to be written, encrypting the data to be written by using the encryption key, obtaining encrypted data, and transmitting the encrypted data to the control module So that the control module writes the encrypted data into the hard disk image to be written.
  • the method further includes: the encryption/decryption virtual machine receiving a decryption request sent by the control module, where the decryption request carries Determining, by the identifier of the user virtual machine, the encrypted data that is read, and the identifier of the hard disk image, determining whether the first association relationship includes the correspondence between the identifier of the user virtual machine and the identifier of the hard disk image.
  • the decryption key corresponding to the identifier of the hard disk image is obtained from the first association relationship, the encrypted data is decrypted by using the decryption key, and the obtained decrypted data is sent to the
  • the control module is configured to cause the control module to return the decrypted data to the user virtual machine.
  • an embodiment of the present invention provides a control device in a virtualization system, where the control device is located in a VMM of a virtualization system, where the virtualization system further includes an encryption and decryption virtual machine, and the encryption and decryption virtual machine A first association relationship between the hard disk image identifier and the key is recorded, the key includes an encryption key, and the second association relationship between the hard disk image identifier and the hard disk image attribute is recorded in the virtualization system,
  • the control device includes:
  • An obtaining unit configured to acquire data to be written by the user virtual machine
  • a processing unit configured to determine, according to the second association relationship, a hard disk mirroring attribute of the hard disk image of the user virtual machine to be written;
  • a sending unit configured to send the identifier of the hard disk image to be written and the data to be written to the encryption and decryption virtual machine when the hard disk image attribute determined by the determining unit is encrypted;
  • the obtaining unit is further configured to receive the encrypted data obtained by encrypting, by using the encryption key, the data to be written by the encryption/decryption virtual machine, where the encryption key is the encryption and decryption virtual machine An encryption key corresponding to the identifier of the hard disk image to be written determined according to the first association relationship;
  • a writing unit configured to write the encrypted data received by the acquiring unit into the hard disk image to be written.
  • the key further includes a decryption key
  • the obtaining unit is further configured to acquire a read request triggered by the user virtual machine
  • the processing unit is further configured to read data from the hard disk image to be read, and determine that the read data is encrypted data;
  • the sending unit is further configured to: when the processing unit determines that the read data is encrypted data, send a decryption request to the encryption and decryption virtual machine, where the decryption request carries an identifier of the user virtual machine, Reading the encrypted data and the identifier of the hard disk image;
  • the obtaining unit is further configured to receive the decrypted data returned by the encryption/decryption virtual machine, where the decrypted data is the encryption/decryption virtual machine includes the user in determining the first association relationship After the corresponding relationship between the identifier of the virtual machine and the identifier of the hard disk image is obtained, the encrypted data is decrypted by using a decryption key corresponding to the hard disk image identifier determined according to the first association relationship;
  • the sending unit is further configured to return the decrypted data received by the acquiring unit to the user virtual machine.
  • the sending unit is further configured to: when the processing unit determines that the read data is non-encrypted data And returning the read unencrypted data to the user virtual machine.
  • the acquiring unit is further configured to receive a virtual machine startup indication message sent by the virtual machine management module, where the virtual machine startup indication message carries the identifier of the activated user virtual machine, the hard disk image identifier of the activated user virtual machine, and Hard disk mirroring attribute;
  • the processing unit is further configured to record a hard disk image identifier of the activated user virtual machine and a hard disk image attribute thereof, and update the second association relationship.
  • the acquiring module is configured to obtain, by a device driver, a write request triggered by the user virtual machine, where the write request carries the to-be-written The data.
  • an embodiment of the present invention provides an encryption and decryption apparatus in a virtualization system, which is applied to a virtualization system, where the virtualization system includes the encryption and decryption apparatus, a VMM, and a system management module, where the VMM includes a virtual
  • the machine management module, the encryption and decryption device includes:
  • a receiving unit configured to receive a virtual machine creation indication message sent by the virtual machine management module, where the virtual machine creation indication message carries an identifier of the created user virtual machine, and a hard disk image identifier allocated to the created user virtual machine And the hard disk mirroring attribute corresponding to the allocated hard disk image identifier, where the virtual machine creation indication message is specifically that the virtual machine management module creates a user virtual machine and a hard disk image according to the virtual machine creation request sent by the system management module.
  • An execution unit configured to: after the receiving unit receives the virtual machine creation indication message, assign a key to the created hard disk image, establish an identifier of the created user virtual machine, the allocated hard disk image identifier, and the secret The first association between the keys;
  • a message returning unit configured to send a virtual machine creation response message to the system management module, where the virtual machine creation response message includes an identifier of the created user virtual machine.
  • the receiving unit is further configured to receive a hard disk image adding indication message sent by the virtual machine management module, where the hard disk image adding indication message carries the user virtual machine identifier, and the virtual machine management module is the user virtual The hard disk mirroring identifier and the hard disk mirroring attribute of the machine, wherein the hard disk mirroring instruction message is that the virtual machine management module creates a new hard disk for the user virtual machine according to the hard disk image adding request sent by the system management module. Sent after mirroring;
  • the execution unit is further configured to: after the receiving unit receives the hard disk image adding indication message, assign a key to the newly added hard disk image, and set the user virtual machine identifier and the newly added hard disk image identifier. And updating a key assigned to the newly added hard disk image to the first association relationship.
  • the receiving unit is further configured to receive an encryption request sent by the control module, where the encryption request carries an identifier of the user virtual machine, an identifier of a hard disk image to be written, and the data to be written;
  • the execution unit is further configured to determine whether the first association relationship includes a correspondence between the identifier of the user virtual machine and the identifier of the hard disk image to be written received by the receiving unit, and if yes, according to the execution relationship
  • the first association relationship determines an encryption key corresponding to the identifier of the hard disk image to be written, and encrypts the data to be written by using the encryption key to obtain encrypted data.
  • the message returning unit is further configured to: when the executing unit determines that the first association relationship does not include the correspondence between the identifier of the user virtual machine and the identifier of the hard disk image to be written, to the control module Returning an encryption failure indication, and when the execution unit determines that the first association relationship includes a correspondence between an identifier of the user virtual machine and an identifier of a hard disk image to be written, sending the encrypted data to the control Module.
  • the receiving unit is further configured to receive a decryption request sent by the control module, where the decryption request carries an identifier of the user virtual machine, the encrypted data that is read, and an identifier of the hard disk image;
  • the execution unit is further configured to determine whether the first association relationship includes a correspondence between the identifier of the user virtual machine and the identifier of the hard disk image received by the receiving unit, and if yes, from the Acquiring a decryption key corresponding to the identifier of the hard disk image in the first association relationship, and decrypting the read encrypted data by using the decryption key to obtain a solution Confidential data;
  • the message returning unit is further configured to send the obtained decrypted data to the control module.
  • an embodiment of the present invention provides a control device in a virtualization system, where the device includes a processor, a memory, a bus, and a communication interface.
  • the memory is configured to store a computer execution instruction
  • the processor is coupled to the memory via the bus, and when the path management device is running, the processor executes the computer execution instruction stored by the memory, To enable the control device in the virtualization system to perform the method of any of the second or third aspect.
  • the embodiment of the present invention provides a computer readable medium, comprising: computer execution instructions, when the processor of the computer executes the computer execution instruction, the computer performs any of the second aspect or the third aspect Said method.
  • a control module for encryption and decryption is added to the VMM.
  • the control module obtains data to be written by the user virtual machine, the control module determines according to the attribute of the hard disk image to be written. Whether to encrypt the data to be written, when the encryption is needed, the control module sends the data to be written to the encryption and decryption virtual machine, and the encryption and decryption virtual machine processes the data to be encrypted, and returns the encrypted data to The control module writes the encrypted data into the corresponding hard disk image to implement encrypted storage of the user data.
  • the control module in the VMM is used to determine whether the data to be written needs to be encrypted and to forward the data to be written, and the function is simple to implement, and the system complexity of the VMM is reduced, and at the same time, in the embodiment of the present invention,
  • the encryption and decryption processing is implemented by a special encryption and decryption virtual machine, which does not need to occupy resources in the VMM, avoids resource conflicts, and improves system stability; on the other hand, the encryption and decryption virtual machine can be directed to different user virtual machine hard disks.
  • the mirror allocates different keys, and provides or does not provide encryption and decryption services for data streams of different sources, thereby implementing access control of the user virtual machine.
  • 1 is a schematic diagram showing the structure of an encryption and decryption technology in an existing virtualization system
  • FIG. 2 is a schematic structural diagram of a virtual machine system according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of another virtual machine system according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a method for encrypting and decrypting in a virtual machine system according to an embodiment of the present invention
  • FIG. 5 is a schematic flowchart of a method for encrypting and decrypting in another virtual machine system according to an embodiment of the present invention
  • FIG. 6 is a schematic flowchart of a method for creating a user virtual machine according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a control device in a virtual machine system according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of an encryption and decryption apparatus in a virtualization system according to an embodiment of the present invention.
  • FIG. 9 is a schematic diagram showing the hardware configuration of a control device in a virtual machine system according to an embodiment of the present invention.
  • FIG. 2 is a schematic structural diagram of a virtualization system according to an embodiment of the present invention, including a VMM 11 and an encryption/decryption virtual machine 13, where the encryption and decryption virtual machine 13 records a first image between a hard disk image identifier and a key.
  • the association relationship, the key includes an encryption key, and the VMM 11 includes a control module 110, where the second association relationship between the hard disk image identifier and the hard disk image attribute is recorded in the virtualization system.
  • the user virtual machine 12 of Figure 2 writes data to the underlying hard disk image.
  • the control module 110 is configured to acquire data to be written by the user virtual machine 12, and determine, according to the second association relationship, a hard disk image attribute of the hard disk image to be written by the user virtual machine 12, if the determined location Sending the identifier of the hard disk image to be written and the data to be written to the encryption/decryption virtual machine 13;
  • the encryption/decryption virtual machine 13 is configured to determine an encryption key corresponding to the identifier of the hard disk image to be written according to the first association relationship, and encrypt the data to be written by using the encryption key. Obtaining encrypted data, and transmitting the encrypted data to the control module 110;
  • the control module 110 is further configured to write the encrypted data into the hard disk image to be written.
  • a control module for encryption and decryption is added to the VMM.
  • the control module obtains data to be written by the user virtual machine, the control module determines according to the attribute of the hard disk image to be written. Whether to encrypt the data to be written, when the encryption is needed, the control module sends the data to be written to the encryption and decryption virtual machine, and the encryption and decryption virtual machine processes the data to be encrypted, and returns the encrypted data to The control module writes the encrypted data into the corresponding hard disk image to implement encrypted storage of the user data.
  • the control module in the VMM is used.
  • the function is simple to implement, and the system complexity of the VMM is reduced.
  • the encryption and decryption processing in the embodiment of the present invention is specifically added. Decrypting the virtual machine to achieve the resources of the VMM, avoiding resource conflicts and improving system stability; on the other hand, the encryption and decryption virtual machine can allocate different keys for different user virtual machine hard disk mirrors, for different The source data stream, with or without encryption and decryption services, enables access control of the user's virtual machine.
  • the virtualized system further includes a system management module 14, in the VMM11.
  • a virtual machine management module 112 is further included.
  • the encryption and decryption virtual machine 13 is first established.
  • the specific encryption and decryption virtual machine 13 can be established by using the existing virtual machine.
  • the encryption and decryption processing shown includes key distribution and data encryption and decryption.
  • the encryption and decryption virtual machine 13 may be installed with various programs related to the encryption and decryption service, such as a rights management program, a key management program, and an encryption and decryption program, so that the encryption/decryption virtual machine 13 is dedicated to
  • the specific implementation form of the present invention is not limited.
  • the embodiment of the present invention further provides a process for the user virtual machine 12 to read data, and the key allocated by the encryption/decryption virtual machine 13 to the hard disk image of the user virtual machine 12 includes an encryption key and a decryption key.
  • the specific type of the key is not limited in the embodiment of the present invention.
  • the data is read from the hard disk image, triggering a read request, and the read request carries the data identifier to be read.
  • the device driver acquires the read request, and the device driver invokes the control module 110 to process the read request;
  • the control module 110 is further configured to acquire a read request triggered by the user virtual machine, read data from the hard disk image to be read, determine that the read data is encrypted data, and send and decrypt the virtual machine to the encrypted virtual machine. 13 sending a decryption request, where the decryption request carries the identifier of the user virtual machine, the encrypted data read, and the identifier of the hard disk image;
  • the encryption/decryption virtual machine 13 is further configured to receive the decryption request, and determine whether the first association relationship includes the identifier of the user virtual machine that sends the read request and the identifier of the hard disk image. And if yes, obtaining a decryption key corresponding to the identifier of the hard disk image from the first association relationship, decrypting the read encrypted data by using the decryption key, and sending the obtained decrypted data to The control module 110;
  • the control module 110 is further configured to return the decrypted data to the user virtual machine 12.
  • control module 110 is further configured to: when the read data is unencrypted data, return the read unencrypted data to the user virtual machine 12.
  • the encryption/decryption virtual machine 13 records the user virtual machine identifier, the hard disk image identifier, and the virtual machine 12 assigned to the user.
  • the first association relationship between the keys of the hard disk image, in the read flow and the write flow, the encryption/decryption virtual machine 13 may determine, according to the received encryption request or the decryption request, the encryption request or the decryption request.
  • the key of the hard disk image thus providing encryption and decryption processing.
  • the embodiment of the present invention further provides a manner of recording the first association relationship in the process of creating the user virtual machine 12: the system management module 14 is further configured to send to the virtual machine management module 112.
  • the virtual machine creation request carries the attribute of the hard disk image of the user virtual machine 12 to be created; the virtual machine management module 112 is further configured to receive the virtual machine creation request and create the user virtual machine 12 Creating a hard disk image for the created user virtual machine 12, assigning a hard disk image identifier, determining a hard disk image attribute corresponding to the allocated hard disk image identifier according to the virtual machine creation request, and sending a virtual to the encryption/decryption virtual machine 13
  • the machine creates an indication message, where the virtual machine creation indication message carries the identifier of the created user virtual machine 12, the allocated hard disk image identifier, and the hard disk image attribute corresponding to the allocated hard disk image identifier;
  • the virtual machine 13 is further configured to receive the virtual machine creation indication message, allocate a key for the created hard disk image, and establish The created identifier of the user virtual machine 12, the assigned hard disk image identifier, and the first association relationship between the keys.
  • the encryption and decryption virtual machine 13 is further configured to send a virtual machine creation response message to the system management module 14, where the virtual machine creation response message includes the identifier of the created user virtual machine 12.
  • control module 110 When the control module 110 provided by the embodiment of the present invention processes the write request or the read request initiated by the user virtual machine 12, it is necessary to determine whether the read/write operation involves data encryption and decryption processing, and when the data needs to be encrypted and decrypted, The data involved is sent to the encryption/decryption virtual machine 13.
  • the control module 110 determines, according to the foregoing second association relationship, whether the data needs to be encrypted and decrypted for the read/write operation.
  • the control module 110 may establish the foregoing second association relationship during the startup process of the user virtual machine 12, where the specific process includes: the system management module 14 is configured to send a virtual machine startup request to the virtual machine management module 112,
  • the virtual machine startup request carries the identifier of the user virtual machine 12 to be started.
  • the virtual machine management module 112 is configured to receive the virtual machine startup request, and start the user virtual machine 12 to be started according to the virtual machine startup request.
  • the hard disk image identifier of the user VM 12 and the hard disk image attribute of the user VM 12 are sent to the control module 110.
  • the control module 110 is further configured to receive and record the hard disk image identifier of the activated user virtual machine 12 and The hard disk mirroring attribute establishes the second association relationship.
  • system management module may be a cloud computing operating system management module.
  • a schematic flowchart of a method for encrypting and decrypting in a virtualization system includes:
  • Step 401 The system management module sends a virtual machine creation request to the virtual machine management module, where the virtual machine creation request is used to request to create a user virtual machine.
  • the system administrator sets the hard disk image attribute of the user VM to be created through the management interface, when the system manages
  • the module carries the hard disk image attribute of the user VM to be created when the virtual machine creation request is sent.
  • the system management module indicates, in the virtual machine creation request, that three hard disk images are created for the user virtual machine, and the hard disk image attribute of one hard disk image is encrypted.
  • Step 402 The virtual machine management module receives the virtual machine creation request, creates a user virtual machine, creates a hard disk image for the created user virtual machine, allocates a hard disk image identifier, and determines the allocated hard disk according to the virtual machine creation request.
  • the virtual machine management module allocates a virtual machine identifier to the user virtual machine, and configures information such as a memory, a CPU, and a network card.
  • the virtual machine management module allocates a hard disk image identifier for the created hard disk image, determines the hard disk image attribute of the created hard disk image according to the information carried in the virtual machine creation request, and connects the hard disk image to the user virtual machine.
  • the virtual machine management module creates three hard disk images for the created user virtual machine, and determines that the hard disk image attribute of one of the hard disk images is encrypted according to the creation request message.
  • Step 403 The virtual machine management module sends a virtual machine creation indication message to the encryption and decryption virtual machine, where the virtual machine creation indication message carries the identifier of the created user virtual machine, and the hard disk image identifier assigned to the created user virtual machine. Its hard disk mirroring attribute;
  • Step 404 The encryption and decryption virtual machine receives the virtual machine creation indication message, and allocates a key for the hard disk image of the user virtual machine, and records the user virtual machine identifier, the hard disk image identifier, and the key between the keys.
  • First association relationship
  • Step 405 The encryption and decryption virtual machine returns a virtual machine creation response message to the system management module, where the virtual machine creation response message carries the identifier of the created user virtual machine.
  • Step 406 When the system management module determines that the hard disk image is to be added to the user virtual machine, the system management module sends a hard disk image increase request to the virtual machine management module, where the hard disk image increase request message carries the user The attributes of the virtual machine ID and the newly added disk image;
  • the disk image addition request carries a disk image attribute, which is used to indicate whether the newly added disk image needs to be encrypted.
  • Step 407 The virtual machine management module receives the hard disk image addition request message, creates a new hard disk image for the user virtual machine, allocates a hard disk image identifier for the new hard disk image, and adds a request message setting according to the hard disk image. Describe the hard disk image attribute of the new hard disk image, and connect the new hard disk image to the user virtual machine as an additional hard disk image of the user virtual machine;
  • Step 408 The virtual machine management module sends the user virtual machine identifier, the identifier of the new hard disk image, and the hard disk image attribute of the new hard disk image to the encryption and decryption virtual machine.
  • Step 409 The encryption and decryption virtual machine allocates a key for the newly allocated hard disk image identifier, and updates the first association relationship to record the identifier of the user virtual machine and the hard disk image identifier of the new hard disk image. And the key Correspondence.
  • Step 410 The encryption and decryption virtual machine returns a hard disk image adding response message to the system management module, and carries the identifier of the user virtual machine and the identifier of the hard disk image added for the user virtual machine.
  • Step 411 The system management module sends a virtual machine startup request to the virtual machine management module, where the virtual machine startup request carries the identifier of the user virtual machine to be started.
  • Step 412 The virtual machine management module starts the user virtual machine, and connects the user virtual machine to the hard disk image.
  • Step 413 The virtual machine management module sends a virtual machine startup indication message to the control module, and sends the identifier of the activated user virtual machine, the identifier of the hard disk image belonging to the user virtual machine, and the corresponding hard disk mirroring attribute to the control.
  • Step 414 The control module records the identifier of the hard disk image and the hard disk mirroring attribute of the user virtual machine to be started, and establishes the second association relationship.
  • the identifier of the user VM to be started may also be included in the second association relationship.
  • Step 415 The control module sends a virtual machine startup response message to the system management module, and carries an identifier of the user virtual machine and an identifier of the hard disk image.
  • Step 416 The user virtual machine writes data to the hard disk image to trigger a write request, where the write request carries data to be written.
  • the device driver acquires the write request, and the device driver invokes the control module to process the write request.
  • the process of writing data to the hard disk image by the user virtual machine may be in the manner of the prior art, which is not limited by the embodiment of the present invention. It should be noted that, in the foregoing process of writing data, the device driver invokes the control module, so that the control module can determine the attribute of the hard disk image to be written, so that when the data to be written is encrypted.
  • the data to be written is forwarded to the encryption and decryption virtual machine to complete the encryption process of the data to be written. Specifically, as described in the following process.
  • Step 417 The control module acquires the write request, searches for the second association relationship, and determines, according to the second association relationship, a hard disk image attribute of the hard disk image to be written by the user virtual machine, if the determined location If the hard disk image attribute is encrypted, step 418 is performed. If the determined hard disk image attribute is not encrypted, the control module writes the data to be written by the device driver to the user virtual machine. In the hard disk image to be written.
  • Step 418 The control module sends an encryption request to the encryption and decryption virtual machine, where the encryption request carries the data to be written and an identifier, and the identifier is used to distinguish the data to be written.
  • the identifier includes an identifier of the hard disk image to be written and a hard disk mirroring attribute, and the identifier may further include an identifier of the user virtual machine to which the hard disk image belongs;
  • Step 419 The encryption/decryption virtual machine receives the encryption request, and determines the to-be-written according to the first association relationship. An encryption key corresponding to the identifier of the hard disk image, and the data to be written is encrypted by using the encryption key to obtain encrypted data;
  • the encryption/decryption virtual machine may perform rights management on the user virtual machine that initiates the write request, specifically, the encryption and decryption
  • the virtual machine queries the first association relationship, and determines whether the correspondence between the identifier of the virtual machine and the hard disk image identifier in the received identifier is recorded in the first association relationship, and if yes, the authentication is passed. Obtaining an encryption key corresponding to the hard disk image identifier. If not, the user virtual machine does not match the hard disk image, and the user virtual machine does not have the right to write data to the hard disk image.
  • the encryption and decryption virtual machine may include a key management module, and the key management module controls the key in the first association relationship.
  • Step 420 The encryption/decryption virtual machine returns encrypted data obtained by encrypting the data to be written to the control module.
  • Step 421 The control module invokes the device driver to write the encrypted data to a hard disk image of the user virtual machine.
  • Step 422 The user virtual machine reads data from the hard disk image, and triggers a read request, where the read request carries the data identifier to be read.
  • a read request is triggered, the device driver acquires the read request, and the device driver invokes the control module to process the read request.
  • Step 423 The control module invokes the function of the device driver to read data from the hard disk image of the user virtual machine. If the read data is encrypted data, step 424 is performed.
  • the device driver including the control module is loaded, and the control module is initialized at the same time.
  • the control module invokes an existing device driver function to address, reads the required data from the disk, and the device driver reads the required data from the disk.
  • the control module may have a device driving function calling capability.
  • the control module may determine whether the read data is encrypted data by determining whether the hard disk image attribute is encrypted. Specifically, if the attribute of the hard disk image to be read is encrypted, indicating that the data read by the control module is encrypted data, step 424 is performed to enable the encryption and decryption virtual machine to decrypt the read encrypted data; No, it indicates that the data read by the control module is non-encrypted data, and the control module directly returns the read data to the user virtual machine without decrypting.
  • Step 424 The control module sends a decryption request to the encryption and decryption virtual machine, where the decryption request carries the encrypted data, the identifier of the user virtual machine, and the identifier of the hard disk image;
  • Step 425 The encryption and decryption virtual machine queries the user virtual machine identifier and the hard disk image identifier according to the received The first association relationship acquires a decryption key of the hard disk image of the user virtual machine, and decrypts the encrypted data by using the decryption key to obtain a plaintext.
  • the encryption/decryption virtual machine searches for the corresponding relationship between the user virtual machine identifier and the hard disk image identifier, and determines whether the identifier of the hard disk image and the identifier of the virtual machine to which the hard disk image belongs are saved in the corresponding relationship. If yes, obtaining the decryption key corresponding to the recorded hard disk image identifier;
  • the key management module in the encryption and decryption virtual machine is configured to manage a decryption key corresponding to a hard disk image of each user virtual machine.
  • Step 426 The encryption and decryption virtual machine carries the decrypted plaintext in the decryption response and returns it to the control module.
  • Step 427 The control module returns the received plaintext obtained by the decryption to the user virtual machine.
  • steps 401-410 a process is created for the user virtual machine.
  • the encryption and decryption virtual machine records the first association relationship; and the steps 411-415 are a user virtual machine startup process.
  • the virtual machine management module sends the hard disk image identifier of the activated user virtual machine and the hard disk mirroring attribute to the control module, where the control module records the second association relationship; the steps 416-421 are the writing process, and the control module obtains When the data to be written of the user virtual machine is determined, the corresponding hard disk image attribute to be written is determined.
  • Steps 421-427 are read processes.
  • the control module acquires the read request triggered by the user virtual machine, if the read data is encrypted data, the encrypted data is forwarded to the encryption and decryption virtual machine for decryption, thereby obtaining the plaintext.
  • the embodiment of the present invention provides a method for performing data encryption and decryption in a virtual machine system.
  • the encryption and decryption process is performed by a dedicated encryption and decryption virtual machine, and the user virtual machine does not need to be changed or Install other auxiliary software; on the other hand, the encryption and decryption virtual machine is located outside the user's virtual machine, and can encrypt the non-system disk of the user virtual machine or the system disk of the user virtual machine.
  • the memory, CPU and other resources required for the encryption and decryption virtual machine can be dynamically allocated, thereby avoiding resource conflicts with the host operating system and the virtualization software, and improving the reliability of the host.
  • Sex. The open and defined ports on the encryption and decryption virtual machine limit the installation of other applications, and also help to further improve system security.
  • the watchdog technology, the dual-process technology, the hot standby technology to improve the reliability of the encryption and decryption virtual machine, and install anti-virus and anti-virus. Trojans, firewalls and other software improve security.
  • control module provided by the embodiment of the present invention can be installed in a device driver of the VMM, and the control module can invoke the function of the device driver, and can effectively provide encryption and decryption services for various types of hard disk images, and at the same time, Affects the construction, release, installation, or startup of a host software system.
  • control module can also be driven independently of the device. At this time, the control module has the capability of calling the device driving function.
  • the key allocated for the hard disk image can be stored in the encryption and decryption virtual machine, so that the key is not known to the host and the virtualization system, and the confidentiality is good.
  • the encryption and decryption virtual machine the user virtual machine identifier, the hard disk image identifier, and related user information are saved, and different keys can be assigned to the hard disk images of different user virtual machines, and the data streams are generated for different sources. Provide or not provide encryption and decryption services to achieve access control of user virtual machines.
  • the hard disk image may be a large file, a local partition, a local block device, a network block device provided by an internet small computer system interface (iSCSI) protocol, and a general Internet file system.
  • iSCSI internet small computer system interface
  • CIFS Common Internet File System
  • NFS Net File System
  • a schematic flowchart of a method for encrypting and decrypting in another virtualization system is applied to a virtualization system, where the virtualization system includes a virtual machine monitor VMM and an encryption and decryption virtual machine.
  • the VMM includes a control module, and the encryption and decryption virtual machine records a hard disk image identifier and a first association relationship between the keys, the key includes an encryption key, and the virtualized system records a hard disk image identifier and A second association relationship between the hard disk mirroring attributes, where the method includes:
  • Step 501 The control module acquires data to be written by the user virtual machine, and determines, according to the second association relationship, a hard disk image attribute of the hard disk image of the user virtual machine to be written, if the hard disk image is determined. Sending the identifier of the hard disk image to be written and the data to be written to the encryption and decryption virtual machine;
  • Step 502 The control module receives the encrypted data obtained by encrypting the data to be written by using the encryption key by the encryption and decryption virtual machine, where the encryption key is the encryption and decryption virtual machine according to the encryption and decryption virtual machine.
  • An encryption key corresponding to the identifier of the hard disk image to be written determined by the first association relationship;
  • Step 503 The control module writes the encrypted data into the hard disk image to be written.
  • a control module for adding and decrypting is added to the VMM.
  • the control module obtains data to be written by the user virtual machine, the control module determines whether the hard disk mirroring attribute is to be written. The data to be written needs to be encrypted.
  • the control module sends the data to be written to the encryption and decryption virtual machine, and the encryption and decryption virtual machine processes the data to be encrypted, and returns the encrypted data to the office.
  • the control module writes the encrypted data into the corresponding hard disk image to implement encrypted storage of the user data.
  • the control module in the VMM is used to determine whether the data to be written needs to be encrypted and to forward the data to be written, and the function is simple to implement, and the system complexity of the VMM is reduced, and at the same time, in the embodiment of the present invention,
  • the encryption and decryption processing is implemented by a special encryption and decryption virtual machine, which does not need to occupy resources in the VMM, avoids resource conflicts, and improves system stability; on the other hand, the encryption and decryption virtual machine can be directed to different user virtual machine hard disks. Mirrors assign different keys, for different streams of data, offer or The user does not provide encryption and decryption services, thereby achieving access control of the user virtual machine.
  • FIG. 6 a schematic flowchart of a method for creating a user virtual machine according to an embodiment of the present invention is applied to a virtualization system, where the virtualization system includes a VMM, a system management module, and an encryption and decryption virtual machine.
  • the virtual machine management module is included, and the method includes:
  • Step 601 The cryptographic virtual machine receives the virtual machine creation indication message sent by the virtual machine management module, where the virtual machine creation indication message carries the identifier of the created user virtual machine, and is allocated for the created user virtual machine.
  • Step 602 The encryption/decryption virtual machine allocates a key for the created hard disk image, and establishes an identifier of the created user virtual machine, the allocated hard disk image identifier, and a first association relationship between the keys.
  • Step 603 The encryption and decryption virtual machine sends a virtual machine creation response message to the system management module, where the virtual machine creation response message includes the identifier of the created user virtual machine.
  • the cryptographic virtual machine receives the hard disk image addition indication message sent by the virtual machine management module, where the hard disk image addition indication message carries the user virtual machine identifier, and the virtual machine management module is the user virtual machine new The hard disk mirroring identifier and the hard disk mirroring attribute thereof, wherein the hard disk mirroring instruction message is specifically configured by the virtual machine management module to create a new hard disk image for the user virtual machine according to the hard disk image adding request sent by the system management module.
  • the encryption/decryption virtual machine allocates a key to the newly added hard disk image, and updates the user virtual machine identifier, the newly added hard disk image identifier, and a key allocated for the newly added hard disk image to the The first relationship.
  • the virtual machine management module identifies the hard disk image that needs to provide the encryption and decryption service, and sends the user virtual machine identifier and the hard disk image identifier to the encryption and decryption virtual machine, and the encryption and decryption virtual machine allocates the confidentiality to the hard disk image. Key, and recording the first association relationship, so that the decryption virtual machine can perform encryption and decryption processing on the read and write data of the hard disk image by the user virtual machine.
  • FIG. 7 a schematic structural diagram of a control device in a virtual machine system according to an embodiment of the present invention, where the control device is located in a VMM of a virtualization system, the virtual
  • the encryption system further includes an encryption and decryption virtual machine, wherein the encryption and decryption virtual machine records a hard disk image identifier and a first association relationship between the keys, the key includes an encryption key, and the hard disk image is recorded in the virtualization system.
  • the control device includes:
  • the obtaining unit 701 is configured to acquire data to be written by the user virtual machine.
  • the processing unit 702 is configured to determine, according to the second association relationship, a hard disk image attribute of the hard disk image of the user virtual machine to be written;
  • the sending unit 703 is configured to: when the hard disk mirroring attribute determined by the processing unit 702 is encrypted, send the identifier of the hard disk image to be written and the data to be written to the encryption and decryption virtual machine;
  • the obtaining unit 701 is further configured to receive, by the encryption/decryption virtual machine, the encrypted data obtained by encrypting the data to be written by using the encryption key, where the encryption key is the encryption and decryption virtual An encryption key corresponding to the identifier of the hard disk image to be written determined by the first association relationship;
  • the writing unit 704 is configured to write the encrypted data received by the obtaining unit 701 into the hard disk image to be written.
  • the key further includes a decryption key
  • the obtaining unit 701 is further configured to acquire a read request triggered by the user virtual machine
  • the processing unit 702 is further configured to: read data from the hard disk image to be read, and determine that the read data is encrypted data;
  • the sending unit 703 is further configured to: when the processing unit 702 determines that the read data is encrypted data, send a decryption request to the encryption/decryption virtual machine, where the decryption request carries the user virtual machine Identifying, reading the encrypted data and the identifier of the hard disk image;
  • the obtaining unit 701 is further configured to receive the decrypted data returned by the encryption/decryption virtual machine, where the decrypted data is included in the first association relationship by the encryption/decryption virtual machine. After the corresponding relationship between the identifier of the user virtual machine and the identifier of the hard disk image is obtained, the encrypted data is decrypted by using a decryption key corresponding to the hard disk image identifier determined according to the first association relationship;
  • the sending unit 703 is further configured to return the decrypted data received by the acquiring unit 701 to the user virtual machine.
  • the sending unit 703 is further configured to: when the processing unit 702 determines that the read data is non-encrypted data, return the read non-encrypted data to the user virtual machine.
  • the obtaining unit 701 is further configured to receive a virtual machine startup indication message sent by the virtual machine management module, where the virtual machine startup indication message carries an identifier of the activated user virtual machine, a hard disk image identifier of the activated user virtual machine, and Its hard disk mirroring attribute;
  • the processing unit 702 is further configured to record a hard disk image identifier of the activated user virtual machine and a hard disk image attribute thereof, and update the second association relationship.
  • the obtaining module 701 is specifically configured to acquire, by the device driver, a write request triggered by the user virtual machine, where the write request carries the data to be written.
  • an embodiment of the present invention further provides a schematic structural diagram of an encryption and decryption apparatus in a virtualization system, which is applied to a virtualization system, where the virtualization system includes the a decryption device, a VMM, and a system management module, the VMM includes a virtual machine management module, and the encryption and decryption device includes:
  • the receiving unit 801 is configured to receive a virtual machine creation indication message sent by the virtual machine management module, where the virtual machine creation indication message carries the identifier of the created user virtual machine, and the hard disk image allocated for the created user virtual machine. And the hard disk mirroring attribute corresponding to the hard disk image identifier that is allocated, where the virtual machine creation indication message is specifically that the virtual machine management module creates a user virtual machine and a hard disk according to the virtual machine creation request sent by the system management module. Sent after mirroring;
  • the executing unit 802 is configured to: after the receiving unit 801 receives the virtual machine creation indication message, assign a key to the created hard disk image, establish an identifier of the created user virtual machine, the allocated hard disk image identifier, and the Determining a first association relationship between keys;
  • the message returning unit 803 is configured to send a virtual machine creation response message to the system management module, where the virtual machine creation response message includes the identifier of the created user virtual machine.
  • the receiving unit 801 is further configured to receive a hard disk image addition indication message sent by the virtual machine management module, where the hard disk image addition indication message carries the user virtual machine identifier, and the virtual machine management module is The hard disk mirroring identifier and the hard disk mirroring attribute of the user virtual machine are newly created by the virtual machine management module according to the hard disk image adding request sent by the system management module. Sent after the new hard disk image is sent;
  • the executing unit 802 is further configured to: after the receiving unit 701 receives the hard disk image adding indication message, assign a key to the newly added hard disk image, and identify the user virtual machine and the newly added hard disk.
  • the image identifier and the key assigned to the newly added hard disk image are updated to the first association relationship.
  • the VMM includes a control module
  • the receiving unit 801 is further configured to receive an encryption request sent by the control module, where the encryption request carries an identifier of the user virtual machine, an identifier of a hard disk image to be written, and the data to be written;
  • the execution unit 802 is further configured to determine whether the first association relationship includes the correspondence between the identifier of the user virtual machine received by the receiving unit 801 and the identifier of the hard disk image to be written, and if so, And determining, according to the first association relationship, an encryption key corresponding to the identifier of the hard disk image to be written, and encrypting the data to be written by using the encryption key to obtain encrypted data;
  • the message returning unit 803 is further configured to: when the executing unit 802 determines that the first association relationship does not include the correspondence between the identifier of the user virtual machine and the identifier of the hard disk image to be written,
  • the control module returns an encryption failure indication, and the execution unit determines that the first association relationship includes the identifier of the user virtual machine and the hard to be written
  • the encrypted data is sent to the control module when the correspondence of the identifiers of the disk images is performed.
  • the receiving unit 801 is further configured to receive a decryption request sent by the control module, where the decryption request carries an identifier of the user virtual machine, the encrypted data that is read, and an identifier of the hard disk image;
  • the execution unit 802 is further configured to determine whether the first association relationship includes a correspondence between the identifier of the user virtual machine and the identifier of the hard disk image received by the receiving unit 801, and if yes, Obtaining, in the first association relationship, a decryption key corresponding to the identifier of the hard disk image, and decrypting the read encrypted data by using the decryption key to obtain decrypted data;
  • the message returning unit is further configured to send the obtained decrypted data to the control module.
  • a control module for adding and decrypting is added to the VMM.
  • the control module obtains data to be written by the user virtual machine, the control module determines whether the hard disk mirroring attribute is to be written. The data to be written needs to be encrypted.
  • the control module sends the data to be written to the encryption and decryption virtual machine, and the encryption and decryption virtual machine processes the data to be encrypted, and returns the encrypted data to the office.
  • the control module writes the encrypted data into the corresponding hard disk image to implement encrypted storage of the user data.
  • the control module in the VMM is used to determine whether the data to be written needs to be encrypted and to forward the data to be written, and the function is simple to implement, and the system complexity of the VMM is reduced, and at the same time, in the embodiment of the present invention,
  • the encryption and decryption processing is implemented by a special encryption and decryption virtual machine, which does not need to occupy resources in the VMM, avoids resource conflicts, and improves system stability; on the other hand, the encryption and decryption virtual machine can be directed to different user virtual machine hard disks.
  • the mirror allocates different keys, and provides or does not provide encryption and decryption services for data streams of different sources, thereby implementing access control of the user virtual machine.
  • the control device includes at least one processor (eg, a CPU), at least one network interface. Or other communication interface, memory, and at least one communication bus for implementing connection communication between the various components of these above-described embodiments.
  • the processor is configured to execute an executable module stored in the memory to implement the functions of the components in the control module in the above embodiments.
  • the memory may include a high speed random access memory (RAM), and may also include a non-volatile memory such as at least one disk memory.
  • the communication connection between the control module and at least one other network element is implemented by at least one network interface (which may be wired or wireless), and an Internet, a wide area network, a local network, a metropolitan area network, or the like may be used.
  • program instructions are stored in a computer readable medium, including computer executed instructions, for execution by the processor of a computer, executing the instructions as described in any of the above embodiments
  • the method of encryption and decryption in a virtualized system may include the components indicated in the foregoing embodiments of the present invention. For the specific implementation of the components, reference may be made to the corresponding content in the foregoing embodiments of the present invention, and details are not described herein again.

Abstract

本发明实施例提供一种虚拟化系统中加解密的方法、装置和系统，包括虚拟机监视器VMM和加解密虚拟机，所述VMM包括控制模块，所述加解密虚拟机记录有硬盘镜像标识以及密钥之间的第一关联关系，所述密钥包括加密密钥，所述虚拟化系统中记录有硬盘镜像标识以及硬盘镜像属性之间的第二关联关系，VMM中的控制模块用于对是否待写入数据是否需要加密进行判断并进行待写入数据的转发，功能实现简单，降低了VMM的系统复杂度，同时，由于本发明实施例中的加解密处理是由专门的加解密虚拟机来实现，无需占用VMM中的资源，避免了资源冲突，提高了系统稳定性

Description

虚拟化系统中加解密的方法、装置和系统 技术领域
本发明涉及计算领域，尤其是涉及一种虚拟化系统中加解密的方法、装置和系统。
背景技术
云计算平台通过将各种互联的计算资源进行有效整合并实现多层次的虚拟化与抽象，可以有效地将大规模的计算资源以虚拟机(Virtual Machine，VM)的形式提供给用户。具体的，云计算主机中部署的虚拟化软件构成了虚拟机运行的环境，为虚拟机提供网络和存储等服务。用户的数据保存在虚拟机的虚拟硬盘中，虚拟硬盘的实际物理存储空间在存储服务器的硬盘阵列中，存储服务器把虚拟硬盘的存储空间组织成一个大文件或者大数据块，该大文件或大数据块被称为硬盘镜像。硬盘镜像是虚拟机数据的存储实体，表示虚拟机的磁盘或硬盘的内容按照扇区为单位组织起来的存储形态。云计算平台需要提供可靠的安全保障技术确保该硬盘镜像中用户数据安全，避免包含商业机密的用户隐私数据的泄露。
如图1所示，为现有虚拟化系统加解密技术实现结构示意图，为保证用户数据的安全性，设备映射和加密模块被包含在虚拟机监视器(Virtual Machine Monitor，VMM)中，用于将硬盘镜像映射为一个虚拟的块设备。硬盘镜像对用户虚拟机不可见，虚拟化软件将块设备连接到用户虚拟机，设备映射和加密模块可以感知用户虚拟机对该块设备的访问，对硬盘镜像中的被访问数据进行加密处理，从而实现对用户数据的保护。但是，云计算主机中可能存在成百上千个硬盘镜像，这些硬盘镜像包含很多类型，例如大文件、本地块设备、网络块设备等等，部分硬盘镜像需要加密，部分不需要加密，因此设备映射和加密模块需要分别进行识别和处理，从而导致该设备映射和加密模块实现复杂，对云计算的操作系统和稳定性带来很大影响。
发明内容
本发明的目的在于提供一种虚拟化系统中加解密的方法、装置和系统，以解决现有技术中由VMM中的设备映射和加密模块进行加解密处理带来的实现复杂、影响系统稳定性等问题。
第一方面，本发明实施例提供了一种虚拟化系统，包括虚拟机监视器VMM和加解密虚拟机，所述VMM包括控制模块，所述加解密虚拟机记录有硬盘镜像标识以及密钥之间的第一关联关系，所述密钥包括加密密钥，所述虚拟化系统中记录有硬盘镜像标识以及硬盘镜像属性之间的第二关联关系，
所述控制模块，用于获取用户虚拟机的待写入的数据，根据所述第二关联关系确定所述用户虚拟机的待写入的硬盘镜像的硬盘镜像属性，如果确定的所述硬盘镜像属性为加密，则向所述加解密虚拟机发送所述待写入的硬盘镜像的标识以及所述待写入的数据；
所述加解密虚拟机，用于根据所述第一关联关系确定所述待写入的硬盘镜像的标识对应的加密密钥，使用所述加密密钥对所述待写入的数据进行加密，获得加密数据，将所述加密数据发送给所述控制模块；
所述控制模块，还用于将所述加密数据写入到所述待写入的硬盘镜像中。
结合第一方面，在第一方面的第一种可能的实施方式中，所述第一关联关系还包括用户虚拟机标识，
所述控制模块，具体用于向所述加解密虚拟机发送所述用户虚拟机的标识、所述待写入的硬盘镜像的标识，以及待写入的数据；
所述加解密虚拟机，具体用于获取所述用户虚拟机的标识以及所述待写入的硬盘镜像标识，确定所述第一关联关系中是否包括所述用户虚拟机的标识与所述待写入的硬盘镜像标识的对应关系，如果否，则向所述控制模块返回加密失败指示，如果是，则使用确定的所述待写入的硬盘镜像标识对应的加密密钥对所述待写入的数据进行加密。
结合第一方面第一种可能的实施方式，在第一方面第二种可能的实施方式中，所述密钥还包括解密密钥，
所述控制模块，还用于获取所述用户虚拟机触发的读请求，从待读取的硬盘镜像中读取数据，确定读取的所述数据为加密数据，向所述加解密虚拟机发送解密请求，所述解密请求中携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
所述加解密虚拟机，还用于接收所述解密请求，确定所述第一关联关系中是否包括所述发送所述读请求的用户虚拟机的标识和所述硬盘镜像的标识的对应关系，如果是，则从所述第一关联关系中获取所述硬盘镜像的标识对应的解密密钥，使用所述解密密钥解密读取的所述加密数据，将获得的解密后的数据发送给所述控制模块；
所述控制模块，还用于将所述解密后的数据返回给所述用户虚拟机。
结合第一方面第二种可能的实施方式，在第一方面第三种可能的实施方式中，
所述控制模块，还用于确定读取的所述数据为非加密数据时，将读取的所述非加密数据返回给所述用户虚拟机。
结合第一方面第一种至第三种任一可能的实施方式，在第一方面第四种可能的实施方式中，所述系统还包括系统管理模块以及虚拟机管理模块，
所述系统管理模块，用于向所述虚拟机管理模块发送虚拟机启动请求，所述虚拟机启动 请求携带待启动的用户虚拟机的标识；
所述虚拟机管理模块，用于接收所述虚拟机启动请求，根据所述虚拟机启动请求启动所述待启动的用户虚拟机，将启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性发送给所述控制模块；
所述控制模块，还用于接收并记录所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性，建立所述第二关联关系。
结合第一方面第一种至第四种任一可能的实施方式，在第一方面第五种可能的实施方式中，所述系统还包括系统管理模块以及虚拟机管理模块，
所述系统管理模块，还用于向所述虚拟机管理模块发送虚拟机创建请求，所述虚拟机创建请求中携带待创建的用户虚拟机的硬盘镜像的属性；
所述虚拟机管理模块，还用于接收所述虚拟机创建请求，创建用户虚拟机，为创建的所述用户虚拟机创建硬盘镜像，分配硬盘镜像标识，根据所述虚拟机创建请求确定分配的所述硬盘镜像标识对应的硬盘镜像属性，向所述加解密虚拟机发送虚拟机创建指示消息，所述虚拟机创建指示消息中携带创建的用户虚拟机的标识、所述分配的硬盘镜像标识以及所述分配的所述硬盘镜像标识对应的硬盘镜像属性；
所述加解密虚拟机，还用于接收所述虚拟机创建指示消息，为创建的硬盘镜像分配密钥，建立所述创建的用户虚拟机的标识、所述分配的硬盘镜像标识以及所述密钥之间的所述第一关联关系。
结合第一方面第五种可能的实施方式，在第一方面第六种可能的实施方式中，
所述加解密虚拟机，还用于向所述系统管理模块发送虚拟机创建响应消息，所述虚拟机创建响应消息中包括所述创建的用户虚拟机的标识。
结合第一方面第五种可能的实施方式，在第一方面第七种可能的实施方式中，
所述系统管理模块，还用于向所述虚拟机管理模块发送硬盘镜像增加请求消息，所述硬盘镜像增加请求消息中携带所述用户虚拟机标识和新增的盘镜像的属性；
所述虚拟机管理模块，还用于接收所述硬盘镜像增加请求消息，为所述用户虚拟机创建新的硬盘镜像，根据所述硬盘镜像增加请求消息确定所述新的硬盘镜像的硬盘镜像属性，将所述用户虚拟机标识、所述新的硬盘镜像的标识以及所述新的硬盘镜像的硬盘镜像属性发送给所述加解密虚拟机；
所述加解密虚拟机，还用于为所述新的硬盘镜像分配密钥，更新所述第一关联关系。
结合第一方面，在第一方面第八种可能的实施方式中，所述控制模块，具体用于从设备驱动获取所述用户虚拟机触发的写请求，所述写请求携带所述待写入的数据。
结合第一方面，在第一方面第九种可能的实施方式中，所述密钥还包括解密密钥，
所述控制模块，还用于获取所述用户虚拟机触发的读请求，从待读取的硬盘镜像中读取数据，确定读取的所述数据为加密数据，向所述加解密虚拟机发送解密请求，所述解密请求中携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
所述加解密虚拟机，还用于接收所述解密请求，根据所述第一关联关系，确定所述硬盘镜像的标识对应的解密密钥，使用所述解密密钥解密所述加密数据，将获得的解密后的数据发送给所述控制模块；
所述控制模块，还用于将所述解密后的数据返回给所述用户虚拟机。
结合第一方面或第一方面第九种可能的实施方式，在第一方面第十种可能的实施方式中，所述系统还包括系统管理模块以及虚拟机管理模块，
所述系统管理模块，用于向所述虚拟机管理模块发送虚拟机启动请求，所述虚拟机启动请求携带待启动的用户虚拟机的标识；
所述虚拟机管理模块，用于接收所述虚拟机启动请求，根据所述虚拟机启动请求启动所述待启动的用户虚拟机，将启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性发送给所述控制模块；
所述控制模块，还用于接收并记录所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性，建立所述第二关联关系。
结合第一方面、第一方面第九种或第一方面第十种可能的实施方式，在第一方面第十一种可能的实施方式中，所述系统还包括系统管理模块以及虚拟机管理模块，
所述系统管理模块，还用于向所述虚拟机管理模块发送虚拟机创建请求，所述虚拟机创建请求中携带待创建的用户虚拟机的硬盘镜像的属性；
所述虚拟机管理模块，还用于接收所述虚拟机创建请求，创建用户虚拟机，为创建的所述用户虚拟机创建硬盘镜像，分配硬盘镜像标识，根据所述虚拟机创建请求确定分配的所述硬盘镜像标识对应的硬盘镜像属性，向所述加解密虚拟机发送虚拟机创建指示消息，所述虚拟机创建指示消息中携带所述分配的硬盘镜像标识以及所述分配的所述硬盘镜像标识对应的硬盘镜像属性；
所述加解密虚拟机，还用于接收所述虚拟机创建指示消息，为所述硬盘镜像标识分配密钥，建立所述硬盘镜像标识以及所述密钥之间的所述第一关联关系。
结合第一方面第十一种可能的实施方式，在第一方面第十二种可能的实施方式中，
所述系统管理模块，还用于向所述虚拟机管理模块发送硬盘镜像增加请求消息，所述硬盘镜像增加请求消息中携带所述用户虚拟机标识和新增的盘镜像的属性；
所述虚拟机管理模块，还用于接收所述硬盘镜像增加请求消息，为所述用户虚拟机创建新的硬盘镜像，确定所述新的硬盘镜像的硬盘镜像属性，将所述新的硬盘镜像的标识以及所述新的硬盘镜像的硬盘镜像属性发送给所述加解密虚拟机；
所述加解密虚拟机，还用于为所述新的硬盘镜像分配密钥，更新所述第一关联关系。
第二方面，本发明实施例提供了一种虚拟化系统中加解密的方法，应用于虚拟化系统，所述虚拟化系统包括虚拟机监视器VMM和加解密虚拟机，所述VMM包括控制模块，所述加解密虚拟机记录有硬盘镜像标识以及密钥之间的第一关联关系，所述密钥包括加密密钥，所述虚拟化系统中记录有硬盘镜像标识以及硬盘镜像属性之间的第二关联关系，所述方法包括：
所述控制模块获取用户虚拟机的待写入的数据，根据所述第二关联关系确定所述用户虚拟机的待写入的硬盘镜像的硬盘镜像属性，如果确定的所述硬盘镜像属性为加密，则向所述加解密虚拟机发送所述待写入的硬盘镜像的标识以及所述待写入的数据；
所述控制模块接收所述加解密虚拟机使用所述加密密钥对所述待写入的数据进行加密获得的加密数据，其中，所述加密密钥为所述加解密虚拟机根据所述第一关联关系确定的所述待写入的硬盘镜像的标识对应的加密密钥；
所述控制模块将所述加密数据写入到所述待写入的硬盘镜像中。
结合第二方面，在第二方面第一种可能的实施方式中，所述第一关联关系中还包括用户虚拟机标识，所述密钥还包括解密密钥，所述方法还包括：
所述控制模块获取所述用户虚拟机触发的读请求，从待读取的硬盘镜像中读取数据，确定读取的所述数据为加密数据，向所述加解密虚拟机发送解密请求，所述解密请求中携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
所述控制模块接收所述加解密虚拟机返回的解密后的数据，其中，所述解密后的数据为所述加解密虚拟机在确定所述第一关联关系中包括所述用户虚拟机的标识和所述硬盘镜像的标识的对应关系后，使用根据所述第一关联关系确定的所述硬盘镜像标识对应的解密密钥对所述加密数据进行解密获得的；
所述控制模块将所述解密后的数据返回给所述用户虚拟机。
结合第二方面第一种可能的实施方式，在第二方面第二种可能的实施方式中，
所述控制模块在确定读取的所述数据为非加密数据时，将读取的所述非加密数据返回给所述用户虚拟机。
结合第二方面，在第二方面第三种可能的实施方式中，所述系统还包括虚拟机管理模块，所述方法还包括：
所述控制模块接收虚拟机管理模块发送的虚拟机启动指示消息，所述虚拟机启动指示消息携带启动的用户虚拟机的标识、所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性；
所述控制模块记录所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性，更新所述第二关联关系。
结合第二方面，在第二方面第四种可能的实施方式中，所述控制模块获取用户虚拟机的待写入的数据包括：
所述控制模块从设备驱动获取所述用户虚拟机触发的写请求，所述写请求携带所述待写入的数据。
第三方面，本发明实施例提供了一种用户虚拟机的创建方法，应用于虚拟化系统，所述虚拟化系统包括VMM、系统管理模块以及加解密虚拟机，所述VMM包括虚拟机管理模块，所述方法包括：
所述加解密虚拟机接收所述虚拟机管理模块发送的虚拟机创建指示消息，所述虚拟机创建指示消息中携带创建的用户虚拟机的标识、为所述创建的用户虚拟机分配的硬盘镜像标识以及所述分配的所述硬盘镜像标识对应的硬盘镜像属性，所述虚拟机创建指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的虚拟机创建请求创建用户虚拟机以及硬盘镜像后发送的；
所述加解密虚拟机为创建的硬盘镜像分配密钥，建立所述创建的用户虚拟机的标识、所述分配的硬盘镜像标识以及所述密钥之间的第一关联关系；
所述加解密虚拟机向所述系统管理模块发送虚拟机创建响应消息，所述虚拟机创建响应消息中包括所述创建的用户虚拟机的标识。
结合第三方面，在第三方面第一种可能的实施方式中，
所述加解密虚拟机接收所述虚拟机管理模块发送的硬盘镜像增加指示消息，所述硬盘镜像增加指示消息中携带所述用户虚拟机标识、所述虚拟机管理模块为所述用户虚拟机新增的硬盘镜像标识及其硬盘镜像属性，所述硬盘镜像指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的硬盘镜像增加请求为所述用户虚拟机创建新增的硬盘镜像后发送的；
所述加解密虚拟机为所述新增的硬盘镜像分配密钥，将所述用户虚拟机标识、新增的硬盘镜像标识，以及为所述新增的硬盘镜像分配的密钥更新至所述第一关联关系。
结合第三方面，在第三方面第二种可能的实施方式中，
所述VMM中包括控制模块，所述方法还包括：
所述加解密虚拟机接收所述控制模块发送的加密请求，所述加密请求携带所述用户虚拟机的标识、待写入的硬盘镜像的标识以及所述待写入的数据，确定所述第一关联关系中是否包括所述用户虚拟机的标识和待写入的硬盘镜像的标识的对应关系，如果否，则向所述控制模块返回加密失败指示，如果是，则根据所述第一关联关系确定所述待写入的硬盘镜像的标识对应的加密密钥，使用所述加密密钥对所述待写入的数据进行加密，获得加密数据，将所述加密数据发送给所述控制模块，以使得所述控制模块将所述加密数据写入到所述待写入的硬盘镜像中。
结合第三方面第二种可能的实施方式，在第三方面第三种可能的实施方式中，还包括：所述加解密虚拟机接收所述控制模块发送的解密请求，所述解密请求携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识，确定所述第一关联关系中是否包括所述用户虚拟机的标识和所述硬盘镜像的标识的对应关系，如果是，则从所述第一关联关系中获取所述硬盘镜像的标识对应的解密密钥，使用所述解密密钥解密读取的所述加密数据，将获得的解密后的数据发送给所述控制模块，以使得所述控制模块将所述解密后的数据返回给所述用户虚拟机。
第四方面，本发明实施例提供了一种虚拟化系统中的控制装置，所述控制装置位于虚拟化系统的VMM中，所述虚拟化系统还包括加解密虚拟机，所述加解密虚拟机记录有硬盘镜像标识以及密钥之间的第一关联关系，所述密钥包括加密密钥，所述虚拟化系统中记录有硬盘镜像标识以及硬盘镜像属性之间的第二关联关系，所述控制装置包括：
获取单元，用于获取用户虚拟机的待写入的数据；
处理单元，用于根据所述第二关联关系确定所述用户虚拟机的待写入的硬盘镜像的硬盘镜像属性；
发送单元，用于当所述确定单元确定的所述硬盘镜像属性为加密时，向所述加解密虚拟机发送所述待写入的硬盘镜像的标识以及所述待写入的数据；
所述获取单元，还用于接收所述加解密虚拟机使用所述加密密钥对所述待写入的数据进行加密获得的加密数据，其中，所述加密密钥为所述加解密虚拟机根据所述第一关联关系确定的所述待写入的硬盘镜像的标识对应的加密密钥；
写入单元，用于将所述获取单元接收到的所述加密数据写入到所述待写入的硬盘镜像中。
结合第四方面，在第四方面第一种可能的实施方式中，所述密钥还包括解密密钥，
所述获取单元，还用于获取所述用户虚拟机触发的读请求；
所述处理单元，还用于从待读取的硬盘镜像中读取数据，确定读取的所述数据为加密数据；
所述发送单元，还用于在所述处理单元确定读取的所述数据为加密数据时，向所述加解密虚拟机发送解密请求，所述解密请求中携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
所述获取单元，还用于接收所述加解密虚拟机返回的解密后的数据，其中，所述解密后的数据为所述加解密虚拟机在确定所述第一关联关系中包括所述用户虚拟机的标识和所述硬盘镜像的标识的对应关系后，使用根据所述第一关联关系确定的所述硬盘镜像标识对应的解密密钥对所述加密数据进行解密获得的；
所述发送单元，还用于将所述获取单元接收到的所述解密后的数据返回给所述用户虚拟机。
结合第四方面第一种可能的实施方式，在第四方面第二种可能的实施方式中，所述发送单元，还用于在所述处理单元确定读取的所述数据为非加密数据时，将读取的所述非加密数据返回给所述用户虚拟机。
结合第四方面，在第四方面第三种可能的实施方式中，
所述获取单元，还用于接收虚拟机管理模块发送的虚拟机启动指示消息，所述虚拟机启动指示消息携带启动的用户虚拟机的标识、所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性；
所述处理单元，还用于记录所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性，更新所述第二关联关系。
结合第四方面，在第四方面第四种可能的实施方式中，所述获取模块，具体用于从设备驱动获取所述用户虚拟机触发的写请求，所述写请求携带所述待写入的数据。
第五方面，本发明实施例提供了一种虚拟化系统中的加解密装置，应用于虚拟化系统，所述虚拟化系统包括所述加解密装置、VMM以及系统管理模块，所述VMM包括虚拟机管理模块，所述加解密装置包括：
接收单元，用于接收所述虚拟机管理模块发送的虚拟机创建指示消息，所述虚拟机创建指示消息中携带创建的用户虚拟机的标识、为所述创建的用户虚拟机分配的硬盘镜像标识以及所述分配的所述硬盘镜像标识对应的硬盘镜像属性，所述虚拟机创建指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的虚拟机创建请求创建用户虚拟机以及硬盘镜像后发送的；
执行单元，用于在接收单元接收到所述虚拟机创建指示消息后，为创建的硬盘镜像分配密钥，建立所述创建的用户虚拟机的标识、所述分配的硬盘镜像标识以及所述密钥之间的第一关联关系；
消息返回单元，用于向所述系统管理模块发送虚拟机创建响应消息，所述虚拟机创建响应消息中包括所述创建的用户虚拟机的标识。
结合第五方面，在第五方面第一种可能的实施方式中，
所述接收单元，还用于接收所述虚拟机管理模块发送的硬盘镜像增加指示消息，所述硬盘镜像增加指示消息中携带所述用户虚拟机标识、所述虚拟机管理模块为所述用户虚拟机新增的硬盘镜像标识及其硬盘镜像属性，所述硬盘镜像指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的硬盘镜像增加请求为所述用户虚拟机创建新增的硬盘镜像后发送的；
所述执行单元，还用于在所述接收单元接收到所述硬盘镜像增加指示消息后，为所述新增的硬盘镜像分配密钥，将所述用户虚拟机标识、新增的硬盘镜像标识，以及为所述新增的硬盘镜像分配的密钥更新至所述第一关联关系。
结合第五方面，在第五方面第二种可能的实施方式中，
所述接收单元，还用于接收所述控制模块发送的加密请求，所述加密请求携带所述用户虚拟机的标识、待写入的硬盘镜像的标识以及所述待写入的数据；
所述执行单元，还用于确定所述第一关联关系中是否包括所述接收单元接收到的所述用户虚拟机的标识和待写入的硬盘镜像的标识的对应关系，如果是，则根据所述第一关联关系确定所述待写入的硬盘镜像的标识对应的加密密钥，使用所述加密密钥对所述待写入的数据进行加密，获得加密数据；
所述消息返回单元，还用于在所述执行单元确定所述第一关联关系中不包括所述用户虚拟机的标识和待写入的硬盘镜像的标识的对应关系时，向所述控制模块返回加密失败指示，在所述执行单元确定所述第一关联关系中包括所述用户虚拟机的标识和待写入的硬盘镜像的标识的对应关系时，将所述加密数据发送给所述控制模块。
结合第五方面第二种可能的实施方式，在第五方面第三种可能的实施方式中，
所述接收单元，还用于接收所述控制模块发送的解密请求，所述解密请求携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
所述执行单元，还用于确定所述第一关联关系中是否包括所述接收单元接收到的所述用户虚拟机的标识和所述硬盘镜像的标识的对应关系，如果是，则从所述第一关联关系中获取所述硬盘镜像的标识对应的解密密钥，使用所述解密密钥解密读取的所述加密数据，获得解 密后的数据；
所述消息返回单元，还用于将获得的解密后的数据发送给所述控制模块。
第六方面，本发明实施例提供了一种虚拟化系统中的控制装置，所述装置包括处理器、存储器、总线和通信接口，
所述存储器用于存储计算机执行指令，所述处理器与所述存储器通过所述总线连接，当所述路径管理的装置运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述虚拟化系统中的控制装置执行第二方面或第三方面中任一所述的方法。
第七方面，本发明实施例提供了一种计算机可读介质，包括计算机执行指令，以供计算机的处理器执行所述计算机执行指令时，所述计算机执行第二方面或第三方面中任一所述的方法。
本发明实施例中，在VMM中新增了加解密的控制模块，当所述控制模块获取到用户虚拟机的待写入的数据时，所述控制模块根据待写入的硬盘镜像的属性确定是否需要对待写入的数据进行加密，当需要进行加密时，所述控制模块将待写入数据发送到加解密虚拟机，由加解密虚拟机对待写入数据进行加密处理，并返还加密数据给所述控制模块，所述控制模块将加密数据写入对应的硬盘镜像中，实现用户数据的加密存储。一方面，VMM中的控制模块用于对是否待写入数据是否需要加密进行判断并进行待写入数据的转发，功能实现简单，降低了VMM的系统复杂度，同时，由于本发明实施例中的加解密处理是由专门的加解密虚拟机来实现，无需占用VMM中的资源，避免了资源冲突，提高了系统稳定性；另一方面，加解密虚拟机可以针对不同的用户虚拟机的硬盘镜像分配不同的密钥，针对不同来源的数据流，提供或者不提供加解密服务，从而实现了用户虚拟机的访问权限控制。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是现有虚拟化系统中加解密技术实现结构示意图；
图2是本发明实施例提供的一种虚拟机系统结构示意图；
图3是本发明实施例提供的另一种虚拟机系统结构示意图；
图4是本发明实施例提供的一种虚拟机系统中加解密的方法流程示意图；
图5是本发明实施例提供的另一种虚拟机系统中加解密的方法流程示意图；
图6是本发明实施例提供的一种用户虚拟机的创建方法流程示意图；
图7是本发明实施例提供的一种虚拟机系统中的控制装置结构示意图；
图8是本发明实施例提供的一种虚拟化系统中的加解密装置结构示意图；
图9是本发明实施例提供的一种虚拟机化系统中控制装置的硬件构成示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
如图2所示，为本发明实施例提供的一种虚拟化系统结构示意图，包括VMM11和加解密虚拟机13，所述加解密虚拟机13记录有硬盘镜像标识以及密钥之间的第一关联关系，所述密钥包括加密密钥，所述VMM11包括控制模块110，所述虚拟化系统中记录有硬盘镜像标识以及硬盘镜像属性之间的第二关联关系。与前述虚拟化系统中的各部件相配合，图2中的用户虚拟机12向其下的硬盘镜像写入数据。
所述控制模块110，用于获取用户虚拟机12的待写入的数据，根据所述第二关联关系确定所述用户虚拟机12的待写入的硬盘镜像的硬盘镜像属性，如果确定的所述硬盘镜像属性为加密，则向所述加解密虚拟机13发送所述待写入的硬盘镜像的标识以及所述待写入的数据；
所述加解密虚拟机13，用于根据所述第一关联关系确定所述待写入的硬盘镜像的标识对应的加密密钥，使用所述加密密钥对所述待写入的数据进行加密，获得加密数据，将所述加密数据发送给所述控制模块110；
所述控制模块110，还用于将所述加密数据写入到所述待写入的硬盘镜像中。
本发明实施例中，在VMM中新增了加解密的控制模块，当所述控制模块获取到用户虚拟机的待写入的数据时，所述控制模块根据待写入的硬盘镜像的属性确定是否需要对待写入的数据进行加密，当需要进行加密时，所述控制模块将待写入数据发送到加解密虚拟机，由加解密虚拟机对待写入数据进行加密处理，并返还加密数据给所述控制模块，所述控制模块将加密数据写入对应的硬盘镜像中，实现用户数据的加密存储。一方面，VMM中的控制模块用 于对是否待写入数据是否需要加密进行判断并进行待写入数据的转发，功能实现简单，降低了VMM的系统复杂度，同时，由于本发明实施例中的加解密处理是由专门的加解密虚拟机来实现，无需占用VMM中的资源，避免了资源冲突，提高了系统稳定性；另一方面，加解密虚拟机可以针对不同的用户虚拟机的硬盘镜像分配不同的密钥，针对不同来源的数据流，提供或者不提供加解密服务，从而实现了用户虚拟机的访问权限控制。
更进一步的，在一种具体的实施场景中，如图3所示，为本发明实施例提供的另一种虚拟交互系统结构示意图，虚拟机化系统进一步包括系统管理模块14，所述VMM11中进一步包括虚拟机管理模块112。
在本发明实施例中，首先建立加解密虚拟机13，具体的加解密虚拟机13建立方式可以采用现有的虚拟机建立方式，不同之处在于，新建的加解密虚拟机13专门负责进行加解密处理，所示加解密处理包括密钥分配及数据加解密。在一种具体的应用场景中，加解密虚拟机13中可以安装权限管理程序、密钥管理程序以及加解密程序等等与加解密服务相关的各种程序，从而使得加解密虚拟机13专用于加解密处理，本发明对具体的实现形式并不进行限定。
与前述流程相对应，本发明实施例还提供了用户虚拟机12读数据的流程，前述加解密虚拟机13为用户虚拟机12的硬盘镜像分配的密钥包括加密密钥和解密密钥，对于密钥具体的类型本发明实施例并不进行限定。
当用户虚拟机12需要从硬盘镜像中读取数据时，从硬盘镜像中读取数据，触发读请求，所述读请求携带待读取数据标识。设备驱动获取所述读请求，所述设备驱动调用控制模块110处理所述读请求；
所述控制模块110，还用于获取所述用户虚拟机触发的读请求，从待读取的硬盘镜像中读取数据，确定读取的所述数据为加密数据，向所述加解密虚拟机13发送解密请求，所述解密请求中携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；；
所述加解密虚拟机13，还用于接收所述解密请求，确定所述第一关联关系中是否包括所述发送所述读请求的用户虚拟机的标识和所述硬盘镜像的标识的对应关系，如果是，则从所述第一关联关系中获取所述硬盘镜像的标识对应的解密密钥，使用所述解密密钥解密读取的所述加密数据，将获得的解密后的数据发送给所述控制模块110；
所述控制模块110，还用于将所述解密后的数据返回给所述用户虚拟机12。
另一方面，所述控制模块110，还用于确定读取的所述数据为非加密数据时，将读取的所述非加密数据返回给所述用户虚拟机12。
加解密虚拟机13记录有用户虚拟机标识、硬盘镜像标识以及分配给所述用户虚拟机12 的所述硬盘镜像的密钥三者之间的第一关联关系，在读流程和写流程中，加解密虚拟机13可以根据接收到的加密请求或解密请求确定所述加密请求或解密请求针对的硬盘镜像的密钥，从而提供加解密处理。进一步的，如下述方式，本发明实施例还提供了在用户虚拟机12创建过程中记录上述第一关联关系的方式：所述系统管理模块14，还用于向所述虚拟机管理模块112发送虚拟机创建请求，所述虚拟机创建请求中携带待创建的用户虚拟机12的硬盘镜像的属性；所述虚拟机管理模块112，还用于接收所述虚拟机创建请求，创建用户虚拟机12，为创建的所述用户虚拟机12创建硬盘镜像，分配硬盘镜像标识，根据所述虚拟机创建请求确定分配的所述硬盘镜像标识对应的硬盘镜像属性，向所述加解密虚拟机13发送虚拟机创建指示消息，所述虚拟机创建指示消息中携带创建的用户虚拟机12的标识、所述分配的硬盘镜像标识以及所述分配的所述硬盘镜像标识对应的硬盘镜像属性；所述加解密虚拟机13，还用于接收所述虚拟机创建指示消息，为创建的硬盘镜像分配密钥，建立所述创建的用户虚拟机12的标识、所述分配的硬盘镜像标识以及所述密钥之间的所述第一关联关系。
所述加解密虚拟机13，还用于向所述系统管理模块14发送虚拟机创建响应消息，所述虚拟机创建响应消息中包括所述创建的用户虚拟机12的标识。
本发明实施例提供的控制模块110处理用户虚拟机12发起的写请求或读请求时，需要判断读写操作涉及到数据是否需要进行加解密处理，当需要对上述数据进行加解密处理时，将涉及到的数据发送给加解密虚拟机13。其中，控制模块110根据前述第二关联关系判断是否需要对读写操作涉及到数据进行加解密处理。所述控制模块110可以在用户虚拟机12启动过程中建立上述第二关联关系，具体流程包括：所述系统管理模块14，用于向所述虚拟机管理模块112发送虚拟机启动请求，所述虚拟机启动请求携带待启动的用户虚拟机12的标识；所述虚拟机管理模块112，用于接收所述虚拟机启动请求，根据所述虚拟机启动请求启动所述待启动的用户虚拟机12，将启动的用户虚拟机12的硬盘镜像标识及其硬盘镜像属性发送给所述控制模块110；所述控制模块110，还用于接收并记录所述启动的用户虚拟机12的硬盘镜像标识及其硬盘镜像属性，建立所述第二关联关系。
需要说明的是，在一种具体的实施场景中，所述系统管理模块具体可以为云计算操作系统管理模块。
结合图3所示的系统结构，如图4所示，为本发明实施例提供的一种虚拟化系统中加解密的方法流程示意图，包括：
步骤401：系统管理模块发送虚拟机创建请求到虚拟机管理模块，所述虚拟机创建请求用于请求创建用户虚拟机；
具体的，系统管理员通过管理界面设置待创建用户虚拟机的硬盘镜像属性，当系统管理 模块发送所述虚拟机创建请求时携带待创建的用户虚拟机的硬盘镜像属性。例如，所述系统管理模块在所述虚拟机创建请求中指示，为用户虚拟机创建3个硬盘镜像，其中1个硬盘镜像的硬盘镜像属性为加密。
步骤402：虚拟机管理模块接收所述虚拟机创建请求，创建用户虚拟机，为创建的所述用户虚拟机创建硬盘镜像，分配硬盘镜像标识，根据所述虚拟机创建请求确定分配的所述硬盘镜像标识对应的硬盘镜像属性；
具体的，虚拟机管理模块在创建用户虚拟机时，为用户虚拟机分配虚拟机标识，配置内存、CPU和网卡等信息。虚拟机管理模块为创建的硬盘镜像分配硬盘镜像标识，根据所述虚拟机创建请求携带的信息确定创建的硬盘镜像的硬盘镜像属性，并将所述硬盘镜像连接到所述用户虚拟机。例如，虚拟机管理模块为创建的用户虚拟机创建3个硬盘镜像，根据所述创建请求消息确定其中1个硬盘镜像的硬盘镜像属性为加密。
步骤403：虚拟机管理模块向加解密虚拟机发送虚拟机创建指示消息，所述虚拟机创建指示消息中携带创建的用户虚拟机的标识、为所述创建的用户虚拟机分配的硬盘镜像标识及其硬盘镜像属性；
步骤404：加解密虚拟机接收所述虚拟机创建指示消息，为所述用户虚拟机的硬盘镜像分配密钥，记录所述用户虚拟机标识、所述硬盘镜像标识以及所述密钥之间的第一关联关系；
步骤405：加解密虚拟机向所述系统管理模块返回虚拟机创建响应消息，所述虚拟机创建响应消息中携带创建的所述用户虚拟机的标识；
步骤406：当系统管理模块确定需要为所述用户虚拟机增加硬盘镜像时，所述系统管理模块向所述虚拟机管理模块发送硬盘镜像增加请求，所述硬盘镜像增加请求消息中携带所述用户虚拟机标识和新增的盘镜像的属性；
需要说明的是，与现有技术中的硬盘镜像增加流程不同的是，本发明实施例中，所述硬盘镜像增加请求中携带硬盘镜像属性，用于指示新增的硬盘镜像是否需要加密。
步骤407：虚拟机管理模块接收所述硬盘镜像增加请求消息，为所述用户虚拟机创建新的硬盘镜像，为所述新的硬盘镜像分配硬盘镜像标识，根据所述硬盘镜像增加请求消息设置所述新的硬盘镜像的硬盘镜像属性，将所述新的硬盘镜像连接到所述用户虚拟机，作为所述用户虚拟机的附加硬盘镜像；
步骤408：所述虚拟机管理模块将所述用户虚拟机标识、所述新的硬盘镜像的标识以及所述新的硬盘镜像的硬盘镜像属性发送给所述加解密虚拟机；
步骤409：所述加解密虚拟机为所述新分配的硬盘镜像标识分配密钥，更新所述第一关联关系，以记录所述用户虚拟机的标识、所述新的硬盘镜像的硬盘镜像标识，以及所述密钥 的对应关系。
步骤410：所述加解密虚拟机向系统管理模块返回硬盘镜像增加响应消息，携带所述用户虚拟机的标识以及为所述用户虚拟机新增的硬盘镜像的标识。
步骤411：系统管理模块向虚拟机管理模块发送虚拟机启动请求，所述虚拟机启动请求携带待启动的用户虚拟机的标识；
步骤412：虚拟机管理模块启动所述用户虚拟机，将用户虚拟机连接到硬盘镜像；
步骤413：虚拟机管理模块向所述控制模块发送虚拟机启动指示消息，将启动的用户虚拟机的标识、属于所述用户虚拟机的硬盘镜像的标识和对应的硬盘镜像属性发送给所述控制模块；
步骤414：所述控制模块记录属于所述待启动的用户虚拟机的硬盘镜像的标识和硬盘镜像属性，建立所述第二关联关系；
需要说明的是，所述第二关联关系中还可以包括所述待启动的用户虚拟机的标识。
步骤415：所述控制模块向所述系统管理模块发送虚拟机启动响应消息，携带所述用户虚拟机的标识和硬盘镜像的标识。
步骤416:用户虚拟机向硬盘镜像写入数据，触发写请求，所述写请求携带待写入的数据；
在具体实现中，用户虚拟机向其归属的硬盘镜像写入数据时，设备驱动获取所述写请求，所述设备驱动调用控制模块处理所述写请求；
用户虚拟机向硬盘镜像写入数据的过程可以采用现有技术中的方式，本发明实施例对此并不进行限定。需要说明的是，本发明实施例在上述写入数据的过程中，由设备驱动调用控制模块，以使得控制模块可以判断待写入的硬盘镜像的属性，从而在需要对待写入数据进行加密时，将待写入数据转发到加解密虚拟机中，完成待写入数据的加密过程。具体如下述流程所述。
步骤417：所述控制模块获取所述写请求，查找所述第二关联关系，根据所述第二关联关系确定所述用户虚拟机的待写入的硬盘镜像的硬盘镜像属性，如果确定的所述硬盘镜像属性为加密，则执行步骤418，如果确定的所述硬盘镜像属性为不加密，所述控制模块将所述待写入的数据通过设备驱动写入到所述用户虚拟机的所述待写入的硬盘镜像中。
步骤418：所述控制模块向所述加解密虚拟机发送加密请求，所述加密请求中携带所述待写入的数据和标识头，所述标识头用来区分所述待写入数据对应的用户虚拟机和硬盘镜像。具体的，所述标识头包括所述待写入的硬盘镜像的标识和硬盘镜像属性，进一步的所述标识头中还可以包括硬盘镜像所属的用户虚拟机的标识；
步骤419：加解密虚拟机接收所述加密请求，根据所述第一关联关系确定所述待写入的 硬盘镜像的标识对应的加密密钥，使用所述加密密钥对所述待写入的数据进行加密，获得加密数据；
更进一步的，当所述第一关联关系中还记录有用户虚拟机的标识时，所述加解密虚拟机可以对发起所述写请求的用户虚拟机进行权限管理，具体的，所述加解密虚拟机查询所述第一关联关系，确定接收到的标识头中的所述虚拟机的标识和硬盘镜像标识的对应关系是否记录在所述第一关联关系中，如果是，则鉴权通过,获取硬盘镜像标识对应的加密密钥，如果否，则表示所述用户虚拟机与硬盘镜像不匹配，所述用户虚拟机无权向该硬盘镜像写入数据；
具体的，在一种具体的实现场景中，所述加解密虚拟机中可以包含密钥管理模块，由所述密钥管理模块对所述第一关联关系中的密钥进行管理。
步骤420：所述加解密虚拟机将对所述待写入的数据进行加密得到的加密数据返回给所述控制模块；
步骤421：所述控制模块调用所述设备驱动，将所述加密数据写入到所述用户虚拟机的硬盘镜像中；
步骤422：用户虚拟机从硬盘镜像中读取数据，触发读请求，所述读请求携带待读取数据标识；
在具体实现中，用户虚拟机从其硬盘镜像读取数据时触发读请求，设备驱动获取所述读请求，所述设备驱动调用控制模块处理所述读请求；
步骤423：控制模块调用设备驱动的功能，从所述用户虚拟机的硬盘镜像中读取数据，如果读取到的所述数据为加密数据，则执行步骤424
具体的，在硬盘镜像连接到虚拟机的时候，包含控制模块的设备驱动被加载，同时会初始化其中的控制模块。所述控制模块调用现有的设备驱动功能进行寻址，从磁盘中读取所需的数据，而设备驱动从磁盘中读取所需的数据可以采用现有技术中的各种方式，本发明实施例对此并不进行限定。本发明实施例中，所述控制模块具备设备驱动功能调用能力即可。
所述控制模块可以通过判断硬盘镜像属性是否是加密来确定读取的数据是否为加密数据。具体的，如果待读取的硬盘镜像的属性为加密，则说明所述控制模块读取的数据为加密数据，则执行步骤424，以使得所述加解密虚拟机解密读取的加密数据；如果否，则说明所述控制模块读取的数据为非加密数据，无需进行解密，则控制模块直接将读取的数据返回给所述用户虚拟机。
步骤424：所述控制模块向所述加解密虚拟机发送解密请求，所述解密请求中携带所述加密数据、所述用户虚拟机的标识，以及所述硬盘镜像的标识；
步骤425：加解密虚拟机根据接收到的所述用户虚拟机标识和硬盘镜像标识，查询所述 第一关联关系，获取所述用户虚拟机的硬盘镜像的解密密钥，使用所述解密密钥解密所述加密数据，获得明文。
具体的，加解密虚拟机查找自身存储的用户虚拟机标识和硬盘镜像标识的对应关系，判断接收到的所述硬盘镜像的标识以及硬盘镜像所属的虚拟机的标识是否保存在所述对应关系中，如果是，则获取记录的所述硬盘镜像标识对应的解密密钥；
具体的，所述加解密虚拟机中的密钥管理模块，用于对各用户虚拟机的硬盘镜像对应的解密密钥进行管理。
步骤426：所述加解密虚拟机将解密得到的明文携带在解密响应中返回给所述控制模块；
步骤427：所述控制模块将接收到的所述解密得到的明文返回给所述用户虚拟机。
需要说明的是，步骤401-410为用户虚拟机创建流程，在流程中，加解密虚拟机记录所述第一关联关系；步骤411-415为用户虚拟机启动流程，当用户虚拟机启动时，所述虚拟机管理模块将启动的用户虚拟机的硬盘镜像标识以及硬盘镜像属性发送给控制模块，所述控制模块记录所述第二关联关系；步骤416-421为写流程，当控制模块获取到用户虚拟机的待写入的数据时，确定对应的待写入的硬盘镜像属性，如果需要对待写入数据进行加密则由加解密虚拟机根据所述第一关联关系对待写入数据进行加密；步骤421-427为读流程，当控制模块获取所述用户虚拟机触发的读请求时，如果读取的数据为加密数据，则将加密数据转发给加解密虚拟机进行解密，从而获得明文。
本发明实施例提供了一种虚拟机系统中进行数据加解密的方法，在本发明实施例中，一方面，加解密处理由专门的加解密虚拟机负责，用户虚拟机无需进行改变，也无需安装其他辅助软件；另一方面，加解密虚拟机位于用户虚拟机的外部，既可以对用户虚拟机的非系统盘进行加密，也可以对用户虚拟机的系统盘进行加密。
在本发明实施例中，与普通的虚拟机类似，上述加解密虚拟机所需的内存、CPU等资源可以动态分配，避免了与主机操作系统及虚拟化软件的资源冲突，提高了主机的可靠性。所述加解密虚拟机上开放限定的端口，限制安装其他应用，也有助于进一步提高系统安全性。更进一步的，在具体产品实现时，由于加解密虚拟机的独立性，还可以针对加解密虚拟机采用看门狗技术、双进程技术、热备技术等方式提高可靠性，安装防病毒、防木马、防火墙等软件提高安全性。
最优地，本发明实施例提供的控制模块可以安装在VMM的设备驱动中，所述控制模块可以调用设备驱动的功能，对于各种类型的硬盘镜像均可以有效提供加解密服务，同时，不影响主机软件系统的构建、发布、安装或启动等。可选地，所述控制模块也可以独立于设备驱动，此时，控制模块具备调用设备驱动功能的能力。
优选地，为所述硬盘镜像分配的密钥可以保存在加解密虚拟机中，使得主机及虚拟化系统外部均无法获知该密钥，保密性较好。另一方面，在加解密虚拟机中保存了用户虚拟机标识、硬盘镜像标识，以及相关的用户信息等等，可以对不同用户虚拟机的硬盘镜像分配不同的密钥，针对不同来源的数据流，提供或不提供加解密服务，实现用户虚拟机的访问权限控制。
在本发明实施例中，所述硬盘镜像，可以是大文件、本地分区、本地块设备，internet小型计算机系统接口(internet Small Computer System Interface,iSCSI)协议提供的网络块设备、通用Internet文件系统(Common Internet File System，CIFS)协议或网络文件系统(Net File System，NFS)协议提供的共享文件等等类型，本发明实施例对此并不进行限定。
如图5所示，为本发明实施例提供的另一种虚拟化系统中加解密的方法流程示意图，应用于虚拟化系统，所述虚拟化系统包括虚拟机监视器VMM和加解密虚拟机，所述VMM包括控制模块，所述加解密虚拟机记录有硬盘镜像标识以及密钥之间的第一关联关系，所述密钥包括加密密钥，所述虚拟化系统中记录有硬盘镜像标识以及硬盘镜像属性之间的第二关联关系，所述方法包括：
步骤501：所述控制模块获取用户虚拟机的待写入的数据，根据所述第二关联关系确定所述用户虚拟机的待写入的硬盘镜像的硬盘镜像属性，如果确定的所述硬盘镜像属性为加密，则向所述加解密虚拟机发送所述待写入的硬盘镜像的标识以及所述待写入的数据；
步骤502：所述控制模块接收所述加解密虚拟机使用所述加密密钥对所述待写入的数据进行加密获得的加密数据，其中，所述加密密钥为所述加解密虚拟机根据所述第一关联关系确定的所述待写入的硬盘镜像的标识对应的加密密钥；
步骤503：所述控制模块将所述加密数据写入到所述待写入的硬盘镜像中。
本发明实施例中，在VMM中新增了加解密的控制模块，当所述控制模块获取到用户虚拟机的待写入的数据时，所述控制模块根据待写入的硬盘镜像属性确定是否需要对待写入的数据进行加密，当需要进行加密时，所述控制模块将待写入数据发送到加解密虚拟机，由加解密虚拟机对待写入数据进行加密处理，并返还加密数据给所述控制模块，所述控制模块将加密数据写入对应的硬盘镜像中，实现用户数据的加密存储。一方面，VMM中的控制模块用于对是否待写入数据是否需要加密进行判断并进行待写入数据的转发，功能实现简单，降低了VMM的系统复杂度，同时，由于本发明实施例中的加解密处理是由专门的加解密虚拟机来实现，无需占用VMM中的资源，避免了资源冲突，提高了系统稳定性；另一方面，加解密虚拟机可以针对不同的用户虚拟机的硬盘镜像分配不同的密钥，针对不同来源的数据流，提供或 者不提供加解密服务，从而实现了用户虚拟机的访问权限控制。
如图6所示，为本发明实施例提供的一种用户虚拟机的创建方法流程示意图，应用于虚拟化系统，所述虚拟化系统包括VMM、系统管理模块以及加解密虚拟机，所述VMM包括虚拟机管理模块，所述方法包括：
步骤601：所述加解密虚拟机接收所述虚拟机管理模块发送的虚拟机创建指示消息，所述虚拟机创建指示消息中携带创建的用户虚拟机的标识、为所述创建的用户虚拟机分配的硬盘镜像标识以及所述分配的所述硬盘镜像标识对应的硬盘镜像属性，所述虚拟机创建指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的虚拟机创建请求创建用户虚拟机以及硬盘镜像后发送的；
步骤602：所述加解密虚拟机为创建的硬盘镜像分配密钥，建立所述创建的用户虚拟机的标识、所述分配的硬盘镜像标识以及所述密钥之间的第一关联关系；
步骤603：所述加解密虚拟机向所述系统管理模块发送虚拟机创建响应消息，所述虚拟机创建响应消息中包括所述创建的用户虚拟机的标识。
在虚拟机创建完成后，还可以为该用户虚拟机添加新的硬盘镜像，并且为新添加的硬盘镜像分配密钥，具体流程包括：
所述加解密虚拟机接收所述虚拟机管理模块发送的硬盘镜像增加指示消息，所述硬盘镜像增加指示消息中携带所述用户虚拟机标识、所述虚拟机管理模块为所述用户虚拟机新增的硬盘镜像标识及其硬盘镜像属性，所述硬盘镜像指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的硬盘镜像增加请求为所述用户虚拟机创建新增的硬盘镜像后发送的；
所述加解密虚拟机为所述新增的硬盘镜像分配密钥，将所述用户虚拟机标识、新增的硬盘镜像标识，以及为所述新增的硬盘镜像分配的密钥更新至所述第一关联关系。
在上述虚拟机创建过程中，虚拟机管理模块识别出需要提供加解密服务的硬盘镜像，将用户虚拟机标识和硬盘镜像标识发送给加解密虚拟机，由加解密虚拟机为上述硬盘镜像分配密钥，并记录所述第一关联关系，以使得所述解密虚拟机可以对上述用户虚拟机对上述硬盘镜像的读写数据进行加解密处理。
与前述系统和方法实施例相对应，如图7所示，为本发明实施例提供的一种虚拟机系统中的控制装置结构示意图，所述控制装置位于虚拟化系统的VMM中，所述虚拟化系统还包括加解密虚拟机，所述加解密虚拟机记录有硬盘镜像标识以及密钥之间的第一关联关系，所述密钥包括加密密钥，所述虚拟化系统中记录有硬盘镜像标识以及硬盘镜像属性之间的第二关联关系，所述控制装置包括：
获取单元701，用于获取用户虚拟机的待写入的数据；
处理单元702，用于根据所述第二关联关系确定所述用户虚拟机的待写入的硬盘镜像的硬盘镜像属性；
发送单元703，用于当所述处理单元702确定的所述硬盘镜像属性为加密时，向所述加解密虚拟机发送所述待写入的硬盘镜像的标识以及所述待写入的数据；
所述获取单元701，还用于接收所述加解密虚拟机使用所述加密密钥对所述待写入的数据进行加密获得的加密数据，其中，所述加密密钥为所述加解密虚拟机根据所述第一关联关系确定的所述待写入的硬盘镜像的标识对应的加密密钥；
写入单元704，用于将所述获取单元701接收到的所述加密数据写入到所述待写入的硬盘镜像中。
进一步的，所述密钥还包括解密密钥，
所述获取单元701，还用于获取所述用户虚拟机触发的读请求；
所述处理单元702，还用于从待读取的硬盘镜像中读取数据，确定读取的所述数据为加密数据；
所述发送单元703，还用于在所述处理单元702确定读取的所述数据为加密数据时，向所述加解密虚拟机发送解密请求，所述解密请求中携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
所述获取单元701，还用于接收所述加解密虚拟机返回的解密后的数据，其中，所述解密后的数据为所述加解密虚拟机在确定所述第一关联关系中包括所述用户虚拟机的标识和所述硬盘镜像的标识的对应关系后，使用根据所述第一关联关系确定的所述硬盘镜像标识对应的解密密钥对所述加密数据进行解密获得的；
所述发送单元703，还用于将所述获取单元701接收到的所述解密后的数据返回给所述用户虚拟机。
所述发送单元703，还用于在所述处理单元702确定读取的所述数据为非加密数据时，将读取的所述非加密数据返回给所述用户虚拟机。
所述获取单元701，还用于接收虚拟机管理模块发送的虚拟机启动指示消息，所述虚拟机启动指示消息携带启动的用户虚拟机的标识、所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性；
所述处理单元702，还用于记录所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性，更新所述第二关联关系。
所述获取模块701，具体用于从设备驱动获取所述用户虚拟机触发的写请求，所述写请求携带所述待写入的数据。
对应于图6所述的方法，如图8所示，本发明实施例还提供了一种虚拟化系统中的加解密装置结构示意图，应用于虚拟化系统，所述虚拟化系统包括所述加解密装置、VMM以及系统管理模块，所述VMM包括虚拟机管理模块，所述加解密装置包括：
接收单元801，用于接收所述虚拟机管理模块发送的虚拟机创建指示消息，所述虚拟机创建指示消息中携带创建的用户虚拟机的标识、为所述创建的用户虚拟机分配的硬盘镜像标识以及所述分配的所述硬盘镜像标识对应的硬盘镜像属性，所述虚拟机创建指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的虚拟机创建请求创建用户虚拟机以及硬盘镜像后发送的；
执行单元802，用于在接收单元801接收到所述虚拟机创建指示消息后，为创建的硬盘镜像分配密钥，建立所述创建的用户虚拟机的标识、所述分配的硬盘镜像标识以及所述密钥之间的第一关联关系；
消息返回单元803，用于向所述系统管理模块发送虚拟机创建响应消息，所述虚拟机创建响应消息中包括所述创建的用户虚拟机的标识。
进一步的，所述接收单元801，还用于接收所述虚拟机管理模块发送的硬盘镜像增加指示消息，所述硬盘镜像增加指示消息中携带所述用户虚拟机标识、所述虚拟机管理模块为所述用户虚拟机新增的硬盘镜像标识及其硬盘镜像属性，所述硬盘镜像指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的硬盘镜像增加请求为所述用户虚拟机创建新增的硬盘镜像后发送的；
所述执行单元802，还用于在所述接收单元701接收到所述硬盘镜像增加指示消息后，为所述新增的硬盘镜像分配密钥，将所述用户虚拟机标识、新增的硬盘镜像标识，以及为所述新增的硬盘镜像分配的密钥更新至所述第一关联关系。
所述VMM中包括控制模块，
所述接收单元801，还用于接收所述控制模块发送的加密请求，所述加密请求携带所述用户虚拟机的标识、待写入的硬盘镜像的标识以及所述待写入的数据；
所述执行单元802，还用于确定所述第一关联关系中是否包括所述接收单元801接收到的所述用户虚拟机的标识和待写入的硬盘镜像的标识的对应关系，如果是，则根据所述第一关联关系确定所述待写入的硬盘镜像的标识对应的加密密钥，使用所述加密密钥对所述待写入的数据进行加密，获得加密数据；
所述消息返回单元803，还用于在所述执行单元802确定所述第一关联关系中不包括所述用户虚拟机的标识和待写入的硬盘镜像的标识的对应关系时，向所述控制模块返回加密失败指示，在所述执行单元确定所述第一关联关系中包括所述用户虚拟机的标识和待写入的硬 盘镜像的标识的对应关系时，将所述加密数据发送给所述控制模块。
所述接收单元801，还用于接收所述控制模块发送的解密请求，所述解密请求携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
所述执行单元802，还用于确定所述第一关联关系中是否包括所述接收单元801接收到的所述用户虚拟机的标识和所述硬盘镜像的标识的对应关系，如果是，则从所述第一关联关系中获取所述硬盘镜像的标识对应的解密密钥，使用所述解密密钥解密读取的所述加密数据，获得解密后的数据；
所述消息返回单元，还用于将获得的解密后的数据发送给所述控制模块。
本发明实施例中，在VMM中新增了加解密的控制模块，当所述控制模块获取到用户虚拟机的待写入的数据时，所述控制模块根据待写入的硬盘镜像属性确定是否需要对待写入的数据进行加密，当需要进行加密时，所述控制模块将待写入数据发送到加解密虚拟机，由加解密虚拟机对待写入数据进行加密处理，并返还加密数据给所述控制模块，所述控制模块将加密数据写入对应的硬盘镜像中，实现用户数据的加密存储。一方面，VMM中的控制模块用于对是否待写入数据是否需要加密进行判断并进行待写入数据的转发，功能实现简单，降低了VMM的系统复杂度，同时，由于本发明实施例中的加解密处理是由专门的加解密虚拟机来实现，无需占用VMM中的资源，避免了资源冲突，提高了系统稳定性；另一方面，加解密虚拟机可以针对不同的用户虚拟机的硬盘镜像分配不同的密钥，针对不同来源的数据流，提供或者不提供加解密服务，从而实现了用户虚拟机的访问权限控制。
进一步的，如图9所示，为本发明实施例提供的一种控制装置的硬件构成示意图，在具体的产品实现中，所述控制装置包括至少一个处理器(例如CPU)，至少一个网络接口或者其他通信接口，存储器，和至少一个通信总线，用于实现这些上述实施例中各部件之间的连接通信。处理器用于执行存储器中存储的可执行模块，实现上述各实施例中控制模块中各部件的功能。存储器可能包含高速随机存取存储器(RAM：Random Access Memory)，也可能还包括非不稳定的存储器(non-volatile memory)，例如至少一个磁盘存储器。通过至少一个网络接口(可以是有线或者无线)实现该控制模块与至少一个其他网元之间的通信连接，可以使用互联网，广域网，本地网，城域网等。
在一些实施方式中，计算机可读介质中存储了程序指令，包括计算机执行指令，以供计算机的处理器执行所述计算机执行指令时，所述计算机执行如上述各实施例中任一所述的虚拟化系统中加解密的方法。其中，程序指令可包括本发明上述实施例中指出的各个部件，各部件具体的实现方式可参见本发明上述实施例中的相应内容，这里不再赘述。
通过以上的实施方式的描述可知，本领域的技术人员可以清楚地了解到上述实施例方法 中的全部或部分步骤可借助软件加必需的通用硬件平台的方式来实现。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，资源管理服务器，或者诸如媒体网关等网络通信设备，等等)执行本发明各个实施例或者实施例的某些部分所述的方法。
需要说明的是，本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于设备及系统实施例而言，由于其基本相似于方法实施例，所以描述得比较简单，相关之处参见方法实施例的部分说明即可。以上所描述的设备及系统实施例仅仅是示意性的，其中作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上所述仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。凡在本发明的精神和原则之内所作的任何修改、等同替换、改进等，均包含在本发明的保护范围内。

Claims (29)

  1. 一种虚拟化系统，其特征在于，包括虚拟机监视器VMM和加解密虚拟机，所述VMM包括控制模块，所述加解密虚拟机记录有硬盘镜像标识以及密钥之间的第一关联关系，所述密钥包括加密密钥，所述虚拟化系统中记录有硬盘镜像标识以及硬盘镜像属性之间的第二关联关系，
    所述控制模块，用于获取用户虚拟机的待写入的数据，根据所述第二关联关系确定所述用户虚拟机的待写入的硬盘镜像的硬盘镜像属性，如果确定的所述硬盘镜像属性为加密，则向所述加解密虚拟机发送所述待写入的硬盘镜像的标识以及所述待写入的数据；
    所述加解密虚拟机，用于根据所述第一关联关系确定所述待写入的硬盘镜像的标识对应的加密密钥，使用所述加密密钥对所述待写入的数据进行加密，获得加密数据，将所述加密数据发送给所述控制模块；
    所述控制模块，还用于将所述加密数据写入到所述待写入的硬盘镜像中。
  2. 如权利要求1所述的系统，其特征在于，所述第一关联关系还包括用户虚拟机标识，
    所述控制模块，具体用于向所述加解密虚拟机发送所述用户虚拟机的标识、所述待写入的硬盘镜像的标识，以及待写入的数据；
    所述加解密虚拟机，具体用于获取所述用户虚拟机的标识以及所述待写入的硬盘镜像标识，确定所述第一关联关系中是否包括所述用户虚拟机的标识与所述待写入的硬盘镜像标识的对应关系，如果否，则向所述控制模块返回加密失败指示，如果是，则使用确定的所述待写入的硬盘镜像标识对应的加密密钥对所述待写入的数据进行加密。
  3. 如权利要求2所述的系统，其特征在于，所述密钥还包括解密密钥，
    所述控制模块，还用于获取所述用户虚拟机触发的读请求，从待读取的硬盘镜像中读取数据，确定读取的所述数据为加密数据，向所述加解密虚拟机发送解密请求，所述解密请求中携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
    所述加解密虚拟机，还用于接收所述解密请求，确定所述第一关联关系中是否包括所述发送所述读请求的用户虚拟机的标识和所述硬盘镜像的标识的对应关系，如果是，则从所述第一关联关系中获取所述硬盘镜像的标识对应的解密密钥，使用所述解密密钥解密读取的所述加密数据，将获得的解密后的数据发送给所述控制模块；
    所述控制模块，还用于将所述解密后的数据返回给所述用户虚拟机。
  4. 如权利要求3所述的系统，其特征在于，
    所述控制模块，还用于确定读取的所述数据为非加密数据时，将读取的所述非加密数据 返回给所述用户虚拟机。
  5. 如权利要求2-4中任一所述的系统，其特征在于，所述系统还包括系统管理模块以及虚拟机管理模块，
    所述系统管理模块，用于向所述虚拟机管理模块发送虚拟机启动请求，所述虚拟机启动请求携带待启动的用户虚拟机的标识；
    所述虚拟机管理模块，用于接收所述虚拟机启动请求，根据所述虚拟机启动请求启动所述待启动的用户虚拟机，将启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性发送给所述控制模块；
    所述控制模块，还用于接收并记录所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性，建立所述第二关联关系。
  6. 如权利要求2-5中任一所述的系统，其特征在于，所述系统还包括系统管理模块以及虚拟机管理模块，
    所述系统管理模块，还用于向所述虚拟机管理模块发送虚拟机创建请求，所述虚拟机创建请求中携带待创建的用户虚拟机的硬盘镜像的属性；
    所述虚拟机管理模块，还用于接收所述虚拟机创建请求，创建用户虚拟机，为创建的所述用户虚拟机创建硬盘镜像，分配硬盘镜像标识，根据所述虚拟机创建请求确定分配的所述硬盘镜像标识对应的硬盘镜像属性，向所述加解密虚拟机发送虚拟机创建指示消息，所述虚拟机创建指示消息中携带创建的用户虚拟机的标识、所述分配的硬盘镜像标识以及所述分配的所述硬盘镜像标识对应的硬盘镜像属性；
    所述加解密虚拟机，还用于接收所述虚拟机创建指示消息，为创建的硬盘镜像分配密钥，建立所述创建的用户虚拟机的标识、所述分配的硬盘镜像标识以及所述密钥之间的所述第一关联关系。
  7. 如权利要求6所述的系统，其特征在于，
    所述加解密虚拟机，还用于向所述系统管理模块发送虚拟机创建响应消息，所述虚拟机创建响应消息中包括所述创建的用户虚拟机的标识。
  8. 如权利要求6所述的系统，其特征在于，
    所述系统管理模块，还用于向所述虚拟机管理模块发送硬盘镜像增加请求消息，所述硬盘镜像增加请求消息中携带所述用户虚拟机标识和新增的盘镜像的属性；
    所述虚拟机管理模块，还用于接收所述硬盘镜像增加请求消息，为所述用户虚拟机创建新的硬盘镜像，根据所述硬盘镜像增加请求消息确定所述新的硬盘镜像的硬盘镜像属性，将所述用户虚拟机标识、所述新的硬盘镜像的标识以及所述新的硬盘镜像的硬盘镜像属性发送 给所述加解密虚拟机；
    所述加解密虚拟机，还用于为所述新的硬盘镜像分配密钥，更新所述第一关联关系。
  9. 如权利要求1所述的系统，其特征在于，
    所述控制模块，具体用于从设备驱动获取所述用户虚拟机触发的写请求，所述写请求携带所述待写入的数据。
  10. 一种虚拟化系统中加解密的方法，其特征在于，应用于虚拟化系统，所述虚拟化系统包括虚拟机监视器VMM和加解密虚拟机，所述VMM包括控制模块，所述加解密虚拟机记录有硬盘镜像标识以及密钥之间的第一关联关系，所述密钥包括加密密钥，所述虚拟化系统中记录有硬盘镜像标识以及硬盘镜像属性之间的第二关联关系，所述方法包括：
    所述控制模块获取用户虚拟机的待写入的数据，根据所述第二关联关系确定所述用户虚拟机的待写入的硬盘镜像的硬盘镜像属性，如果确定的所述硬盘镜像属性为加密，则向所述加解密虚拟机发送所述待写入的硬盘镜像的标识以及所述待写入的数据；
    所述控制模块接收所述加解密虚拟机使用所述加密密钥对所述待写入的数据进行加密获得的加密数据，其中，所述加密密钥为所述加解密虚拟机根据所述第一关联关系确定的所述待写入的硬盘镜像的标识对应的加密密钥；
    所述控制模块将所述加密数据写入到所述待写入的硬盘镜像中。
  11. 如权利要求10所述的方法，其特征在于，所述第一关联关系中还包括用户虚拟机标识，所述密钥还包括解密密钥，所述方法还包括：
    所述控制模块获取所述用户虚拟机触发的读请求，从待读取的硬盘镜像中读取数据，确定读取的所述数据为加密数据，向所述加解密虚拟机发送解密请求，所述解密请求中携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
    所述控制模块接收所述加解密虚拟机返回的解密后的数据，其中，所述解密后的数据为所述加解密虚拟机在确定所述第一关联关系中包括所述用户虚拟机的标识和所述硬盘镜像的标识的对应关系后，使用根据所述第一关联关系确定的所述硬盘镜像标识对应的解密密钥对所述加密数据进行解密获得的；
    所述控制模块将所述解密后的数据返回给所述用户虚拟机。
  12. 如权利要求11所述的方法，其特征在于，还包括：
    所述控制模块在确定读取的所述数据为非加密数据时，将读取的所述非加密数据返回给所述用户虚拟机。
  13. 如权利要求10所述的方法，其特征在于，所述系统还包括虚拟机管理模块，所述方法还包括：
    所述控制模块接收虚拟机管理模块发送的虚拟机启动指示消息，所述虚拟机启动指示消息携带启动的用户虚拟机的标识、所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性；
    所述控制模块记录所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性，更新所述第二关联关系。
  14. 如权利要求10所述的方法，其特征在于，所述控制模块获取用户虚拟机的待写入的数据包括：
    所述控制模块从设备驱动获取所述用户虚拟机触发的写请求，所述写请求携带所述待写入的数据。
  15. 一种用户虚拟机的创建方法，其特征在于，应用于虚拟化系统，所述虚拟化系统包括VMM、系统管理模块以及加解密虚拟机，所述VMM包括虚拟机管理模块，所述方法包括：
    所述加解密虚拟机接收所述虚拟机管理模块发送的虚拟机创建指示消息，所述虚拟机创建指示消息中携带创建的用户虚拟机的标识、为所述创建的用户虚拟机分配的硬盘镜像标识以及所述分配的所述硬盘镜像标识对应的硬盘镜像属性，所述虚拟机创建指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的虚拟机创建请求创建用户虚拟机以及硬盘镜像后发送的；
    所述加解密虚拟机为创建的硬盘镜像分配密钥，建立所述创建的用户虚拟机的标识、所述分配的硬盘镜像标识以及所述密钥之间的第一关联关系；
    所述加解密虚拟机向所述系统管理模块发送虚拟机创建响应消息，所述虚拟机创建响应消息中包括所述创建的用户虚拟机的标识。
  16. 如权利要求15所述的方法，其特征在于，还包括：
    所述加解密虚拟机接收所述虚拟机管理模块发送的硬盘镜像增加指示消息，所述硬盘镜像增加指示消息中携带所述用户虚拟机标识、所述虚拟机管理模块为所述用户虚拟机新增的硬盘镜像标识及其硬盘镜像属性，所述硬盘镜像指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的硬盘镜像增加请求为所述用户虚拟机创建新增的硬盘镜像后发送的；
    所述加解密虚拟机为所述新增的硬盘镜像分配密钥，将所述用户虚拟机标识、新增的硬盘镜像标识，以及为所述新增的硬盘镜像分配的密钥更新至所述第一关联关系。
  17. 如权利要求15所述的方法、其特征在于，所述VMM中包括控制模块，所述方法还包括：
    所述加解密虚拟机接收所述控制模块发送的加密请求，所述加密请求携带所述用户虚拟 机的标识、待写入的硬盘镜像的标识以及所述待写入的数据，确定所述第一关联关系中是否包括所述用户虚拟机的标识和待写入的硬盘镜像的标识的对应关系，如果否，则向所述控制模块返回加密失败指示，如果是，则根据所述第一关联关系确定所述待写入的硬盘镜像的标识对应的加密密钥，使用所述加密密钥对所述待写入的数据进行加密，获得加密数据，将所述加密数据发送给所述控制模块，以使得所述控制模块将所述加密数据写入到所述待写入的硬盘镜像中。
  18. 如权利要求17所述的方法，其特征在于，还包括：所述加解密虚拟机接收所述控制模块发送的解密请求，所述解密请求携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识，确定所述第一关联关系中是否包括所述用户虚拟机的标识和所述硬盘镜像的标识的对应关系，如果是，则从所述第一关联关系中获取所述硬盘镜像的标识对应的解密密钥，使用所述解密密钥解密读取的所述加密数据，将获得的解密后的数据发送给所述控制模块，以使得所述控制模块将所述解密后的数据返回给所述用户虚拟机。
  19. 一种虚拟化系统中的控制装置，其特征在于，所述控制装置位于虚拟化系统的VMM中，所述虚拟化系统还包括加解密虚拟机，所述加解密虚拟机记录有硬盘镜像标识以及密钥之间的第一关联关系，所述密钥包括加密密钥，所述虚拟化系统中记录有硬盘镜像标识以及硬盘镜像属性之间的第二关联关系，所述控制装置包括：
    获取单元，用于获取用户虚拟机的待写入的数据；
    处理单元，用于根据所述第二关联关系确定所述用户虚拟机的待写入的硬盘镜像的硬盘镜像属性；
    发送单元，用于当所述确定单元确定的所述硬盘镜像属性为加密时，向所述加解密虚拟机发送所述待写入的硬盘镜像的标识以及所述待写入的数据；
    所述获取单元，还用于接收所述加解密虚拟机使用所述加密密钥对所述待写入的数据进行加密获得的加密数据，其中，所述加密密钥为所述加解密虚拟机根据所述第一关联关系确定的所述待写入的硬盘镜像的标识对应的加密密钥；
    写入单元，用于将所述获取单元接收到的所述加密数据写入到所述待写入的硬盘镜像中。
  20. 如权利要求19所述的装置，其特征在于，所述密钥还包括解密密钥，
    所述获取单元，还用于获取所述用户虚拟机触发的读请求；
    所述处理单元，还用于从待读取的硬盘镜像中读取数据，确定读取的所述数据为加密数据；
    所述发送单元，还用于在所述处理单元确定读取的所述数据为加密数据时，向所述加解密虚拟机发送解密请求，所述解密请求中携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
    所述获取单元，还用于接收所述加解密虚拟机返回的解密后的数据，其中，所述解密后的数据为所述加解密虚拟机在确定所述第一关联关系中包括所述用户虚拟机的标识和所述硬盘镜像的标识的对应关系后，使用根据所述第一关联关系确定的所述硬盘镜像标识对应的解密密钥对所述加密数据进行解密获得的；
    所述发送单元，还用于将所述获取单元接收到的所述解密后的数据返回给所述用户虚拟机。
  21. 如权利要求20所述的装置，其特征在于，
    所述发送单元，还用于在所述处理单元确定读取的所述数据为非加密数据时，将读取的所述非加密数据返回给所述用户虚拟机。
  22. 如权利要求19所述的装置，其特征在于，
    所述获取单元，还用于接收虚拟机管理模块发送的虚拟机启动指示消息，所述虚拟机启动指示消息携带启动的用户虚拟机的标识、所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性；
    所述处理单元，还用于记录所述启动的用户虚拟机的硬盘镜像标识及其硬盘镜像属性，更新所述第二关联关系。
  23. 如权利要求19所述的装置，其特征在于，
    所述获取模块，具体用于从设备驱动获取所述用户虚拟机触发的写请求，所述写请求携带所述待写入的数据。
  24. 一种虚拟化系统中的加解密装置，其特征在于，应用于虚拟化系统，所述虚拟化系统包括所述加解密装置、VMM以及系统管理模块，所述VMM包括虚拟机管理模块，所述加解密装置包括：
    接收单元，用于接收所述虚拟机管理模块发送的虚拟机创建指示消息，所述虚拟机创建指示消息中携带创建的用户虚拟机的标识、为所述创建的用户虚拟机分配的硬盘镜像标识以及所述分配的所述硬盘镜像标识对应的硬盘镜像属性，所述虚拟机创建指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的虚拟机创建请求创建用户虚拟机以及硬盘镜像后发送的；
    执行单元，用于在接收单元接收到所述虚拟机创建指示消息后，为创建的硬盘镜像分配密钥，建立所述创建的用户虚拟机的标识、所述分配的硬盘镜像标识以及所述密钥之间的第 一关联关系；
    消息返回单元，用于向所述系统管理模块发送虚拟机创建响应消息，所述虚拟机创建响应消息中包括所述创建的用户虚拟机的标识。
  25. 如权利要求24所述的装置，其特征在于，
    所述接收单元，还用于接收所述虚拟机管理模块发送的硬盘镜像增加指示消息，所述硬盘镜像增加指示消息中携带所述用户虚拟机标识、所述虚拟机管理模块为所述用户虚拟机新增的硬盘镜像标识及其硬盘镜像属性，所述硬盘镜像指示消息具体为所述虚拟机管理模块根据所述系统管理模块发送的硬盘镜像增加请求为所述用户虚拟机创建新增的硬盘镜像后发送的；
    所述执行单元，还用于在所述接收单元接收到所述硬盘镜像增加指示消息后，为所述新增的硬盘镜像分配密钥，将所述用户虚拟机标识、新增的硬盘镜像标识，以及为所述新增的硬盘镜像分配的密钥更新至所述第一关联关系。
  26. 如权利要求24所述的装置，其特征在于，所述VMM中包括控制模块，
    所述接收单元，还用于接收所述控制模块发送的加密请求，所述加密请求携带所述用户虚拟机的标识、待写入的硬盘镜像的标识以及所述待写入的数据；
    所述执行单元，还用于确定所述第一关联关系中是否包括所述接收单元接收到的所述用户虚拟机的标识和待写入的硬盘镜像的标识的对应关系，如果是，则根据所述第一关联关系确定所述待写入的硬盘镜像的标识对应的加密密钥，使用所述加密密钥对所述待写入的数据进行加密，获得加密数据；
    所述消息返回单元，还用于在所述执行单元确定所述第一关联关系中不包括所述用户虚拟机的标识和待写入的硬盘镜像的标识的对应关系时，向所述控制模块返回加密失败指示，在所述执行单元确定所述第一关联关系中包括所述用户虚拟机的标识和待写入的硬盘镜像的标识的对应关系时，将所述加密数据发送给所述控制模块。
  27. 如权利要求26所述的装置，其特征在于，
    所述接收单元，还用于接收所述控制模块发送的解密请求，所述解密请求携带所述用户虚拟机的标识、读取的所述加密数据以及所述硬盘镜像的标识；
    所述执行单元，还用于确定所述第一关联关系中是否包括所述接收单元接收到的所述用户虚拟机的标识和所述硬盘镜像的标识的对应关系，如果是，则从所述第一关联关系中获取所述硬盘镜像的标识对应的解密密钥，使用所述解密密钥解密读取的所述加密数据，获得解密后的数据；
    所述消息返回单元，还用于将获得的解密后的数据发送给所述控制模块。
  28. 一种虚拟化系统中的控制装置，其特征在于，所述装置包括处理器、存储器、总线和通信接口，
    所述存储器用于存储计算机执行指令，所述处理器与所述存储器通过所述总线连接，当所述路径管理的装置运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述虚拟化系统中的控制装置执行如权利要求10-18中任一所述的方法。
  29. 一种计算机可读介质，其特征在于，包括计算机执行指令，以供计算机的处理器执行所述计算机执行指令时，所述计算机执行如权利要求10-18中任一所述的方法。
PCT/CN2014/095598 2014-12-30 2014-12-30 虚拟化系统中加解密的方法、装置和系统 WO2016106566A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
JP2017504166A JP6414863B2 (ja) 2014-12-30 2014-12-30 仮想化システムにおける暗号復号方法および装置、およびシステム
CN201480056793.7A CN106063218B (zh) 2014-12-30 2014-12-30 虚拟化系统中加解密的方法、装置和系统
EP14909378.3A EP3160103B1 (en) 2014-12-30 2014-12-30 Method, apparatus and system for encryption/decryption in virtualization system
PCT/CN2014/095598 WO2016106566A1 (zh) 2014-12-30 2014-12-30 虚拟化系统中加解密的方法、装置和系统
US15/637,091 US9959410B2 (en) 2014-12-30 2017-06-29 Encryption and decryption method and apparatus in virtualization system, and system
US15/935,744 US10409990B2 (en) 2014-12-30 2018-03-26 Encryption and decryption method and apparatus in virtualization system, and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2014/095598 WO2016106566A1 (zh) 2014-12-30 2014-12-30 虚拟化系统中加解密的方法、装置和系统

Related Child Applications (3)

Application Number Title Priority Date Filing Date
US15637091 A-371-Of-International 2014-12-30
US15/637,091 Continuation US9959410B2 (en) 2014-12-30 2017-06-29 Encryption and decryption method and apparatus in virtualization system, and system
US15/935,744 Continuation US10409990B2 (en) 2014-12-30 2018-03-26 Encryption and decryption method and apparatus in virtualization system, and system

Publications (1)

Publication Number Publication Date
WO2016106566A1 true WO2016106566A1 (zh) 2016-07-07

Family

ID=56283847

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/095598 WO2016106566A1 (zh) 2014-12-30 2014-12-30 虚拟化系统中加解密的方法、装置和系统

Country Status (5)

Country Link
US (2) US9959410B2 (zh)
EP (1) EP3160103B1 (zh)
JP (1) JP6414863B2 (zh)
CN (1) CN106063218B (zh)
WO (1) WO2016106566A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110297687A (zh) * 2018-03-21 2019-10-01 阿里巴巴集团控股有限公司 基于虚拟主机的数据交互方法、装置及系统
CN110971656A (zh) * 2018-10-01 2020-04-07 施耐德电器工业公司 区块链中的数据的安全存储
CN111741068A (zh) * 2020-05-20 2020-10-02 中国电子科技网络信息安全有限公司 一种虚拟机镜像链密钥模型及其数据加密密钥传输方法
CN110971656B (zh) * 2018-10-01 2024-04-26 施耐德电器工业公司 区块链中的数据的安全存储

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9892265B1 (en) * 2015-03-31 2018-02-13 Veritas Technologies Llc Protecting virtual machine data in cloud environments
US9767318B1 (en) * 2015-08-28 2017-09-19 Frank Dropps Secure controller systems and associated methods thereof
CN105184154B (zh) * 2015-09-15 2017-06-20 中国科学院信息工程研究所 一种在虚拟化环境中提供密码运算服务的系统和方法
US10303899B2 (en) * 2016-08-11 2019-05-28 Intel Corporation Secure public cloud with protected guest-verified host control
CN106775924B (zh) * 2016-11-07 2018-08-07 北京百度网讯科技有限公司 虚拟机启动方法和装置
US11687654B2 (en) * 2017-09-15 2023-06-27 Intel Corporation Providing isolation in virtualized systems using trust domains
CN109190386B (zh) * 2018-04-04 2021-11-12 中国电子科技网络信息安全有限公司 基于Device Mapper的容器镜像分层加密存储方法
CN109639424B (zh) * 2018-12-25 2022-06-17 超越科技股份有限公司 一种基于不同密钥的虚拟机镜像加密方法及装置
US11537421B1 (en) * 2019-06-07 2022-12-27 Amazon Technologies, Inc. Virtual machine monitor providing secure cryptographic operations
CN110334531B (zh) * 2019-07-01 2023-07-11 深信服科技股份有限公司 虚拟机密钥的管理方法、主节点、系统、存储介质及装置
KR102179185B1 (ko) * 2020-07-02 2020-11-17 굿모닝아이텍(주) 서버 관리 시스템
KR102175317B1 (ko) * 2020-07-02 2020-11-06 굿모닝아이텍(주) 데스크톱 가상화
US11936791B2 (en) * 2020-09-21 2024-03-19 Jason Burt Verification of the reliability of software and devices against assertions and guarantees
CN112748984B (zh) * 2020-12-28 2022-12-06 海光信息技术股份有限公司 虚拟机数据处理、控制方法、处理器、芯片、装置及介质
CN114553478A (zh) * 2022-01-13 2022-05-27 成都储迅科技有限责任公司 一种基于国密的云服务器访问固态硬盘的安全系统和方法
CN114285675B (zh) * 2022-03-07 2022-07-12 杭州优云科技有限公司 一种报文转发方法及设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101976317A (zh) * 2010-11-05 2011-02-16 北京世纪互联工程技术服务有限公司 一种私有云计算应用中虚拟机镜像安全方法
CN103107994A (zh) * 2013-02-06 2013-05-15 中电长城网际系统应用有限公司 一种虚拟化环境数据安全隔离方法和系统
CN103457919A (zh) * 2012-06-04 2013-12-18 中兴通讯股份有限公司 虚拟机镜像的安全验证方法和装置
CN103563278A (zh) * 2011-05-20 2014-02-05 西里克斯系统公司 保护加密的虚拟硬盘

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2005096120A1 (ja) * 2004-04-02 2005-10-13 Matsushita Electric Industrial Co., Ltd. 実行装置
JP4782871B2 (ja) * 2007-10-03 2011-09-28 富士通株式会社 デバイスアクセス制御プログラム、デバイスアクセス制御方法および情報処理装置
US8364983B2 (en) * 2008-05-08 2013-01-29 Microsoft Corporation Corralling virtual machines with encryption keys
CN101587524B (zh) 2009-06-23 2015-02-11 宏碁电脑(上海)有限公司 一种基于虚拟系统的数据存储设备加密方法
US9367341B2 (en) * 2010-03-30 2016-06-14 Red Hat Israel, Ltd. Encrypting and decrypting virtual disk content using a single user sign-on
WO2011150346A2 (en) * 2010-05-28 2011-12-01 Laurich Lawrence A Accelerator system for use with secure data storage
JP5552942B2 (ja) * 2010-07-28 2014-07-16 富士通株式会社 情報送信装置、ネットワークシステム、情報送信方法および情報送信プログラム
CN102034046B (zh) * 2010-12-10 2012-10-03 北京世纪互联工程技术服务有限公司 云计算环境中基于磁盘驱动的数据底层加密方法
US8495356B2 (en) * 2010-12-31 2013-07-23 International Business Machines Corporation System for securing virtual machine disks on a remote shared storage subsystem
US9021264B2 (en) * 2011-02-03 2015-04-28 Cloudlink Technologies Inc. Method and system for cloud based storage
JP5786611B2 (ja) * 2011-09-30 2015-09-30 富士通株式会社 ストレージ装置およびストレージシステム
CN103067425B (zh) * 2011-10-20 2016-04-27 中国移动通信集团公司 虚拟机创建方法、虚拟机管理系统及相关设备
CN102609643A (zh) * 2012-01-10 2012-07-25 道里云信息技术(北京)有限公司 一种对虚拟机作动态密码学保护与所需的密钥管理方法
US9250945B2 (en) * 2012-03-27 2016-02-02 Microsoft Technology Licensing, Llc Detecting a repeating execution time sequence in a virtual machine
CN103634339A (zh) 2012-08-22 2014-03-12 中国银联股份有限公司 虚拟加密机装置、金融加密机及加密报文的方法
CN104756127B (zh) * 2012-10-12 2018-03-27 皇家飞利浦有限公司 通过虚拟机进行安全数据处理
US9215067B2 (en) * 2013-04-05 2015-12-15 International Business Machines Corporation Achieving storage efficiency in presence of end-to-end encryption using downstream decrypters
US10671545B2 (en) * 2014-06-28 2020-06-02 Vmware, Inc. Asynchronous encryption and decryption of virtual machine memory for live migration
CN104104692B (zh) * 2014-08-05 2017-03-08 中孚信息股份有限公司 一种虚拟机加密方法、解密方法及加解密控制系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101976317A (zh) * 2010-11-05 2011-02-16 北京世纪互联工程技术服务有限公司 一种私有云计算应用中虚拟机镜像安全方法
CN103563278A (zh) * 2011-05-20 2014-02-05 西里克斯系统公司 保护加密的虚拟硬盘
CN103457919A (zh) * 2012-06-04 2013-12-18 中兴通讯股份有限公司 虚拟机镜像的安全验证方法和装置
CN103107994A (zh) * 2013-02-06 2013-05-15 中电长城网际系统应用有限公司 一种虚拟化环境数据安全隔离方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3160103A4 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110297687A (zh) * 2018-03-21 2019-10-01 阿里巴巴集团控股有限公司 基于虚拟主机的数据交互方法、装置及系统
CN110297687B (zh) * 2018-03-21 2023-05-30 阿里巴巴集团控股有限公司 基于虚拟主机的数据交互方法、装置及系统
CN110971656A (zh) * 2018-10-01 2020-04-07 施耐德电器工业公司 区块链中的数据的安全存储
CN110971656B (zh) * 2018-10-01 2024-04-26 施耐德电器工业公司 区块链中的数据的安全存储
CN111741068A (zh) * 2020-05-20 2020-10-02 中国电子科技网络信息安全有限公司 一种虚拟机镜像链密钥模型及其数据加密密钥传输方法
CN111741068B (zh) * 2020-05-20 2022-03-18 中国电子科技网络信息安全有限公司 一种数据加密密钥传输方法

Also Published As

Publication number Publication date
US10409990B2 (en) 2019-09-10
EP3160103B1 (en) 2019-11-20
EP3160103A4 (en) 2017-10-18
EP3160103A1 (en) 2017-04-26
CN106063218B (zh) 2018-06-05
US20180218156A1 (en) 2018-08-02
JP2017535091A (ja) 2017-11-24
US20170300695A1 (en) 2017-10-19
JP6414863B2 (ja) 2018-10-31
US9959410B2 (en) 2018-05-01
CN106063218A (zh) 2016-10-26

Similar Documents

Publication Publication Date Title
WO2016106566A1 (zh) 虚拟化系统中加解密的方法、装置和系统
US11200327B1 (en) Protecting virtual machine data in cloud environments
US9461819B2 (en) Information sharing system, computer, project managing server, and information sharing method used in them
US10262130B2 (en) System and method for providing cryptographic operation service in virtualization environment
US9317316B2 (en) Host virtual machine assisting booting of a fully-encrypted user virtual machine on a cloud environment
US9300640B2 (en) Secure virtual machine
US8977842B1 (en) Hypervisor enabled secure inter-container communications
US11675914B2 (en) Secure information storage
KR20160097892A (ko) 가상화 기반의 보안 서비스 제공 장치 및 제공 방법
JP2011048661A (ja) 仮想サーバ暗号化システム
US11327782B2 (en) Supporting migration of virtual machines containing enclaves
JP5524355B2 (ja) 仮想計算機管理方法、計算機システム及び計算機
TWI786373B (zh) 用於安全介面控制之安全執行客體所有者控制之電腦實施方法、電腦系統及電腦程式產品
WO2023273647A1 (zh) 虚拟化可信平台模块实现方法、安全处理器及存储介质
JP2023511834A (ja) セキュア・ゲストへのセキュリティ・モジュールのセキュア・オブジェクトのバインディング
US20140189235A1 (en) Stealth appliance between a storage controller and a disk array
US20220326975A1 (en) Transparent data reduction in private/public cloud environments for host encrypted data
JP2013003612A (ja) 仮想サーバ利用時のデータを秘匿するシステム及び方法
KR20040020175A (ko) 공개키 암호화 알고리즘을 적용하여 콘텐츠 파일을커널모드에서 복호화하는 방법, 이를 이용하여뷰어프로그램의 plug-in 지원에 비종속적인 DRM클라이언트 프로그램
JP2020043493A (ja) ネットワーク装置及びプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14909378

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2014909378

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2014909378

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2017504166

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE