WO2019157816A1 - 一种加密方法及装置 - Google Patents

一种加密方法及装置 Download PDF

Info

Publication number
WO2019157816A1
WO2019157816A1 PCT/CN2018/106017 CN2018106017W WO2019157816A1 WO 2019157816 A1 WO2019157816 A1 WO 2019157816A1 CN 2018106017 W CN2018106017 W CN 2018106017W WO 2019157816 A1 WO2019157816 A1 WO 2019157816A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual machine
software system
key
symmetric key
user terminal
Prior art date
Application number
PCT/CN2018/106017
Other languages
English (en)
French (fr)
Inventor
刘国平
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2019157816A1 publication Critical patent/WO2019157816A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2107—File encryption

Definitions

  • the present application relates to the field of cloud computing, and in particular, to an encryption method and apparatus.
  • the cloud data center belongs to the cloud service provider, and the user only rents the virtual machine (VM) of the cloud service provider.
  • the VM runs on the host of the service provider.
  • the random access memory (RAM) of the VM is allocated by the operating system (OS) of the host and the virtual machine manager (VMM). It is part of the Host RAM. Because RAM is not encrypted, Host can scan and peek into the confidential information in the RAM of the client VM. Therefore, in cloud computing, customers need to consider how to encrypt this important data when migrating important data to the cloud data center.
  • the most popular technology today is the built-in encryption engine and security processor in the processor.
  • the VMM loads the basic input output system (BIOS) of the VM and the clear text of the OS into the RAM of the cloud data center, and then the security processor generates a VM for the VM.
  • the encryption engine Encrypting the key and configuring the encryption key to the encryption engine, the encryption engine encrypts the RAM of the VM to generate a secure running environment; then moving the plaintext BIOS and the OS into the secure running environment, and finally the VM Run in this secure operating environment.
  • BIOS basic input output system
  • the cloud computing center establishes a safe running environment for the client's VM, which ensures the security of the VM during runtime.
  • the customer's data cannot be guaranteed to be secure until the VM's secure operating environment is established.
  • the embodiment of the present invention provides an encryption method and device for encrypting a whole process of a client in a cloud data center to implement security protection for customer data.
  • an embodiment of the present application provides an encryption method, including:
  • the encryption method is applied to a cloud computing server, where the cloud computing server includes a security processor, an encryption and decryption engine, a target virtual machine, and a virtual machine manager; wherein the virtual machine manager allocates a virtual central processing unit vCPU and the target virtual machine a first RAM; then the security processor acquires a symmetric key and configures the symmetric key to the encryption and decryption engine; and finally the encryption and decryption engine utilizes the symmetric key to virtualize the target for the vCPU when accessing the first RAM
  • the software system ciphertext of the machine is encrypted and decrypted.
  • the software system ciphertext is generated by the user terminal using the symmetric key to encrypt the software system of the target virtual machine, and the software system ciphertext is loaded by the cloud computing server to the first RAM of the target virtual machine.
  • the user terminal encrypts the software system of the target virtual machine belonging to the user by using the symmetric key to generate the ciphertext of the software system; and then loads the ciphertext of the software system into the target virtual machine.
  • the RAM is configured to the encryption and decryption engine after the security processor obtains the symmetric key, so that the encryption and decryption engine can use the symmetric key to encrypt and decrypt the operating environment of the target virtual machine. That is, in the process of performing cloud computing, the user uses the symmetric key for encryption from data transmission to data operation, and the virtual machine manager does not know the symmetric key, thereby ensuring data security.
  • the symmetric key may be generated autonomously by the user terminal, or may be generated by the user terminal in consultation with the security processor.
  • the method for the security processor to obtain the symmetric key is as follows:
  • the security processor generates an asymmetric key, and the asymmetric key includes a public key and a private key, and the public key is provided by the security processor to the user terminal, and the private key is saved by the security processor and cannot be Deriving a memory port of the security processor; then, the security processor receives the encrypted symmetric key encrypted by the user terminal by using the public key; and finally the security processor encrypts the symmetric key by using the private key saved by itself Decryption is performed to obtain the symmetric key.
  • the security processor itself knows the symmetric key, and the symmetric key does not need to be acquired to the user terminal or other device.
  • the public key may be sent to the user terminal by using an email, or the public key may be notified to the user terminal by using a communication method such as a short message. Way, here is not limited.
  • the cloud computing server and the user terminal determine the symmetric key in multiple manners, and in the case that the symmetric key is automatically generated by the user terminal, the security processor generates an asymmetric key.
  • the key encrypts and transmits the symmetric key, thereby effectively ensuring the security of the user to transmit data.
  • the software system ciphertext needs to be loaded into the first RAM of the target virtual machine by the cloud computing server, and the specific manner includes the following:
  • the virtual machine manager receives the software system ciphertext sent by the user terminal; and then the virtual machine manager loads the software system ciphertext to the first RAM.
  • the security processor receives the software system ciphertext sent by the user terminal; and then the security processor loads the software system ciphertext to the first RAM.
  • the embodiment of the present application further includes the following method:
  • the security processor generates a temporary symmetric key
  • the security processor configures the temporary symmetric key to the encryption and decryption engine
  • the security processor decrypts the ciphertext of the software system by using the symmetric key to obtain the software system;
  • the security processor loads the software system to the first RAM;
  • the encryption and decryption engine uses the temporary symmetric key to perform encryption and decryption processing on the software system of the target virtual machine when the security processor and the vCPU access the first RAM.
  • the security processor can generate a new temporary symmetric key to avoid security problems when multiple virtual machines share a symmetric key.
  • the cloud computing server may directly load the software system ciphertext into the first RAM, or may use the virtual machine manager to The software system ciphertext is loaded into the first RAM, thereby effectively ensuring data security.
  • the software system of the target virtual machine includes at least one of a BIOS, an OS loader, an OS kernel, and an Application
  • the software system ciphertext includes at least one of a BIOS, an OS loader, an OS kernel, and an Application.
  • the cloud computing server loads the BIOS and the OS Loader into the first RAM, and then when the OS Loader is run, the OS Loader boots the OS Kernel. Load until the software system is loaded.
  • the encryption key of the OS kernel is different from the encryption key of the BIOS and the OS loader. It can be understood that the encryption method of the OS kernel is the same as the encryption method of the BIOS and the OS loader, and details are not described herein.
  • the cloud computing server can also perform the following operations:
  • the virtual machine manager allocates a second RAM to the target virtual machine; at the same time, the security processor generates a temporary key for the second RAM, and allocates the temporary key to the encryption and decryption engine; the target virtual machine has its own
  • the software system migrates from the first RAM to the second RAM; the encryption and decryption engine utilizes the temporary key configured by the security processor to access the second RAM of the user's target virtual machine to the vCPU,
  • the RAM performs encryption and decryption processing; finally, the target virtual machine starts running by using the vCPU and the second RAM, and performs corresponding operations of the user; after the target virtual machine migrates the software system, the virtual machine manager may A RAM is released.
  • the virtual machine manager can allocate the first RAM and the second RAM to the target virtual machine at the same time; or the target virtual machine can first allocate the first RAM, and then load the software system of the target virtual machine.
  • the second RAM is allocated to the target virtual machine after the first RAM, as long as the data security of the user can be ensured.
  • the specific manner is not limited herein.
  • an embodiment of the present application provides an encryption method, including:
  • the encryption method is applied to a user terminal, and the user terminal encrypts a software system of the target virtual machine by using a symmetric key to obtain a software system ciphertext, where the target virtual machine is located in the cloud computing server; and then the user terminal sends the software system ciphertext Giving the cloud computing server; the cloud computing server loading the software system ciphertext to the first RAM, wherein the first RAM is allocated by the virtual machine manager of the cloud computing server to the target virtual machine; when the virtual machine is managed When the virtual CPU assigned to the target virtual machine accesses the first RAM, the software system ciphertext is encrypted and decrypted by the encryption and decryption engine of the target virtual machine by using the symmetric key, and the symmetric key is used by the
  • the security processor of the cloud computing server is acquired and configured for the encryption and decryption engine.
  • the user terminal encrypts the software system of the target virtual machine belonging to the user by using the symmetric key to generate the ciphertext of the software system; and then loads the ciphertext of the software system into the target virtual machine.
  • the RAM is configured to the encryption and decryption engine after the security processor obtains the symmetric key, so that the encryption and decryption engine can use the symmetric key to encrypt and decrypt the operating environment of the target virtual machine. That is, in the process of performing cloud computing, the user uses the symmetric key for encryption from data transmission to data operation, and the virtual machine manager does not know the symmetric key, thereby ensuring data security.
  • the symmetric key may be generated by the user terminal itself and then notified to the security processor or may be generated by the user terminal in consultation with the security processor.
  • the encryption method further includes the following solutions:
  • the user terminal receives the public key in the asymmetric key generated by the security processor sent by the security processor; then the user terminal uses the public key to encrypt the symmetric key to generate an encrypted symmetric key; finally, the user The terminal sends the encrypted symmetric key to the security processor, so that the security processor decrypts the encrypted symmetric key by using the private key in the asymmetric key to obtain the symmetric key.
  • the cloud computing server and the user terminal determine the symmetric key in multiple manners, and in the case that the symmetric key is automatically generated by the user terminal, the security processor generates an asymmetric key.
  • the key encrypts and transmits the symmetric key, thereby effectively ensuring the security of the user to transmit data.
  • the user terminal may further send the software system ciphertext to the virtual machine manager or the security processor, so that the cloud computing server may load the software system ciphertext to the first according to actual conditions.
  • RAM random access memory
  • the embodiment of the present application provides a cloud computing server, where the cloud computing server includes: a security processor, an encryption and decryption engine, a target virtual machine, and a virtual machine manager;
  • the virtual machine manager is configured to allocate a virtual central processing unit vCPU and a first RAM to the target virtual machine;
  • the security processor is configured to acquire a symmetric key, and configure the symmetric key to the encryption and decryption engine;
  • the encryption and decryption engine is configured to perform encryption and decryption processing on the software system ciphertext of the target virtual machine when the vCPU accesses the first RAM by using the symmetric key, where the software system ciphertext is a user terminal A software system for encrypting the target virtual machine is generated using the symmetric key, and the software system ciphertext is loaded to the first RAM.
  • the embodiment of the present application provides a user terminal, where the user terminal has the function of implementing the user terminal in the foregoing method.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the user terminal includes:
  • a processing module configured to encrypt a software system of the target virtual machine by using a symmetric key to obtain a software system ciphertext, where the target virtual machine is located in the cloud computing server;
  • a sending module configured to send the software system ciphertext to the cloud computing server, so that the software system ciphertext is loaded to a first RAM, where the first RAM is a virtual machine management of the cloud computing server The virtual machine is allocated to the target virtual machine.
  • the virtual central processing unit vCPU accesses the first RAM, the software system ciphertext is processed by the encryption and decryption engine of the cloud computing server by using the symmetric key for the virtual central processing.
  • the vCPU performs encryption and decryption processing when accessing the first RAM, and the symmetric key is acquired by a security processor of the cloud computing server and configured to the encryption and decryption engine, and the vCPU is configured by the virtual machine manager The target virtual machine is allocated.
  • the user terminal includes:
  • Transceiver one or more processors, bus
  • the transceiver is coupled to the one or more processors via a bus;
  • the processor performs the following steps:
  • the software system of the target virtual machine is encrypted by using a symmetric key to obtain a ciphertext of the software system, where the target virtual machine is located in the cloud computing server;
  • the transceiver performs the following steps:
  • the security processor of the cloud computing server acquires and configures the encryption and decryption engine, and the vCPU is allocated by the virtual machine manager for the target virtual machine.
  • the embodiment of the present application provides a cloud computing system, where the cloud computing system includes a cloud computing server and a user terminal; and the cloud computing server performs data transmission with the user terminal; wherein the cloud computing server has the foregoing description.
  • an embodiment of the present application provides a computer readable storage medium, including instructions, when the instructions are run on a computer, the computer executes the foregoing method.
  • an embodiment of the present application provides a computer program product comprising instructions, wherein the computer executes the above method when the computer program product runs on a computer.
  • the embodiment of the present application has the following advantages: the user terminal encrypts the software system of the target virtual machine belonging to the user by using the symmetric key to generate the ciphertext of the software system; and then loads the ciphertext of the software system into the software system.
  • the target virtual machine is in the first RAM; and the security processor acquires the symmetric key and then allocates to the encryption and decryption engine, so that the encryption and decryption engine can use the symmetric key to add the operating environment of the target virtual machine.
  • Decrypt That is, in the process of performing cloud computing, the user uses the symmetric key for encryption from data transmission to data operation, and the virtual machine manager does not know the symmetric key, thereby ensuring data security.
  • FIG. 1 is a schematic diagram of a cloud computing system architecture in an embodiment of the present application
  • FIG. 3 is a schematic diagram of an embodiment of an encryption method in an embodiment of the present application.
  • FIG. 4 is a schematic diagram of loading a ciphertext of a software system in an embodiment of the present application
  • FIG. 5 is a schematic diagram of another embodiment of an encryption method according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of another embodiment of an encryption method in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of another embodiment of an encryption method according to an embodiment of the present application.
  • FIG. 8 is a schematic diagram of an embodiment of a cloud computing server according to an embodiment of the present application.
  • FIG. 9 is a schematic diagram of an embodiment of a user terminal according to an embodiment of the present application.
  • FIG. 10 is a schematic diagram of another embodiment of a user terminal according to an embodiment of the present application.
  • FIG. 11 is a schematic diagram of an embodiment of a cloud computing system according to an embodiment of the present application.
  • the embodiment of the present invention provides an encryption method and device for encrypting a whole process of a client in a cloud data center to implement security protection for customer data.
  • the cloud computing system includes: a cloud computing server and a user terminal; wherein the cloud computing server includes a central processing unit (CPU), a memory RAM, a security processor, and a A decryption engine, a virtual machine, and a virtual machine manager; the user terminal is a user-approved physical or virtual computer in a secure state.
  • the virtual machine manager allocates a corresponding RAM and a virtual central processing unit (vCPU) for the virtual machine, and the virtual machine will run in the corresponding vCPU and RAM.
  • vCPU virtual central processing unit
  • the current encryption technology is shown in Figure 2.
  • the CPU of the cloud computing server has a built-in encryption engine. Then, when the client performs cloud computing in the cloud data center, the specific steps are as follows: 1.
  • the VMM loads the BIOS and OS plaintext of the VM into the cloud data center.
  • the security processor generates an encryption key for the VM, and configures the encryption key to the encryption engine; 3.
  • the encryption engine encrypts the RAM of the VM to generate a secure operating environment; And moving the plaintext BIOS and OS into the secure running environment; 5.
  • the VM runs in the secure running environment.
  • the cloud computing center establishes a safe running environment for the VM of the client, which ensures the security of the VM during operation, but the data of the client cannot be secured before the safe running environment of the VM is established.
  • the user cannot control the key during the entire encryption process, so that the user cannot generate sufficient security for the system.
  • the embodiment of the present application provides a solution that is applied to a cloud computing server, where the cloud computing server includes a security processor, an encryption and decryption engine, a target virtual machine, and a virtual machine manager; wherein the virtual The machine manager allocates a virtual central processing unit vCPU and a first RAM for the target virtual machine; then the security processor acquires a symmetric key and configures the symmetric key to the encryption and decryption engine; finally, the encryption and decryption engine utilizes the symmetric
  • the key is the encryption and decryption process of the software system ciphertext of the target virtual machine when the vCPU accesses the first RAM.
  • the software system ciphertext is generated by the user terminal using the symmetric key to encrypt the software system of the target virtual machine, and the software system ciphertext is loaded by the cloud computing server to the first RAM of the target virtual machine.
  • the virtual machine manager loads the software system of the target virtual machine to the first RAM.
  • an embodiment of the encryption method in the embodiment of the present application includes:
  • the security processor generates an asymmetric key, where the asymmetric key includes a public key and a private key.
  • the security processor generates an asymmetric key that will include the public and private keys.
  • the public key will be provided to the user, and the private key will be saved by the security processor and the private key cannot be exported by the secure processor.
  • the asymmetric key may be generated when the user performs cloud computing, or may be generated in advance.
  • the security processor provides the public key to the user.
  • the manner in which the security processor provides the public key to the user may include the following possibilities:
  • the security processor sends the public key to a cloud computing interface of a user terminal currently used by the user;
  • the security processor sends the public key to the user by SMS or email.
  • the user uses the public key to encrypt the symmetric key by using the public key, and generates a software system ciphertext according to the symmetric key to encrypt the software system of the target virtual machine.
  • the user When the user uses the cloud computing, the user sets a symmetric key for the software system of the target virtual machine belonging to the user, and encrypts the software system of the target virtual machine by using the symmetric key by the currently used user terminal.
  • Software system ciphertext At the same time, the cloud computing server can decrypt the software system ciphertext, and the user encrypts the symmetric key by using the public key to generate an encrypted symmetric key.
  • the user terminal sends the encrypted symmetric key to the security processor.
  • the user transmits the encrypted symmetric key to the secure processor through the user terminal.
  • the user terminal sends the software system ciphertext to the virtual machine manager.
  • the user sends the software system ciphertext to the virtual machine manager through the user terminal.
  • step 304 there is no time difference between step 304 and step 305, and the specific time sequence of occurrence is not limited herein.
  • the virtual machine manager loads the software system ciphertext to the first RAM.
  • the virtual machine manager allocates a first vCPU and a first RAM to a target virtual machine rented by a user. After receiving the ciphertext sent by the user terminal to the software system, the virtual machine manager loads the ciphertext of the software system into the first RAM.
  • the components of the software system of the target virtual machine include a Basic Input Output System (BIOS), an OS loader OS loader, an operating system kernel OS kernel, and an application Application.
  • BIOS Basic Input Output System
  • OS loader OS loader OS loader
  • OS kernel OS kernel
  • application Application an application Application
  • FIG. 4 when the user encrypts the generated software system using the symmetric key to include the BIOS and the OS Loader, the virtual machine manager loads the BIOS and the OS Loader into the first RAM, and then After the OS Loader is run, the OS Loader boots the OS Kernel to load until the software system is loaded.
  • OS Kernel and the BIOS and the OS Loader may not have the same encryption key, and the virtual machine manager does not know the encryption key of each part of the software system, but the OS Kernel is encrypted.
  • the encryption method of the OS Loader is the same, and will not be described here.
  • the security processor decrypts the encrypted symmetric key to obtain a symmetric key.
  • the security processor decrypts the encrypted symmetric key using the private key to obtain the symmetric key.
  • the security processor sends the symmetric key to the encryption and decryption engine.
  • the security processor configures the symmetric key to the encryption and decryption engine.
  • the encryption and decryption engine uses the symmetric key to perform encryption and decryption processing when the vCPU of the target virtual machine accesses the first RAM.
  • the encryption and decryption engine encrypts and decrypts the software system ciphertext and the first RAM when the vCPU accesses the first RAM by using the symmetric key configured by the security processor. Finally, the target virtual machine starts running with the vCPU and the first RAM, and performs corresponding operations of the user.
  • the user terminal encrypts the software system of the target virtual machine belonging to the user by using a symmetric key to generate a software system ciphertext; and then loads the software system ciphertext into the first RAM of the target virtual machine;
  • the security processor is configured to the encryption and decryption engine, so that the encryption and decryption engine can use the symmetric key to encrypt and decrypt the operating environment of the target virtual machine. That is, in the process of performing cloud computing, the user uses the symmetric key for encryption from data transmission to data operation, and the virtual machine manager does not know the symmetric key, thereby ensuring data security.
  • the security processor loads the software system of the target virtual machine to the first RAM.
  • FIG. 5 another embodiment of the encryption method in the embodiment of the present application includes:
  • the security processor generates an asymmetric key, where the asymmetric key includes a public key and a private key.
  • the security processor generates an asymmetric key that will include the public and private keys.
  • the public key will be provided to the user, and the private key will be saved by the security processor and the private key cannot be exported by the secure processor.
  • the asymmetric key may be generated when the user performs cloud computing, or may be generated in advance.
  • the security processor provides the public key to the user.
  • the manner in which the security processor provides the public key to the user may include the following possibilities:
  • the security processor sends the public key to a cloud computing interface of a user terminal currently used by the user;
  • the security processor sends the public key to the user by SMS or email.
  • the user terminal encrypts the symmetric key by using the public key to generate an encrypted symmetric key, and encrypts the software system of the target virtual machine according to the symmetric key to generate a software system ciphertext.
  • the user When the user uses the cloud computing, the user generates a symmetric key for the software system assigned to the target virtual machine of the user, and encrypts the software system of the target virtual machine by using the symmetric key by the currently used user terminal.
  • Software system ciphertext At the same time, the cloud computing server can decrypt the software system ciphertext, and the user encrypts the symmetric key by using the public key to generate an encrypted symmetric key.
  • the user terminal sends the encrypted symmetric key and the software system ciphertext to the security processor.
  • the user sends the encrypted symmetric key and the software system ciphertext to the security processor through the user terminal.
  • the security processor loads the software system ciphertext to the first RAM.
  • the virtual machine manager allocates a first vCPU and a first RAM to a target virtual machine rented by a user.
  • the security processor loads the ciphertext of the software system into the first RAM.
  • the components of the software system of the target virtual machine include a Basic Input Output System (BIOS), an OS loader OS loader, an operating system kernel OS kernel, and an application Application.
  • BIOS Basic Input Output System
  • OS loader OS loader OS loader
  • OS kernel OS kernel
  • application Application an application Application
  • the security processor during the loading process of the actual software system, which part of the security processor is specifically loaded can be freely set by the security processor. For example, as shown in FIG. 4, when the user encrypts the generated software system using the symmetric key to include the BIOS and the OS Loader, the security processor loads the BIOS and the OS Loader into the first RAM, and then the OS. After the Loader is run, the OS Loader boots the OS Kernel to load until the software system is loaded.
  • the encryption key of the OS Kernel and the BIOS and the OS Loader may be different, and the security processor does not know the encryption key of each part of the software system, but the encryption method of the OS Kernel and the The encryption method of the OS Loader is the same, and will not be described here.
  • the security processor may first decrypt the software system ciphertext by using the private key to obtain a plaintext of the software system, and then load the software system plaintext into the first RAM.
  • the security processor needs to configure the symmetric key to the encryption/decryption engine or configure a new temporary symmetric key generated by the security processor when loading into the first RAM;
  • the encryption and decryption engine may perform encryption and decryption processing on the software system by using the symmetric key or the temporary symmetric key.
  • the security processor decrypts the encrypted symmetric key to obtain a symmetric key.
  • the security processor decrypts the encrypted symmetric key using the private key to obtain the symmetric key.
  • the security processor sends the symmetric key to the encryption and decryption engine.
  • the security processor configures the symmetric key to the encryption and decryption engine.
  • the encryption and decryption engine uses the symmetric key to perform encryption and decryption processing when the vCPU of the target virtual machine accesses the first RAM.
  • the encryption and decryption engine encrypts and decrypts the software system ciphertext and the first RAM when the vCPU accesses the first RAM by using the symmetric key configured by the security processor. Finally, the target virtual machine starts running with the vCPU and the first RAM, and performs corresponding operations of the user.
  • the user terminal encrypts the software system of the target virtual machine belonging to the user by using a symmetric key to generate a software system ciphertext; and then loads the software system ciphertext into the first RAM of the target virtual machine;
  • the security processor is configured to the encryption and decryption engine, so that the encryption and decryption engine can use the symmetric key to encrypt and decrypt the operating environment of the target virtual machine. That is, in the process of performing cloud computing, the user uses the symmetric key for encryption from data transmission to data operation, and the virtual machine manager does not know the symmetric key, thereby ensuring data security.
  • FIG. 6 another embodiment of the encryption method in the embodiment of the present application includes:
  • the security processor negotiates with the user terminal to generate a symmetric key.
  • the security processor and the user terminal negotiate the current symmetric key through signaling interaction.
  • the representation of the symmetric key may be a Deffie-Hellman (DH) key exchange protocol, which is used to enable both parties of the communication to securely exchange keys in an unsecured channel for encryption. Subsequent communication messages.
  • DH Deffie-Hellman
  • the symmetric key of the user terminal encrypts a software system of the target virtual machine to generate a software system ciphertext.
  • the user uses the symmetric key to encrypt and generate the software system ciphertext for the software system assigned to the target virtual machine of the user.
  • the user terminal sends the software system ciphertext to the security processor.
  • the user sends the encrypted symmetric key and the software system ciphertext to the security processor through the user terminal.
  • the security processor loads the software system ciphertext to the first RAM.
  • the virtual machine manager allocates a first vCPU and a first RAM to a target virtual machine rented by a user.
  • the security processor loads the ciphertext of the software system into the first RAM.
  • the components of the software system of the target virtual machine include a Basic Input Output System (BIOS), an OS loader OS loader, an operating system kernel OS kernel, and an application Application.
  • BIOS Basic Input Output System
  • OS loader OS loader OS loader
  • OS kernel OS kernel
  • application Application an application Application
  • the security processor during the loading process of the actual software system, which part of the security processor is specifically loaded can be freely set by the security processor. For example, as shown in FIG. 4, when the user encrypts the generated software system using the symmetric key to include the BIOS and the OS Loader, the security processor loads the BIOS and the OS Loader into the first RAM, and then the OS. After the Loader is run, the OS Loader boots the OS Kernel to load until the software system is loaded.
  • the encryption key of the OS Kernel and the BIOS and the OS Loader may be different, and the security processor does not know the encryption key of each part of the software system, but the encryption method of the OS Kernel and the The encryption method of the OS Loader is the same, and will not be described here.
  • the security processor may first decrypt the software system ciphertext by using the symmetric key to obtain a plaintext of the software system, and then load the software system plaintext into the first RAM.
  • the security processor sends the symmetric key to the encryption and decryption engine.
  • the security processor configures the symmetric key to the encryption and decryption engine.
  • the encryption and decryption engine uses the symmetric key to perform encryption and decryption processing on the ciphertext of the software system when the vCPU of the target virtual machine accesses the first RAM.
  • the encryption and decryption engine encrypts and decrypts the software system ciphertext and the first RAM when the vCPU accesses the first RAM by using the symmetric key configured by the security processor. Finally, the target virtual machine starts running with the vCPU and the first RAM, and performs corresponding operations of the user.
  • the security system loads the ciphertext of the software system as an example, but it can be understood that the technical solution provided by the embodiment can also be applied to load the software system with the virtual machine manager shown in FIG. 3.
  • the steps 603 and 604 in the embodiment are replaced by the steps 305 and 306, and details are not described herein.
  • the cloud computing server can also perform the following operations:
  • the virtual machine manager allocates a second RAM to the target virtual machine; and the security processor generates a temporary key for the second RAM, and allocates the temporary key to the encryption and decryption engine;
  • the target virtual machine migrates its own software system from the first RAM to the second RAM;
  • the encryption and decryption engine uses the temporary key configured by the security processor to access the second RAM of the user's target virtual machine at the vCPU
  • the second RAM is subjected to encryption and decryption processing; finally, the target virtual machine starts running with the vCPU and the second RAM, and performs corresponding operations of the user.
  • the virtual machine manager can release the first RAM.
  • the virtual machine manager can allocate the first RAM and the second RAM to the target virtual machine at the same time; or the target virtual machine can first allocate the first RAM, and then load the software system of the target virtual machine.
  • the second RAM is allocated to the target virtual machine after the first RAM, as long as the data security of the user can be ensured.
  • the specific manner is not limited herein.
  • the user terminal encrypts the software system of the target virtual machine belonging to the user by using a symmetric key to generate a software system ciphertext; and then loads the software system ciphertext into the first RAM of the target virtual machine;
  • the security processor is configured to the encryption and decryption engine, so that the encryption and decryption engine can use the symmetric key to encrypt and decrypt the operating environment of the target virtual machine. That is, in the process of performing cloud computing, the user uses the symmetric key for encryption from data transmission to data operation, and the virtual machine manager does not know the symmetric key, thereby ensuring data security.
  • the encryption method in the embodiment of the present application is described above.
  • the cloud computing server in the embodiment of the present application is described below.
  • the cloud computing server 800 in the embodiment of the present application includes: a security processor 801, an encryption and decryption engine 802, a target virtual machine 803, and a virtual machine manager 804;
  • the virtual machine manager 804 is configured to allocate a virtual central processing unit vCPU and a first RAM to the target virtual machine 803, where the target virtual machine 803 is located in the cloud computing server 800;
  • the security processor 801 is configured to acquire a symmetric key; the symmetric key is configured to the encryption and decryption engine 802;
  • the encryption and decryption engine 802 is configured to perform encryption and decryption processing on the software system ciphertext of the target virtual machine 803 when the vCPU accesses the first RAM by using the symmetric key, where the software system ciphertext is The user terminal encrypts the software system of the target virtual machine by using the symmetric key, and the software system ciphertext is loaded to the first RAM.
  • the symmetric key is generated by the user terminal or generated by the security processor 801 and the user terminal.
  • the security processor 801 is further configured to generate an asymmetric key, where the asymmetric key includes a public key and a private key, where the public key The key is provided by the security processor to the user terminal, and the private key is saved by the security processor; receiving an encrypted symmetric key sent by the user terminal, where the encrypted symmetric key is utilized by the user terminal The public key encrypts the symmetric key generation; decrypting the encrypted symmetric key by using the private key to obtain the symmetric key.
  • the virtual machine manager 804 is configured to receive the software system ciphertext sent by the user terminal, and load the software system ciphertext into the first RAM;
  • the security processor 801 is configured to receive the software system ciphertext sent by the user terminal, and load the software system ciphertext into the first RAM.
  • the software system of the target virtual machine includes at least one of a basic input output system BIOS, an operating system loader OS loader, an operating system kernel OS kernel, and an application application, where the software system ciphertext includes a BIOS, At least one of OS loader, OS kernel, and Application.
  • loading the ciphertext of the software system includes:
  • BIOS and the OS loader are loaded to the first RAM
  • the OS loader loads the OS kernel to the first RAM.
  • the encryption key of the OS kernel is different from the encryption key of the BIOS and the OS loader.
  • the virtual machine manager 804 is further configured to allocate a second RAM to the target virtual machine 803;
  • the security processor 801 is further configured to generate a temporary key, and allocate the temporary key to the encryption and decryption engine 802;
  • the target virtual machine 803 is configured to migrate the software system to the second RAM, where the software system is decrypted by the encryption and decryption engine 802 by using the symmetric key to decrypt the software system ciphertext. ;
  • the encryption/decryption 802 is configured to encrypt and decrypt the software system when the vCPU accesses the second RAM by using the temporary key;
  • the target virtual machine 803 is configured to be in the vCPu and the Running in the second RAM;
  • the virtual machine manager 804 is configured to release the first RAM.
  • the user terminal encrypts the software system of the target virtual machine belonging to the user by using a symmetric key to generate a software system ciphertext; and then loads the software system ciphertext into the first RAM of the target virtual machine;
  • the security processor is configured to the encryption and decryption engine, so that the encryption and decryption engine can use the symmetric key to encrypt and decrypt the operating environment of the target virtual machine. That is, in the process of performing cloud computing, the user uses the symmetric key for encryption from data transmission to data operation, and the virtual machine manager does not know the symmetric key, thereby ensuring data security.
  • an embodiment of the user terminal in the embodiment of the present application includes:
  • the processing module 901 is configured to encrypt the software system of the target virtual machine by using a symmetric key to obtain a software system ciphertext, where the target virtual machine is located in the cloud computing server;
  • the sending module 902 is configured to send the software system ciphertext to the cloud computing server, so that the software system ciphertext is loaded to the first RAM, where the first RAM is a virtual machine of the cloud computing server
  • the manager allocates the target virtual machine, and when the virtual central processing unit vCPU accesses the first RAM, the software system ciphertext is encrypted and decrypted by the encryption and decryption engine of the cloud computing server by using the symmetric key,
  • the symmetric key is acquired by a security processor of the cloud computing server and configured to the encryption and decryption engine, and the vCPU is allocated by the virtual machine manager to the target virtual machine.
  • processing module 901 is further configured to negotiate with the security processor to generate the symmetric key.
  • the processing module 901 is further configured to generate the symmetric key.
  • the sending module 902 is specifically configured to send the software system ciphertext to the virtual machine manager or the security processor.
  • the user terminal further includes a receiving module 903, where the receiving module 903 is configured to obtain a public key, where the public key is a public key in an asymmetric key generated by the security processor;
  • the processing module 901 is further configured to generate the encrypted symmetric key by using the public key to encrypt the symmetric key;
  • the sending module 902 is further configured to send the encrypted symmetric key to the security processor, so that the security processor decrypts the encrypted symmetric key by using the private key to obtain the symmetric key.
  • a key, the private key being a private key in an asymmetric key generated by the security processor.
  • the user terminal uses the symmetric key to encrypt the software system of the target virtual machine, thereby ensuring that the user can protect the data from the beginning when using the cloud computing server, thereby ensuring data security.
  • another embodiment of the user terminal in this embodiment of the present application includes:
  • transceiver 1001 a transceiver 1001, a processor 1002, and a bus 1003;
  • the transceiver 1001 is connected to the processor 1002 via the bus 1003;
  • the bus 1003 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 10, but it does not mean that there is only one bus or one type of bus.
  • the processor 1002 may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP.
  • CPU central processing unit
  • NP network processor
  • the processor 1002 may further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL) or any combination.
  • the user terminal may further include a memory 1004.
  • the memory 1004 may include a volatile memory such as a random-access memory (RAM); the memory may also include a non-volatile memory such as a flash memory ( A flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); the memory 1004 may further include a combination of the above types of memories.
  • RAM random-access memory
  • non-volatile memory such as a flash memory
  • HDD hard disk drive
  • SSD solid-state drive
  • the memory 1004 may further include a combination of the above types of memories.
  • the memory 1004 can also be used to store program instructions, and the processor 1002 can call the program instructions stored in the memory 1004, and can perform one or more of the above various embodiments, or an optional implementation thereof, The function of the user terminal in the above method is implemented.
  • the processor 1002 performs the following steps:
  • the software system of the target virtual machine is encrypted by using a symmetric key to obtain a ciphertext of the software system, where the target virtual machine is located in the cloud computing server;
  • the transceiver 1001 performs the following steps:
  • the security processor of the cloud computing server acquires and configures the encryption and decryption engine, and the vCPU is allocated by the virtual machine manager for the target virtual machine.
  • processor 1002 performs the following steps:
  • the symmetric key is generated in agreement with the security processor.
  • processor 1002 performs the following steps:
  • the symmetric key is generated.
  • the transceiver 1001 performs the following steps:
  • the transceiver 1001 performs the following steps:
  • the processor 1002 performs the following steps: using the public key to encrypt the symmetric key to generate an encrypted symmetric key;
  • the transceiver 1001 performs the steps of: transmitting the encrypted symmetric key to the security processor, so that the security processor decrypts the encrypted symmetric key by using the private key to obtain the symmetric A key, the private key being a private key in an asymmetric key generated by the security processor.
  • the user terminal uses the symmetric key to encrypt the software system of the target virtual machine, thereby ensuring that the user can protect the data from the beginning when using the cloud computing server, thereby ensuring data security.
  • an embodiment of the cloud computing system in the embodiment of the present application includes:
  • the cloud computing server has all the functions of the cloud computing server in FIG. 8;
  • the user terminal has all the functions of the user terminal in FIGS. 9 and 10.
  • the cloud computing system can effectively ensure data security when the user uses the cloud computing service.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • a computer readable storage medium A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)
  • Stored Programmes (AREA)

Abstract

一种加密方法及装置，用于为客户在云数据中心进行运行时的全过程进行加密，实现对客户数据的安全保护。本申请实施例方法包括：所述虚拟机管理器为目标虚拟机分配虚拟中央处理器vCPU和第一RAM，所述目标虚拟机位于所述云计算服务器；所述安全处理器获取对称密钥；所述安全处理器将所述对称密钥配置给所述加解密引擎；所述加解密引擎利用所述对称密钥为所述vCPU访问所述第一RAM时对所述目标虚拟机的软件系统密文进行加解密处理，所述软件系统密文为所述用户终端利用所述对称密钥加密所述目标虚拟机的软件系统生成，且所述软件系统密文被加载至所述第一RAM。

Description

一种加密方法及装置
本申请要求于2018年02月14日提交中国专利局、申请号为201810152246.9、申请名称为“一种加密方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及云计算领域，尤其涉及一种加密方法及装置。
背景技术
随着云计算技术的飞速发展，各大科技公司都把云计算作为其最重要的业务以及占领未来市场的杀手锏和技术制高点。越来越多的客户已经或正在计划把其数据中心往云数据中心上迁移。而云数据中心属于云服务商，用户只是租用云服务商的虚拟机(virtual machine，VM)使用。VM运行在服务商的主机(Host)上，VM的随机存取存储器(random access memory，RAM)由Host的操作系统(operating system，OS)和虚拟机管理器(virtual machine manager，VMM)分配，是Host RAM的一部分。因为RAM是没有加密的，所以Host完全可以扫描和偷窥客户VM的RAM中机密信息。因此，在云计算中，客户在将重要数据迁移到云数据中心上时需要考虑如何对该重要数据进行加密。
目前最普及的技术为在处理器中内置加密引擎和安全处理器。在客户在云数据中心中进行云计算时，VMM将VM的基本输入输出系统(basic input output system，BIOS)和OS明文加载入云数据中心的RAM中，然后该安全处理器为该VM生成一个加密密钥，并将该加密密钥配置给该加密引擎，由该加密引擎为该VM的RAM进行加密生成一个安全运行环境；然后将该明文BIOS和OS移入到该安全运行环境，最后该VM在该安全运行环境进行运行。
该技术中该云计算中心为该客户的VM建立了安全运行环境，保证了该VM运行时的安全。但是在该VM的安全运行环境建立之前，客户的数据却无法保证安全。
发明内容
本申请实施例提供了一种加密方法及装置，用于为客户在云数据中心进行运行时的全过程进行加密，实现对客户数据的安全保护。
第一方面，本申请实施例提供一种加密方法，具体包括：
该加密方法应用于云计算服务器，该云计算服务器包括安全处理器、加解密引擎、目标虚拟机以及虚拟机管理器；其中，该虚拟机管理器为该目标虚拟机分配虚拟中央处理器vCPU和第一RAM；然后该安全处理器获取对称密钥，并将该对称密钥配置给该加解密引擎；最后该加解密引擎利用该对称密钥为该vCPU访问该第一RAM时对该目标虚拟机的软件系统密文进行加解密处理。其中，该软件系统密文由用户终端利用该对称密钥加密该目标虚拟机的软件系统生成，且该软件系统密文被该云计算服务器加载至该目标虚拟机的第一RAM。
本申请实施例提供的技术方案中，用户终端利用对称密钥对归属于用户的目标虚拟机的软件系统进行加密生成软件系统密文；然后将该软件系统密文加载至该目标虚拟机的第一RAM中；同时该安全处理器获取到该对称密钥之后配置给加解密引擎，以使得该加解密 引擎可以利用该对称密钥对该目标虚拟机的运行环境进行加解密。即该用户在进行云计算的过程中，从数据的传输至数据的运行都利用该对称密钥进行加密，同时该虚拟机管理器并不知道该对称密钥，从而保证数据的安全性。
可选的，该对称密钥可以由该用户终端自主生成，也可以由该用户终端与该安全处理器协商处理生成。
在上述技术的基础上，若该对称密钥由该用户终端自主生成，则该安全处理器获取该对称密钥的方法具体如下：
该安全处理器生成非对称密钥，该非对称密钥包括公钥和私钥，该公钥由该安全处理器提供给该用户终端，而该私钥由该安全处理器自主保存，并不能导出该安全处理器的存储器口；然后，该安全处理器将接收到该用户终端利用该公钥加密后的加密对称密钥；最后该安全处理器通过自身保存的私钥对该加密对称密钥进行解密得到该对称密钥。
若该对称密钥收该用户终端与该安全处理器协商生成，则该安全处理器自身即获知该对称密钥，无需再向该用户终端或其他设备获取该对称密钥。
可以理解的是，该安全处理器将该公钥提供给该用户终端时，可以通过邮件向该用户终端发送该公钥，也可以通过短信等通信方式将该公钥告知给该用户终端，具体方式，此处不做限定。
本申请实施例提供的技术方案中，该云计算服务器与该用户终端采用多种方式确定对称密钥，并在对称密钥由该用户终端自主生成的情况下，该安全处理器生成非对称密钥对该对称密钥进行加密传输，从而有效保证用户传输数据的安全性。
可选的，在该目标虚拟机运行的过程中，该软件系统密文需要被该云计算服务器加载至该目标虚拟机的第一RAM中，具体方式包括如下：
一种可能实现方式中，该虚拟机管理器接收该用户终端发送的该软件系统密文；然后该虚拟机管理器将该软件系统密文加载至该第一RAM。
另一种可能实现方式中，该安全处理器接收该用户终端发送的该软件系统密文；然后，该安全处理器将该软件系统密文加载至该第一RAM。
可以理解的是，在该安全处理器在接收到该用户终端发送的软件系统密文之后，本申请实施例还包括如下方法：
该安全处理器生成临时对称密钥；
该安全处理器将该临时对称密钥配置给该加解密引擎；
该安全处理器利用该对称密钥对该软件系统密文进行解密得到该软件系统；
该安全处理器将该软件系统加载至该第一RAM；
该加解密引擎利用该临时对称密钥为该安全处理器和该vCPU访问该第一RAM时对该目标虚拟机的软件系统进行加解密处理。
本申请实施例中，该安全处理器在解密得到该软件系统之后，该安全处理器可以生成的新的临时对称密钥，以避免在多个虚拟机共用对称密钥时的安全性问题。
本申请实施例中，该云计算服务器在该安全处理器的内存满足数据加载的情况下，可以直接将该软件系统密文加载至该第一RAM中，也可以通过该虚拟机管理器将该软件系统 密文加载到该第一RAM中，从而有效的保证了数据安全性。
可选的，该目标虚拟机的软件系统包括BIOS、OS loader、OS kernel和Application中的至少一种，所述软件系统密文包括BIOS、OS loader、OS kernel和Application中的至少一种。当该软件系统密文包括该BIOS和该OS loader时，该云计算服务器将该BIOS和该OS Loader加载入该第一RAM，然后当该OS Loader运行起来后，该OS Loader引导该OS Kernel进行加载，直到加载完该软件系统。
可选的，该OS kernel的加密密钥与该BIOS和该OS loader的加密密钥不同。可以理解的是，该OS kernel的加密方法与该BIOS和该OS loader的加密方法是相同的，具体方式此处不再赘述。
可选的，由于可能出现用户将同一个对称密钥分配给该用户的多个VM使用，这样当该对称密钥出现泄露或者其他不安全的情况时，该用户的数据将存在泄露风险，为了解决这一问题，该云计算服务器还可以执行如下操作：
该虚拟机管理器为该目标虚拟机分配第二RAM；同时该安全处理器为该第二RAM生成临时密钥，并将该临时密钥分配给该加解密引擎；该目标虚拟机将自身的软件系统从该第一RAM中迁移至该第二RAM中；该加解密引擎利用该安全处理器配置的临时密钥对该用户的目标虚拟机在vCPU访问该第二RAM时，对该第二RAM进行加解密处理；最后该目标虚拟机利用该vCPU和该第二RAM开始运行，执行该用户的相应操作；在该目标虚拟机迁移该软件系统完成之后，该虚拟机管理器可以将该第一RAM释放。
可以理解的是，该虚拟机管理器可以同时为该目标虚拟机分配第一RAM和第二RAM；也可以为该目标虚拟机先分配该第一RAM，然后在该目标虚拟机的软件系统加载至该第一RAM之后再为该目标虚拟机分配该第二RAM，只要可以保证用户的数据安全即可，具体方式此处不做限定。
本申请实施例提供的技术方案中，可以当该对称密钥发生泄露时，有效的避免数据发生泄露风险。
第二方面，本申请实施例提供一种加密方法，具体包括：
该加密方法应用于用户终端，该用户终端利用对称密钥对目标虚拟机的软件系统进行加密得到软件系统密文，该目标虚拟机位于云计算服务器；然后该用户终端将该软件系统密文发送给该云计算服务器；该云计算服务器将该软件系统密文加载到第一RAM，其中，该第一RAM由该云计算服务器的虚拟机管理器为该目标虚拟机分配；当该虚拟机管理器为该目标虚拟机分配的虚拟中央处理器访问该第一RAM时，该软件系统密文将被该目标虚拟机的加解密引擎利用该对称密钥进行加解密处理，该对称密钥由该云计算服务器的安全处理器获取并配置给该加解密引擎。
本申请实施例提供的技术方案中，用户终端利用对称密钥对归属于用户的目标虚拟机的软件系统进行加密生成软件系统密文；然后将该软件系统密文加载至该目标虚拟机的第一RAM中；同时该安全处理器获取到该对称密钥之后配置给加解密引擎，以使得该加解密引擎可以利用该对称密钥对该目标虚拟机的运行环境进行加解密。即该用户在进行云计算的过程中，从数据的传输至数据的运行都利用该对称密钥进行加密，同时该虚拟机管理器 并不知道该对称密钥，从而保证数据的安全性。
可选的，该对称密钥可以由该用户终端自身生成然后通知给该安全处理器也可以由该用户终端与该安全处理器协商生成。
基于上述技术方案，在该对称密钥由该用户终端自身生成时，该加密方法还包括如下方案：
该用户终端接收该安全处理器发送的由该安全处理器生成的非对称密钥中的公钥；然后该用户终端利用该公钥将该对称密钥进行加密生成加密对称密钥；最后该用户终端将该加密对称密钥发送给该安全处理器，以使得该安全处理器利用该非对称密钥中的私钥解密该加密对称密钥得到该对称密钥。
本申请实施例提供的技术方案中，该云计算服务器与该用户终端采用多种方式确定对称密钥，并在对称密钥由该用户终端自主生成的情况下，该安全处理器生成非对称密钥对该对称密钥进行加密传输，从而有效保证用户传输数据的安全性。
可选的，该用户终端还可以将该软件系统密文发送给该虚拟机管理器或者是该安全处理器，以使得该云计算服务器可以根据实际情况将该软件系统密文加载到该第一RAM中。
第三方面，本申请实施例提供一种云计算服务器，其中，该云计算服务器包括：安全处理器、加解密引擎、目标虚拟机以及虚拟机管理器；
所述虚拟机管理器，用于为所述目标虚拟机分配虚拟中央处理器vCPU和第一RAM；
所述安全处理器，用于获取对称密钥；将所述对称密钥配置给所述加解密引擎；
所述加解密引擎，用于利用所述对称密钥为所述vCPU访问所述第一RAM时对所述目标虚拟机的软件系统密文进行加解密处理，所述软件系统密文为用户终端利用所述对称密钥加密所述目标虚拟机的软件系统生成，且所述软件系统密文被加载至所述第一RAM。
第四方面，本申请实施例提供一种用户终端，该用户终端具有实现上述方法中用户终端的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能实现方式中，该用户终端包括：
处理模块，用于利用对称密钥对目标虚拟机的软件系统进行加密得到软件系统密文，所述目标虚拟机位于云计算服务器；
发送模块，用于将所述软件系统密文发送给所述云计算服务器，以使得所述软件系统密文被加载至第一RAM，所述第一RAM为所述云计算服务器的虚拟机管理器为所述目标虚拟机分配，虚拟中央处理器vCPU访问所述第一RAM时，所述软件系统密文被所述云计算服务器的加解密引擎利用所述对称密钥为所述虚拟中央处理器vCPU访问所述第一RAM时进行加解密处理，所述对称密钥由所述云计算服务器的安全处理器获取并配置给所述加解密引擎，所述vCPU由所述虚拟机管理器为所述目标虚拟机分配。
另一种可能实现方式中，该用户终端包括：
收发器，一个或多个处理器，总线；
该收发器与该一个或多个处理器通过总线相连；
该处理器，执行如下步骤：
利用对称密钥对目标虚拟机的软件系统进行加密得到软件系统密文，所述目标虚拟机位于云计算服务器；
该收发器，执行如下步骤：
将所述软件系统密文发送给所述云计算服务器，以使得所述软件系统密文被加载至第一RAM，所述第一RAM为所述云计算服务器的虚拟机管理器为所述目标虚拟机分配，虚拟中央处理器vCPU访问所述第一RAM时，所述软件系统密文被所述云计算服务器的加解密引擎利用所述对称密钥进行加解密处理，所述对称密钥由所述云计算服务器的安全处理器获取并配置给所述加解密引擎，所述vCPU由所述虚拟机管理器为所述目标虚拟机分配。
第五方面，本申请实施例提供一种云计算系统，该云计算系统包括云计算服务器和用户终端；该云计算服务器与该用户终端之间进行数据传输；其中，该云计算服务器具有上述描述中的云计算服务器的全部功能；该用户终端具有上述描述中的用户终端的全部功能。
第六方面，本申请实施例提供一种计算机可读存储介质，包括指令，当所述指令在计算机上运行时，所述计算机执行上述的方法。
第七方面，本申请实施例提供一种包含指令的计算机程序产品，当所述计算机程序产品在计算机上运行时，所述计算机执行上述方法。
从以上技术方案可以看出，本申请实施例具有以下优点：用户终端利用对称密钥对归属于用户的目标虚拟机的软件系统进行加密生成软件系统密文；然后将该软件系统密文加载至该目标虚拟机的第一RAM中；同时该安全处理器获取到该对称密钥之后配置给加解密引擎，以使得该加解密引擎可以利用该对称密钥对该目标虚拟机的运行环境进行加解密。即该用户在进行云计算的过程中，从数据的传输至数据的运行都利用该对称密钥进行加密，同时该虚拟机管理器并不知道该对称密钥，从而保证数据的安全性。
附图说明
图1为本申请实施例中云计算系统架构；
图2为现有技术中云加密的过程；
图3为本申请实施例中加密方法的一个实施例示意图；
图4为本申请实施例中软件系统密文的加载示意图；
图5为本申请实施例中加密方法的另一个实施例示意图；
图6为本申请实施例中加密方法的另一个实施例示意图；
图7为本申请实施例中加密方法的另一个实施例示意图；
图8为本申请实施例中云计算服务器的一个实施例示意图；
图9为本申请实施例中用户终端的一个实施例示意图；
图10为本申请实施例中用户终端的另一个实施例示意图；
图11为本申请实施例中云计算系统的一个实施例示意图。
具体实施方式
本申请实施例提供了一种加密方法及装置，用于为客户在云数据中心进行运行时的全过程进行加密，实现对客户数据的安全保护。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
随着云计算技术的飞速发展，各大科技公司都把云计算作为其最重要的业务以及占领未来市场的杀手锏和技术制高点。越来越多的客户已经或正在计划把其数据中心往云数据中心上迁移。但是客户在将重要数据迁移到云数据中心上时，需要考虑如何对重要数据进行加密。目前的云计算系统如图1所示，该云计算系统包括：云计算服务器和用户终端；其中，该云计算服务器包括中央处理器(Central Processing Unit，CPU)、内存RAM、安全处理器、加解密引擎、虚拟机以及虚拟机管理器；该用户终端是用户认可的处于安全状态的物理或虚拟计算机。其中，该虚拟机管理器为该虚拟机分配对应的RAM和虚拟中央处理器(virtual Central Processing Unit，vCPU)，该虚拟机将运行在对应的vCPU和RAM。
目前的加密技术如图2所示，云计算服务器的CPU内置加密引擎，然后在客户在云数据中心中进行云计算时具体步骤如下：1、VMM将VM的BIOS和OS明文加载入云数据中心的RAM中；2、该安全处理器为该VM生成一个加密密钥，并将该加密密钥配置给该加密引擎；3、该加密引擎为该VM的RAM进行加密生成一个安全运行环境；4、将该明文BIOS和OS移入到该安全运行环境；5、该VM在该安全运行环境进行运行。
由上述步骤可知，该云计算中心为该客户的VM建立了安全运行环境，保证了该VM运行时的安全，但是在该VM的安全运行环境建立之前，客户的数据却无法保证安全。同时整个加密过程中，用户无法掌控密钥，使得用户无法对该系统产生足够的安全感。
为了解决这一问题，本申请实施例提供了如下方案：该加密方法应用于云计算服务器，该云计算服务器包括安全处理器、加解密引擎、目标虚拟机以及虚拟机管理器；其中，该虚拟机管理器为该目标虚拟机分配虚拟中央处理器vCPU和第一RAM；然后该安全处理器获取对称密钥，并将该对称密钥配置给该加解密引擎；最后该加解密引擎利用该对称密钥为该vCPU访问该第一RAM时对该目标虚拟机的软件系统密文进行加解密处理。其中，该软件系统密文由用户终端利用该对称密钥加密该目标虚拟机的软件系统生成，且该软件系统密文被该云计算服务器加载至该目标虚拟机的第一RAM。
下面根据加载该目标虚拟机的软件系统的对象不同进行说明：
一、该虚拟机管理器加载该目标虚拟机的软件系统至该第一RAM。
具体请参阅图3所示，本申请实施例中加密方法的一个实施例，包括：
301、该安全处理器生成非对称密钥，该非对称密钥包括公钥和私钥
该安全处理器生成一个非对称密钥，该非对称密钥将包括公钥和私钥。该公钥将提供给该用户，而该私钥将由该安全处理器保存，且该私钥无法由该安全处理器导出。
本实施例中，该非对称密钥可以是在该用户进行云计算时生成，也可以事先生成。
302、该安全处理器将该公钥提供给用户。
该安全处理器提供该公钥给该用户的方式可以包括如下几种可能情况：
一种可能实现方式中，该安全处理器将该公钥发送到该用户当前使用的用户终端的云计算界面；
另一种可能实现方式中，该安全处理器通过短信或者是邮件将该公钥发送给该用户。
可以理解的是，只要该安全处理器可以将该公钥告知给该用户即可，具体方式此处不做限定。
303、该用户通过该用户终端利用该公钥对对称密钥进行加密生成加密对称密钥，并根据该对称密钥对该目标虚拟机的软件系统加密生成软件系统密文。
该用户在使用云计算时，该用户为归属于自身的目标虚拟机的软件系统设置一个对称密钥，并通过当前使用的用户终端利用该对称密钥对该目标虚拟机的软件系统进行加密生成软件系统密文。同时为了该云计算服务器可以解密该软件系统密文，该用户通过该用户终端利用该公钥对该对称密钥进行加密生成加密对称密钥。
304、该用户终端将该加密对称密钥发送给该安全处理器。
该用户通过该用户终端将该加密对称密钥发送给该安全处理器。
305、该用户终端将该软件系统密文发送给该虚拟机管理器。
该用户通过该用户终端将该软件系统密文发送给该虚拟机管理器。
可以理解的是，步骤304与步骤305之间的并没有时间的先后之分，具体的发生时间顺序，此处不做限定。
306、该虚拟机管理器将该软件系统密文加载至该第一RAM。
在云计算系统中，该虚拟机管理器为用户租用的目标虚拟机分配第一vCPU和第一RAM。该虚拟机管理器在接收到该用户终端发送给软件系统密文之后，将该软件系统密文加载到该第一RAM。
在实际应用中，该目标虚拟机的软件系统的组成部分包括基本输入输出系统(Basic Input Output System，BIOS)、操作系统加载器OS loader、操作系统内核OS kernel和应用程序Application等。以本实施例中虚拟机管理器为例，在实际软件系统的加载过程中，该虚拟机管理器具体加载哪些部分可以由虚拟机管理器自由设定。比如如图4所示，该用户利用该对称密钥加密生成的软件系统密文中包括BIOS和OS Loader时，该虚拟机管理器将该BIOS和该OS Loader加载入该第一RAM，然后当该OS Loader运行起来后，该OS Loader引导该OS Kernel进行加载，直到加载完该软件系统。可以理解的是，该OS Kernel与该BIOS和该OS Loader的加密密钥可以不相同，而且该虚拟机管理器也不知道该软件系统各部分的加密密钥，但是该OS Kernel的加密方式与该OS Loader的加密的加密方法相同，此处不再赘述。
307、该安全处理器将该加密对称密钥进行解密得到对称密钥。
该安全处理器利用该私钥将该加密对称密钥进行解密，得到该对称密钥。
308、该安全处理器将该对称密钥发送给该加解密引擎。
该安全处理器将该对称密钥配置给该加解密引擎。
309、该加解密引擎利用该对称密钥为该目标虚拟机的vCPU访问该第一RAM时进行加解密处理。
该加解密引擎利用该安全处理器配置的对称密钥对该用户的目标虚拟机在vCPU访问该第一RAM时，对该软件系统密文和该第一RAM进行加解密处理。最后该目标虚拟机利用该vCPU和该第一RAM开始运行，执行该用户的相应操作。
本实施例中，用户终端利用对称密钥对归属于用户的目标虚拟机的软件系统进行加密生成软件系统密文；然后将该软件系统密文加载至该目标虚拟机的第一RAM中；同时该安全处理器获取到该对称密钥之后配置给加解密引擎，以使得该加解密引擎可以利用该对称密钥对该目标虚拟机的运行环境进行加解密。即该用户在进行云计算的过程中，从数据的传输至数据的运行都利用该对称密钥进行加密，同时该虚拟机管理器并不知道该对称密钥，从而保证数据的安全性。
二、该安全处理器加载该目标虚拟机的软件系统至该第一RAM。
具体请参阅图5所示，本申请实施例中加密方法的另一个实施例包括：
501、该安全处理器生成非对称密钥，该非对称密钥包括公钥和私钥。
该安全处理器生成一个非对称密钥，该非对称密钥将包括公钥和私钥。该公钥将提供给该用户，而该私钥将由该安全处理器保存，且该私钥无法由该安全处理器导出。
本实施例中，该非对称密钥可以是在该用户进行云计算时生成，也可以事先生成。
502、该安全处理器将该公钥提供给用户。
在该安全处理器提供该公钥给该用户的方式可以包括如下几种可能情况：
一种可能实现方式中，该安全处理器将该公钥发送到该用户当前使用的用户终端的云计算界面；
另一种可能实现方式中，该安全处理器通过短信或者是邮件将该公钥发送给该用户。
可以理解的是，只要该安全处理器可以将该公钥告知给该用户即可，具体方式此处不做限定。
503、该用户终端利用该公钥对对称密钥进行加密生成加密对称密钥，并根据该对称密钥对该目标虚拟机的软件系统加密生成软件系统密文。
该用户在使用云计算时，该用户为分配给自身的目标虚拟机的软件系统生成一个对称密钥，并通过当前使用的用户终端利用该对称密钥对该目标虚拟机的软件系统进行加密生成软件系统密文。同时为了该云计算服务器可以解密该软件系统密文，该用户通过该用户终端利用该公钥对该对称密钥进行加密生成加密对称密钥。
504、该用户终端将该加密对称密钥和该软件系统密文发送给该安全处理器。
该用户通过该用户终端将该加密对称密钥和该软件系统密文发送给该安全处理器。
505、该安全处理器将该软件系统密文加载至该第一RAM。
在云计算系统中，该虚拟机管理器为用户租用的目标虚拟机分配第一vCPU和第一RAM。该安全处理器在接收到该用户终端发送给软件系统密文之后，将该软件系统密文加载到该第一RAM。
在实际应用中，该目标虚拟机的软件系统的组成部分包括基本输入输出系统(Basic Input Output System，BIOS)、操作系统加载器OS loader、操作系统内核OS kernel和应用程序Application等。以本实施例中安全处理器为例，在实际软件系统的加载过程中，该安全处理器具体加载哪些部分可以由该安全处理器自由设定。比如如图4所示，该用户利用该对称密钥加密生成的软件系统密文中包括BIOS和OS Loader时，该安全处理器将该BIOS和该OS Loader加载入该第一RAM，然后当该OS Loader运行起来后，该OS Loader引导该OS Kernel进行加载，直到加载完该软件系统。可以理解的是，该OS Kernel与该BIOS和该OS Loader的加密密钥可以不相同，而且该安全处理器也不知道该软件系统各部分的加密密钥，但是该OS Kernel的加密方式与该OS Loader的加密的加密方法相同，此处不再赘述。
可选的，该安全处理器加载该软件系统时，还可以先将该软件系统密文利用该私钥进行解密得到软件系统明文，然后将该软件系统明文加载至该第一RAM。在这种方式中，该安全处理器需要在加载至该第一RAM中时，先给该加解密引擎配置该对称密钥或者是配置一个新的由该安全处理器生成的临时对称密钥；然后当该安全处理器和该vCPU访问该第一RAM时，该加解密引擎可以利用该对称密钥或该临时对称密钥对该软件系统进行加解密处理。
506、该安全处理器将该加密对称密钥进行解密得到对称密钥。
该安全处理器利用该私钥将该加密对称密钥进行解密，得到该对称密钥。
507、该安全处理器将该对称密钥发送给该加解密引擎。
该安全处理器将该对称密钥配置给该加解密引擎。
508、该加解密引擎利用该对称密钥为该目标虚拟机的vCPU访问该第一RAM时进行加解密处理。
该加解密引擎利用该安全处理器配置的对称密钥对该用户的目标虚拟机在vCPU访问该第一RAM时，对该软件系统密文和该第一RAM进行加解密处理。最后该目标虚拟机利用该vCPU和该第一RAM开始运行，执行该用户的相应操作。
本实施例中，用户终端利用对称密钥对归属于用户的目标虚拟机的软件系统进行加密生成软件系统密文；然后将该软件系统密文加载至该目标虚拟机的第一RAM中；同时该安全处理器获取到该对称密钥之后配置给加解密引擎，以使得该加解密引擎可以利用该对称密钥对该目标虚拟机的运行环境进行加解密。即该用户在进行云计算的过程中，从数据的传输至数据的运行都利用该对称密钥进行加密，同时该虚拟机管理器并不知道该对称密钥，从而保证数据的安全性。
具体请参阅图6所示，本申请实施例中加密方法的另一个实施例，包括：
601、该安全处理器与该用户终端协商生成对称密钥。
该安全处理器与该用户终端通过信令交互协商当前的对称密钥。
本实施例中，该对称密钥的表现形式可以为Deffie-Hellman(简称DH)密钥交换协议，它的作用是让通信的双方能在非安全的信道中安全的交换密钥，用于加密后续的通信消息。
602、该用户终端该对称密钥对该目标虚拟机的软件系统加密生成软件系统密文。
该用户在使用云计算系统时，该用户利用该对称密钥为分配给自身的目标虚拟机的软件系统进行加密生成软件系统密文。
603、该用户终端将该软件系统密文发送给该安全处理器。
该用户通过该用户终端将该加密对称密钥和该软件系统密文发送给该安全处理器。
604、该安全处理器将该软件系统密文加载至该第一RAM。
在云计算系统中，该虚拟机管理器为用户租用的目标虚拟机分配第一vCPU和第一RAM。该安全处理器在接收到该用户终端发送给软件系统密文之后，将该软件系统密文加载到该第一RAM。
在实际应用中，该目标虚拟机的软件系统的组成部分包括基本输入输出系统(Basic Input Output System，BIOS)、操作系统加载器OS loader、操作系统内核OS kernel和应用程序Application等。以本实施例中安全处理器为例，在实际软件系统的加载过程中，该安全处理器具体加载哪些部分可以由该安全处理器自由设定。比如如图4所示，该用户利用该对称密钥加密生成的软件系统密文中包括BIOS和OS Loader时，该安全处理器将该BIOS和该OS Loader加载入该第一RAM，然后当该OS Loader运行起来后，该OS Loader引导该OS Kernel进行加载，直到加载完该软件系统。可以理解的是，该OS Kernel与该BIOS和该OS Loader的加密密钥可以不相同，而且该安全处理器也不知道该软件系统各部分的加密密钥，但是该OS Kernel的加密方式与该OS Loader的加密的加密方法相同，此处不再赘述。
可选的，该安全处理器加载该软件系统时，还可以先将该软件系统密文利用该对称密钥进行解密得到软件系统明文，然后将该软件系统明文加载至该第一RAM。
605、该安全处理器将该对称密钥发送给该加解密引擎。
该安全处理器将该对称密钥配置给该加解密引擎。
606、该加解密引擎利用该对称密钥为该目标虚拟机的vCPU访问该第一RAM时对该软件系统密文进行加解密处理。
该加解密引擎利用该安全处理器配置的对称密钥对该用户的目标虚拟机在vCPU访问该第一RAM时，对该软件系统密文和该第一RAM进行加解密处理。最后该目标虚拟机利用该vCPU和该第一RAM开始运行，执行该用户的相应操作。
本实施例中以安全处理器加载该软件系统密文为例进行了说明，但是可以理解的是，本实施例提供的技术方案也可以应用与图3所示的虚拟机管理器加载该软件系统密文的方案，具体只需要将本实施例中中步骤603与步骤604替换为步骤305与步骤306即可，具体此处不再赘述。
基于上述方案中，由于可能出现用户将同一个对称密钥分配给该用户的多个VM使用，这样当该对称密钥出现泄露或者其他不安全的情况时，该用户的数据将存在泄露风险，为了解决这一问题，该云计算服务器还可以执行如下操作：
如图7所示，该虚拟机管理器为该目标虚拟机分配第二RAM；同时该安全处理器为该第二RAM生成临时密钥，并将该临时密钥分配给该加解密引擎；该目标虚拟机将自身的软 件系统从该第一RAM中迁移至该第二RAM中；该加解密引擎利用该安全处理器配置的临时密钥对该用户的目标虚拟机在vCPU访问该第二RAM时，对该第二RAM进行加解密处理；最后该目标虚拟机利用该vCPU和该第二RAM开始运行，执行该用户的相应操作。
在本实施例中，在该目标虚拟机迁移该软件系统完成之后，该虚拟机管理器可以将该第一RAM释放。
可以理解的是，该虚拟机管理器可以同时为该目标虚拟机分配第一RAM和第二RAM；也可以为该目标虚拟机先分配该第一RAM，然后在该目标虚拟机的软件系统加载至该第一RAM之后再为该目标虚拟机分配该第二RAM，只要可以保证用户的数据安全即可，具体方式此处不做限定。
本实施例中，用户终端利用对称密钥对归属于用户的目标虚拟机的软件系统进行加密生成软件系统密文；然后将该软件系统密文加载至该目标虚拟机的第一RAM中；同时该安全处理器获取到该对称密钥之后配置给加解密引擎，以使得该加解密引擎可以利用该对称密钥对该目标虚拟机的运行环境进行加解密。即该用户在进行云计算的过程中，从数据的传输至数据的运行都利用该对称密钥进行加密，同时该虚拟机管理器并不知道该对称密钥，从而保证数据的安全性。
上面对本申请实施例中的加密方法进行说明，下面对本申请实施例中的云计算服务器进行说明。
具体请参阅图8所示，本申请实施例中的云计算服务器800包括：安全处理器801、加解密引擎802、目标虚拟机803以及虚拟机管理器804；
所述虚拟机管理器804，用于为所述目标虚拟机803分配虚拟中央处理器vCPU和第一RAM，所述目标虚拟机803位于所述云计算服务器800；
所述安全处理器801，用于获取对称密钥；将所述对称密钥配置给所述加解密引擎802；
所述加解密引擎802，用于利用所述对称密钥为所述vCPU访问所述第一RAM时对所述目标虚拟机803的软件系统密文进行加解密处理，所述软件系统密文为用户终端利用所述对称密钥加密所述目标虚拟机的软件系统生成，且所述软件系统密文被加载至所述第一RAM。
可选的，所述对称密钥由所述用户终端生成或由所述安全处理器801与所述用户终端协商生成。
可选的，在所述对称密钥由所述用户终端生成时，所述安全处理器801，还用于生成非对称密钥，所述非对称密钥包括公钥和私钥，所述公钥由所述安全处理器提供给所述用户终端，所述私钥由所述安全处理器保存；接收所述用户终端发送的加密对称密钥，所述加密对称密钥由所述用户终端利用所述公钥加密所述对称密钥生成；利用所述私钥解密所述加密对称密钥得到所述对称密钥。
可选的，所述虚拟机管理器804，用于接收所述用户终端发送的所述软件系统密文；将所述软件系统密文加载至所述第一RAM；
或，
所述安全处理器801，用于接收所述用户终端发送的所述软件系统密文；将所述软件系统密文加载至所述第一RAM。
可选的，所述目标虚拟机的软件系统包括基本输入输出系统BIOS、操作系统加载器OS loader、操作系统内核OS kernel和应用程序Application中的至少一种，所述软件系统密文包括BIOS、OS loader、OS kernel和Application中的至少一种。
可选的，当所述软件系统密文包括所述BIOS和所述OS loader时，所述软件系统密文的加载包括：
所述BIOS和所述OS loader被加载至所述第一RAM；
所述OS loader将所述OS kernel加载至所述第一RAM。
可选的，所述OS kernel的加密密钥与所述BIOS和所述OS loader的加密密钥不同。
可选的，所述虚拟机管理器804，还用于为所述目标虚拟机803分配第二RAM；
所述安全处理器801，还用于生成临时密钥，并将所述临时密钥分配给所述加解密引擎802；
所述目标虚拟机803，用于将所述软件系统迁移至所述第二RAM，所述软件系统由所述加解密引擎802利用所述对称密钥对所述软件系统密文进行解密后得到；
所述加解密802，用于利用所述临时密钥为所述vCPU访问所述第二RAM时对所述软件系统进行加解密；所述目标虚拟机803，用于在所述vCPu和所述第二RAM中运行；
所述虚拟机管理器804，用于释放所述第一RAM。
本实施例中，用户终端利用对称密钥对归属于用户的目标虚拟机的软件系统进行加密生成软件系统密文；然后将该软件系统密文加载至该目标虚拟机的第一RAM中；同时该安全处理器获取到该对称密钥之后配置给加解密引擎，以使得该加解密引擎可以利用该对称密钥对该目标虚拟机的运行环境进行加解密。即该用户在进行云计算的过程中，从数据的传输至数据的运行都利用该对称密钥进行加密，同时该虚拟机管理器并不知道该对称密钥，从而保证数据的安全性。
具体请参阅图9所示，本申请实施例中用户终端的一个实施例，包括：
处理模块901，用于利用对称密钥对目标虚拟机的软件系统进行加密得到软件系统密文，所述目标虚拟机位于云计算服务器；
发送模块902，用于将所述软件系统密文发送给所述云计算服务器，以使得所述软件系统密文被加载至第一RAM，所述第一RAM为所述云计算服务器的虚拟机管理器为所述目标虚拟机分配，虚拟中央处理器vCPU访问所述第一RAM时，所述软件系统密文被所述云计算服务器的加解密引擎利用所述对称密钥进行加解密处理，所述对称密钥由所述云计算服务器的安全处理器获取并配置给所述加解密引擎，所述vCPU由所述虚拟机管理器为所述目标虚拟机分配。
可选的，所述处理模块901，还用于与所述安全处理器协商生成所述对称密钥。
可选的，所述处理模块901，还用于生成所述对称密钥。
可选的，所述发送模块902，具体用于将所述软件系统密文发送给所述虚拟机管理器或所述安全处理器。
可选的，所述用户终端还包括接收模块903，所述接收模块903，用于获取公钥，所述公钥为所述安全处理器生成的非对称密钥中的公钥；
所述处理模块901，还用于利用所述公钥加密所述对称密钥生成加密对称密钥；
所述发送模块902，还用于将所述加密对称密钥发送给所述安全处理器，以使得所述安全处理器利用所述私钥对所述加密对称密钥进行解密得到所述对称密钥，所述私钥为所述安全处理器生成的非对称密钥中的私钥。
本实施例中，该用户终端利用对称密钥为该目标虚拟机的软件系统时行加密，从而保证用户在使用云计算服务器时，可以从头将数据进行保护，从而保证数据的安全性。
具体请参阅图10所示，本申请实施例中用户终端的另一个实施例，包括：
收发器1001、处理器1002、总线1003；
该收发器1001与该处理器1002通过该总线1003连接；
该总线1003可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。该总线可以分为地址总线、数据总线、控制总线等。为便于表示，图10中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
处理器1002可以是中央处理器(central processing unit，简称CPU)，网络处理器(network processor，简称NP)或者CPU和NP的组合。
处理器1002还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，简称ASIC)，可编程逻辑器件(programmable logic device，简称PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，简称CPLD)，现场可编程逻辑门阵列(field-programmable gate array，简称FPGA)，通用阵列逻辑(generic array logic,简称GAL)或其任意组合。
参见图10所示，该用户终端还可以包括存储器1004。该存储器1004可以包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，简称RAM)；存储器也可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，简称HDD)或固态硬盘(solid-state drive，简称SSD)；存储器1004还可以包括上述种类的存储器的组合。
可选地，存储器1004还可以用于存储程序指令，处理器1002调用该存储器1004中存储的程序指令，可以执行上述多个实施例中的一个或多个步骤，或其中可选的实施方式，实现上述方法中用户终端的功能。
该处理器1002，执行如下步骤：
利用对称密钥对目标虚拟机的软件系统进行加密得到软件系统密文，所述目标虚拟机位于云计算服务器；
该收发器1001，执行如下步骤：
将所述软件系统密文发送给所述云计算服务器，以使得所述软件系统密文被加载至第一RAM，所述第一RAM为所述云计算服务器的虚拟机管理器为所述目标虚拟机分配，虚拟 中央处理器vCPU访问所述第一RAM时，所述软件系统密文被所述云计算服务器的加解密引擎利用所述对称密钥进行加解密处理，所述对称密钥由所述云计算服务器的安全处理器获取并配置给所述加解密引擎，所述vCPU由所述虚拟机管理器为所述目标虚拟机分配。
可选的，所述处理器1002，执行如下步骤：
与所述安全处理器协商生成所述对称密钥。
可选的，所述处理器1002，执行如下步骤：
生成所述对称密钥。
可选的，所述收发器1001，执行如下步骤：
将所述软件系统密文发送给所述虚拟机管理器或所述安全处理器。
可选的，该收发器1001，执行如下步骤：
获取公钥，所述公钥为所述安全处理器生成的非对称密钥中的公钥；
所述处理器1002，执行如下步骤：利用所述公钥加密所述对称密钥生成加密对称密钥；
所述收发器1001，执行如下步骤：将所述加密对称密钥发送给所述安全处理器，以使得所述安全处理器利用所述私钥对所述加密对称密钥进行解密得到所述对称密钥，所述私钥为所述安全处理器生成的非对称密钥中的私钥。
本实施例中，该用户终端利用对称密钥为该目标虚拟机的软件系统时行加密，从而保证用户在使用云计算服务器时，可以从头将数据进行保护，从而保证数据的安全性。
具体请参阅图11所示，本申请实施例中云计算系统的一个实施例包括：
云计算服务器1101和用户终端1102；
该云计算服务器1101与该用户终端1102之间进行数据传输；
该云计算服务器具有图8中云计算服务器的全部功能；
该用户终端具有图9和图10中用户终端的全部功能。
本实施例中，该云计算系统可以有效的保证用户在使用云计算服务时的数据安全性。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既 可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (29)

  1. 一种加密方法，应用于云计算服务器，所述云计算服务器包括安全处理器、加解密引擎、目标虚拟机以及虚拟机管理器，其特征在于，所述方法包括：
    所述虚拟机管理器为所述目标虚拟机分配虚拟中央处理器vCPU和第一RAM；
    所述安全处理器获取对称密钥；
    所述安全处理器将所述对称密钥配置给所述加解密引擎；
    所述加解密引擎利用所述对称密钥为所述vCPU访问所述第一RAM时对所述目标虚拟机的软件系统密文进行加解密处理，所述软件系统密文为用户终端利用所述对称密钥加密所述目标虚拟机的软件系统生成，且所述软件系统密文被加载至所述第一RAM。
  2. 根据权利要求1所述的方法，其特征在于，所述对称密钥由所述用户终端生成或由所述安全处理器与所述用户终端协商生成。
  3. 根据权利要求2所述的方法，其特征在于，所述对称密钥由所述用户终端生成时，所述安全处理器获取所述对称密钥包括：
    所述安全处理器生成非对称密钥，所述非对称密钥包括公钥和私钥，所述公钥由所述安全处理器提供给所述用户终端，所述私钥由所述安全处理器保存；
    所述安全处理器接收所述用户终端发送的加密对称密钥，所述加密对称密钥由所述用户终端利用所述公钥加密所述对称密钥生成；
    所述安全处理器利用所述私钥解密所述加密对称密钥得到所述对称密钥。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述加解密引擎利用所述对称密钥为所述vCPU访问所述第一RAM时对所述目标虚拟机的软件系统密文进行加解密处理之前，所述方法包括：
    所述虚拟机管理器接收所述用户终端发送的所述软件系统密文；
    所述虚拟机管理器将所述软件系统密文加载至所述第一RAM；
    或，
    所述安全处理器接收所述用户终端发送的所述软件系统密文；
    所述安全处理器将所述软件系统密文加载至所述第一RAM。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述目标虚拟机的软件系统包括基本输入输出系统BIOS、操作系统加载器OS loader、操作系统内核OS kernel和应用程序Application中的至少一种，所述软件系统密文包括BIOS、OS loader、OS kernel和Application中的至少一种。
  6. 根据权利要求5所述的方法，其特征在于，当所述软件系统密文包括所述BIOS和所述OS loader时，所述软件系统密文的加载包括：
    所述BIOS和所述OS loader被加载至所述第一RAM；
    所述OS loader将所述OS kernel加载至所述第一RAM。
  7. 根据权利要求6所述的方法，其特征在于，所述OS kernel的加密密钥与所述BIOS和所述OS loader的加密密钥不同。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述加解密引擎利用所述 对称密钥对所述vCPU访问所述第一RAM时对所述软件系统密文进行加解密处理之后，所述方法还包括：
    所述虚拟机管理器为所述目标虚拟机分配第二RAM；
    所述安全处理器生成临时密钥，并将所述临时密钥分配给所述加密引擎；
    所述目标虚拟机将所述软件系统迁移至所述第二RAM，所述软件系统由所述加解密引擎利用所述对称密钥对所述软件系统密文进行解密后得到；
    所述加解密引擎利用所述临时密钥为所述vCPU访问所述第二RAM时对所述软件系统进行加解密；
    所述目标虚拟机在所述vCPu和所述第二RAM中运行；
    所述虚拟机管理器释放所述第一RAM。
  9. 一种加密方法，应用于用户终端，所述方法包括：
    所述用户终端利用对称密钥对目标虚拟机的软件系统进行加密得到软件系统密文，所述目标虚拟机位于云计算服务器；
    所述用户终端将所述软件系统密文发送给所述云计算服务器，以使得所述软件系统密文被加载至第一RAM，所述第一RAM为所述云计算服务器的虚拟机管理器为所述目标虚拟机分配，虚拟中央处理器vCPU访问所述第一RAM时，所述软件系统密文被所述云计算服务器的加解密引擎利用所述对称密钥进行加解密处理，所述对称密钥由所述云计算服务器的安全处理器获取并配置给所述加解密引擎，所述vCPU由所述虚拟机管理器为所述目标虚拟机分配。
  10. 根据权利要求9所述的方法，其特征在于，所述用户终端利用对称密钥对目标虚拟机的软件系统进行加密得到软件系统密文之前，所述方法还包括：
    所述用户终端与所述安全处理器协商生成所述对称密钥。
  11. 根据权利要求9所述的方法，其特征在于，所述用户终端利用对称密钥对目标虚拟机的软件系统进行加密得到软件系统密文之前，所述方法还包括：
    所述用户终端生成所述对称密钥。
  12. 根据权利要求11所述的方法，其特征在于，所述用户终端生成所述对称密钥之后，所述方法还包括：
    所述用户终端获取公钥，所述公钥为所述安全处理器生成的非对称密钥中的公钥；
    所述用户终端利用所述公钥加密所述对称密钥生成加密对称密钥；
    所述用户终端将所述加密对称密钥发送给所述安全处理器，以使得所述安全处理器利用所述私钥对所述加密对称密钥进行解密得到所述对称密钥，所述私钥为所述安全处理器生成的非对称密钥中的私钥。
  13. 根据权利要求9至12中任一项所述的方法，其特征在于，所述用户终端将所述软件系统密文发送给所述云计算服务器包括：
    所述用户终端将所述软件系统密文发送给所述虚拟机管理器或所述安全处理器。
  14. 一种云计算服务器，其特征在于，包括：
    安全处理器、加解密引擎、目标虚拟机以及虚拟机管理器；
    所述虚拟机管理器，用于为所述目标虚拟机分配虚拟中央处理器vCPU和第一RAM；
    所述安全处理器，用于获取对称密钥；将所述对称密钥配置给所述加解密引擎；
    所述加解密引擎，用于利用所述对称密钥为所述vCPU访问所述第一RAM时对所述目标虚拟机的软件系统密文进行加解密处理，所述软件系统密文为所述用户终端利用所述对称密钥加密所述目标虚拟机的软件系统生成，且所述软件系统密文被加载至所述第一RAM。
  15. 根据权利要求14所述的云计算服务器，其特征在于，所述对称密钥由所述用户终端生成或由所述安全处理器与所述用户终端协商生成。
  16. 根据权利要求15所述的云计算服务器，其特征在于，在所述对称密钥由所述用户终端生成时，所述安全处理器，还用于生成非对称密钥，所述非对称密钥包括公钥和私钥，所述公钥由所述安全处理器提供给所述用户终端，所述私钥由所述安全处理器保存；接收所述用户终端发送的加密对称密钥，所述加密对称密钥由所述用户终端利用所述公钥加密所述对称密钥生成；利用所述私钥解密所述加密对称密钥得到所述对称密钥。
  17. 根据权利要求14至16中任一项所述云计算服务器，其特征在于，所述虚拟机管理器，用于接收所述用户终端发送的所述软件系统密文；将所述软件系统密文加载至所述第一RAM；
    或，
    所述安全处理器，用于接收所述用户终端发送的所述软件系统密文；将所述软件系统密文加载至所述第一RAM。
  18. 根据权利要求14至17中任一项所述的云计算服务器，其特征在于，所述目标虚拟机的软件系统包括基本输入输出系统BIOS、操作系统加载器OS loader、操作系统内核OS kernel和应用程序Application中的至少一种，所述软件系统密文包括BIOS、OS loader、OS kernel和Application中的至少一种。
  19. 根据权利要求18所述的云计算服务器，其特征在于，当所述软件系统密文包括所述BIOS和所述OS loader时，所述软件系统密文的加载包括：
    所述BIOS和所述OS loader被加载至所述第一RAM；
    所述OS loader将所述OS kernel加载至所述第一RAM。
  20. 根据权利要求19所述的云计算服务器，其特征在于，所述OS kernel的加密密钥与所述BIOS和所述OS loader的加密密钥不同。
  21. 根据权利要求14至20中任一项所述的云计算服务器，其特征在于，所述虚拟机管理器，还用于为所述目标虚拟机分配第二RAM；
    所述安全处理器，还用于生成临时密钥，并将所述临时密钥分配给所述加解密引擎；
    所述目标虚拟机，用于将所述软件系统迁移至所述第二RAM，所述软件系统由所述加解密引擎利用所述对称密钥对所述软件系统密文进行解密后得到；
    所述加解密引擎，用于利用所述临时密钥为所述vCPU访问所述第二RAM时对所述软件系统进行加解密；所述目标虚拟机，用于在所述vCPu和所述第二RAM中运行；
    所述虚拟机管理器，用于释放所述第一RAM。
  22. 一种用户终端，其特征在于，包括：
    处理模块，用于利用对称密钥对目标虚拟机的软件系统进行加密得到软件系统密文，所述目标虚拟机位于云计算服务器；
    发送模块，用于将所述软件系统密文发送给所述云计算服务器，以使得所述软件系统密文被加载至第一RAM，所述第一RAM为所述云计算服务器的虚拟机管理器为所述目标虚拟机分配，虚拟中央处理器vCPU访问所述第一RAM时，所述软件系统密文被所述云计算服务器的加解密引擎利用所述对称密钥进行加解密处理，所述对称密钥由所述云计算服务器的安全处理器获取并配置给所述加解密引擎，所述vCPU由所述虚拟机管理器为所述目标虚拟机分配。
  23. 根据权利要求22所述的用户终端，其特征在于，所述处理模块，还用于与所述安全处理器协商生成所述对称密钥。
  24. 根据权利要求22所述的用户终端，其特征在于，所述处理模块，还用于生成所述对称密钥。
  25. 根据权利要求24所述的用户终端，其特征在于，所述用户终端还包括接收模块，所述接收模块，用于获取公钥，所述公钥为所述安全处理器生成的非对称密钥中的公钥；
    所述处理模块，还用于利用所述公钥加密所述对称密钥生成加密对称密钥；
    所述发送模块，还用于将所述加密对称密钥发送给所述安全处理器，以使得所述安全处理器利用所述私钥对所述加密对称密钥进行解密得到所述对称密钥，所述私钥为所述安全处理器生成的非对称密钥中的私钥。
  26. 根据权利要求22至25中任一项所述的用户终端，其特征在于，所述发送模块，具体用于将所述软件系统密文发送给所述虚拟机管理器或所述安全处理器。
  27. 一种云计算系统，其特征在于，包括：
    云计算服务器和用户终端；
    所述云计算服务器与所述用户终端之间进行数据传输；
    所述云计算服务器具有上述权利要求14至权利要求21所述的云计算服务器的全部功能；
    所述用户终端具有上述权利要求22至权利要求26所述的用户终端的全部功能。
  28. 一种计算机可读存储介质，包括指令，当所述指令在计算机上运行时，所述计算机执行上述权利要求1至权利要求13所述的方法。
  29. 一种包含指令的计算机程序产品，当所述计算机程序产品在计算机上运行时，所述计算机执行上述权利要求1至权利要求13所述的方法。
PCT/CN2018/106017 2018-02-14 2018-09-17 一种加密方法及装置 WO2019157816A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810152246.9A CN108418817B (zh) 2018-02-14 2018-02-14 一种加密方法及装置
CN201810152246.9 2018-02-14

Publications (1)

Publication Number Publication Date
WO2019157816A1 true WO2019157816A1 (zh) 2019-08-22

Family

ID=63128986

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/106017 WO2019157816A1 (zh) 2018-02-14 2018-09-17 一种加密方法及装置

Country Status (2)

Country Link
CN (1) CN108418817B (zh)
WO (1) WO2019157816A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11601260B1 (en) 2021-10-29 2023-03-07 Uti Limited Partnership Encryption/decryption using key encapsulation/decapsulation

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108418817B (zh) * 2018-02-14 2021-02-26 华为技术有限公司 一种加密方法及装置
CN109672521B (zh) * 2018-12-26 2022-11-29 贵州华芯通半导体技术有限公司 基于国密加密引擎实现的安全存储系统和方法
CN110781506A (zh) * 2019-10-18 2020-02-11 浪潮电子信息产业股份有限公司 一种虚拟化fpga的运行方法、运行装置及运行系统
CN110995685B (zh) * 2019-11-26 2022-07-19 中国银联股份有限公司 数据的加解密方法、装置、系统及存储介质
CN111371546A (zh) * 2020-03-11 2020-07-03 核芯互联(北京)科技有限公司 基于企业通信办公平台的通信系统、通信方法及设备
CN113179240B (zh) * 2020-09-28 2023-01-06 深圳华智融科技股份有限公司 密钥保护方法、装置、设备及存储介质
CN115422568B (zh) * 2022-10-31 2023-03-24 南京芯驰半导体科技有限公司 一种基于SoC的文件加密方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101470789A (zh) * 2007-12-28 2009-07-01 中国长城计算机深圳股份有限公司 一种计算机的加解密方法及装置
CN102739689A (zh) * 2012-07-16 2012-10-17 四川师范大学 一种用于云存储系统的文件数据传输装置和方法
CN107368354A (zh) * 2017-08-03 2017-11-21 致象尔微电子科技（上海）有限公司 一种虚拟机安全隔离方法
CN108418817A (zh) * 2018-02-14 2018-08-17 华为技术有限公司 一种加密方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102726027B (zh) * 2011-12-28 2014-05-21 华为技术有限公司 虚拟机全盘加密下预启动时的密钥传输方法和设备
CN102726028A (zh) * 2011-12-31 2012-10-10 华为技术有限公司 一种加密方法、解密方法和相关装置及系统
CN103530169B (zh) * 2013-10-22 2017-01-18 中国联合网络通信集团有限公司 虚拟机文件保护方法和用户终端
US10425229B2 (en) * 2016-02-12 2019-09-24 Microsoft Technology Licensing, Llc Secure provisioning of operating systems

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101470789A (zh) * 2007-12-28 2009-07-01 中国长城计算机深圳股份有限公司 一种计算机的加解密方法及装置
CN102739689A (zh) * 2012-07-16 2012-10-17 四川师范大学 一种用于云存储系统的文件数据传输装置和方法
CN107368354A (zh) * 2017-08-03 2017-11-21 致象尔微电子科技（上海）有限公司 一种虚拟机安全隔离方法
CN108418817A (zh) * 2018-02-14 2018-08-17 华为技术有限公司 一种加密方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11601260B1 (en) 2021-10-29 2023-03-07 Uti Limited Partnership Encryption/decryption using key encapsulation/decapsulation
WO2023070219A1 (en) * 2021-10-29 2023-05-04 Uti Limited Partnership Encryption/decryption using key encapsulation/decapsulation

Also Published As

Publication number Publication date
CN108418817B (zh) 2021-02-26
CN108418817A (zh) 2018-08-17

Similar Documents

Publication Publication Date Title
WO2019157816A1 (zh) 一种加密方法及装置
US11159518B2 (en) Container independent secure file system for security application containers
US10171432B2 (en) Systems to implement security in computer systems
US9317316B2 (en) Host virtual machine assisting booting of a fully-encrypted user virtual machine on a cloud environment
US8977842B1 (en) Hypervisor enabled secure inter-container communications
WO2017092671A1 (zh) 虚拟机管理的方法、装置和系统
CN106610863B (zh) 虚拟机可信迁移方法及装置
US10157290B1 (en) Systems and methods for encrypting files
JP7486530B2 (ja) 管理されたコンテナ環境における共有機密情報へのアクセス方法、システム、プログラム
EP4209949A1 (en) Data management method, apparatus and system, and storage medium
US10447720B1 (en) Systems and methods for performing application container introspection
WO2023169271A1 (zh) 一种数据存储方法及数据处理设备
EP3716563A1 (en) Method and apparatus for establishing virtual network function instance
US10673827B1 (en) Secure access to user data
CN106911721B (zh) 基于云计算的创业登记数据处理平台
WO2022001842A1 (zh) 处理数据的方法、主机及装置
WO2023041025A1 (zh) 基于云技术的计算节点及基于云技术的实例管理方法
US11995197B2 (en) Sensitive data encryption
US11025594B2 (en) Secret information distribution method and device
WO2023124530A1 (zh) 一种数据加密系统及相关产品
US20240020412A1 (en) Cloud Service System and Data Processing Method Based on Cloud Service
US11645092B1 (en) Building and deploying an application
US20230188338A1 (en) Limiting use of encryption keys in an integrated circuit device
US20230267214A1 (en) Virtual trusted platform module implementation method and related apparatus
CN115840943A (zh) 基于云技术的计算节点及基于云技术的实例管理方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18906359

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18906359

Country of ref document: EP

Kind code of ref document: A1