WO2020001617A1

WO2020001617A1 - Method for obtaining verification information and data center

Info

Publication number: WO2020001617A1
Application number: PCT/CN2019/093687
Authority: WO
Inventors: 刘亮
Original assignee: 华为技术有限公司
Priority date: 2018-06-29
Filing date: 2019-06-28
Publication date: 2020-01-02
Also published as: CN109120588A; CN109120588B

Abstract

A method for obtaining verification information. The method is used for a first virtual machine of a first data center to obtain verification information from a host. The method comprises: a metadata server of the first data center receives an upload request comprising the virtual machine ID of the first virtual machine and verification information from the host, and stores the verification information into a storage space of the first virtual machine according to the upload request; the metadata server receives a metadata obtaining request of the first virtual machine, and sends the verification information to the first virtual machine according to the metadata obtaining request, wherein the verification information is used for verification for channel establishment between the virtual machine and the host. By means of a security access mode that can be provided by a metadata server, the risk of leakage of verification information caused by a virtual machine directly obtaining the verification information from a host is avoided, the security of obtaining verification information is improved, and the security of data migration between a host outside a data center and a virtual machine on the data center is ensured.

Description

Method and data center for obtaining verification information

Technical field

The present application relates to the field of information processing technology, and in particular, to a method and a data center for acquiring verification information.

Background technique

In recent years, cloud computing technology has gained more and more popularity, and more and more Internet and IT vendors have launched cloud computing services. If an enterprise needs to migrate its business to a cloud platform, in addition to re-deploying business systems on the cloud platform, another important way is to migrate host data under the cloud to virtual machines on the cloud platform. This process requires the source agent software to be installed on the source host and the destination agent to be installed on the destination virtual machine of the public cloud platform. The source agent is used to read the data on the source host and transfer it to the destination agent through the network. The destination agent writes the received data to the destination virtual machine disk to realize the data transmission between the source host and the destination virtual machine. To complete the migration of the source host.

In order to ensure the security during user data migration, the data transmission between the source host and the destination virtual machine needs to use a Secure Sockets Layer (SSL) channel. The configuration of the SSL channel needs to configure authentication information on the source host and the destination virtual machine. Specifically, before each migration, the authentication information needs to be generated on the source host and the verification information generated by the source host is sent to the destination virtual machine. Complete the security verification required for the SSL channel. In the prior art, the authentication information needs to be manually configured. At the same time, the process of sending the authentication information from the source host to the destination virtual machine has no security guarantee. Therefore, it may lead to the leakage of the authentication virtual machine, which will cause a great risk of data security.

Summary of the invention

In a first aspect, the present invention provides an embodiment of a method for acquiring authentication information. The method is used for a first virtual machine in a first data center to acquire the authentication information from a host, and the first data center does not include the host. The method includes: the metadata server of the first data center receives an upload request from the host, the upload request including a virtual machine ID of the first virtual machine and the verification information. The metadata server accesses the storage space of the first virtual machine in the metadata server according to the virtual machine ID in the upload request, and stores the verification information in the storage space of the first virtual machine, where the first virtual machine The storage space of the machine has the virtual machine ID. The metadata server receives a metadata acquisition request of the first virtual machine, and the metadata acquisition request includes the virtual machine ID. The metadata server accesses the storage space of the first virtual machine in the metadata server according to the virtual machine ID in the metadata acquisition request, and sends the verification information stored in the storage space of the first virtual machine to the The first virtual machine, the verification information is used for verification of establishing a channel between the virtual machine and the host.

Using the metadata server of the data center to obtain the verification information, so that the secure access method provided by the metadata server can be used to avoid the risk of leakage of verification information caused by the virtual machine directly obtaining the verification information from the host, which improves the acquisition of verification information Security, thereby ensuring the security of data migration between hosts outside the data center and virtual machines on the data center.

With reference to the first aspect, in a first implementation manner of the first aspect, the host is a physical machine or a second virtual machine in a second data center.

With reference to the first aspect or the first implementation manner of the first aspect, in a second implementation manner of the first aspect, the verification information is generated by the host according to a timestamp, and the timestamp is related to a time when the verification information is generated by the host. .

Generate verification information using timestamp, so that the host can automatically generate verification information. Compared with the way that users or operation and maintenance personnel manually configure verification information, the verification information automatically generated by the host can reduce the risk of leakage of the verification information during the generation phase, further verify the security of the information, and thus protect the hosts and data centers outside the data center. Security of data migration between virtual machines.

With reference to the first aspect, the first or second implementation manner of the first aspect, in a third implementation manner of the first aspect, the established channel is an SSL channel, and the verification information includes a certificate and a private key, and the certificate and the The private key is used to verify the establishment of this SSL channel.

With reference to the first aspect and the first to third implementation manners of the first aspect, in a fourth implementation manner of the first aspect, the upload request further includes a verification signature, and the metadata server according to the virtual request in the upload request Before the machine ID accesses the storage space of the first virtual machine in the metadata server, the method further includes: the metadata server successfully verifies the upload permission of the physical machine according to the verification signature.

In a second aspect, the present invention provides an embodiment of a data center. The data center is deployed with at least one metadata server and at least one first virtual machine server. The at least one metadata server is configured to receive an upload request from a host, where the upload request includes a virtual machine ID of the first virtual machine and the verification information, and the data center does not include the host; according to the virtual machine in the upload request The ID accesses the storage space of the first virtual machine in the at least one metadata server, and stores the verification information to the storage space of the first virtual machine, wherein the storage space of the first virtual machine has the virtual machine ID. The at least one first virtual machine server is configured to run the first virtual machine to initiate a metadata acquisition request to the at least one metadata server, where the metadata acquisition request includes the virtual machine ID. The at least one metadata server is further configured to receive the metadata acquisition request, access the storage space of the first virtual machine in the at least one metadata server according to the virtual machine ID in the metadata acquisition request, and store the storage space in the first virtual machine. The verification information in the storage space of the first virtual machine is sent to the first virtual machine, and the verification information is used for verification of establishing a channel between the virtual machine and the host.

Use at least one metadata server in the data center to obtain authentication information, so that the secure access method provided by the metadata server can avoid the risk of leakage of authentication information caused by the virtual machine directly obtaining authentication information from the host, which improves the acquisition Verify the security of the information, thereby ensuring the security of data migration between hosts outside the data center and virtual machines on the data center.

With reference to the second aspect, in a first implementation manner of the second aspect, the host is a physical machine or a second virtual machine that does not belong to the data center, and the second virtual machine runs on at least one second virtual machine server.

With reference to the second aspect or the first implementation manner of the second aspect, in the second implementation manner of the second aspect, the verification information is generated by the host according to a timestamp, and the timestamp is related to a time when the verification information is generated by the host. .

With reference to the second aspect and the first or second implementation manner of the second aspect, in a third implementation manner of the second aspect, the established channel is an SSL channel, and the verification information includes a certificate and a private key, and the certificate and the The private key is used to verify the establishment of this SSL channel.

With reference to the second aspect and the first to third implementation manners of the second aspect, in a fourth implementation manner of the second aspect, the upload request further includes a verification signature, which is accessed according to the virtual machine ID in the upload request Before the storage space of the first virtual machine in the at least one metadata server, the metadata server is further configured to successfully verify the upload permission of the physical machine according to the verification signature.

In a third aspect, the present invention provides an embodiment of a data center. The data center includes at least one computing device, and each computing device includes a processor and a memory. The processor of the at least one computing device is configured to run a metadata service unit and a first virtual machine. The metadata service unit is configured to receive an upload request from a host, where the upload request includes a virtual machine ID of the first virtual machine and the verification information, and the data center does not include the host; according to the virtual machine ID in the upload request Accessing the storage space of the first virtual machine in the metadata service unit, and storing the verification information to the storage space of the first virtual machine, wherein the storage space of the first virtual machine has the virtual machine ID. The first virtual machine is configured to initiate a metadata acquisition request to the metadata service unit, where the metadata acquisition request includes the virtual machine ID. The metadata service unit is further configured to receive the metadata acquisition request, access the storage space of the first virtual machine in the metadata service unit according to the virtual machine ID in the metadata acquisition request, and store the storage space in the first virtual machine. The verification information in the storage space of the virtual machine is sent to the first virtual machine, and the verification information is used for verification of establishing a channel between the virtual machine and the host.

The metadata service unit of the data center is used to obtain the verification information, so that the secure access method provided by the metadata service unit can be used to avoid the risk of leakage of verification information caused by the virtual machine directly obtaining the verification information from the host, which improves the acquisition Verify the security of the information, thereby ensuring the security of data migration between hosts outside the data center and virtual machines on the data center.

With reference to the third aspect, in a first implementation manner of the third aspect, the host is a physical machine or a second virtual machine in a second data center.

With reference to the third aspect or the first implementation manner of the third aspect, in the second implementation manner of the second aspect, the verification information is generated by the host according to a timestamp, and the timestamp is related to a time when the verification information is generated by the host. .

With reference to the third aspect and the first or second implementation manner of the third aspect, in a third implementation manner of the third aspect, the established channel is an SSL channel, and the verification information includes a certificate and a private key, and the certificate and the The private key is used to verify the establishment of this SSL channel.

With reference to the third aspect and the first to third implementation manners of the third aspect, in a fourth implementation manner of the third aspect, the upload request further includes a verification signature, which is accessed according to the virtual machine ID in the upload request Before the storage space of the first virtual machine in the metadata service unit, the metadata service unit is further configured to successfully verify the upload right of the physical machine according to the verification signature.

According to a fourth aspect, the present invention provides a computer program product and a non-transitory readable storage medium. The computer program product and the readable storage pool each contain computer instructions, and the controller executes the computer instructions for implementing the first aspect. Methods.

In a fifth aspect, the present invention provides a data migration module 300. The data migration module may run on the host and is configured to provide verification information for establishing an SSL channel to a first virtual machine in a first data center. The data migration module includes a verification information upload unit. The verification information uploading unit is configured to generate an upload request including a virtual machine ID and verification information of the first virtual machine, and initiate the upload request to a metadata server of the first data center.

With reference to the fifth aspect, in a first implementation manner of the fifth aspect, the data migration module further includes a verification information generating module, the verification information generating module is configured to generate the verification information according to a timestamp, and the timestamp is generated by the host Validation information is time dependent.

With reference to the fifth aspect or the first implementation manner of the fifth aspect, in a second implementation manner of the fifth aspect, the host is a physical machine or a second virtual machine, and the second virtual machine is a virtual machine of the second data center. machine.

According to a sixth aspect, the present invention provides a computer program product and a non-transitory readable storage medium. The computer program product and the readable storage medium each contain computer instructions, and the controller executes the computer instructions to implement the fifth aspect. Data migration module.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of a system for obtaining authentication information according to an embodiment of the present invention; FIG.

FIG. 2 is a schematic flowchart of a method for obtaining verification information according to an embodiment of the present invention; FIG.

3 is a schematic diagram of a data migration module according to an embodiment of the present invention;

4 is a schematic diagram of a data center according to an embodiment of the present invention;

5 is a schematic diagram of a first architecture of another data center according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of a second architecture of another data center according to an embodiment of the present invention.

detailed description

A system 100 for obtaining authentication information provided by an embodiment of the present invention is shown in FIG. 1. The system 100 includes a data center 110 and a host 120. The data center 110 includes a metadata server 111 and at least one virtual machine. For example, a virtual machine 112 (ie, a first virtual machine) is drawn in FIG. 1. The host 120 does not belong to the data center 110, and the host 120 may be a virtual machine or a physical machine, which is not limited in the embodiment of the present invention. In order to migrate the data of the host 120 to the data center 110, the data of the host 120 needs to be migrated to the virtual machine 112 in the data center 110. A source-side proxy is configured on the host 120, and the source-side proxy can connect the host 120 to the network of the data center 110 to implement data migration.

After the source agent on the host 120 connects the host 120 to the data center 110 network, if the host 120 directly sends the SSL channel authentication information to the virtual machine 112 through the data center 110 network, the openness of the data center 110 may cause The authentication information is intercepted by a third party, which causes a significant hidden danger to data security. Therefore, the metadata server 111 is used to implement the transmission of the authentication information from the host 120 to the virtual machine 112.

The metadata server is located in the data center and is a server that provides metadata services for each virtual machine in the data center. The metadata of the virtual machine is data used to describe the data of the virtual machine, and includes, for example, descriptive information about data and information resources on the virtual machine, and configuration information of the virtual machine. The metadata server stores metadata such as configuration information and secret keys of each virtual machine in the data center. To ensure the security of the metadata of each virtual machine stored on the metadata server, the metadata of each virtual machine is isolated on the metadata server. The metadata server specifies that each virtual machine in the data center can only access metadata corresponding to the virtual machine. Specifically, the metadata server divides the storage space on it into several partitions, corresponding to several virtual machines in the data center, each partition is identified by the virtual machine ID of the corresponding virtual machine, and each virtual machine can only access the metadata server The metadata storage space corresponding to itself cannot be accessed by other virtual machines. As shown in FIG. 1, the metadata server 111 has a storage space 113 of a virtual machine 112, and the storage space 113 has a virtual machine ID of the virtual machine 112. The virtual machine ID of the virtual machine 112 can be used to locate the storage space 113.

Based on the system 100 in FIG. 1, an embodiment of the present invention provides a method for obtaining verification information, as shown in FIG. 2.

s201. The host 120 initiates an upload request to the metadata server 111. The upload request includes a virtual machine ID and verification information of the virtual machine 112.

Optionally, the upload request may be an additional server metadata interface (Application Programming Interface) provided by the data center 100 to upload the verification information to the metadata server 111.

Optionally, before initiating the upload request, the host 120 automatically generates verification information. The verification information is generated by the host according to the timestamp, and the timestamp is related to the time when the host generates verification information. For example, the time when the host generates verification information is used as the timestamp; A fixed time constant is used as the timestamp. The host 120 may also use the name of the host to name the authentication information.

Optionally, the verification information may be a certificate or a private key used to generate an SSL channel.

Optionally, the upload request further includes a verification signature. The verification signature can be an access key or a private access key. The metadata server 111 verifies the data upload authority of the host 120 by verifying the signature.

S202: The metadata server 111 receives the upload request from the host 120, and stores the verification information in the storage space 113 of the virtual machine 112.

Optionally, before the metadata server 111 stores the verification information in the storage space 113 of the virtual machine 112, the upload right of the physical machine is successfully verified according to the verification signature in the upload request.

s203. The virtual machine 112 initiates a metadata acquisition request to the metadata server 111, and the metadata acquisition request includes the virtual machine ID.

Optionally, the virtual machine 112 listens to the metadata server, that is, the virtual machine 112 periodically accesses the storage space 113 in the metadata server 111, and periodically issues a metadata acquisition request to the metadata server 111 until the verification information in the storage space 113 is obtained. .

Optionally, if the virtual machine 112 is configured to initiate a metadata acquisition request to the metadata server 111 upon restart, the virtual machine 112 may be restarted after the host 120 is required to complete uploading the verification information, and the virtual machine 112 automatically The metadata server obtains authentication information. Generally, restarting the virtual machine 112 is a necessary step for data migration. Therefore, in this case, restarting the virtual machine 112 to obtain verification information can simplify the process and does not require the regular metadata server 111 to initiate metadata acquisition. Request, save computing and network resources.

s204. The metadata server 111 accesses the storage space 113 according to the virtual machine ID in the metadata acquisition request, and sends the verification information stored in the storage space 113 to the virtual machine 112.

The metadata server of the data center is used to obtain the verification information, and the secure access method provided by the metadata server can be used to avoid the risk of the verification information leakage caused by the virtual machine directly obtaining the verification information from the host, which improves the acquisition of the verification information Security, thereby ensuring the security of data migration between hosts outside the data center and virtual machines on the data center.

An embodiment of the present invention provides a data migration module 300 as shown in FIG. 3. The data migration module 300 may be run on the host 120 and configured to provide the virtual machine 112 with authentication information for establishing an SSL channel. The data migration module 300 includes a verification information generating unit 301 and a verification information uploading unit 302.

The verification information generating unit 301 is configured to automatically generate verification information. The verification information is generated by the host 120 according to a timestamp, which is related to the time when the verification information is generated by the host 120. The host 120 may also use the name of the host to name the authentication information.

The verification information is generated using a timestamp, so that the host 120 can automatically generate verification information. Compared with the way that users or operation and maintenance personnel manually configure verification information, the verification information automatically generated by the host can reduce the risk of leakage of the verification information during the generation phase, further verify the security of the information, and thus protect the hosts and data centers outside the data center. Security of data migration between virtual machines.

The verification information uploading unit 302 is configured to generate an upload request including a virtual machine ID of the virtual machine 112 and verification information, and initiate an upload request to the metadata server 111. The verification information is verification information generated by the verification information generating unit 301.

Optionally, the verification information generating unit 301 and the verification information uploading unit 302 may be implemented in a source-side proxy software installed on the host 120.

An embodiment of the present invention also provides a data center 400 as shown in FIG. 4. The data center 400 includes a metadata service unit 401 and a virtual machine 402. The metadata service unit 401 may be a software module running on a computing device, or may be jointly run by multiple computing devices. The data center 110 shown in FIG. 1 is an embodiment of the data center 400. The metadata server 111 in the data center 110 is the metadata service unit 401 in the data center 400, and the virtual machine 112 in the data center 110 is data. Virtual machine 402 in the center 400.

The metadata service unit 401 is used to manage metadata storage space in the data center 400, and the storage space of the virtual machine 402 is used to store metadata of the virtual machine 402.

Receive an upload request from a host. The upload request includes the virtual machine ID and verification information of the virtual machine 402. The data center 400 does not include the host. The metadata service unit 401 accesses the storage space of the virtual machine 402 in the metadata service unit 401 according to the virtual machine ID in the upload request, and stores the verification information to the storage space of the virtual machine 402, where the storage of the virtual machine 402 is The space has the virtual machine ID.

The virtual machine 402 is configured to initiate a metadata acquisition request to the metadata service unit 401, where the metadata acquisition request includes a virtual machine ID of the virtual machine 402.

The metadata service unit 401 is further configured to receive the metadata acquisition request, access the storage space of the virtual machine 402 in the metadata service unit 401 according to the virtual machine ID in the metadata acquisition request, and store the storage space in the storage of the virtual machine 402. The verification information in the space is sent to the virtual machine 402, and the verification information is used for verification of establishing a channel between the virtual machine and the host.

Use the metadata server of the data center to obtain the authentication information, and use the secure access method provided by the metadata server to avoid the risk of authentication information leakage caused by the virtual machine directly obtaining the authentication information from the host, and improve the access to the authentication information. Security, thereby ensuring the security of data migration between hosts outside the data center and virtual machines on the data center.

Optionally, the host is a physical machine or a virtual machine on another data center.

Optionally, the verification information is generated by the host according to a timestamp, and the timestamp is related to a time when the host generates verification information.

Optionally, the verification information includes a certificate and a private key.

Optionally, the data upload request further includes a verification signature. Before accessing the storage space of the virtual machine 402 in the metadata server according to the virtual machine ID in the upload request, the metadata server is further configured to successfully verify the signature according to the verification signature. Verify the upload permissions of the physical machine.

The invention also provides a data center 500. The data center 500 includes at least one computing device 510. The at least one computing device 510 includes one or more processors and one or more memories. The processors and the memories may be connected through an internal bus, or connected through an external interface. The one or more processors are used to run the metadata service unit 401, the virtual machine 402, and the storage space of the virtual machine 402 in the data center 400, and the storage space of the virtual machine 402 is used to store the metadata of the virtual machine 402. The metadata service unit 401 may be a software module running on a computing device, or may be jointly run by multiple computing devices. Exemplarily, a processor 511, a memory 512, and a bus 513 running on a computing device 510 are plotted in FIG. 5; a computing device 520 has a processor 521, a memory 522, and a bus 523, a metadata service unit 401, and a virtual machine 402 Runs on the processor 511. In addition, both the metadata service unit 401 and the virtual machine 402 can run on processors of multiple computing devices. The metadata service unit 401 and the virtual machine 402 can also run on different computing devices in the data center 500. Such an implementation is described in FIG.

The data center 500 shown in FIG. 6 includes at least one metadata server 601 and at least one virtual machine server 602. The at least one virtual machine server 602 runs a virtual machine 402 in the data center 500, that is, the virtual machine 402 can run on the virtual machine server 602, and can run on at least two virtual machine servers in the data center 600. The at least one metadata server 601 runs a storage space of the metadata service unit 401 and the virtual machine 402 in the data center 500, and the storage space of the virtual machine 402 is used to store metadata of the virtual machine 402. Because the metadata of each virtual machine in the data center has high requirements for security, deploying the metadata service unit 401 and the virtual machine 402 on different computing devices can improve the security of the metadata service unit 401 and further improve verification. Information security. The processor in the storage system 500 includes one or more general-purpose processors, where the general-purpose processor may be any type of device capable of processing electronic instructions, including a central processing unit (CPU), a microprocessor, a microprocessor, Controller, main processor, controller, ASIC (Application Specific Integrated Circuit), etc. The processor executes various types of digital storage instructions, such as software or firmware programs stored in the memory 95, which enables the data center to provide a wide variety of services. For example, a processor can execute a program or process data to perform at least a portion of a method discussed herein.

The memory in the storage system 500 may include volatile memory (Volatile memory), such as Random Access Memory (RAM); the memory may also include non-volatile memory (Non-Volatile Memory), such as read-only memory (Read-Only Memory (ROM), Flash Memory (Flash), Hard Disk (HDD), or Solid-State Drive (Solid-State Drive (SSD)) memory may also include a combination of the above types of memories. A service program may be stored in the memory to provide services for the data center.

In the several embodiments provided by the present invention, it should be understood that the disclosed data center, device, and method may be implemented in other manners. For example, the division of the modules described in the device embodiments described above is only a logical function division. In actual implementation, there may be another division manner. For example, multiple modules or components may be combined or integrated into another system, or Some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or modules, and may be electrical, mechanical or other forms.

The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, which may be located in one place, or may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the objective of the solution of this embodiment.

In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist separately physically, or two or more modules may be integrated into one module.

Claims

A method for obtaining verification information, characterized in that the method is used for a first virtual machine in a first data center to obtain the verification information from a host, the first data center does not include the host; the method includes :

Receiving, by the metadata server of the first data center, an upload request from the host, the upload request including a virtual machine ID of the first virtual machine and the verification information;

The metadata server accesses the storage space of the first virtual machine in the metadata server according to the virtual machine ID in the upload request, and stores the verification information in the storage space of the first virtual machine , Wherein the storage space of the first virtual machine has the virtual machine ID;

Receiving, by the metadata server, a metadata acquisition request of the first virtual machine, where the metadata acquisition request includes the virtual machine ID;

The metadata server accesses the storage space of the first virtual machine in the metadata server according to the virtual machine ID in the metadata acquisition request, and stores the storage space in the storage space of the first virtual machine. The verification information is sent to the first virtual machine, and the verification information is used for verification of establishing a channel between the virtual machine and the host.
The method according to claim 1, wherein the host is a physical machine or a second virtual machine in a second data center.
The method according to any one of claims 1 or 2, wherein the verification information is generated by the host according to a timestamp, and the timestamp is related to a time when the host generates verification information.
The method according to any one of claims 1-3, wherein the established channel is a secure socket layer SSL channel, the verification information includes a certificate and a private key, and the certificate and the private key are used for the Verification of SSL tunnel establishment.
The method according to any one of claims 1-4, wherein the upload request further comprises verifying a signature, and the metadata server accesses the metadata server according to the virtual machine ID in the upload request Before the storage space of the first virtual machine in the method, the method further includes:

The metadata server successfully verifies the upload authority of the physical machine according to the verification signature.
A data center characterized in that at least one metadata server and at least one first virtual machine server are deployed in the data center, and a first virtual machine is run on the at least one virtual machine server;

The at least one metadata server is configured to: receive an upload request from a host, where the upload request includes a virtual machine ID and verification information of the first virtual machine, and the data center does not include the host; according to the upload request The virtual machine ID in accessing the storage space of the first virtual machine in the at least one metadata server, and storing the verification information to the storage space of the first virtual machine, wherein the first virtual machine The storage space has the virtual machine ID;

The at least one first virtual machine server is configured to run the first virtual machine to initiate a metadata acquisition request to the at least one metadata server, where the metadata acquisition request includes the virtual machine ID;

The at least one metadata server is further configured to receive the metadata acquisition request, and access the storage of the first virtual machine in the at least one metadata server according to the virtual machine ID in the metadata acquisition request. Space, sending the verification information stored in the storage space of the first virtual machine to the first virtual machine, where the verification information is used for verification of channel establishment between the virtual machine and the host .
The data center according to claim 6, wherein the host is a physical machine or a second virtual machine, and the second virtual machine is a virtual machine of the second data center.
The data center according to any one of claims 6 to 7, wherein the host is a physical machine or a second virtual machine that does not belong to the data center.
The data center according to any one of claims 6-8, wherein the established channel is a secure socket layer SSL channel, the verification information includes a certificate and a private key, and the certificate and the private key are used for all The verification of SSL channel establishment is described.
The data center according to any one of claims 6-9, wherein the upload request further includes a verification signature, and the accessing the at least one metadata server according to the virtual machine ID in the upload request Prior to the storage space of the first virtual machine, the at least one metadata server is further configured to successfully verify the upload right of the physical machine according to the verification signature.
A data center is characterized in that the data center includes at least one computing device, and each computing device includes a processor and a memory; the processor of the at least one computing device is configured to run a metadata service unit and a first virtual device; machine;

The metadata service unit is configured to receive an upload request from a computing device, where the upload request includes a virtual machine ID of the first virtual machine and the verification information, and the data center does not include the computing device; The virtual machine ID in the upload request accesses a storage space of the first virtual machine in the metadata service unit, and stores the verification information in a storage space of the first virtual machine, wherein the first The storage space of the virtual machine has the virtual machine ID;

The first virtual machine is configured to initiate a metadata acquisition request to the metadata service unit, where the metadata acquisition request includes the virtual machine ID;

The metadata service unit is further configured to receive the metadata acquisition request, and access the storage space of the first virtual machine in the metadata service unit according to the virtual machine ID in the metadata acquisition request, Sending the verification information stored in the storage space of the first virtual machine to the first virtual machine, where the verification information is used for verification of channel establishment between the virtual machine and the computing device.
The data center according to claim 11, wherein the host is a physical machine or a second virtual machine of the second data center.
The data center according to any one of claims 11-12, wherein the host is a physical machine or a second virtual machine of the second data center, and the second virtual machine is a virtual machine of the second data center .
The data center according to any one of claims 11-13, wherein the established channel is a secure socket layer SSL channel, the verification information includes a certificate and a private key, and the certificate and the private key are used for all The verification of SSL channel establishment is described.
The data center according to any one of claims 11-14, wherein the upload request further comprises a verification signature, and the accessing the metadata service unit according to the virtual machine ID in the upload request Before the storage space of the first virtual machine, the metadata service unit is further configured to successfully verify the upload right of the physical machine according to the verification signature.