WO2023000502A1

WO2023000502A1 - Method, apparatus and device for encrypting and decrypting disk data of virtual machine, and storage medium

Info

Publication number: WO2023000502A1
Application number: PCT/CN2021/121911
Authority: WO
Inventors: 刘海伟
Original assignee: 苏州浪潮智能科技有限公司
Priority date: 2021-07-21
Filing date: 2021-09-29
Publication date: 2023-01-26
Also published as: CN113285804A

Abstract

Disclosed in the present application are a method, apparatus and device for encrypting and decrypting disk data of a virtual machine, and a storage medium. The method comprises: when an input/output data encryption and decryption request for a target virtual machine is received, determining whether the condition of communicating with a key management server is met; if so, acquiring a data encryption key from the key management server, so as to perform data encryption and decryption operations; and if not, acquiring ciphertext of the data encryption key from a local memory, decrypting the ciphertext of the data encryption key by using a pre-stored key encryption key, and then obtaining the data encryption key to perform data encryption and decryption operations. Therefore, when a key management server is temporarily unavailable or a cloud management platform and a key management server are temporarily unreachable by means of a network, a data encryption key can still be acquired in a timely manner, and the security of the data encryption key is ensured by means of storing the data encryption key in an encrypted manner, thereby improving the availability of data encryption and decryption of a virtual machine while also ensuring the security of the data encryption key.

Description

Encryption and decryption method, device, equipment and storage medium for virtual machine disk data

This application claims the priority of the Chinese patent application submitted to the China Patent Office on July 21, 2021, with the application number 202110822203.9, and the title of the invention is "encryption and decryption method, device, equipment and storage medium for virtual machine disk data", all of which The contents are incorporated by reference in this application.

technical field

The present application relates to the field of data security, in particular to a method, device, device and storage medium for encrypting and decrypting disk data of a virtual machine.

Background technique

Cloud computing deploys computing, storage, and network resources to cloud servers through virtualization technology, which improves the utilization rate of resources, and also enables dynamic acquisition of resources and convenient expansion. Compared with traditional local computing, data is stored on remote cloud servers through the network, which also brings many security risks. In order to reduce the risk of data leakage, virtual disks are usually encrypted and stored in remote cloud servers. In the prior art, when the input data of the virtual machine falls into the disk, the cloud management platform uses a data encryption key (Data Encryption Key, DEK) to encrypt the input data and save it. When the data of the virtual machine needs to be accessed, the cloud management platform uses the data encryption key to decrypt it. In this way, the security protection of the disk data of the virtual machine is realized.

In order to ensure the security of the data encryption key, the data encryption key is obtained from the Key Management Server (KMS) in real time through the network when the virtual machine disk encryption and decryption task is generated. This brings about a new problem: when the key management server is temporarily unavailable or the cloud management platform and the key management server are temporarily unreachable through the network, the cloud management platform cannot obtain the data encryption key, which also causes virtual machine data encryption. The unsustainable progress of the decryption task. This unsustainable service cannot meet the high-availability service requirements proposed by many industries today.

Contents of the invention

The purpose of this application is to provide a virtual machine disk data encryption and decryption method, device, device and storage medium, which are used to improve the availability of virtual machine data encryption and decryption on the premise of ensuring the security of the data encryption key.

In order to solve the above technical problems, the present application provides a method for encrypting and decrypting virtual machine disk data, including:

When receiving the input and output data encryption and decryption requests of the target virtual machine, it is judged whether the conditions for communicating with the key management server are met;

If the conditions for communicating with the key management server are met, then obtain a data encryption key from the key management server;

If the condition for communicating with the key management server is not met, the ciphertext of the data encryption key is obtained from the local storage, and the ciphertext of the data encryption key is decrypted using the pre-stored key encryption key Obtain the data encryption key;

Using the data encryption key to perform encryption and decryption operations on the data of the target virtual machine.

Optionally, the judging whether the conditions for communicating with the key management server are met, specifically includes:

Judging whether the key management server is in a normal network connection state and the key management server is in an available state at the same time;

If yes, then determining that the conditions for communicating with the key management server are met;

If not, it is determined that the condition for communicating with the key management server is not met.

judging whether the estimated time for communicating with the key management server is within a preset time range;

If not, determining that the conditions for communicating with the key management server are not met;

Wherein, the estimated time is calculated based on the network connection status with the key management server and the performance parameters of the input/output data encryption/decryption request.

Optionally, also include:

When creating the target virtual machine, generating a key encryption key corresponding to the target virtual machine;

receiving the ciphertext of the data encryption key returned by the key management server after encrypting the data encryption key with the key encryption key;

storing the ciphertext of the data encryption key into the local memory.

Optionally, the key encryption key is specifically an asymmetric key;

After generating the key encryption key corresponding to the target virtual machine, the encryption and decryption method further includes:

sending the public key in the asymmetric key and the unique identifier of the target virtual machine to the key management server;

The receiving of the ciphertext of the data encryption key returned by the key management server after encrypting the data encryption key with the key encryption key is specifically:

receiving the ciphertext of the data encryption key returned by the key management server after encrypting the data encryption key with the public key.

Optionally, the key encryption key is specifically an SM2-type asymmetric key; the data encryption key is specifically an SM4-type symmetric key.

Optionally, also include:

Judging whether the expiration time of the ciphertext of the data encryption key has been reached;

If yes, obtain the ciphertext of the data encryption key from the key management server to update the ciphertext of the data encryption key in the local storage, and change the expiration time.

In order to solve the above technical problems, the present application also provides an encryption and decryption device for virtual machine disk data, including:

The first judging unit is configured to judge whether the condition for communicating with the key management server is satisfied when receiving the input and output data encryption and decryption request of the target virtual machine;

a first obtaining unit, configured to obtain a data encryption key from the key management server if the conditions for communicating with the key management server are met;

The second obtaining unit is configured to obtain the ciphertext of the data encryption key from the local storage if the condition for communicating with the key management server is not satisfied, and encrypt the data using the pre-stored key encryption key decrypting the ciphertext of the key to obtain the data encryption key;

The execution unit is configured to use the data encryption key to perform encryption and decryption operations on the data of the target virtual machine.

A memory for storing instructions, the instructions including the steps of any one of the methods for encrypting and decrypting virtual machine disk data described above;

a processor for executing the instructions.

In order to solve the above technical problems, the present application also provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for encrypting and decrypting virtual machine disk data as described in any one of the above items are implemented.

The encryption and decryption method for virtual machine disk data provided by this application includes: when receiving the input and output data encryption and decryption requests of the target virtual machine, judging whether the conditions for communicating with the key management server are met, and if the conditions are met, then Obtain the data encryption key from the key management server for data encryption and decryption operations; if this condition is not met, obtain the ciphertext of the data encryption key from the local storage, and use the pre-stored key encryption key to encrypt the data encryption key After the ciphertext is decrypted, the data encryption key is obtained for data encryption and decryption operations. Then, by applying the encryption and decryption method of virtual machine disk data provided by this application, the data encryption key can be obtained in time when the key management server is temporarily unavailable or the cloud management platform and the key management server are temporarily unreachable through the network, and through The way of encrypting and storing the data encryption key ensures the security of the data encryption key, thereby improving the usability of virtual machine data encryption and decryption under the premise of ensuring the security of the data encryption key.

The present application also provides an encryption and decryption device, device, and storage medium for virtual machine disk data, which have the above-mentioned beneficial effects, and will not be repeated here.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the accompanying drawings that need to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings in the following description are only For some embodiments of the present application, those of ordinary skill in the art can also obtain other drawings based on these drawings without creative effort.

FIG. 1 is a flow chart of a method for encrypting and decrypting virtual machine disk data provided by an embodiment of the present application;

FIG. 2 is a schematic structural diagram of an encryption and decryption device for virtual machine disk data provided by an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a virtual machine disk data encryption and decryption device provided by an embodiment of the present application.

detailed description

The core of the present application is to provide a virtual machine disk data encryption and decryption method, device, device and storage medium, which are used to improve the usability of virtual machine data encryption and decryption on the premise of ensuring the security of the data encryption key.

The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

Embodiment one

FIG. 1 is a flowchart of a method for encrypting and decrypting disk data of a virtual machine provided by an embodiment of the present application.

As shown in Figure 1, the method for encrypting and decrypting virtual machine disk data provided by the embodiment of the present application includes:

S101: When receiving the input and output data encryption and decryption request of the target virtual machine, judge whether the condition for communicating with the key management server is met; if yes, go to step S102; if not, go to step S103.

S102: Obtain the data encryption key from the key management server.

S103: Obtain the ciphertext of the data encryption key from the local storage, and use the prestored key encryption key to decrypt the ciphertext of the data encryption key to obtain the data encryption key.

S104: Encrypt and decrypt the data of the target virtual machine by using the data encryption key.

In a specific implementation, the software architecture of the encryption and decryption method for virtual machine disk data provided in the embodiment of the present application may include a key management system, a cloud management platform, a key cache manager, and a disk encryption and decryption module.

Among them, the key management system is deployed on the key management server, which is used to manage the data encryption keys used for encryption and decryption of virtual machine disk data, including application scenarios such as creation and deletion, and can also be used to verify the identity information of the cloud management platform Then use the key encryption key (Key Encryption Key, KEK) agreed with the cloud management platform to encrypt the data encryption key to generate the ciphertext of the data encryption key.

The cloud management platform and the key cache manager are usually deployed on the same server node. The cloud management platform is used to manage the life cycle of the virtual machine, interact with the key management system, and also be used to obtain encrypted data sent by the key management server. The ciphertext of the key is distributed to the key cache manager; the key cache manager is used to interact with the cloud management platform to cache the ciphertext of the data encryption key in the local storage, and interact with the disk encryption module to provide data encryption The ciphertext of the key is given to the disk encryption module, and can also be used to provide the key expiration time setting to determine whether the key in the local storage needs to be updated based on the key expiration time. Before using the cloud management platform to perform virtual machine disk data encryption and decryption tasks, you should ensure that the cloud management platform is a reliable platform. Then before performing the above steps, it also includes: the server node where the cloud management platform is located sends the unique identifier (UUID) of the cloud management platform to the key management server and submits a registration application. After receiving the unique identifier of the cloud management platform, the key management server generates a digital certificate based on the unique identifier and returns a registration request. The server node where the cloud management platform is located records the returned digital certificate, and establishes an SSL channel for subsequent network communication based on the digital certificate.

The disk encryption module can be deployed on the same server node as the cloud management platform, or it can be deployed on a different server node. It is used to generate the key encryption key and send the key encryption key to the cloud management platform. The manager obtains the ciphertext of the data encryption key, uses the key encryption key to decrypt the ciphertext of the data encryption key, obtains the plaintext of the data encryption key, and uses the data encryption key to encrypt the disk data of the virtual machine. decryption operation.

Based on the above architecture, the method for encrypting and decrypting virtual machine disk data provided in the embodiment of the present application can be implemented based on the server nodes deployed on the cloud management platform.

For step S101, the request for encryption and decryption of input and output data of the target virtual machine includes an encryption request for input data of the target virtual machine and/or a decryption request for disk data of the virtual machine when accessing the target virtual machine. That is, each data input or output of the target virtual machine needs to request a data encryption key. To ensure security, data encryption keys can be in one-to-one correspondence with virtual machines. Further, the data encryption key may also be in one-to-one correspondence with each disk of the virtual machine.

In step S101, judging whether the conditions for communicating with the key management server are met may include:

Judging whether it is in a normal network connection state with the key management server and the key management server is available at the same time;

If so, determining that the conditions for communicating with the key management server are met;

That is, if the key management server is reachable, the data encryption key is preferentially obtained from the key management server. Specifically, a request for a data encryption key may be sent to the key management server. If the data encryption key sent by the key management server is not received within a certain period of time, the key management server is considered unreachable.

Preferably, in step S101, it is judged whether the conditions for communicating with the key management server are met, specifically including:

Judging whether the estimated time for communicating with the key management server is within the preset time range;

If not, then determining that the conditions for communicating with the key management server are not met;

Wherein, the estimated time is calculated based on the network connection status with the key management server and the performance parameters of the input and output data encryption and decryption requests.

Since the key management server and the server nodes deployed by the cloud management platform may or may not be in the same local area network, and the resources allocated by the server to the virtual machine disk encryption and decryption tasks may also be different, resulting in cloud management It takes different time for the server nodes deployed on the platform to obtain the first key from the key management server, and different users or businesses have different requirements for virtual machine data encryption and decryption services. Therefore, the estimated time for communicating with the key management server can be calculated based on parameters such as the possible network relationship between the key management server and the server nodes deployed on the cloud management platform, and the resources allocated by the server to the virtual machine disk encryption and decryption tasks, and The preset time range is determined based on user or business requirements for virtual machine data encryption and decryption services.

Either of the above two methods for judging whether the conditions for communicating with the key management server are met can be selected, or they can be used in combination.

For step S102 and step S103, in order to ensure the security of the data encryption key, preferably, the data encryption key provided by the key management server is the ciphertext of the data encryption key. The key management server encrypts the data encryption key with the key encryption key agreed between the key management system and the cloud management platform, generates the ciphertext of the data encryption key, and sends the ciphertext of the data encryption key to the cloud management The node where the platform is located. After the cloud management platform receives the ciphertext of the data encryption key, it distributes the ciphertext of the data encryption key to the key cache manager, and the key cache manager caches the ciphertext of the data encryption key in the local memory.

In step S102, after the node where the cloud management platform is located obtains the ciphertext of the data encryption key, it sends the ciphertext of the data encryption key to the disk encryption module, and the disk encryption module decrypts it to obtain the data encryption key.

In step S103, the node where the cloud management platform is located takes out the ciphertext of the data encryption key pre-stored in the local memory by the key cache manager, sends the ciphertext of the data encryption key to the disk encryption module, and the disk encryption module decrypts it Then get the data encryption key.

After obtaining the data encryption key, the encryption and decryption tasks are executed according to the input and output data encryption and decryption requests of the target virtual machine.

Both the data encryption key and the key encryption key may specifically be symmetric keys or asymmetric keys. Since the virtual machine disk encryption and decryption tasks have high requirements on delay and high security requirements on the data encryption key, the data encryption key is preferably a symmetric key, and the key encryption key is preferably an asymmetric key. . In order to meet the relevant policy requirements of the my country Commercial Cryptography Bureau and increase the compliance of the system, the key encryption key adopts the SM2 type asymmetric key, and the data encryption key adopts the SM4 type symmetric key.

The method for encrypting and decrypting virtual machine disk data provided by the embodiment of the present application includes: when receiving the input and output data encryption and decryption request of the target virtual machine, judging whether the condition for communicating with the key management server is met; if this condition is met, Obtain the data encryption key from the key management server for data encryption and decryption operations; if this condition is not met, obtain the ciphertext of the data encryption key from the local storage, and use the pre-stored key encryption key to encrypt the data After decrypting the ciphertext of the key, the data encryption key is obtained for data encryption and decryption operations. Then, by applying the method for encrypting and decrypting virtual machine disk data provided by the embodiment of the present application, the data encryption key can be obtained in time even when the key management server is temporarily unavailable or the cloud management platform and the key management server are temporarily unreachable through the network. Moreover, the security of the data encryption key is ensured by encrypting and storing the data encryption key, so that the usability of data encryption and decryption of the virtual machine can be improved under the premise of ensuring the security of the data encryption key.

Embodiment two

On the basis of the above-mentioned embodiments, the method for encrypting and decrypting virtual machine disk data provided in the embodiments of the present application further includes:

When creating the target virtual machine, generate a key encryption key corresponding to the target virtual machine;

Receive the ciphertext of the data encryption key returned by the key management server after encrypting the data encryption key with the key encryption key;

Store the ciphertext of the data encryption key in the local memory.

As mentioned in the above embodiments, to ensure security, the data encryption key is in one-to-one correspondence with the virtual machine, or even one-to-one with the disk of the virtual machine. At the same time, in order to ensure the security of the data encryption key, it is preferable to make the key encryption key correspond to the target virtual machine, and the key management server also holds the key encryption key, and the key management server uses the key encryption key to After encrypting the data encryption key, return the ciphertext of the data encryption key to the server node where the cloud management platform is located.

Since the key encryption key is generated by the server node where the cloud management platform is located, the key management server may obtain the key encryption key from the server node where the cloud management platform is located. The encryption key for the key may be a symmetric key or an asymmetric key, and in this case, an asymmetric key is preferred. That is, in the method for encrypting and decrypting virtual machine disk data provided in the embodiment of the present application, after generating the key encryption key corresponding to the target virtual machine, it further includes:

Send the public key in the asymmetric key and the unique identifier of the target virtual machine to the key management server;

Receive the ciphertext of the data encryption key returned by the key management server after encrypting the data encryption key with the key encryption key, specifically:

Receive the ciphertext of the data encryption key returned by the key management server after encrypting the data encryption key with the public key.

In addition to using an asymmetric key to ensure security for the key encryption key, the cloud management platform and the key management system can also pre-agree on the generation method of the key encryption key, such as calculating the key encryption key based on time, Then, after the server node where the cloud management platform is located generates the key encryption key corresponding to the target virtual machine, it sends the type and generation time of the target virtual machine to the key management server, and the key management server determines the The key encryption key corresponding to the target virtual machine is generated, and the key encryption key corresponding to the target virtual machine is calculated by itself according to the generation time of the target virtual machine, thereby eliminating the transmission process of the key encryption key, Play a role in protecting the security of the key.

Embodiment three

On the basis of the above-mentioned embodiments, the method for encrypting and decrypting virtual machine disk data provided in the embodiments of the present application may further include:

Determine whether the expiration time of the ciphertext of the data encryption key has been reached;

If so, obtain the ciphertext of the data encryption key from the key management server to update the ciphertext of the data encryption key in the local storage, and change the expiration time.

The expiration time is set for the ciphertext of the data encryption key to ensure the consistency of the data encryption key of the server node where the cloud management platform is located and the data encryption key of the key management server.

In a specific implementation, the expiration time of the ciphertext of the data encryption key can be calculated based on the agreed valid duration of the ciphertext of each data encryption key and the time when the server node where the cloud management platform is located receives the ciphertext of the data encryption key The obtained expiration time point may also be in the countdown form, and when the current time reaches the expiration time point or the countdown is zero, it is considered that the expiration time of the ciphertext of the data encryption key has been reached. Then the storage form of the ciphertext of the data encryption key in the local storage can be shown in Table 1:

vm_uuidvm_uuid	虚拟机唯一标识Virtual machine unique identifier
Cipher_dekCipher_dek	数据加密密钥的密文Ciphertext of the data encryption key

Expire_time

The expiration time of the ciphertext of the data encryption key

Table 1. Key fields of ciphertext for storing data encryption keys in local memory

In order to avoid using an inconsistent data encryption key to perform virtual machine disk data encryption and decryption operations, after checking the ciphertext of the data encryption key in the local storage beyond the expiration time, the data encryption key is not used. However, this will result in no data encryption key available for the virtual machine disk data encryption and decryption task. In this regard, it can also be set to reacquire the ciphertext of the data encryption key from the key management server at a certain point in the valid time of the ciphertext of the data encryption key, which is about to reach the expiration time, instead of When the ciphertext of the key reaches the expiration time, it will go to the key management server to obtain the ciphertext of the data encryption key.

Various embodiments corresponding to the method for encrypting and decrypting virtual machine disk data are described in detail above. On this basis, the present application also discloses an encryption and decryption device, device, and storage medium for virtual machine disk data corresponding to the above method.

Embodiment four

FIG. 2 is a schematic structural diagram of an apparatus for encrypting and decrypting disk data of a virtual machine provided by an embodiment of the present application.

As shown in Figure 2, the encryption and decryption device for virtual machine disk data provided by the embodiment of the present application includes:

The first judging unit 201 is configured to judge whether a condition for communicating with the key management server is met when receiving an input/output data encryption/decryption request from the target virtual machine;

The first obtaining unit 202 is configured to obtain the data encryption key from the key management server if the condition for communicating with the key management server is met;

The second obtaining unit 203 is configured to obtain the ciphertext of the data encryption key from the local storage if the condition for communicating with the key management server is not satisfied, and use the prestored key encryption key to encrypt the ciphertext of the data encryption key Decrypt to obtain the data encryption key;

The execution unit 204 is configured to perform encryption and decryption operations on the data of the target virtual machine by using the data encryption key.

Optionally, the first judging unit 201 judges whether the conditions for communicating with the key management server are met, specifically including:

Optionally, the first judging unit 201 judges whether the conditions for communicating with the key management server are met, specifically including: judging whether the estimated time for communicating with the key management server is within a preset time range;

Optionally, the device for encrypting and decrypting virtual machine disk data provided in the embodiment of the present application further includes:

A generating unit, configured to generate a key encryption key corresponding to the target virtual machine when creating the target virtual machine;

The receiving unit is configured to receive the ciphertext of the data encryption key returned by the key management server after encrypting the data encryption key with the key encryption key;

The storage unit is configured to store the ciphertext of the data encryption key in the local storage.

Optionally, the key encryption key is specifically an asymmetric key;

Optionally, the key encryption key is specifically an SM2 type asymmetric key; the data encryption key is specifically an SM4 type symmetric key.

The second judging unit is used to judge whether the expiration time of the ciphertext of the data encryption key has been reached;

The third acquisition unit is used to obtain the ciphertext of the data encryption key from the key management server to update the ciphertext of the data encryption key in the local storage if the expiration time of the ciphertext of the data encryption key is reached, and change Expiration time.

Since the embodiment of the device part corresponds to the embodiment of the method part, please refer to the description of the embodiment of the method part for the embodiment of the device part, and details will not be repeated here.

Embodiment five

As shown in Figure 3, the encryption and decryption equipment for virtual machine disk data provided by the embodiment of the present application includes:

The memory 310 is used to store instructions, and the instructions include the steps of the method for encrypting and decrypting virtual machine disk data described in any one of the above-mentioned embodiments;

The processor 320 is configured to execute the instruction.

Wherein, the processor 320 may include one or more processing cores, such as a 3-core processor, an 8-core processor, and the like. The processor 320 can be realized by at least one hardware form of DSP (Digital Signal Processing), Field-Programmable Gate Array (FPGA) and Programmable Logic Array (PLA). Processor 320 may also include a main processor and a coprocessor, the main processor is a processor for processing data in a wake-up state, and is also called a central processing unit CPU (Central Processing Unit); Low-power processor for processing data in standby state. In some embodiments, the processor 320 may be integrated with an image processor GPU (Graphics Processing Unit), and the GPU is used for rendering and drawing the content that needs to be displayed on the display screen. In some embodiments, the processor 320 may also include an artificial intelligence AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

Memory 310 may include one or more storage media, which may be non-transitory. The memory 310 may also include high-speed random access memory, and non-volatile memory, such as one or more magnetic disk storage devices and flash memory storage devices. In this embodiment, the memory 310 is at least used to store the following computer program 311, wherein, after the computer program 311 is loaded and executed by the processor 320, it can realize the method for encrypting and decrypting virtual machine disk data disclosed in any of the preceding embodiments. related steps. In addition, the resources stored in the memory 310 may also include an operating system 312 and data 313, etc., and the storage method may be temporary storage or permanent storage. Wherein, the operating system 312 can be Windows. The data 313 may include but not limited to the data involved in the above method.

In some embodiments, the device for encrypting and decrypting virtual machine disk data may further include a display screen 330 , a power supply 340 , a communication interface 350 , an input/output interface 360 , a sensor 370 and a communication bus 380 .

Those skilled in the art can understand that the structure shown in FIG. 3 does not constitute a limitation on the device for encrypting and decrypting virtual machine disk data, and may include more or less components than those shown in the figure.

The encryption and decryption device for virtual machine disk data provided by the embodiment of the present application includes a memory and a processor. When the processor executes a program stored in the memory, it can implement the above-mentioned encryption and decryption method for virtual machine disk data, and the effect is the same as above.

Embodiment six

It should be noted that the above-described device and device embodiments are only illustrative. For example, the division of modules is only a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components May be combined or may be integrated into another system, or some features may be omitted, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or modules may be in electrical, mechanical or other forms. A module described as a separate component may or may not be physically separated, and a component shown as a module may or may not be a physical module, that is, it may be located in one place, or may also be distributed to multiple network modules. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional module in each embodiment of the present application may be integrated into one processing module, each module may exist separately physically, or two or more modules may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules.

If an integrated module is realized in the form of a software function module and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , executing all or part of the steps of the methods described in the various embodiments of the present application.

To this end, the embodiment of the present application also provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for encrypting and decrypting disk data of a virtual machine are implemented.

The storage medium may include: U disk, mobile hard disk, read-only memory ROM (Read-Only Memory), random access memory RAM (Random Access Memory), magnetic disk or optical disk and other media that can store program codes.

The computer program included in the storage medium provided in this embodiment can implement the steps of the method for encrypting and decrypting virtual machine disk data as described above when executed by a processor, and the effect is the same as above.

A method, device, device, and storage medium for encrypting and decrypting disk data of a virtual machine provided by the present application have been described above in detail. Each embodiment in the description is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other. As for the devices, equipment and storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and for relevant details, please refer to the description of the method part. It should be pointed out that those skilled in the art can make several improvements and modifications to the application without departing from the principles of the application, and these improvements and modifications also fall within the protection scope of the claims of the application.

It should also be noted that in this specification, relative terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that these entities or operations There is no such actual relationship or order between the operations. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

Claims

A method for encrypting and decrypting disk data of a virtual machine, comprising:

When receiving the input and output data encryption and decryption requests of the target virtual machine, it is judged whether the conditions for communicating with the key management server are met;

If the conditions for communicating with the key management server are met, then obtain a data encryption key from the key management server;

If the condition for communicating with the key management server is not met, the ciphertext of the data encryption key is obtained from the local storage, and the ciphertext of the data encryption key is decrypted using the pre-stored key encryption key Obtain the data encryption key;

Using the data encryption key to perform encryption and decryption operations on the data of the target virtual machine.
The encryption and decryption method according to claim 1, wherein the judging whether the condition for communicating with the key management server is met specifically includes:

Judging whether the key management server is in a normal network connection state and the key management server is in an available state at the same time;

If yes, then determining that the conditions for communicating with the key management server are met;

If not, it is determined that the condition for communicating with the key management server is not met.
The encryption and decryption method according to claim 1, wherein the judging whether the condition for communicating with the key management server is met specifically includes:

judging whether the estimated time for communicating with the key management server is within a preset time range;

If yes, then determining that the conditions for communicating with the key management server are met;

If not, determining that the conditions for communicating with the key management server are not met;

Wherein, the estimated time is calculated based on the network connection status with the key management server and the performance parameters of the input/output data encryption/decryption request.
The encryption and decryption method according to claim 1, further comprising:

When creating the target virtual machine, generating a key encryption key corresponding to the target virtual machine;

receiving the ciphertext of the data encryption key returned by the key management server after encrypting the data encryption key with the key encryption key;

storing the ciphertext of the data encryption key into the local memory.
The encryption and decryption method according to claim 4, wherein the key encryption key is specifically an asymmetric key;

After generating the key encryption key corresponding to the target virtual machine, the encryption and decryption method further includes:

sending the public key in the asymmetric key and the unique identifier of the target virtual machine to the key management server;

The receiving of the ciphertext of the data encryption key returned by the key management server after encrypting the data encryption key with the key encryption key is specifically:

receiving the ciphertext of the data encryption key returned by the key management server after encrypting the data encryption key with the public key.
The encryption and decryption method according to claim 5, wherein the key encryption key is specifically an SM2-type asymmetric key; the data encryption key is specifically an SM4-type symmetric key.
The encryption and decryption method according to claim 1, further comprising:

Judging whether the expiration time of the ciphertext of the data encryption key has been reached;

If yes, obtain the ciphertext of the data encryption key from the key management server to update the ciphertext of the data encryption key in the local storage, and change the expiration time.
An encryption and decryption device for virtual machine disk data, characterized in that it includes:

The first judging unit is configured to judge whether the condition for communicating with the key management server is satisfied when receiving the input and output data encryption and decryption request of the target virtual machine;

A first obtaining unit, configured to obtain a data encryption key from the key management server if the conditions for communicating with the key management server are met;

The second obtaining unit is configured to obtain the ciphertext of the data encryption key from the local storage if the condition for communicating with the key management server is not satisfied, and encrypt the data using the pre-stored key encryption key decrypting the ciphertext of the key to obtain the data encryption key;

The execution unit is configured to use the data encryption key to perform encryption and decryption operations on the data of the target virtual machine.
An encryption and decryption device for virtual machine disk data, characterized in that it includes:

A memory for storing instructions, the instructions including the steps of the method for encrypting and decrypting virtual machine disk data according to any one of claims 1 to 7;

a processor for executing the instructions.
A storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the method for encrypting and decrypting virtual machine disk data according to any one of claims 1 to 7 are implemented.