WO2024045407A1

WO2024045407A1 - Virtual disk-based secure storage method

Info

Publication number: WO2024045407A1
Application number: PCT/CN2022/137630
Authority: WO
Inventors: 王宇锋; 谢明; 孙立明; 张铎
Original assignee: 麒麟软件有限公司
Priority date: 2022-09-02
Filing date: 2022-12-08
Publication date: 2024-03-07
Also published as: CN115146318A; CN115146318B

Abstract

A virtual disk-based secure storage method, comprising the following steps: using a qemu-img tool to create a set of partitioned virtual disk files, partition information of the virtual disk files being written into a file header of an image of a first virtual disk file; starting a virtual machine, specifying the first virtual disk file of a virtual disk image by means of a qemu-kvm program, reading the partition information, and finding images of the remaining virtual disk files; opening a qcow2 virtual disk in qemu, creating partition meta information by means of the partition information; and according to the ranges of partitions of corresponding read/write requests, respectively sending the corresponding read/write requests to the corresponding virtual disk files of the virtual disk image for processing. According to the present invention, data is stored in different virtual disk files, and the content of a full image cannot be recovered when part of the image is stolen, thereby ensuring the security of data in a virtual disk image.

Description

Safe storage methods for virtual disks

Technical field

The present invention relates to the field of information security technology, and in particular to a virtual disk safe storage method.

Background technique

The era of cloud computing is inseparable from the processing and storage of massive data. The storage of massive data often requires a secure disk image storage method. Once a problem occurs with the disk image, it will seriously affect the data security of the cloud computing center. In order to improve the data security of massive virtual machine disk images, it is often necessary to encrypt the data when storing it and decrypt it when using it.

technical problem

In principle, there are two problems that safe storage needs to solve:

1. How to ensure that file data is complete, reliable and not leaked?

2. How to ensure that only legitimate users can access relevant files?

To solve the above two problems, we need to use data encryption and authentication and authorization management technologies, which are also the core technologies of secure storage. In secure storage, technical means are used to convert files into garbled (encrypted) storage, and when the files are used, the same or different means are used to restore (decrypt) them. In this way, when stored and used, the file switches between ciphertext and plaintext states. It not only ensures safety, but also can be used conveniently. Encryption consists of two elements: algorithm and key. The technology of data encryption is divided into two categories, namely symmetric encryption (private key encryption) and asymmetric encryption (public key encryption). Symmetric encryption is typically represented by the Data Encryption Standard (DES) algorithm, and asymmetric encryption is usually represented by the RSA (Rivest Shamir Ademan) algorithm. The encryption key and decryption key of symmetric encryption are the same, while the encryption key and decryption key of asymmetric encryption are different. The encryption key can be made public but the decryption key needs to be kept secret.

Generally speaking, asymmetric keys are mainly used for identity authentication, or to protect symmetric keys. Daily data encryption generally uses symmetric keys.

Modern mature encryption and decryption algorithms have reliable encryption strength and are difficult to forcibly crack unless the correct key is held. During the actual deployment of secure storage products, if higher-strength identity authentication is required, U-key can also be used. This authentication device is commonly used in online banking.

Using encryption and identity authentication technology, storage is reliably guaranteed.

As the most commonly used encryption method for virtual machine image storage: it is processed where the block device read and write functions are located. The data is encrypted when writing and decrypted when reading. The key can be dynamically transferred or stored on the key card. The specific encryption algorithm can be selected according to your usage scenario.

Secure storage is essentially storage and can serve as a remote distributed storage center for files and data. Compared with ordinary storage, distributed storage is safer and more reliable, and can be used in areas that require confidentiality. If the data is placed in one place, you can get all the data by cracking it once. If the data is placed in different places, you need to crack multiple places at the same time to fully recover the complete data, and you need to crack multiple remote storage centers at the same time. So our solution is to make the disk image consist of multiple blocks, with data scattered in various image files, and each image file can be stored in different data centers. In this way, even if a data center is cracked, the disk image content cannot be restored. Therefore, the virtual disk file needs to support block storage and place different storage blocks in different storage locations. Our patent is aimed at allowing disk image files in the qcow2 format to be stored in different files in blocks, and the previously stored data can also be read from each storage block during operation. This allows the data of the virtual machine to be stored in different locations to achieve storage security.

Chinese invention patent "A method of creating and using encrypted snapshots of disk image files and storage media" (Patent No.: CN109376119A). The embodiment of the present invention discloses a method for creating and using an encrypted snapshot of a disk image file and a storage medium, which belongs to the field of virtualization. The method of creating an encrypted snapshot of a disk image file includes the following steps: parsing key parameters and generating cipher password information for use in encrypting and decrypting files; copying the cipher password information to the source file operation options; opening the source file according to the source file operation options; judging Check whether the source file is opened successfully. If successful, create a snapshot and set the encryption information of the snapshot. When operating a snapshot in the embodiment of the present invention, the key of the snapshot can be used to decrypt the source file, thereby changing the problem in the existing function that the key cannot be transferred to the source file and the snapshot at the same time, and realizing the simultaneous implementation of the encryption function and the snapshot function. Implemented the creation of encrypted snapshots of Qemu Qcow2 disk image files. This does not improve encryption security, mainly because encryption and snapshot functions are implemented at the same time.

Chinese invention patent "Trusted virtual machine vTPM private information protection method and system based on tenant identity information" (Patent No.: CN111683052A). The invention discloses a method and system for protecting trusted virtual machine vTPM private information based on tenant identity information. The method includes: establishing two non-migratory keys RSA_local and RSA_mig of the physical trusted platform module, and RSA_mig key Generate the corresponding digital certificate Certificate_mig; the cloud tenant generates identity authentication information on the local host and saves it; when creating a trusted virtual machine, create a vTPM label for the vTPM instance of each virtual machine; obtain identity_info identity authentication information, vTPM The tag and tenant_info are checked for integrity, timeliness, legality and consistency; similarly, during the running phase of the trusted virtual machine, when migrating the trusted virtual machine, and during the exit, destruction, suspension and snapshot phases, the corresponding fields are completed validity, timeliness, legality and consistency checks. The present invention can perform full life cycle security protection on the vTPM based on libtpms software simulation added to the IaaS cloud platform based on KVM virtualization technology to prevent the leakage of its private information. This patent uses the TPM module for feasibility verification, and the disk security is not protected during shutdown.

Chinese invention patent "Virtual Machine Data Protection System and Method" (Patent No.: CN103902884A). The patent discloses a virtual machine data protection system and method, involving the field of cloud computing virtualization data security technology. By verifying, marking and network controlling requests to access virtual machine data in Domain0, combined with data behavior and flow monitoring within the virtual machine, the purpose of secure access to virtual machine data is achieved. It solves the problem of illegal access from outside the cloud or other virtual machines in a multi-tenant virtual machine environment due to vulnerabilities or configuration errors in the services deployed by the virtual machine, or bugs in the virtual machine's application or kernel. This patent is mainly aimed at data security at runtime.

Chinese invention patent "A method and mobile terminal for secure data storage and rapid retrieval" (Patent No.: CN109829324A). The invention discloses a method for secure data storage and quick retrieval and a mobile terminal, which include: encrypting data that the system needs to store under an open public path; and storing the encrypted data under the open public path; Decrypt the data under the open public path, store the decrypted data in virtual memory, and form a mapped path according to the storage address; perform the system call interface whose access path defaults to the open public path. Modify, modify the access path of the system call interface to the mapped path, thereby causing the system to retrieve the decrypted data from the virtual memory for use. The present invention can not only solve the problem of safe storage of data under the default path of the system, but also improve the speed of data calling, avoid system lags, unresponsiveness and other phenomena, and well solve the problem of data storage security and data calling speed. conflicts between issues. The patent only focuses on encrypting data stored in an open public path.

Chinese invention patent "Secure storage method of mobile terminal data based on virtual disk" (Patent No.: CN109325355A). The invention provides a virtual disk-based mobile terminal data secure storage method, which belongs to the field of information security. The working method of this invention is to first create an independent disk partition in the hard disk, simulate the disk partition by creating a fixed-size file, and then format the file content into a custom file system, so that it can be simulated into a disk, that is, a virtual disk. disk. Finally, combined with real-time encryption technology, encryption and decryption methods are added during the process of reading and writing disks to ensure data security. The invention customizes an encrypted file system for an independent disk partition, constructs an encryption and decryption pipeline for plain text in the memory and cipher text on the disk, avoids leaving traces of plain text on the disk, and provides transparent data protection. The invention has high security and flexibility, provides strong protection for data in the mobile terminal, can customize the encrypted file system and identity verification mechanism, and can also provide a variety of encryption algorithms and working modes. The encryption method implemented by this patent is that qemu already supports disk data segment encryption.

Chinese invention patent "A Differential Virtual Disk Linking Method" (Patent No.: CN108228108A). The patent discloses a differential virtual disk linking method, which includes the following steps: 1) Improve the differential virtual disk file format, and modify the recorded original virtual disk path information from the current absolute path or relative path in the physical machine system. It is the URL path information that can be accessed through the network; 2) Virtual disk driver improvement, the reading and writing of the differential virtual disk depends on the virtual disk driver, which requires the virtual disk driver to access the server through the IP network based on the network path information recorded by the differential virtual disk. Original virtual disk file; 3) Virtual disk access service, a host that stores original virtual disk files, a network service that provides original virtual disk access, monitors access requests from the differential virtual disk host, and completes read and write operations on the original virtual disk according to the request; It has the characteristics of separate deployment of differential virtual disks and its original virtual disks and cross-host access, which facilitates rapid deployment and has the advantages of balancing data security and access speed. This patent already has the "backing file" feature in the qcow2 format to implement it. A certain image is used as the base disk (generally installed with the most basic OS files and data). Other disks that require a base can specify this as the backing file, and then The contents of differential writes will be written to their respective virtual disks. If you create a multi-level backing file, modifying the previous data will lead to data redundancy, which will consume disk space at a very high cost.

Technical solutions

In order to solve the shortcomings of the existing technology, the present invention provides a virtual disk safe storage method, which includes the following steps:

Step S1: Use the qemu-img tool to create a set of block virtual disk files. The block information of the virtual disk file is written into the file header of the first virtual disk file;

Step S2: Start the virtual machine, specify the first virtual disk file of the virtual disk image through the qemu-kvm program, read the block information, and find the images of other virtual disk files;

Step S3: Open the qcow2 virtual disk image in qemu, and create block meta information through the block information;

Step S4: According to the block range of the corresponding read and write requests, send the corresponding read and write requests to the virtual disk file of the corresponding virtual disk image for processing.

Among them, in step S1, a set of block virtual disk files is created through the following command line:

qemu-img create -f qcow2 -d parameter 1 xxxx.qcow2 parameter 2;

Among them, parameter 1 is the size of each virtual disk file created, and parameter 2 is the size of the entire virtual disk image.

Among them, in step S1, the addressing range is determined for each created virtual disk file by adding an image positioning layer to the source code of the qcow2_co_create_opt function;

In step S2, by adding an image positioning layer to the source code of the qcow2_open function, the block information in the first virtual disk file is read, and the images of other virtual disk files are found;

In step S4, by adding an image positioning layer to the source code of the qcow2_co_preadv and qcow2_co_pwritev functions, the virtual disk file of the corresponding virtual disk image is determined when processing read and write requests.

Among them, in step S4, the image positioning layer added to the source code of the qcow2_co_preadv and qcow2_co_pwritev functions includes an offset parameter and a bytes parameter, where the offset parameter is used to determine the offset position of the virtual disk image, and the bytes parameter is used to determine the requested Content size.

In step S1, the block information of the virtual disk file is saved by adding the field div_img_size to the file header of the image of the first virtual disk file.

Among them, in step S1, the block information of the virtual disk file is saved in the following directory of the file header of the first virtual disk file: uint64_t div_img_size//.

The virtual disk safe storage method provided by the present invention ensures the security of the data in the virtual disk image by storing data in different virtual disk files. If part of the image is stolen, the content of the complete image cannot be restored.

Description of drawings

Figure 1: Logic diagram of the basic technical concept of the present invention.

Figure 2: Prior art virtual disk image IO addressing flow chart.

Figure 3: The IO addressing flow chart after segmentation based on the qcow2 virtual disk image of the present invention.

Best Mode of Carrying Out the Invention

In order to have a further understanding of the technical solutions and beneficial effects of the present invention, the technical solutions of the present invention and the beneficial effects thereof will be described in detail below with reference to the accompanying drawings.

Figure 1 is a logic diagram of the basic concept of the present invention: At present, in most cases, the qcow2 virtual disk image is stored in a file. If the backing file function is used, there may be a golden image. If there is an information leak where the virtual disk image file is stored, all data stored in the virtual machine will be easily obtained by the attacker. However, if the virtual disk image can be composed of multiple files, and then put each block of the image in a different location, it is like "putting eggs in different baskets". If the thief only gets a part of the image , it is impossible to restore the contents of the complete image. This allows the virtual disk image to be stored in different locations in blocks, thereby improving the security of the data in the virtual disk image.

In order to achieve the above goals, the following issues need to be solved:

1. How to divide into chunks

Blocking strategy, in order not to increase the complexity of addressing, we can create a virtual disk image (qemu-img When creating), specify the addressable range of each block, and the operation range will automatically create the next block image. Each block is in qcow2 format, so that the storage space occupied by the block is very small when created. , with the continuous data writing, the mirror slowly expands, retaining the best features of qcow2.

2. At which layer is the read and write requests of the virtual machine intercepted to implement block storage of the storage image?

By modifying qcow2.c in the qemu source code The source code of qcow2_co_create_opt / qcow2_open / qcow2_co_preadv / qcow2_co_pwritev adds the image positioning layer (which image read and write requests are assigned to) to realize the block storage of the image.

3. Where is the chunked information stored?

It exists in the qcow2 header of the first virtual disk file and records the block size through the div_img_size field. This way you can tell who is the first image. The next time you open it, you will know the chunking information when you read it.

In view of the technical problems to be solved, the present invention mainly analyzes the principles of the qcow2 format, and then optimizes the code for the qcow2 format image in the qemu source code, and adds the image positioning layer code by modifying the qcow2 series interface method to achieve image separation. Block storage without affecting the original usage interface and habits.

Figure 2 is a prior art virtual disk image IO addressing flow chart. The qcow2 universal addressing process is as follows: Locate the location of the Level1 table in the virtual disk image by reading the qcow2_header, and then find the corresponding addressing in the Level1 table. The location of the Level2 table, and then find the offset corresponding to the cluster where the data is stored.

After adding the qcow2 block design of the present invention, the flow chart is shown in Figure 3. Based on this, the virtual disk safe storage method of the present invention is formed:

1. Use the qemu-img tool to create a partitioned virtual disk image

Assume that an 80G virtual disk image needs to be divided into eight virtual disk files, use the following command line: qemu-img create -f qcow2 -d 10G xxxx.qcow2 80G, it will automatically create a set of segmented virtual disk files based on the specified virtual disk image size. When creating, add the image positioning layer to the source code of the qcow2_co_create_opt function to provide each The created virtual disk file determines the addressing range; block size information, etc. can be written to the file header of the first virtual disk file. Specifically, add a field (div_img_size) at the end of QCowHeader to save the "block size" information to the first virtual disk file.

[0-10G]: xxxx.qcow2

[10-20G]: xxxx.qcow2.div1

[20-30G]: xxxx.qcow2.div2

[30-40G]: xxxx.qcow2.div3

[40-50G]: xxxx.qcow2.div4

[50-60G]: xxxx.qcow2.div5

[60-70G]: xxxx.qcow2.div6

[70-80G]: xxxx.qcow2.div7.

In this way, the segmented virtual disk image has been created. Next, the virtual machine needs to know that the created virtual disk image is a segmented virtual disk image. That is, the virtual machine needs to read this segmentation information when it starts.

2. Start the virtual machine, specify the first block virtual disk file of the virtual disk image through the qemu-kvm program, read the block size, find the block images of other virtual disk files, and determine the storage responsibility of each virtual disk file. The scope; specifically, by adding the image positioning layer to the source code of the qcow2_open function, read the block information in the first virtual disk file and find the images of other virtual disk files.

3. Open the qcow2 virtual disk image in qemu and create block meta information through the block information. Specifically, after the virtual machine reads the block information of the first virtual disk file, it knows the block images of all virtual disk files, and then allows the program to perform a data representation of the above block information through meta information, and also That is, after describing the data of the block information of the virtual disk image through meta information, it is loaded into the memory to form a data model, so that the program can address through the meta information, and perform corresponding read and write operations. , there is no need to repeatedly read the block information from the file header of the first virtual disk file.

At this point, the block operation of the virtual disk image has been completed, and then read and write operations on the virtual disk image can be performed.

When reading and writing to the virtual disk image, the file system layer will automatically manage the virtual disk image and automatically determine the location from which to write the new file. The program will address and complete the reading and writing based on the information fed back by the file system layer.

4. Read request operation

When qemu's qcow2 processes a "read" read request, it sends the request to the virtual disk file divided into blocks of the corresponding virtual disk image for processing according to the block range. By adding the image positioning layer to the source code of the qcow2_co_preadv function, ensure that the virtual disk file of the corresponding virtual disk image is addressed when processing a read request. The specific steps include the following:

(1) Among the parameters of the qcow2_co_preadv function are offset (virtual disk offset position) and bytes (requested content size), this request is processed according to the range responsible for the virtual disk file divided by the virtual disk image, and the IO request queue is processed segmentation.

(2) Build the environment context based on the virtual disk file to be distributed according to the split request.

(3) Distribute the divided request queue for execution based on the image of the virtual disk file.

5. Write request operation

When qemu's qcow2 processes a "write" write request, it sends the request to the virtual disk file divided into blocks of the corresponding virtual disk image for processing according to the block range. By adding the image positioning layer to the source code of the qcow2_co_pwritev function, the virtual disk file of the corresponding virtual disk image can be addressed when processing a write request. The specific steps include the following steps:

(1) Among the parameters of the qcow2_co_pwritev function are offset (virtual disk offset position) and bytes (requested content size), this request is processed according to the range of the virtual disk file that the virtual disk image is divided into, and the IO request queue is processed. segmentation.

In the present invention, the so-called "virtual disk file" is a storage method that uses files to simulate hard disk devices and is used by virtual machines. From the perspective of the Host (host), the disk of the virtual machine is just a file, and from the perspective of the Guest (virtual machine), it is no different from an ordinary hard disk.

In this invention, the so-called "QCOW2 format", the full name is qemu copy On write format, the Qemu virtual machine dynamically grows the virtual disk image format when a "write" operation occurs. Corresponding to the native image format (RAW), its biggest feature is that it will only be used when you really need to store data. to allocate space, thus saving disk space on the Host. The qcow2 image format is organized into multiple fixed-size units, called clusters. Both actual user data (guest data) and image metadata (metadata) are stored in a cluster unit.

Compared with the existing technology, the advantages of the present invention are:

1. This invention avoids the problem that one disk image is stolen and all the data in the entire virtual disk can be cracked by breaking up a previous disk image file into different image files.

2. There can also be more security designs in the disk partitioning strategy. Instead of a fixed range of partitioning strategies, security encryption strategies can be customized according to usage scenarios.

3. The present invention can be implemented without changing the original virtual machine usage interface and usage habits, and has good compatibility with upper-layer libvirt and the like.

Although the present invention has been described using the above preferred embodiments, they are not intended to limit the scope of the present invention. Any person skilled in the art can make various changes relative to the above embodiments without departing from the spirit and scope of the present invention. and modifications still fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be defined by the claims.

Claims

A method for safe storage of virtual disks, which is characterized by including the following steps:

Step S1: Use the qemu-img tool to create a set of block virtual disk files. The block information of the virtual disk file is written into the file header of the first virtual disk file;

Step S2: Start the virtual machine, specify the first virtual disk file of the virtual disk image through the qemu-kvm program, read the block information, and find the images of other virtual disk files;

Step S3: Open the qcow2 virtual disk image in qemu, and create block meta information through the block information;

Step S4: According to the block range of the corresponding read and write requests, send the corresponding read and write requests to the virtual disk file of the corresponding virtual disk image for processing.
The virtual disk safe storage method according to claim 1, characterized in that, in step S1, a set of block virtual disk files is created through the following command line:

qemu-img create -f qcow2 -d parameter 1 xxxx.qcow2 parameter 2;

Among them, parameter 1 is the size of each virtual disk file created, and parameter 2 is the size of the entire virtual disk image.
The virtual disk safe storage method according to claim 1, characterized in that, in step S1, the addressing range is determined for each created virtual disk file by adding a mirror positioning layer to the source code of the qcow2_co_create_opt function;

In step S2, by adding an image positioning layer to the source code of the qcow2_open function, the block information in the first virtual disk file is read, and the images of other virtual disk files are found;

In step S4, by adding an image positioning layer to the source code of the qcow2_co_preadv and qcow2_co_pwritev functions, the virtual disk file of the corresponding virtual disk image is determined when processing read and write requests.
The virtual disk safe storage method according to claim 3, characterized in that, in step S4, the image positioning layer added to the source code of the qcow2_co_preadv and qcow2_co_pwritev functions includes an offset parameter and a bytes parameter, wherein the offset parameter is used to determine The offset position of the virtual disk image. The bytes parameter is used to determine the requested content size.
The virtual disk safe storage method according to claim 1, characterized in that, in step S1, the block information of the virtual disk file is saved by adding a field div_img_size to the file header of the image of the first virtual disk file.
The virtual disk safe storage method according to claim 5, characterized in that, in step S1, the block information of the virtual disk file is saved in the following directory of the file header of the first virtual disk file: uint64_t div_img_size/ /.