Method and device for secure switching of keys during virtual machine import / export process

Abstract

The application discloses a kind of virtual machine import and export process in the security switching method and device of key.Therein, virtual machine import and export process in the security switching method of key includes: generating public key encryption key;Data encryption key in virtual machine import and export process is changed using public key encryption key;The data encryption key after change is written to virtual machine configuration.The security switching method and device of key of virtual machine import and export process of the embodiment of the application, by generating public key encryption key, and data encryption key in virtual machine import and export process is changed using public key encryption key, and the data encryption key after change is written to virtual machine configuration, the security management of key in the import and export process of virtual machine is realized.

Description

Technical Field

[0001] This invention relates to the field of virtual machine security technology, and in particular to a method and apparatus for securely switching keys during virtual machine import and export processes. Background Technology

[0002] Virtual machine encryption refers to the encryption and decryption of data on a virtual machine's disk to prevent malicious users from stealing and accessing the data within the target virtual machine's disk. The overall process of virtual machine encryption and decryption, as well as the objects and components involved, can be described as follows: Figure 1 As shown, users input the tenant key (KEY) through a PKCS#11-compliant HSM (Hardware Security Module), which then generates a data key (DEK) through the key management system. The DEK is then input into the virtual machine encryption module, where the hypervisor encrypts or decrypts the virtual machine. However, within the OpenStack framework, a secure key management mechanism is currently not implemented during the virtual machine import / export process. Summary of the Invention

[0003] The purpose of this invention is to at least partially solve one of the aforementioned technical problems.

[0004] Therefore, the first objective of this invention is to propose a secure key switching method during virtual machine import and export, which can achieve secure key management during virtual machine import and export.

[0005] The second objective of this invention is to provide a secure key switching device during virtual machine import / export processes.

[0006] The third objective of this invention is to provide a computer device.

[0007] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0008] To achieve the above objectives, a first aspect of the present invention provides a method for secure key switching during virtual machine import / export, the method comprising:

[0009] Generate public-key encryption keys;

[0010] The public key is used to encrypt the key used to change the data encryption key during the virtual machine import / export process;

[0011] Write the changed data encryption key into the virtual machine configuration.

[0012] Optionally, the data encryption key during the virtual machine import / export process can be changed using the public key encryption key, including:

[0013] Obtain the user key encryption key during virtual machine export;

[0014] The data encryption key is decrypted using the user key encryption key;

[0015] Generate a new data encryption key using the decrypted data encryption key;

[0016] The new data encryption key is encrypted using the public key encryption key.

[0017] Optionally, the data encryption key during the virtual machine import / export process can be changed using the public key encryption key, including:

[0018] Obtain the user key encryption key during virtual machine import;

[0019] The public key encryption key is used to decrypt the data encryption key;

[0020] Generate a new data encryption key using the decrypted data encryption key;

[0021] The new data encryption key is encrypted using the user key encryption key.

[0022] Optionally, the virtual machine import / export process is based on the OpenStack framework.

[0023] The secure key switching method for virtual machine import / export in this embodiment of the invention achieves secure key management during the import / export process by generating a public key encryption key, using the public key encryption key to change the data encryption key during the virtual machine import / export process, and writing the changed data encryption key into the virtual machine configuration.

[0024] To achieve the above objectives, a second aspect of the present invention provides a secure key switching device during virtual machine import / export processes, comprising:

[0025] The generation module is used to generate public-key encryption keys;

[0026] The modification module is used to modify the data encryption key during the virtual machine import / export process using the public key encryption key;

[0027] The write module is used to write the changed data encryption key into the virtual machine configuration.

[0028] Optionally, the change module is used for:

[0029] Obtain the user key encryption key during virtual machine export;

[0030] The data encryption key is decrypted using the user key encryption key;

[0031] Generate a new data encryption key using the decrypted data encryption key;

[0032] The new data encryption key is encrypted using the public key encryption key.

[0033] Optionally, the change module is used for:

[0034] Obtain the user key encryption key during virtual machine import;

[0035] The public key encryption key is used to decrypt the data encryption key;

[0036] Generate a new data encryption key using the decrypted data encryption key;

[0037] The new data encryption key is encrypted using the user key encryption key.

[0038] Optionally, the virtual machine import / export process is based on the OpenStack framework.

[0039] The secure key switching device for virtual machine import / export in this embodiment of the invention generates a public key encryption key, uses the public key encryption key to change the data encryption key during virtual machine import / export, and writes the changed data encryption key into the virtual machine configuration, thereby achieving secure key management for virtual machine import / export.

[0040] To achieve the above objectives, a third aspect of the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the secure key switching method during virtual machine import / export as described in the first aspect of the embodiment.

[0041] To achieve the above objectives, a fourth aspect of the present invention also proposes a non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the secure key switching method during virtual machine import / export as described in the first aspect of the embodiment.

[0042] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0043] The accompanying drawings, which form part of this specification, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0044] Figure 1 This is a schematic diagram of virtual machine password management in existing technology;

[0045] Figure 2 This is a flowchart of a secure key switching method during virtual machine import / export according to an embodiment of the present invention;

[0046] Figure 3 This is a flowchart of a secure key switching method during virtual machine export according to a specific embodiment of the present invention;

[0047] Figure 4 This is a flowchart of a secure key switching method during virtual machine import according to a specific embodiment of the present invention;

[0048] Figure 5 This is a schematic diagram of the secure key switching device during virtual machine import / export process according to an embodiment of the present invention. Detailed Implementation

[0049] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0050] The present invention will be further described in detail below with reference to specific embodiments, which should not be construed as limiting the scope of protection claimed by the present invention.

[0051] The following describes a method and apparatus for secure key switching during virtual machine import / export according to embodiments of the present invention, with reference to the accompanying drawings.

[0052] Figure 2 This is a flowchart of a secure key switching method during virtual machine import / export according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes the following steps:

[0053] S1, Generate a public-key encryption key.

[0054] During system initialization, a public key encryption key specifically used for virtual machine import and export can be generated, namely the import / export KEK (Key Encryption Key).

[0055] S2 uses a public key to encrypt the key and change the data encryption key during the virtual machine import / export process.

[0056] After generating the public key encryption key, this public key encryption key can be used to change the data encryption key (DEK) during the virtual machine import and export process, thereby ensuring security.

[0057] Specifically, the import and export process of a virtual machine can be divided into two distinct processes: export and import. The technical solutions for changing the data encryption key during these two processes are described in detail below.

[0058] The virtual machine export process can be as follows: Figure 3 As shown, it includes the following steps:

[0059] S21, when exporting the virtual machine, obtain the user key encryption key.

[0060] The process of exporting a virtual machine is the process of uploading the volume in the virtual machine to the image storage repository glance.

[0061] S22, using the user key to encrypt the data encryption key to perform a decryption operation.

[0062] After obtaining the user key encryption key, it can be verified. If the verification is successful, the data encryption key can be decrypted; otherwise, if the verification fails, the user key encryption key cannot be used to decrypt the data encryption key.

[0063] S23, use the decrypted data encryption key to generate a new data encryption key.

[0064] After the data encryption key is decrypted, it can be changed to generate a new data encryption key. The new data encryption key can be generated using a preset algorithm, randomly, or by other methods; this embodiment does not impose any limitations.

[0065] S24, use the public key encryption key to encrypt the new data encryption key.

[0066] After generating a new data encryption key, you can use a public key encryption key specifically designed for importing and exporting virtual machines to encrypt the new data encryption key.

[0067] The virtual machine import process can be as follows: Figure 4 As shown, it includes the following steps:

[0068] S25, during virtual machine import, obtain the user key encryption key.

[0069] The process of importing a virtual machine is the process of downloading an encrypted image file from the image storage repository glance.

[0070] S26, use the public key encryption key to decrypt the data encryption key.

[0071] During this process, the public key encryption key can be verified. If the verification is successful, the data encryption key can be decrypted; otherwise, if the verification fails, the public key encryption key cannot be used to decrypt the data encryption key.

[0072] S27, use the decrypted data encryption key to generate a new data encryption key.

[0073] After the data encryption key is decrypted, it can be changed to generate a new data encryption key. The new data encryption key can be generated using a preset algorithm, randomly, or by other methods; this embodiment does not impose any limitations.

[0074] S28, use the user key encryption key to encrypt the new data encryption key.

[0075] After generating a new data encryption key, you can use the user key encryption key to encrypt the new data encryption key.

[0076] By using the above method, the data encryption key can be changed during the virtual machine import / export process.

[0077] S3 writes the changed data encryption key into the virtual machine configuration.

[0078] After changing the data encryption key, the changed key can be written into the virtual machine configuration. For example, during the virtual machine export process, the encrypted, changed data encryption key can be written into the virtual machine's metadata and XML configuration. This method ensures the safe storage, transmission, and modification of keys (one key per machine) during the virtual machine import / export process, thus addressing the issue of secure key transmission when different users import the same virtual machine.

[0079] It should be understood that the above virtual machine import and export processes are all implemented based on the OpenStack framework.

[0080] The secure key switching method for virtual machine import / export in this embodiment of the invention achieves secure key management during the import / export process by generating a public key encryption key, using the public key encryption key to change the data encryption key during the virtual machine import / export process, and writing the changed data encryption key into the virtual machine configuration.

[0081] To achieve the above embodiments, the present invention also proposes a secure key switching device during virtual machine import and export.

[0082] Figure 5 This is a schematic diagram of the secure key switching device during virtual machine import / export process according to an embodiment of the present invention.

[0083] like Figure 5 As shown, the device includes a generation module 51, a modification module 52, and a writing module 53.

[0084] The generation module 51 is used to generate public key encryption keys.

[0085] The modification module 52 is used to change the data encryption key during the virtual machine import and export process using the public key encryption key.

[0086] The writing module 53 is used to write the changed data encryption key into the virtual machine configuration.

[0087] It should be understood that the secure key switching device during the virtual machine import / export process in this embodiment is consistent with the description of the secure key switching method during the virtual machine import / export process in the first aspect embodiment, and will not be repeated here.

[0088] The secure key switching device for virtual machine import / export in this embodiment of the invention generates a public key encryption key, uses the public key encryption key to change the data encryption key during virtual machine import / export, and writes the changed data encryption key into the virtual machine configuration, thereby achieving secure key management for virtual machine import / export.

[0089] To implement the above embodiments, the present invention also proposes a computer device.

[0090] The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a secure key switching method during virtual machine import / export as described in the first aspect embodiment.

[0091] To implement the above embodiments, the present invention also proposes a non-transitory computer-readable storage medium.

[0092] The non-transitory computer-readable storage medium stores a computer program that, when executed by a processor, implements a secure key switching method during virtual machine import / export as described in the first aspect embodiment.

[0093] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0094] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0095] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0096] It should be noted that, in the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0097] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

Claims

1. A method for securely switching keys during virtual machine import / export, characterized in that, include: During system initialization, a public key encryption key is generated for importing and exporting virtual machines; The public key is used to encrypt the key used to change the data encryption key during the virtual machine import / export process; Specifically, the user key encryption key is obtained during virtual machine export; The data encryption key is decrypted using the user key encryption key; Generate a new data encryption key using the decrypted data encryption key; The new data encryption key is encrypted using the public key encryption key. Obtain the user key encryption key during virtual machine import; The public key encryption key is used to decrypt the data encryption key; Generate a new data encryption key using the decrypted data encryption key; The new data encryption key is encrypted using the user key encryption key. Write the changed data encryption key into the virtual machine configuration.

2. The method as described in claim 1, characterized in that, The virtual machine import / export process is based on the OpenStack framework.

3. A secure key switching device during virtual machine import / export, characterized in that, include: The generation module is used during system initialization to generate public key encryption keys for virtual machine import and export. The modification module is used to modify the data encryption key during the virtual machine import / export process using the public key encryption key; Specifically, the user key encryption key is obtained during virtual machine export; The data encryption key is decrypted using the user key encryption key; Generate a new data encryption key using the decrypted data encryption key; The new data encryption key is encrypted using the public key encryption key. Obtain the user key encryption key during virtual machine import; The public key encryption key is used to decrypt the data encryption key; Generate a new data encryption key using the decrypted data encryption key; The new data encryption key is encrypted using the user key encryption key. The write module is used to write the changed data encryption key into the virtual machine configuration.

4. The apparatus as described in claim 3, characterized in that, The virtual machine import / export process is based on the OpenStack framework.

5. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the secure key switching method during virtual machine import / export as described in any one of claims 1-2.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the secure key switching method during virtual machine import / export as described in any one of claims 1-2.

Images