A cloud host creation method, device, equipment and computer-readable storage medium

Abstract

The present invention discloses a cloud host creation method, comprising the following steps: receiving a plaintext system image to be encrypted and a preselected target encryption algorithm; retrieving a target key corresponding to the target encryption algorithm from a cloud platform password management service; performing an encryption operation on the plaintext system image using the target key to obtain a ciphertext system image; and performing a cloud host creation operation using the ciphertext system image to obtain a target cloud host. The cloud host creation method provided by the present invention effectively blocks malicious attackers from stealing key user data, thereby protecting the cloud platform and user data and enhancing the security and reliability of cloud platform data. The present invention also discloses a cloud host creation device, equipment, and storage medium, all having corresponding technical effects.

Description

Technical Field

[0001] The present invention relates to the field of virtualization technology, and in particular to a cloud host creation method, device, equipment and computer-readable storage medium. Background Art

[0002] With the development of cloud computing, people's pace of life is accelerating, and the scale of cloud platform clusters has exploded. This has brought severe challenges to the daily operation, maintenance, and use of cloud platforms. A key role of cloud platforms is to manage users' cloud hosts. Cloud host system data is generally stored in the storage backends connected to each cloud platform. Cloud platforms use virtualization technology to complete the read and write interaction between user virtual machines and backend storage to meet user business needs.

[0003] However, in the existing technology, when a cloud platform creates a cloud host, the system communicates in plain text between the business network and the storage network. At this time, if the cloud platform is attacked by malicious attacks, it is easy to obtain the user's system information and judge the user's private operations through network packet capture or other means. Malicious attackers will carry out targeted attacks on user accounts or steal user private data based on user operations. If the user's critical private data is stolen, the consequences are bound to be very serious, not only causing loss of the user's personal safety and property, but also seriously affecting the reputation and credibility of the cloud platform service provider. The losses caused will be immeasurable.

[0004] In summary, how to effectively solve the problem that the existing cloud host creation method easily causes user private data to be attacked or stolen, resulting in serious losses, is an issue that technicians in this field urgently need to solve. Summary of the Invention

[0005] The purpose of the present invention is to provide a cloud host creation method, which effectively blocks malicious attackers from stealing user key data, achieves the purpose of protecting the cloud platform and user data, and enhances the security and reliability of cloud platform data; another purpose of the present invention is to provide a cloud host creation device, equipment and computer-readable storage medium.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] A cloud host creation method, comprising:

[0008] Receiving a plaintext system image to be encrypted and a pre-selected target encryption algorithm;

[0009] Retrieve the target key corresponding to the target encryption algorithm from the cloud platform password management service;

[0010] Performing an encryption operation on the plaintext system image using the target key to obtain a ciphertext system image;

[0011] The ciphertext system image is used to perform a cloud host creation operation to obtain a target cloud host.

[0012] In a specific embodiment of the present invention, retrieving the target key corresponding to the target encryption algorithm from the cloud platform password management service includes:

[0013] Generate a key creation request according to the target encryption algorithm;

[0014] Sending the key creation request to the cloud platform password management service, so that the cloud platform password management service creates the target key and generates a target key identification number corresponding to the target key;

[0015] Receive the target key identification number returned by the cloud platform password management service;

[0016] The target key is retrieved from the cloud platform password management service according to the target key identification number.

[0017] In a specific embodiment of the present invention, after obtaining the target cloud host, the method further includes:

[0018] The target key is stored in a first physical machine corresponding to the target cloud host, so that the first physical machine stores the target key in XML format.

[0019] In a specific embodiment of the present invention, after obtaining the target cloud host, the method further includes:

[0020] Obtaining the device resources pre-selected when creating the target cloud host;

[0021] Generate a cloud host xml file based on the device resources;

[0022] Write the target key identification number and the ciphertext system image into the cloud host xml file.

[0023] In a specific embodiment of the present invention, after writing the target key identification number and the ciphertext system image into the cloud host XML file, the method further includes:

[0024] When a cloud host startup instruction is received, the cloud host XML file is parsed to obtain the target key identification number;

[0025] Retrieving the target key according to the target key identification number;

[0026] Decrypting the ciphertext system image using the target key to obtain the plaintext system image;

[0027] The target cloud host is started using the plaintext system image.

[0028] In a specific embodiment of the present invention, after storing the target key in the target physical machine corresponding to the target cloud host, the method further includes:

[0029] Parsing the received cloud host migration request to obtain a second physical machine to which the target cloud host is to be migrated;

[0030] Migrate the target cloud host from the first physical machine to the second physical machine.

[0031] In a specific embodiment of the present invention, the process of migrating the target cloud host from the first physical machine to the second physical machine further includes:

[0032] Backing up the target key to the second physical machine;

[0033] A deletion operation is performed on the target key of the first physical machine.

[0034] A cloud host creation device, comprising:

[0035] An algorithm receiving module, configured to receive a plaintext system image to be encrypted and a pre-selected target encryption algorithm;

[0036] A key retrieval module is used to retrieve the target key corresponding to the target encryption algorithm from the cloud platform password management service;

[0037] A ciphertext image obtaining module, configured to perform an encryption operation on the plaintext system image using the target key to obtain a ciphertext system image;

[0038] The cloud host creation module is used to use the encrypted system image to perform a cloud host creation operation to obtain a target cloud host.

[0039] A cloud host creation device, comprising:

[0040] Memory for storing computer programs;

[0041] A processor is configured to implement the steps of the cloud host creation method as described above when executing the computer program.

[0042] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the cloud host creation method as described above.

[0043] The cloud host creation method provided by the present invention includes: receiving a plaintext system image to be encrypted and a pre-selected target encryption algorithm; retrieving a target key corresponding to the target encryption algorithm from a cloud platform password management service; using the target key to perform an encryption operation on the plaintext system image to obtain a ciphertext system image; and using the ciphertext system image to perform a cloud host creation operation to obtain a target cloud host.

[0044] As can be seen from the above technical solution, by pre-selecting a target encryption algorithm for encrypting a pre-created plaintext system image, the correspondence between each encryption algorithm and each key is pre-stored in the cloud platform password management service. After receiving the plaintext system image and the target encryption algorithm, the target key corresponding to the target encryption algorithm is retrieved from the cloud platform password management service, and the target key is used to encrypt the plaintext system image to obtain the ciphertext system image. The ciphertext system image is used to create a cloud host to obtain the target cloud host. By encrypting and storing the system image and ensuring that the system image is transmitted in ciphertext form within the cloud platform's internal network, malicious attackers are effectively blocked from stealing user key data, thereby achieving the purpose of protecting the cloud platform and user data and enhancing the security and reliability of cloud platform data.

[0045] Correspondingly, the present invention also provides a cloud host creation device, equipment and computer-readable storage medium corresponding to the above-mentioned cloud host creation method, which have the above-mentioned technical effects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0047] Figure 1 This is a flowchart of an implementation method of a cloud host creation method according to an embodiment of the present invention;

[0048] Figure 2 Another implementation flow chart of the cloud host creation method according to an embodiment of the present invention;

[0049] Figure 3 This is a structural block diagram of a cloud host creation device according to an embodiment of the present invention;

[0050] Figure 4 A structural block diagram of a cloud host creation device according to an embodiment of the present invention;

[0051] Figure 5 This is a schematic diagram of the specific structure of a cloud host creation device provided in this embodiment. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the present invention, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0053] See also Figure 1 , Figure 1 This is a flowchart of an implementation method of a cloud host creation method according to an embodiment of the present invention. The method may include the following steps:

[0054] S101: Receive a plaintext system image to be encrypted and a pre-selected target encryption algorithm.

[0055] After creating a plaintext system image, the client selects the target encryption algorithm required to encrypt the plaintext system image and sends the plaintext system image and the target encryption algorithm to Glance, the cloud platform image management service. The cloud platform image management service receives the plaintext system image to be encrypted and the pre-selected target encryption algorithm.

[0056] The target encryption algorithms include the more common AES symmetric encryption algorithm, SM4 and other symmetric encryption algorithms.

[0057] S102: Retrieve the target key corresponding to the target encryption algorithm from the cloud platform password management service.

[0058] The correspondence between each encryption algorithm and each key is pre-stored in the cloud platform password management service KMS. After receiving the plaintext system image to be encrypted and the pre-selected target encryption algorithm, the target key corresponding to the target encryption algorithm is retrieved from the cloud platform password management service.

[0059] S103: Using the target key, encrypt the plaintext system image to obtain the ciphertext system image.

[0060] After retrieving the target key corresponding to the target encryption algorithm, use the target key to encrypt the plaintext system image to obtain the ciphertext system image. The specific encryption method can be used with the qemu-img tool: qemu-img convert -O luks -f source-format -o cipher-alg=aes-256(sm4-256) cipher-mode=xxx,ivgen-alg=xxx --object secret,id=luks_sec,format=xxx,file=xxx -o key-secret=luks_sec src dst.

[0061] S104: Using the encrypted system image to create a cloud host, obtain a target cloud host.

[0062] After encrypting the plaintext system image using the target key to obtain the ciphertext system image, the system then selects a suitable device resource based on host creation requirements and uses the ciphertext system image to create a cloud host, obtaining the target cloud host. By encrypting the system image for storage and ensuring that it is transmitted in ciphertext within the cloud platform's internal network, malicious attackers are effectively prevented from stealing critical user data, protecting the cloud platform and user data, and enhancing the security and reliability of cloud platform data.

[0063] As can be seen from the above technical solution, by pre-selecting a target encryption algorithm for encrypting a pre-created plaintext system image, the correspondence between each encryption algorithm and each key is pre-stored in the cloud platform password management service. After receiving the plaintext system image and the target encryption algorithm, the target key corresponding to the target encryption algorithm is retrieved from the cloud platform password management service, and the target key is used to encrypt the plaintext system image to obtain the ciphertext system image. The ciphertext system image is used to create a cloud host to obtain the target cloud host. By encrypting and storing the system image and ensuring that the system image is transmitted in ciphertext form within the cloud platform's internal network, malicious attackers are effectively blocked from stealing user key data, thereby achieving the purpose of protecting the cloud platform and user data and enhancing the security and reliability of cloud platform data.

[0064] It should be noted that, based on the above embodiment, the embodiment of the present invention also provides corresponding improved solutions. In subsequent embodiments, the same steps or corresponding steps as those in the above embodiment can be referenced to each other, and the corresponding beneficial effects can also be referenced to each other, and will not be described in detail in the following improved embodiments.

[0065] See also Figure 2 , Figure 2This is another implementation flow chart of a cloud host creation method according to an embodiment of the present invention. The method may include the following steps:

[0066] S201: Receive a plaintext system image to be encrypted and a pre-selected target encryption algorithm.

[0067] S202: Generate a key creation request according to the target encryption algorithm.

[0068] After receiving the pre-selected target encryption algorithm required for encrypting the plaintext system image, a key creation request is generated according to the target encryption algorithm.

[0069] S203: Send a key creation request to the cloud platform password management service, so that the cloud platform password management service creates a target key and generates a target key identification number corresponding to the target key.

[0070] After generating the key creation request, the key creation request is sent to the cloud platform password management service, so that the cloud platform password management service creates the target key according to the received key creation request and generates a target key identification number corresponding to the target key, so that each target key corresponds to an identification number key_id that uniquely identifies it.

[0071] S204: Receive the target key identification number returned by the cloud platform password management service.

[0072] After generating the target key identification number corresponding to the target key, the cloud platform password management service returns the target key identification number to the cloud platform image management service, and the cloud platform image management service receives the target key identification number returned by the cloud platform password management service.

[0073] S205: Retrieve the target key from the cloud platform password management service according to the target key identification number.

[0074] After receiving the target key identification number returned by the cloud platform password management service, the cloud platform image management service retrieves the target key from the cloud platform password management service based on the target key identification number, thereby achieving rapid acquisition of the target key using a key-value pair.

[0075] S206: Using the target key, perform an encryption operation on the plaintext system image to obtain a ciphertext system image.

[0076] After obtaining the ciphertext system image, the encrypted ciphertext system image can be stored in the storage backend connected to the platform image management service, and the image record information and the key_id of the key can be saved in the cloud platform database, so that the ciphertext system image is successfully created.

[0077] S207: Using the encrypted system image to create a cloud host, obtain a target cloud host.

[0078] S208: Store the target key in the first physical machine corresponding to the target cloud host, so that the first physical machine stores the target key in XML format.

[0079] After the target cloud host is created, the target key is stored on the first physical machine corresponding to the target cloud host, for example, in the libvirt component of the first physical machine. The first physical machine then stores the target key in XML format, leveraging the XML format's advantages of openness, simplicity, self-describing nature, interoperability, separation of structure and content, and scalability.

[0080] S209: Acquire the device resources pre-selected when creating the target cloud host.

[0081] After the target cloud host is created, obtain the device resources pre-selected when creating the target cloud host.

[0082] S210: Generate a cloud host XML file based on the resources of each device.

[0083] After obtaining the device resources pre-selected when creating the target cloud host, a cloud host xml file is generated based on the device resources.

[0084] S211: Write the target key identification number and the ciphertext system image into the cloud host xml file.

[0085] After generating the cloud host XML file based on the resources of each device, the target key identification number and the ciphertext system image are written into the cloud host XML file, thereby completing the overall preservation of the user's key information and facilitating the reading and identification of the libvirt component.

[0086] S212: When the cloud host startup instruction is received, the cloud host XML file is parsed to obtain the target key identification number.

[0087] After the target cloud host is created and the overall storage of the user's key information is completed, a check is performed to determine whether a cloud host startup instruction exists. When a cloud host startup instruction is received, the cloud host XML file is obtained and parsed to obtain the target key identification number.

[0088] S213: Retrieve the target key according to the target key identification number.

[0089] After the target key identification number is obtained through parsing, the target key is retrieved from the storage location of the target key in the first physical machine according to the target key identification number.

[0090] S214: Decrypt the ciphertext system image using the target key to obtain the plaintext system image.

[0091] After retrieving the target key, the ciphertext system image is decrypted using the target key to obtain the plaintext system image, thereby ensuring that the plaintext system image only exists locally on the physical machine. During the interaction between the cloud host and the back-end storage, all interactions are carried out in ciphertext, thus ensuring the security and reliability of the cloud platform data.

[0092] S215: Start the target cloud host using the plaintext system image.

[0093] After obtaining the plaintext system image, the target cloud host is started using the plaintext system image. For example, the cloud host can be started using the qemu process, thereby achieving secure startup of the target host created with the encrypted image file.

[0094] S216: Parse the received cloud host migration request to obtain a second physical machine to which the target cloud host is to be migrated.

[0095] When a pre-created target host needs to be migrated from the original first physical host to a second physical host, a cloud host migration request is generated. The cloud host migration request includes the second physical host to which the target cloud host is to be migrated. The cloud platform image management service receives the cloud host migration request and parses it to obtain the second physical host to which the target cloud host is to be migrated.

[0096] S217: Migrate the target cloud host from the first physical machine to the second physical machine.

[0097] After parsing and obtaining the second physical machine to which the target cloud host is to be migrated, the target cloud host is migrated from the first physical machine to the second physical machine, thereby realizing the cold-hot migration of the target cloud host.

[0098] S218: During the process of migrating the target cloud host from the first physical machine to the second physical machine, the target key is backed up to the second physical machine, and the target key of the first physical machine is deleted.

[0099] During the migration of the target cloud host from the first physical machine to the second physical machine, the target key is backed up to the second physical machine and the target key on the first physical machine is deleted. For example, during the pre-live migration phase, execute the create_secret command on the target node to create the key and back it up to the local libvirt directory on the second physical machine. During the post-live migration phase, execute the delete_secret command on the source node to delete the mirrored key information.

[0100] Corresponding to the above method embodiment, the present invention further provides a cloud host creation device. The cloud host creation device described below and the cloud host creation method described above can refer to each other.

[0101] See also Figure 3 , Figure 3 This is a structural block diagram of a cloud host creation device according to an embodiment of the present invention. The device may include:

[0102] Algorithm receiving module 31, used to receive the plaintext system image to be encrypted and a pre-selected target encryption algorithm;

[0103] The key retrieval module 32 is used to retrieve the target key corresponding to the target encryption algorithm from the cloud platform password management service;

[0104] The ciphertext image obtaining module 33 is used to encrypt the plaintext system image using the target key to obtain the ciphertext system image;

[0105] The cloud host creation module 34 is used to perform a cloud host creation operation using the encrypted system image to obtain a target cloud host.

[0106] As can be seen from the above technical solution, by pre-selecting a target encryption algorithm for encrypting a pre-created plaintext system image, the correspondence between each encryption algorithm and each key is pre-stored in the cloud platform password management service. After receiving the plaintext system image and the target encryption algorithm, the target key corresponding to the target encryption algorithm is retrieved from the cloud platform password management service, and the target key is used to encrypt the plaintext system image to obtain the ciphertext system image. The ciphertext system image is used to create a cloud host to obtain the target cloud host. By encrypting and storing the system image and ensuring that the system image is transmitted in ciphertext form within the cloud platform's internal network, malicious attackers are effectively blocked from stealing user key data, thereby achieving the purpose of protecting the cloud platform and user data and enhancing the security and reliability of cloud platform data.

[0107] In a specific embodiment of the present invention, the key retrieval module 32 includes:

[0108] The request generation submodule is used to generate a key creation request according to the target encryption algorithm;

[0109] The identification number generation submodule is used to send a key creation request to the cloud platform password management service, so that the cloud platform password management service creates a target key and generates a target key identification number corresponding to the target key;

[0110] The identification number receiving submodule is used to receive the target key identification number returned by the cloud platform password management service;

[0111] The key retrieval submodule is used to retrieve the target key from the cloud platform password management service according to the target key identification number.

[0112] In a specific embodiment of the present invention, the device may further include:

[0113] The key storage module is used to store the target key in the first physical machine corresponding to the target cloud host after obtaining the target cloud host, so that the first physical machine stores the target key in XML format.

[0114] In a specific embodiment of the present invention, the device may further include:

[0115] The device resource acquisition module is used to obtain the device resources pre-selected when creating the target cloud host after obtaining the target cloud host;

[0116] The file generation module is used to generate cloud host XML files based on the resources of each device;

[0117] The writing module is used to write the target key identification number and the ciphertext system image into the cloud host XML file.

[0118] In a specific embodiment of the present invention, the device may further include:

[0119] A file parsing module is used to parse the cloud host XML file to obtain the target key identification number after the target key identification number and the ciphertext system image are written into the cloud host XML file and when a cloud host startup instruction is received;

[0120] A key retrieval module, configured to retrieve a target key according to a target key identification number;

[0121] The image decryption module is used to decrypt the ciphertext system image using the target key to obtain the plaintext system image;

[0122] The host startup module is used to start the target cloud host using the plaintext system image.

[0123] In a specific embodiment of the present invention, the device may further include:

[0124] A physical machine obtaining module is used to parse the received cloud host migration request after storing the target key in the target physical machine corresponding to the target cloud host, and obtain a second physical machine to which the target cloud host is to be migrated;

[0125] The cloud host migration module is used to migrate the target cloud host from the first physical machine to the second physical machine.

[0126] In a specific embodiment of the present invention, the device may further include:

[0127] A key backup module, configured to back up a target key to the second physical machine during the process of migrating the target cloud host from the first physical machine to the second physical machine;

[0128] The key deletion module is used to delete the target key of the first physical machine.

[0129] Corresponding to the above method embodiment, see Figure 4 , Figure 4 This is a schematic diagram of the cloud host creation device provided by the present invention, which may include:

[0130] Memory 332, for storing computer programs;

[0131] The processor 322 is configured to implement the steps of the cloud host creation method of the above method embodiment when executing the computer program.

[0132] For details, please refer to Figure 5 , Figure 5 This is a schematic diagram of the specific structure of a cloud host creation device provided in this embodiment. This cloud host creation device may vary significantly depending on its configuration or performance. It may include a processor (central processing unit, CPU) 322 (e.g., one or more processors) and memory 332. Memory 332 stores one or more computer applications 342 or data 344. Memory 332 may be either transient or persistent storage. The program stored in memory 332 may include one or more modules (not shown), each of which may include a series of instruction operations on the data processing device. Furthermore, processor 322 may be configured to communicate with memory 332 to execute the series of instruction operations stored in memory 332 on cloud host creation device 301.

[0133] The cloud host creation device 301 may further include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and / or one or more operating systems 341 .

[0134] The steps in the cloud host creation method described above can be implemented by the structure of the cloud host creation device.

[0135] Corresponding to the above method embodiment, the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the following steps can be implemented:

[0136] Receive the plaintext system image to be encrypted and the pre-selected target encryption algorithm; retrieve the target key corresponding to the target encryption algorithm from the cloud platform password management service; use the target key to encrypt the plaintext system image to obtain the ciphertext system image; use the ciphertext system image to create a cloud host to obtain the target cloud host.

[0137] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program codes.

[0138] For an introduction to the computer-readable storage medium provided by the present invention, please refer to the above method embodiment, and the present invention will not elaborate on it here.

[0139] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. References to the same or similar parts between the various embodiments are sufficient. The devices, apparatuses, and computer-readable storage media disclosed in the embodiments are described briefly because they correspond to the methods disclosed in the embodiments. For relevant details, refer to the description of the methods.

[0140] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only intended to help understand the technical solutions and core concepts of the present invention. It should be noted that those skilled in the art can make various improvements and modifications to the present invention without departing from the principles of the present invention, and such improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A cloud host creation method, characterized in that: include: Receiving a plaintext system image to be encrypted and a pre-selected target encryption algorithm; Retrieve the target key corresponding to the target encryption algorithm from the cloud platform password management service; Performing an encryption operation on the plaintext system image using the target key to obtain a ciphertext system image; Using the encrypted system image to create a cloud host, a target cloud host is obtained; Storing the target key in a first physical machine corresponding to the target cloud host; Parsing the received cloud host migration request to obtain a second physical machine to which the target cloud host is to be migrated; Migrating the target cloud host from the first physical machine to the second physical machine to perform a hot-cold migration on the target cloud host; The process of migrating the target cloud host from the first physical machine to the second physical machine further includes: Backing up the target key to the second physical machine; A deletion operation is performed on the target key of the first physical machine.

2. The cloud host creation method according to claim 1, characterized in that: Retrieve the target key corresponding to the target encryption algorithm from the cloud platform password management service, including: Generate a key creation request according to the target encryption algorithm; Sending the key creation request to the cloud platform password management service, so that the cloud platform password management service creates the target key and generates a target key identification number corresponding to the target key; Receive the target key identification number returned by the cloud platform password management service; The target key is retrieved from the cloud platform password management service according to the target key identification number.

3. The cloud host creation method according to claim 2, characterized in that: Also includes: The first physical machine stores the target key in XML format.

4. The cloud host creation method according to claim 3, characterized in that: After obtaining the target cloud host, it also includes: Obtaining the device resources pre-selected when creating the target cloud host; Generate a cloud host xml file based on the device resources; Write the target key identification number and the ciphertext system image into the cloud host xml file.

5. The cloud host creation method according to claim 4, characterized in that: After writing the target key identification number and the ciphertext system image into the cloud host XML file, the method further includes: When a cloud host startup instruction is received, the cloud host XML file is parsed to obtain the target key identification number; Retrieving the target key according to the target key identification number; Decrypting the ciphertext system image using the target key to obtain the plaintext system image; The target cloud host is started using the plaintext system image.

6. A cloud host creation device, characterized in that: include: An algorithm receiving module, configured to receive a plaintext system image to be encrypted and a pre-selected target encryption algorithm; A key retrieval module is used to retrieve the target key corresponding to the target encryption algorithm from the cloud platform password management service; A ciphertext image obtaining module, configured to perform an encryption operation on the plaintext system image using the target key to obtain a ciphertext system image; A cloud host creation module is used to perform a cloud host creation operation using the encrypted system image to obtain a target cloud host; A key storage module is used to store the target key in a first physical machine corresponding to the target cloud host after obtaining the target cloud host; A physical machine obtaining module is used to parse the received cloud host migration request and obtain a second physical machine to which the target cloud host is to be migrated; A cloud host migration module is used to migrate the target cloud host from the first physical machine to the second physical machine to perform a cold-hot migration on the target cloud host; A key backup module, configured to back up a target key to the second physical machine during the process of migrating the target cloud host from the first physical machine to the second physical machine; The key deletion module is used to delete the target key of the first physical machine.

7. A cloud host creation device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the cloud host creation method according to any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the cloud host creation method according to any one of claims 1 to 5.

Images