Method, device, medium and equipment for encrypting and decrypting virtual machine data using quantum key

Abstract

The present invention provides a method, device, medium and equipment for encrypting and decrypting virtual machine data using a quantum key, wherein the method includes: obtaining an identification of a virtual machine in response to the migration of a virtual machine from a first computing node to a second computing node; sending a request for obtaining a data encryption key of the virtual machine to a quantum key distribution node where a first virtual key management machine is located; receiving a ciphertext of the data encryption key of the virtual machine and an identification of a quantum key used to encrypt the data encryption key of the virtual machine; obtaining a quantum key according to the identification of the quantum key; decrypting the data encryption key of the virtual machine from the ciphertext of the data encryption key of the virtual machine using the quantum key; and encrypting or decrypting data of the virtual machine from the second computing node using the decrypted data encryption key. The present invention effectively solves the problem that a virtual machine cannot use a data encryption key to encrypt and decrypt data due to migration in a cloud computing platform.

Description

Technical Field

[0001] The present invention relates to the field of quantum encryption and decryption technology, and in particular to a method, device, medium and equipment for encrypting and decrypting virtual machine data using a quantum key. Background Art

[0002] In a cloud computing platform based on quantum keys, virtual machines can encrypt and decrypt virtual machine data through encryption cards in quantum key distribution nodes connected to their computing nodes to ensure the security of cloud storage data. When a device failure occurs in the computing node where the virtual machine is located, the virtual machine will migrate to other computing nodes to continue to provide services to users. However, since the data encryption key used to encrypt and decrypt virtual machine data will not migrate with the migration of the virtual machine, this migration will result in the migration of the virtual machine being unable to obtain the data encryption key and thus being unable to encrypt and decrypt the virtual machine data. Summary of the invention

[0003] The purpose of the present invention is to provide a method, device, medium and equipment for encrypting and decrypting virtual machine data using quantum keys.

[0004] According to one aspect of the present invention, a method for encrypting and decrypting virtual machine data using a quantum key is provided, the method comprising: obtaining an identification of the virtual machine in response to the migration of the virtual machine from a first computing node to a second computing node; sending a request for obtaining a data encryption key of the virtual machine to a quantum key distribution node where a first virtual key management machine is located, the request including the identification of the virtual machine; receiving a response to the request from the quantum key distribution node, the response including a ciphertext of the data encryption key of the virtual machine and an identification of a quantum key between the first virtual key management machine and a second virtual key management machine used to encrypt the data encryption key of the virtual machine; obtaining the quantum key from a quantum key pool of the second virtual key management machine according to the identification of the quantum key; decrypting the data encryption key of the virtual machine from the ciphertext of the data encryption key of the virtual machine using the quantum key; encrypting or decrypting data of the virtual machine from the second computing node using the decrypted data encryption key, wherein the first virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located at the first computing node, and the second virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located at the second computing node.

[0005] According to one embodiment of the present invention, the quantum key obtained from the quantum key pool of the second virtual key management machine is a ciphertext of the quantum key.

[0006] According to one embodiment of the present invention, before using the quantum key to decrypt the data encryption key of the virtual machine from the ciphertext of the data encryption key of the virtual machine, the method also includes: obtaining a quantum key encryption key of the quantum key from an encryption card of a quantum key distribution node where a second virtual key management machine is located according to an identifier of the quantum key; and decrypting the quantum key from the ciphertext of the quantum key using the quantum key encryption key of the quantum key.

[0007] According to another aspect of the present invention, a method for encrypting and decrypting virtual machine data using a quantum key is provided, the method comprising: receiving a request for obtaining a data encryption key of a virtual machine from a quantum key distribution node where a second virtual key management machine is located, the request comprising an identification of the virtual machine; obtaining the data encryption key of the virtual machine from an encryption card of a quantum key distribution node where a first virtual key management machine is located according to the identification of the virtual machine; obtaining a quantum key between the first virtual key management machine and the second virtual key management machine for encrypting the data encryption key of the virtual machine from a quantum key pool of the first virtual key management machine; encrypting the data encryption key of the virtual machine into a ciphertext of the data encryption key of the virtual machine using the quantum key; sending the ciphertext of the data encryption key of the virtual machine and the identification of the quantum key as a response to the request to the quantum key distribution node where the second virtual key management machine is located, wherein the first virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located at the first computing node, and the second virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located at the second computing node.

[0008] According to one embodiment of the present invention, the quantum key obtained from the quantum key pool of the first virtual key management machine is a ciphertext of the quantum key.

[0009] According to one embodiment of the present invention, before using the quantum key to encrypt the data encryption key of the virtual machine into a ciphertext of the data encryption key of the virtual machine, the method further includes: obtaining a quantum key encryption key of the quantum key from an encryption card of a quantum key distribution node where a first virtual key management machine is located according to an identifier of the quantum key; and decrypting the quantum key from the ciphertext of the quantum key using the quantum key encryption key of the quantum key.

[0010] According to another aspect of the present invention, a device for encrypting and decrypting virtual machine data using a quantum key is provided, the device comprising: a virtual machine identification acquisition unit, configured to acquire the identification of the virtual machine in response to the migration of the virtual machine from a first computing node to a second computing node; a data encryption key request unit, configured to send a request for acquiring the data encryption key of the virtual machine to a quantum key distribution node where a first virtual key management machine is located, the request including the identification of the virtual machine; a data encryption key receiving unit, configured to receive a response to the request from the quantum key distribution node, the response including a ciphertext of the data encryption key of the virtual machine and a first virtual key management machine and a second virtual key management machine for encrypting the data encryption key of the virtual machine. an identifier of a quantum key between the two virtual machines; a first quantum key acquisition unit, configured to acquire the quantum key from a quantum key pool of a second virtual key management machine according to the identifier of the quantum key; a data encryption key decryption unit, configured to use the quantum key to decrypt the data encryption key of the virtual machine from the ciphertext of the data encryption key of the virtual machine; a virtual machine data encryption and decryption unit, configured to use the decrypted data encryption key to encrypt or decrypt data of the virtual machine from the second computing node, wherein the first virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located at the first computing node, and the second virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located at the second computing node.

[0011] According to one embodiment of the present invention, the quantum key obtained from the quantum key pool of the second virtual key management machine is a ciphertext of the quantum key.

[0012] According to one embodiment of the present invention, the device also includes: a first quantum key encryption key acquisition unit, configured to obtain a quantum key encryption key of the quantum key from an encryption card of a quantum key distribution node where a second virtual key management machine is located according to an identifier of the quantum key; and a first quantum key decryption unit, configured to use the quantum key encryption key of the quantum key to decrypt the quantum key from a ciphertext of the quantum key.

[0013] According to another aspect of the present invention, a device for encrypting and decrypting virtual machine data using a quantum key is provided, the device comprising: a data encryption key request receiving unit, configured to receive a request for obtaining a data encryption key of a virtual machine from a quantum key distribution node where a second virtual key management machine is located, the request comprising an identifier of the virtual machine; a data encryption key obtaining unit, configured to obtain the data encryption key of the virtual machine from an encryption card of a quantum key distribution node where a first virtual key management machine is located according to the identifier of the virtual machine; a second quantum key obtaining unit, configured to obtain the data encryption key of the first virtual key management machine from a quantum key pool of the first virtual key management machine for encrypting the data encryption key of the virtual machine; a quantum key between the virtual machine and the second virtual key management machine; a data encryption key encryption unit, configured to use the quantum key to encrypt the data encryption key of the virtual machine into a ciphertext of the data encryption key of the virtual machine; a data encryption key request response unit, configured to send the ciphertext of the data encryption key of the virtual machine and the identifier of the quantum key as a response to the request to the quantum key distribution node where the second virtual key management machine is located, wherein the first virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the first computing node, and the second virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the second computing node.

[0014] According to one embodiment of the present invention, the quantum key obtained from the quantum key pool of the first virtual key management machine is a ciphertext of the quantum key.

[0015] According to one embodiment of the present invention, the device also includes: a second quantum key encryption key acquisition unit, configured to obtain the quantum key encryption key of the quantum key from the encryption card of the quantum key distribution node where the first virtual key management machine is located according to the identifier of the quantum key; a second quantum key decryption unit, configured to use the quantum key encryption key of the quantum key to decrypt the quantum key from the ciphertext of the quantum key.

[0016] According to another aspect of the present invention, a computer-readable storage medium storing a computer program is provided. When the computer program is executed by a processor, the method of encrypting and decrypting virtual machine data using a quantum key as described above is implemented.

[0017] According to another aspect of the present invention, a computer device is provided, comprising: a processor; and a memory storing a computer program, wherein when the computer program is executed by the processor, the method for encrypting and decrypting virtual machine data using a quantum key as described above is implemented.

[0018] The method, device, medium and equipment for encrypting and decrypting virtual machine data using quantum keys provided by the present invention can not only solve the problem that the virtual machine cannot use data encryption keys to encrypt and decrypt its data (such as virtual machine image data, snapshot data, etc.) because it is migrated to other computing nodes in the cloud computing platform, but also effectively reduce the risk of data leakage caused by virtual machine migration, which greatly improves the security of the cloud computing platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above objects and features of the present invention will become more apparent from the following description in conjunction with the accompanying drawings.

[0020] Figure 1 A schematic diagram showing the system architecture of a cloud computing platform.

[0021] Figure 2 A schematic flow chart of a method for encrypting and decrypting virtual machine data using a quantum key according to an exemplary embodiment of the present invention is shown.

[0022] Figure 3 Another schematic flow chart of a method for encrypting and decrypting virtual machine data using a quantum key according to an exemplary embodiment of the present invention is shown.

[0023] Figure 4 A schematic operation sequence diagram of encrypting and decrypting virtual machine data using a quantum key in a cloud computing platform according to an exemplary embodiment of the present invention is shown.

[0024] Figure 5 A schematic structural block diagram of an apparatus for encrypting and decrypting virtual machine data using a quantum key according to an exemplary embodiment of the present invention is shown.

[0025] Figure 6 Another schematic structural block diagram of an apparatus for encrypting and decrypting virtual machine data using a quantum key according to an exemplary embodiment of the present invention is shown.

[0026] Figure 7 A schematic architecture diagram of a system for encrypting and decrypting virtual machine data using a quantum key in a cloud computing platform according to an exemplary embodiment of the present invention is shown. DETAILED DESCRIPTION

[0027] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0028] Figure 1 A schematic diagram showing the system architecture of a cloud computing platform.

[0029] Reference Figure 1 ,exist Figure 1In the cloud computing platform shown, different computing platforms can be connected to different quantum key distribution nodes, one or more virtual machines can be run on each computing platform, and one or more virtual key managers can be generated on each quantum key distribution node based on virtualization technology to provide data encryption and decryption services for the corresponding virtual machines. In addition, the virtual key managers in the same quantum key distribution node are data isolated to reduce the risk of quantum key leakage between different virtual key managers in the same quantum key distribution node, which makes it impossible for the virtual key managers in the same quantum key distribution node to access each other's data.

[0030] In addition, Figure 1 In the cloud computing platform shown, in addition to being connected to the corresponding computing platform, each quantum key distribution node is also connected to a quantum key distribution device (Quantum Key Distribution, referred to as QKD) (not shown) to perform quantum key distribution with quantum key distribution devices connected to other quantum key distribution nodes in the cloud computing platform. By performing basis vector comparison and data post-processing on the quantum light generated in the quantum key distribution process to screen out suitable symmetric quantum keys, these quantum keys are distributed according to predetermined strategies to the quantum key pools of various virtual key management machines generated in the same quantum key distribution node based on virtualization technology, so as to provide security for data transmission between different computing nodes or different virtual machines in the cloud computing platform.

[0031] In addition, Figure 1 In the cloud computing platform shown, each quantum key distribution node is provided with an encryption card (such as, but not limited to, a PCI-E encryption card), and the master key, key encryption key, data encryption key, and quantum key encryption key can all be stored in the encryption card. The quantum key can be assigned to the quantum key pool of each virtual key manager. In other words, the quantum key can be stored in a storage device other than the encryption card. Each virtual key manager can use the data encryption key via the encryption card to encrypt and decrypt data from its corresponding virtual machine (such as virtual machine image data, snapshot data, etc.). However, when a virtual machine is migrated due to equipment failure or other reasons (for example, but not limited to, from a virtual machine to a virtual machine), the virtual machine can be encrypted and decrypted by the data encryption key. Figure 1 The computing node A shown in the figure is migrated to Figure 1 When the virtual machine is migrated to computing node C), since the data encryption key of the virtual machine still resides in the encryption card (not shown) of the quantum key distribution node QKDN1, and the encryption card will not migrate with the migration of the virtual machine, the data encrypted by the virtual machine using the data encryption key when the virtual machine is in computing node A will not be able to be decrypted after the virtual machine is migrated to computing node C.

[0032] To this end, the present invention proposes a method and device for encrypting and decrypting virtual machine data using quantum keys to overcome the occurrence of the above-mentioned problems.

[0033] Figure 2 A schematic flow chart of a method for encrypting and decrypting virtual machine data using a quantum key according to an exemplary embodiment of the present invention is shown.

[0034] Reference Figure 2 , Figure 2 The method shown may include the following steps.

[0035] In step 201 , an identifier of a virtual machine may be obtained in response to the virtual machine migrating from a first computing node to a second computing node.

[0036] In step 202, a request for obtaining a data encryption key of a virtual machine may be sent to a quantum key distribution node where the first virtual key management machine is located, and the request includes an identifier of the virtual machine.

[0037] In step 203, a response to the request may be received from the quantum key distribution node, the response including the ciphertext of the data encryption key of the virtual machine and an identifier of the quantum key between the first virtual key manager and the second virtual key manager used to encrypt the data encryption key of the virtual machine.

[0038] In step 204, the quantum key may be obtained from the quantum key pool of the second virtual key management machine according to the identifier of the quantum key.

[0039] In step 205, the data encryption key of the virtual machine may be decrypted from the ciphertext of the data encryption key of the virtual machine using the quantum key.

[0040] In step 206, the decrypted data encryption key may be used to encrypt or decrypt data from the virtual machine of the second computing node.

[0041] The above method can be executed in the quantum key distribution node where the second virtual key manager is located, and the first virtual key manager can be configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the first computing node, and the second virtual key manager can be configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the second computing node.

[0042] In the example, the quantum key obtained from the quantum key pool of the second virtual key management machine can be a plaintext of the quantum key or a ciphertext of the quantum key. If the obtained quantum key is a ciphertext, before executing step 205, the quantum key encryption key of the quantum key can be obtained from the encryption card of the quantum key distribution node where the second virtual key management machine is located according to the identifier of the quantum key, and the quantum key encryption key of the quantum key is used to decrypt the quantum key from the ciphertext of the quantum key. Here, the quantum key and the quantum key encryption key of the quantum key are both generated during the quantum key distribution by the quantum key distribution node, so the quantum key and the quantum key encryption key of the quantum key are both symmetric keys.

[0043] Figure 3 Another schematic flow chart of a method for encrypting and decrypting virtual machine data using a quantum key according to an exemplary embodiment of the present invention is shown.

[0044] Reference Figure 3 , Figure 3 The method shown may include the following steps.

[0045] In step 301, a request for obtaining a data encryption key of a virtual machine may be received from a quantum key distribution node where a second virtual key management machine is located, and the request includes an identifier of the virtual machine.

[0046] In step 302, the data encryption key of the virtual machine can be obtained from the encryption card of the quantum key distribution node where the first virtual key management machine is located according to the identifier of the virtual machine.

[0047] In step 303, a quantum key between the first virtual key manager and the second virtual key manager for encrypting a data encryption key of the virtual machine may be obtained from the quantum key pool of the first virtual key manager.

[0048] In step 304, the data encryption key of the virtual machine may be encrypted into a ciphertext of the data encryption key of the virtual machine using a quantum key.

[0049] In step 305, the ciphertext of the data encryption key of the virtual machine and the identifier of the quantum key may be sent as a response to the request to the quantum key distribution node where the second virtual key management machine is located.

[0050] The above method can be executed in a quantum key distribution node where the first virtual key manager is located, and the first virtual key manager can be configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located at the first computing node, and the second virtual key manager can be configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located at the second computing node.

[0051] In the example, the quantum key obtained from the quantum key pool of the first virtual key management machine can be a plaintext of the quantum key or a ciphertext of the quantum key. If the obtained quantum key is a ciphertext, before executing step 304, the quantum key encryption key of the quantum key can be obtained from the encryption card of the quantum key distribution node where the first virtual key management machine is located according to the identifier of the quantum key, and the quantum key encryption key of the quantum key is used to decrypt the quantum key from the ciphertext of the quantum key. Here, the quantum key and the quantum key encryption key of the quantum key are both generated during the quantum key distribution by the quantum key distribution node, so the quantum key and the quantum key encryption key of the quantum key are both symmetric keys.

[0052] Figure 4 A schematic operation sequence diagram of encrypting and decrypting virtual machine data using a quantum key in a cloud computing platform according to an exemplary embodiment of the present invention is shown.

[0053] Reference Figure 4 In the cloud computing platform, after the virtual machine VM is migrated from computing node A to computing node C due to equipment failure or other reasons, the virtual machine VM data can be encrypted and decrypted according to the following operation sequence.

[0054] First, in operation S401, the quantum key distribution node QKDN2 may obtain an identification of the virtual machine VM in response to the virtual machine VM migrating from the first computing node A to the second computing node C.

[0055] Next, in operation S402, the quantum key distribution node QKDN2 may send a request for obtaining a data encryption key of the virtual machine VM to the quantum key distribution node QKDN1, where the request includes an identifier of the virtual machine VM.

[0056] Next, in operation S403, the quantum key distribution node QKDN1 may receive a request from the quantum key distribution node QKDN2 for obtaining a data encryption key of the virtual machine VM.

[0057] Next, in operation S404, the quantum key distribution node QKDN1 may obtain the data encryption key of the virtual machine VM from the encryption card of the quantum key distribution node QKDN1 according to the identifier of the virtual machine VM. The encryption card of the quantum key distribution node QKDN1 may store the data encryption keys of each virtual machine in the computing node A and the computing node B connected to the quantum key distribution node QKDN1. In the cloud computing platform, the encryption cards of other quantum key distribution nodes also store the data encryption keys of each virtual machine in each computing node connected to other quantum key distribution nodes.

[0058] Next, in operation S405, the quantum key distribution node QKDN1 may obtain the quantum key K between the virtual key manager VQKM1 and the virtual key manager VQKM2 for encrypting the data encryption key of the virtual machine VM from the quantum key pool of the virtual key manager VQKM1. The quantum key pool of the virtual key manager VQKM1 may store the quantum keys between the virtual key manager VQKM1 and the virtual key manager VQKM2 and between the virtual key manager VQKM1 and other virtual key managers. In the cloud computing platform, the quantum key pools of other virtual key managers also store the quantum keys between other virtual key managers and another virtual key manager.

[0059] Next, in operation S406, the quantum key distribution node QKDN1 may use the quantum key K to encrypt the data encryption key of the virtual machine VM into a ciphertext of the data encryption key of the virtual machine VM.

[0060] Next, in operation S407, the quantum key distribution node QKDN1 may send the ciphertext of the data encryption key of the virtual machine VM and the identifier of the quantum key K to the quantum key distribution node QKDN2 as a response to the request.

[0061] Next, in operation S408, the quantum key distribution node QKDN2 may receive a response to the request from the quantum key distribution node QKDN1, where the response includes the ciphertext of the data encryption key of the virtual machine VM and the identifier of the quantum key K.

[0062] Next, in operation S409, the quantum key distribution node QKDN2 may obtain the quantum key K from the quantum key pool of the virtual key manager VQKM2 according to the identifier of the quantum key K. The quantum key pool of the virtual key manager VQKM2 may store quantum keys between the virtual key manager VQKM2 and the virtual key manager VQKM1, and between the virtual key manager VQKM2 and other virtual key managers.

[0063] Next, in operation S410, the quantum key distribution node QKDN2 may use the quantum key K to decrypt the data encryption key of the virtual machine VM from the ciphertext of the data encryption key of the virtual machine VM.

[0064] Finally, in operation S411, the quantum key distribution node QKDN2 may use the decrypted data encryption key to encrypt or decrypt data from the virtual machine VM of the computing node C.

[0065] Figure 5 A schematic structural block diagram of an apparatus for encrypting and decrypting virtual machine data using a quantum key according to an exemplary embodiment of the present invention is shown.

[0066] Reference Figure 5 According to an exemplary embodiment of the present invention, an apparatus for encrypting and decrypting virtual machine data using a quantum key may include at least a virtual machine identification acquisition unit 501, a data encryption key request unit 502, a data encryption key receiving unit 503, a first quantum key acquisition unit 504, a data encryption key decryption unit 505, and a virtual machine data encryption and decryption unit 506.

[0067] exist Figure 5 In the device shown, a virtual machine identification acquisition unit 501 may acquire the identification of the virtual machine in response to the migration of the virtual machine from the first computing node to the second computing node; a data encryption key request unit 502 may send a request for acquiring the data encryption key of the virtual machine to the quantum key distribution node where the first virtual key management machine is located, and the request includes the identification of the virtual machine; a data encryption key receiving unit 503 may receive a response to the request from the quantum key distribution node, and the response includes the ciphertext of the data encryption key of the virtual machine and the identification of the quantum key between the first virtual key management machine and the second virtual key management machine used to encrypt the data encryption key of the virtual machine; a first quantum key acquisition unit 504 may acquire a quantum key from the quantum key pool of the second virtual key management machine according to the identification of the quantum key; a data encryption key decryption unit 505 may use the quantum key to decrypt the data encryption key of the virtual machine from the ciphertext of the data encryption key of the virtual machine; and a virtual machine data encryption and decryption unit 506 may use the decrypted data encryption key to encrypt or decrypt data of the virtual machine from the second computing node.

[0068] exist Figure 5 In the device shown, the first virtual key manager can be configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the first computing node, and the second virtual key manager can be configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the second computing node.

[0069] In the example, the quantum key obtained from the quantum key pool of the second virtual key management machine can be a plain text quantum key or a cipher text quantum key. If the obtained quantum key is a cipher text, then Figure 5 The device shown may also include a first quantum key encryption key acquisition unit and a first quantum key decryption unit (both not shown). The first quantum key encryption key acquisition unit can obtain the quantum key encryption key of the quantum key from the encryption card of the quantum key distribution node where the second virtual key management machine is located according to the identifier of the quantum key; the first quantum key decryption unit can use the quantum key encryption key of the quantum key to decrypt the quantum key from the ciphertext of the quantum key.

[0070] Figure 6Another schematic structural block diagram of an apparatus for encrypting and decrypting virtual machine data using a quantum key according to an exemplary embodiment of the present invention is shown.

[0071] Reference Figure 6 According to an exemplary embodiment of the present invention, an apparatus for encrypting and decrypting virtual machine data using a quantum key may include at least a data encryption key request receiving unit 601, a data encryption key obtaining unit 602, a second quantum key obtaining unit 603, a data encryption key encryption unit 604, and a data encryption key request responding unit 605.

[0072] exist Figure 6 In the device shown, a data encryption key request receiving unit 601 may receive a request for obtaining a data encryption key of a virtual machine from a quantum key distribution node where a second virtual key manager is located, the request including an identification of the virtual machine; a data encryption key obtaining unit 602 may obtain the data encryption key of the virtual machine from an encryption card of a quantum key distribution node where a first virtual key manager is located according to the identification of the virtual machine; a second quantum key obtaining unit 603 may obtain a quantum key between the first virtual key manager and the second virtual key manager for encrypting the data encryption key of the virtual machine from a quantum key pool of the first virtual key manager; a data encryption key encryption unit 604 may use a quantum key to encrypt the data encryption key of the virtual machine into a ciphertext of the data encryption key of the virtual machine; a data encryption key request response unit 605 may send the ciphertext of the data encryption key of the virtual machine and the identification of the quantum key as a response to the request to the quantum key distribution node where the second virtual key manager is located.

[0073] exist Figure 6 In the device shown, the first virtual key manager can be configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the first computing node, and the second virtual key manager can be configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the second computing node.

[0074] In the example, the quantum key obtained from the quantum key pool of the first virtual key management machine can be a plain text quantum key or a cipher text quantum key. If the obtained quantum key is a cipher text, then Figure 6 The device shown may also include a second quantum key encryption key acquisition unit and a second quantum key decryption unit (neither shown). The second quantum key encryption key acquisition unit can obtain the quantum key encryption key of the quantum key from the encryption card of the quantum key distribution node where the first virtual key management machine is located according to the identifier of the quantum key; the second quantum key decryption unit can use the quantum key encryption key of the quantum key to decrypt the quantum key from the ciphertext of the quantum key.

[0075] Figure 7A schematic architecture diagram of a system for encrypting and decrypting virtual machine data using a quantum key in a cloud computing platform according to an exemplary embodiment of the present invention is shown.

[0076] Reference Figure 7 According to an exemplary embodiment of the present invention, a system for migrating a virtual machine using a quantum key in a cloud computing platform may include Figure 5 and Figure 6 The device shown. Figure 5 The device shown can be arranged in Figure 4 In the quantum key distribution node QKDN2 shown. Figure 6 The device shown can be arranged in Figure 4 In the quantum key distribution node QKDN1 shown in FIG. After the virtual machine VM is migrated from computing node A to computing node C, the virtual machine VM can be Figure 7 The system shown implements encryption and decryption of virtual machine data.

[0077] It can be seen that the method and device for encrypting and decrypting virtual machine data using quantum keys according to exemplary embodiments of the present invention can not only solve the problem that the virtual machine cannot use data encryption keys to encrypt and decrypt its data (such as virtual machine image data, snapshot data, etc.) because it is migrated to other computing nodes in the cloud computing platform, but also effectively reduce the risk of data leakage caused by virtual machine migration, which greatly improves the security of the cloud computing platform.

[0078] According to an exemplary embodiment of the present invention, a computer-readable storage medium storing a computer program may also be provided. The computer-readable storage medium stores a computer program that, when executed by a processor, causes the processor to perform a method for encrypting and decrypting virtual machine data using a quantum key according to the present invention. The computer-readable recording medium is any data storage device that can store data read out by a computer system. Examples of computer-readable recording media include: read-only memory, random access memory, read-only optical disk, magnetic tape, floppy disk, optical data storage device, and carrier wave (such as data transmission over the Internet via a wired or wireless transmission path).

[0079] According to an exemplary embodiment of the present invention, a computer device may also be provided. The computer device includes a processor and a memory. The memory is used to store a computer program. The computer program is executed by the processor so that the processor executes a computer program of the method for encrypting and decrypting virtual machine data using a quantum key according to the present invention.

[0080] While the present application has been shown and described with reference to preferred embodiments, it will be understood by those skilled in the art that various modifications and variations may be made to these embodiments without departing from the spirit and scope of the present application as defined by the appended claims.

Claims

1. A method for encrypting and decrypting virtual machine data using a quantum key, characterized in that: The method comprises: Responsive to the migration of the virtual machine from the first computing node to the second computing node, obtaining an identification of the virtual machine; Sending a request for obtaining a data encryption key of the virtual machine to a quantum key distribution node where the first virtual key management machine is located, wherein the request includes an identifier of the virtual machine; Receiving a response to the request from the quantum key distribution node, the response including a ciphertext of a data encryption key of the virtual machine and an identifier of a quantum key between a first virtual key management machine and a second virtual key management machine used to encrypt the data encryption key of the virtual machine; Obtaining the quantum key from a quantum key pool of a second virtual key management machine according to the identifier of the quantum key; Decrypting the data encryption key of the virtual machine from the ciphertext of the data encryption key of the virtual machine using the quantum key; Using the decrypted data encryption key to encrypt or decrypt the data of the virtual machine from the second computing node, Among them, the first virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the first computing node, and the second virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the second computing node.

2. The method according to claim 1, characterized in that The quantum key obtained from the quantum key pool of the second virtual key management machine is the ciphertext of the quantum key.

3. The method according to claim 2, characterized in that Before using the quantum key to decrypt the data encryption key of the virtual machine from the ciphertext of the data encryption key of the virtual machine, the method further includes: Obtaining a quantum key encryption key of the quantum key from an encryption card of a quantum key distribution node where a second virtual key management machine is located according to the identifier of the quantum key; The quantum key is decrypted from the ciphertext of the quantum key using a quantum key encryption key of the quantum key.

4. A method for encrypting and decrypting virtual machine data using a quantum key, characterized in that: The method comprises: Receiving a request for obtaining a data encryption key of a virtual machine from a quantum key distribution node where a second virtual key management machine is located, wherein the request includes an identifier of the virtual machine; Obtaining a data encryption key of the virtual machine from an encryption card of a quantum key distribution node where the first virtual key management machine is located according to the identifier of the virtual machine; Acquire a quantum key between the first virtual key manager and the second virtual key manager for encrypting a data encryption key of the virtual machine from a quantum key pool of the first virtual key manager; Encrypting the data encryption key of the virtual machine into a ciphertext of the data encryption key of the virtual machine using the quantum key; sending the ciphertext of the data encryption key of the virtual machine and the identifier of the quantum key as a response to the request to the quantum key distribution node where the second virtual key management machine is located, Among them, the first virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the first computing node, and the second virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the second computing node.

5. The method according to claim 4, characterized in that The quantum key obtained from the quantum key pool of the first virtual key management machine is the ciphertext of the quantum key.

6. The method according to claim 5, characterized in that Before using the quantum key to encrypt the data encryption key of the virtual machine into a ciphertext of the data encryption key of the virtual machine, the method further includes: Obtaining a quantum key encryption key of the quantum key from an encryption card of a quantum key distribution node where the first virtual key management machine is located according to the identifier of the quantum key; The quantum key is decrypted from the ciphertext of the quantum key using a quantum key encryption key of the quantum key.

7. A device for encrypting and decrypting virtual machine data using a quantum key, characterized in that: The device comprises: a virtual machine identification acquisition unit, configured to acquire an identification of the virtual machine in response to the virtual machine migrating from the first computing node to the second computing node; A data encryption key request unit is configured to send a request for obtaining the data encryption key of the virtual machine to the quantum key distribution node where the first virtual key management machine is located, wherein the request includes an identifier of the virtual machine; a data encryption key receiving unit, configured to receive a response to the request from the quantum key distribution node, the response including a ciphertext of the data encryption key of the virtual machine and an identifier of a quantum key between a first virtual key management machine and a second virtual key management machine for encrypting the data encryption key of the virtual machine; A first quantum key acquisition unit is configured to acquire the quantum key from a quantum key pool of a second virtual key management machine according to an identifier of the quantum key; a data encryption key decryption unit, configured to use the quantum key to decrypt the data encryption key of the virtual machine from the ciphertext of the data encryption key of the virtual machine; a virtual machine data encryption and decryption unit, configured to encrypt or decrypt the data of the virtual machine from the second computing node using the decrypted data encryption key, Among them, the first virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the first computing node, and the second virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the second computing node.

8. The device according to claim 7, characterized in that The quantum key obtained from the quantum key pool of the second virtual key management machine is the ciphertext of the quantum key.

9. The device according to claim 8, characterized in that The device also includes: A first quantum key encryption key acquisition unit is configured to acquire a quantum key encryption key of the quantum key from an encryption card of a quantum key distribution node where a second virtual key management machine is located according to an identifier of the quantum key; The first quantum key decryption unit is configured to decrypt the quantum key from the ciphertext of the quantum key using the quantum key encryption key of the quantum key.

10. A device for encrypting and decrypting virtual machine data using a quantum key, characterized in that: The device comprises: A data encryption key request receiving unit is configured to receive a request for obtaining a data encryption key of a virtual machine from a quantum key distribution node where a second virtual key management machine is located, wherein the request includes an identifier of the virtual machine; A data encryption key acquisition unit is configured to acquire the data encryption key of the virtual machine from an encryption card of a quantum key distribution node where the first virtual key management machine is located according to the identifier of the virtual machine; A second quantum key acquisition unit is configured to acquire, from the quantum key pool of the first virtual key management machine, a quantum key between the first virtual key management machine and the second virtual key management machine for encrypting a data encryption key of the virtual machine; a data encryption key encryption unit, configured to encrypt the data encryption key of the virtual machine into a ciphertext of the data encryption key of the virtual machine using the quantum key; a data encryption key request response unit, configured to send the ciphertext of the data encryption key of the virtual machine and the identifier of the quantum key as a response to the request to the quantum key distribution node where the second virtual key management machine is located, Among them, the first virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the first computing node, and the second virtual key management machine is configured to provide data encryption and decryption services to the virtual machine when the virtual machine is located in the second computing node.

11. The device according to claim 10, characterized in that The quantum key obtained from the quantum key pool of the first virtual key management machine is the ciphertext of the quantum key.

12. The device according to claim 11, characterized in that The device also includes: A second quantum key encryption key acquisition unit is configured to acquire the quantum key encryption key of the quantum key from an encryption card of a quantum key distribution node where the first virtual key management machine is located according to the identifier of the quantum key; The second quantum key decryption unit is configured to decrypt the quantum key from the ciphertext of the quantum key using the quantum key encryption key of the quantum key.

13. A computer-readable storage medium storing a computer program, wherein: When the computer program is executed by a processor, the method for encrypting and decrypting virtual machine data using a quantum key as described in any one of claims 1 to 6 is implemented.

14. A computing device comprising: processor; A memory storing a computer program, which, when executed by a processor, implements the method for encrypting and decrypting virtual machine data using a quantum key as described in any one of claims 1 to 6.

Images