A virtual machine rapid authentication method based on SM9 and openstack platform

Abstract

The application discloses a kind of based on SM9's Openstack platform's virtual machine fast authentication method, it includes in Openstack cloud platform increase component SM9 key generation center;Virtual machine is created, obtains virtual machine identification information;User private key is injected into virtual machine;And user private key is loaded into key management module;Client initiates login request;Establishes encryption tunnel;Client sends username and password to server;Call the interface of key management module, after signing virtual machine identification information, send to client;Client uses virtual machine identification information to sign, and if signature is passed, then virtual machine authentication succeeds, and network protocol connection is established.The application directly integrates SM9 identification password algorithm in Openstack cloud platform system, and realizes key injection in the process of virtual machine creation, effectively reduces the use cost of cloud platform, greatly improves the authentication efficiency of cloud platform virtual machine.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a fast authentication method for virtual machines based on the OpenStack platform with SM9. Background Technology

[0002] With the rapid expansion of cloud computing, security risks such as cyberattacks against cloud platforms are becoming increasingly prominent. To address attacks such as identity forgery in the internet environment, PKI / CA certificate systems are often introduced into security architectures to ensure data source authentication and guarantee the trustworthiness of communicating parties. While PKI / CA certificate systems offer extremely high security, they also suffer from drawbacks such as high cost, heavy computational load, and complex management. In controllable scenarios, such as office networks and internal networks, using PKI / CA certificate systems can be overly cumbersome, significantly increasing costs and reducing efficiency.

[0003] OpenStack is an open-source cloud computing management platform project that provides scalable and elastic cloud computing services for private clouds. The project aims to provide a simple, reliable, scalable, feature-rich, and standardized cloud computing management platform. While OpenStack offers a key management module, it does not support Chinese national cryptographic algorithms or provide virtual machine security authentication services. Users of OpenStack must purchase PKI / CA services separately to enhance cloud platform security, undoubtedly increasing costs significantly.

[0004] Therefore, how to authenticate OpenStack cloud platform virtual machines based on national cryptographic algorithms is one of the technical problems that urgently needs to be solved. Summary of the Invention

[0005] Therefore, it is necessary to address the shortcomings of existing technologies by providing a rapid authentication method for virtual machines on the OpenStack cloud platform based on SM9, which can effectively reduce the cost of using the cloud platform and greatly improve the authentication efficiency of virtual machines on the cloud platform.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0007] This invention provides a fast virtual machine authentication method based on the SM9 OpenStack platform, which includes the following steps:

[0008] Add the SM9 Key Generation Center component to the OpenStack cloud platform;

[0009] Create a virtual machine and obtain its identification information;

[0010] Obtain the user's private key corresponding to the virtual machine and inject the user's private key into the virtual machine;

[0011] Start the key management module and load the user's private key into the key management module;

[0012] The client initiates a login request;

[0013] Establish an encrypted tunnel;

[0014] The client sends its username and password to the server.

[0015] After the server verifies the username and password, it calls the key management module's interface to sign the virtual machine identification information and send it to the client.

[0016] The client uses the virtual machine identification information to verify the signature. If the signature verification is successful, the virtual machine is successfully authenticated and a network protocol connection is established.

[0017] In one embodiment, the method for creating a virtual machine and obtaining virtual machine identification information specifically involves the following steps:

[0018] Create a virtual machine on the OpenStack cloud platform and send the virtual machine key generation command and virtual machine identification information to the SM9 key generation center through a message queue.

[0019] In one embodiment, the method of obtaining the user's private key corresponding to the virtual machine and injecting the user's private key into the virtual machine specifically involves the following steps:

[0020] Modify files such as crypto.py in the OpenStack nova source code to add support for the SM9 identifier encryption algorithm;

[0021] The SM9 Key Generation Center generates a user private key using the virtual machine identification information as an identifier, and obtains the user private key corresponding to the virtual machine.

[0022] The Cloud-init process code was modified to allow Cloud-init to obtain the user's private key corresponding to the virtual machine from the SM9 key generation center and inject the user's private key into the virtual machine.

[0023] In one embodiment, the method of starting the startup key management module and loading the user's private key into the key management module specifically involves:

[0024] Start the virtual machine created on the OpenStack cloud platform. When the virtual machine starts, the key management module will also start automatically. The virtual machine will load the user's private key into the key management module.

[0025] In one embodiment, the method for establishing the encrypted tunnel in the step specifically involves:

[0026] Step S161: The server and the client establish a session. The server sends the algorithms it supports to the client. The client compares the algorithms it supports with the algorithms supported by the server. The client and the server then determine and negotiate the required algorithms.

[0027] Step S162: The server uses the DH algorithm to negotiate a session key with the client through a session to establish an encrypted tunnel.

[0028] In one embodiment, prior to step S161, the method further includes...

[0029] Step S161-1: Modify the ssh-keyscan.c, sshconnect2.c and other files in the openssh source code to add the SM2 identifier.

[0030] In one embodiment, after the server verifies the username and password, it calls the interface of the key management module to sign the virtual machine identification information and send it to the client. The specific operation is as follows:

[0031] Modify the OpenSSH source code to add a server-side authentication method based on SM9;

[0032] The server verifies the username and password.

[0033] The server calls the key management module's interface to sign the virtual machine identification information;

[0034] The server sends the signed virtual machine identification information to the client.

[0035] In one embodiment, the key generation center is located within the encryption device.

[0036] In one embodiment, the virtual machine identification information is virtual machine IP information or virtual machine network card MAC address information.

[0037] In one embodiment, the key management module is interfaced with Python or Java.

[0038] In summary, the present invention provides a fast virtual machine authentication method based on the SM9 OpenStack platform. By directly integrating the SM9 identifier cryptography algorithm into the OpenStack cloud platform system and implementing key injection during the virtual machine creation process, it effectively reduces the cost of using the cloud platform and greatly improves the authentication efficiency of the cloud platform virtual machine. Attached Figure Description

[0039] Figure 1This is a flowchart illustrating a fast virtual machine authentication method based on the SM9 OpenStack platform, provided as an embodiment of the present invention. Detailed Implementation

[0040] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] Figure 1 This is a flowchart illustrating a fast virtual machine authentication method based on the SM9 OpenStack platform provided in an embodiment of the present invention. Figure 1 As shown, a fast virtual machine authentication method based on the SM9 OpenStack platform includes the following steps:

[0042] Step S110: Add an SM9 key generation center component to the OpenStack cloud platform; integrate the SM9 key generation center into the key management module of the OpenStack cloud platform, enabling OpenStack to support the SM9 algorithm at the protocol layer without the need for separate deployment of third-party security services, effectively reducing the usage cost of the cloud platform. The SM9 key generation center is used to generate a master public key and a master private key. The master private key is used to generate user private keys, and the master public key is used to disclose the user's private key. In this invention, the user's private key is the SM9 key. The key generation center can be set up in different encryption devices, such as encryption machines, U-keys, and cloud encryption machines, according to actual needs.

[0043] Step S120: Create a virtual machine and obtain the virtual machine identification information; wherein, the virtual machine identification information is the virtual machine IP information or the virtual machine network card MAC address information.

[0044] The method of step S120 is specifically operated as follows:

[0045] A virtual machine is created on the OpenStack cloud platform, and a virtual machine key generation command and virtual machine identification information are sent to the SM9 key generation center through a message queue, so that the SM9 key generation center can obtain the virtual machine identification information.

[0046] Step S130: Obtain the user private key corresponding to the virtual machine and inject the user private key into the virtual machine.

[0047] The method in step S130 is specifically operated as follows:

[0048] Modify files such as crypto.py in the OpenStack nova source code to add support for the SM9 identifier encryption algorithm;

[0049] The SM9 key generation center generates a user private key using the virtual machine identification information as an identifier, and obtains the user private key corresponding to the virtual machine; specifically, the SM9 key generation center generates a user private key using the virtual machine IP information or the virtual machine network card MAC address information as an identifier.

[0050] The Cloud-init process code is modified to allow Cloud-init to obtain the user's private key corresponding to the virtual machine from the SM9 key generation center and inject the user's private key into the virtual machine. The SM9 identifier encryption algorithm is directly integrated into the OpenStack cloud platform system, and the user's private key is injected during the virtual machine creation process. The key injection is achieved during the virtual machine creation process, eliminating the need for a complicated key injection process, which is more secure and efficient than other key injection processes.

[0051] Step S140: Start the key management module and load the user's private key into the key management module; when the virtual machine starts, it passes the user's private key to the key management module through Cloud-init, thereby achieving the effect of loading the user's private key.

[0052] The method of step S140 is specifically operated as follows:

[0053] Start the virtual machine created on the OpenStack cloud platform. When the virtual machine starts, the key management module will also start automatically. The virtual machine will load the user's private key into the key management module.

[0054] Step S150: The client initiates a login request; specifically, taking the SSH protocol as an example, the SSH client initiates a login request to the SSH server.

[0055] Step S160: Establish an encrypted tunnel.

[0056] The method of step S160 includes the following steps:

[0057] Step S161: The server and the client establish a session. The server sends the algorithms it supports to the client. The client compares the algorithms it supports with the algorithms supported by the server. The client and the server then determine and negotiate the required algorithms.

[0058] Step S162: The server uses the DH algorithm to negotiate a session key with the client through a session to establish an encrypted tunnel.

[0059] In one embodiment, prior to step S161, the method further includes...

[0060] Step S161-1: Modify the ssh-keyscan.c, sshconnect2.c and other files in the openssh source code to add the SM2 identifier, so that the client and server negotiate the required algorithm to be the SM2 algorithm.

[0061] Step S170: The client sends the username and password to the server.

[0062] Step S180: After the server verifies the username and password, it calls the interface of the key management module to sign the virtual machine identification information and send it to the client. The interface corresponding to the key management module can be Python or Java, etc. After the server verifies the username and password, it calls the interface of the key management module corresponding to the virtual machine.

[0063] The method of step S180 is specifically operated as follows:

[0064] Modify the OpenSSH source code to add a server authentication method based on SM9; the authentication process of the SM9-based server authentication method includes, but is not limited to, the SSH protocol, and the network service protocols of all authenticated virtual machines can use the corresponding authentication process.

[0065] The server verifies the username and password.

[0066] The server calls the key management module's interface to sign the virtual machine identification information;

[0067] The server sends the signed virtual machine identification information to the client.

[0068] Step S190: The client uses the virtual machine identification information for signature verification. If the signature verification is successful, the virtual machine is successfully authenticated, and a network protocol connection is established to complete the client's login request operation, thereby enhancing the security of the client's access to the virtual machine. Specifically, during the process of establishing a network protocol connection between the client and the virtual machine, the client does not need to perform key negotiation and certificate exchange based on SM9. It only needs to use the virtual machine identification information to complete the authentication of the virtual machine, effectively reducing the cost of using the cloud platform and greatly improving the authentication efficiency of the cloud platform virtual machine.

[0069] like Figure 1 As shown, in order to make the technical solution of the present invention clearer, preferred embodiments will be described below.

[0070] Step S110: Add the SM9 Key Generation Center component to the OpenStack cloud platform;

[0071] Step S120: Create a virtual machine and obtain virtual machine identification information;

[0072] Step S130: Obtain the user's private key corresponding to the virtual machine and inject the user's private key into the virtual machine;

[0073] Step S140: Start the key management module and load the user's private key into the key management module;

[0074] Step S150: The client initiates a login request;

[0075] Step S160: Establish an encrypted tunnel;

[0076] Step S170: The client sends the username and password to the server;

[0077] Step S180: After the server verifies the username and password, it calls the interface of the key management module to sign the virtual machine identification information and send it to the client.

[0078] Step S190: The client uses the virtual machine identification information to verify the signature. If the signature verification is successful, the virtual machine authentication is successful, and a network protocol connection is established.

[0079] In summary, the present invention provides a fast virtual machine authentication method for the OpenStack platform based on SM9. By directly integrating the SM9 identifier cryptography algorithm into the OpenStack cloud platform system and implementing key injection during the virtual machine creation process, the method effectively reduces the cost of using the cloud platform and greatly improves the authentication efficiency of the cloud platform virtual machine.

[0080] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0081] In the embodiments provided by this invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of each unit is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0082] The steps in the method of this invention can be adjusted, merged, or deleted according to actual needs. The units in the device of this invention can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which can be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of this invention.

[0083] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the appended claims.

Claims

1. A rapid authentication method for virtual machines based on the OpenStack platform using SM9, characterized in that, Includes the following steps: Add the SM9 Key Generation Center component to the OpenStack cloud platform; Create a virtual machine and obtain its identification information; Obtain the user's private key corresponding to the virtual machine and inject the user's private key into the virtual machine; Start the key management module and load the user's private key into the key management module; The client initiates a login request; Establish an encrypted tunnel; The client sends its username and password to the server. After the server verifies the username and password, it calls the key management module's interface to sign the virtual machine identification information and send it to the client. The client uses the virtual machine identification information to verify the signature. If the signature verification is successful, the virtual machine authentication is successful, and a network protocol connection is established. The method for creating a virtual machine and obtaining virtual machine identification information in the step described herein is as follows: Create a virtual machine on the OpenStack cloud platform and send the virtual machine key generation command and virtual machine identification information to the SM9 key generation center through a message queue; The method for obtaining the user's private key corresponding to the virtual machine and injecting the user's private key into the virtual machine is as follows: Modify the crypto.py file in the OpenStack nova source code to add support for the SM9 identifier encryption algorithm; The SM9 Key Generation Center generates a user private key using the virtual machine identification information as an identifier, and obtains the user private key corresponding to the virtual machine. The Cloud-init process code was modified to allow Cloud-init to obtain the user's private key corresponding to the virtual machine from the SM9 key generation center and inject the user's private key into the virtual machine.

2. The method for rapid virtual machine authentication based on the SM9 OpenStack platform according to claim 1, characterized in that, The method for starting the startup key management module and loading the user's private key into the key management module is as follows: Start the virtual machine created on the OpenStack cloud platform. When the virtual machine starts, the key management module will also start automatically. The virtual machine will load the user's private key into the key management module.

3. The method for rapid virtual machine authentication based on the SM9 OpenStack platform according to claim 1, characterized in that, The method for establishing an encrypted tunnel in the aforementioned steps is as follows: Step S161: The server and the client establish a session. The server sends the algorithms it supports to the client. The client compares the algorithms it supports with the algorithms supported by the server. The client and the server then determine and negotiate the required algorithms. Step S162: The server uses the DH algorithm to negotiate a session key with the client through a session to establish an encrypted tunnel.

4. The method for rapid virtual machine authentication based on the SM9 OpenStack platform according to claim 3, characterized in that: Before step S161, the following steps are also included: Step S161-1: Modify the ssh-keyscan.c and sshconnect2.c files in the OpenSSH source code to add the SM2 identifier.

5. The method for rapid virtual machine authentication based on the SM9 OpenStack platform according to claim 1, characterized in that, After the server verifies the username and password, it calls the interface of the key management module to sign the virtual machine identification information and send it to the client. The specific operation is as follows: Modify the OpenSSH source code to add a server-side authentication method based on SM9; The server verifies the username and password. The server calls the key management module's interface to sign the virtual machine identification information; The server sends the signed virtual machine identification information to the client.

6. The method for rapid virtual machine authentication based on the SM9 OpenStack platform according to claim 1, characterized in that: The key generation center is located within the encryption device.

7. The method for rapid virtual machine authentication based on the SM9 OpenStack platform according to claim 1, characterized in that: The virtual machine identification information is either the virtual machine IP address or the virtual machine network card MAC address.

8. The method for rapid virtual machine authentication based on the SM9 OpenStack platform according to claim 1, characterized in that: The key management module has an interface in Python or Java.

Images