A method for building a kvm virtual machine migration channel encryption based on a national secret algorithm

Abstract

The application discloses a method for building a kvm virtual machine migration channel encryption based on a national secret algorithm, and comprises the following steps: S1, building a data transmission channel between a first virtual machine management layer of a source host and a second virtual machine management layer of a destination host; S2, configuring a first encryption component layer and a first encryption library of the source host, and configuring a second encryption component layer and a second encryption library of the destination host; S3, building a first transmission channel of the first virtual machine management layer and the first encryption component layer, so that a first national secret algorithm is migrated to the first virtual machine management layer; building a second transmission channel of the first encryption component layer and the first encryption library, so that a second national secret algorithm is migrated to the second virtual machine management layer; S4, building a third transmission channel of the second virtual machine management layer and the second encryption component layer, and building a fourth transmission channel of the second encryption component layer and the second encryption library. The virtual machine migration channel is encrypted by using the national secret algorithm, and the safety of virtual machine information transmission is ensured.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method for encrypting the migration channel of a KVM virtual machine based on Chinese cryptographic algorithms. Background Technology

[0002] As virtualization technology becomes more and more widely used, virtual machines are gradually replacing physical machines to run some services in various fields. As more and more services run on virtual machines, people's requirements for virtual machines are also getting higher and higher. On the one hand, this includes the configuration and performance of virtual machines. On the other hand, the data security of virtual machines is also a very important part of virtualization technology. For the secure transmission of data during the migration of virtual machines, it is necessary to encrypt the virtual machine migration channel. Summary of the Invention

[0003] The purpose of this invention is to solve the problem of low security in virtual machine information transmission. It proposes a method for encrypting the migration channel of a KVM virtual machine based on the national cryptographic algorithm. The national cryptographic algorithm is used to encrypt the virtual machine migration channel, thereby ensuring the security of virtual machine information transmission.

[0004] To achieve the above technical objectives, the present invention provides a method for encrypting the migration channel of a KVM virtual machine based on Chinese cryptographic algorithms, comprising the following steps: S1. Establish a data transmission channel between the first virtual machine management layer of the source host and the second virtual machine management layer of the destination host; S2. Configure the first encryption component layer and the first encryption library of the source host, and configure the second encryption component layer and the second encryption library of the destination host. S3. Construct a first transmission channel between the first virtual machine management layer and the first encryption component layer so that the first national cryptographic algorithm can be migrated to the first virtual machine management layer; construct a second transmission channel between the first encryption component layer and the first encryption library so that the second national cryptographic algorithm can be migrated to the second virtual machine management layer. S4. Construct a third transmission channel between the second virtual machine management layer and the second encryption component layer, and construct a fourth transmission channel between the second encryption component layer and the second encryption library.

[0005] Preferably, the data transmission channel is constructed using any one of the SSH, TCP, or TLS protocols.

[0006] Preferably, the first virtual machine management layer is extended with a first configuration file. The first configuration sub-file includes a certificate directory, a certificate identifier, a certificate structure, and a first information configuration path. The first information configuration path is used to identify the first national cryptographic algorithm obtained by the first transmission channel.

[0007] Preferably, the second virtual machine management layer is extended with a second configuration file, the second configuration sub-file including a certificate directory, a certificate identifier, a certificate structure, and a second information configuration path; the second information configuration path is used to identify the second national cryptographic algorithm obtained by the second transmission channel.

[0008] Preferably, the first encryption library stores a first national cryptographic algorithm.

[0009] Preferably, the second encryption library stores a second national cryptographic algorithm.

[0010] Preferably, both the first and second national cryptographic algorithms include one or more of SM1, SM2, SM3, SM4, SM7, and SM9.

[0011] As a preferred option, after the KVM virtual machine migration channel is set up, perform the following steps: The source host receives the virtual machine migration request issued by the cloud platform and stores the encapsulation information to the first sender of the first virtual machine management layer; The source host establishes a connection with the destination host through a data transmission channel; The source host migrates the first national cryptographic algorithm to the first virtual machine management layer through the first transmission channel; and obtains the identification information of the first national cryptographic algorithm through the first transmission channel; Retrieve the certificate directory, certificate identifier, and certificate structure from the first configuration subfile; The first encryption component layer initializes and verifies the legitimacy of the certificate structure, and performs a handshake verification on the certificate signature. After the certificate handshake is successful, the data transmission channel is encrypted once based on the first national cryptographic algorithm, and the encapsulated information is sent to the second virtual machine management layer through the encrypted data transmission channel.

[0012] The beneficial effects of this invention are as follows: It proposes a method for encrypting the migration channel of a KVM virtual machine based on the national cryptographic algorithm. By using the national cryptographic algorithm to encrypt the virtual machine migration channel, the security of virtual machine information transmission is guaranteed. Attached Figure Description

[0013] Figure 1 This is a flowchart of a method for encrypting the migration channel of a KVM virtual machine based on the national cryptographic algorithm, according to the present invention.

[0014] Figure 2 This is a schematic diagram of the KVM virtual machine information transmission structure of the present invention.

[0015] The markings in the diagram are as follows: 1-Source host, 2-Destination host, 11-First virtual machine management layer, 12-First encryption component layer, 13-First encryption library, 21-Second virtual machine management layer, 22-Second encryption component layer, 23-Second encryption library. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only one preferred embodiment of this invention and are only used to explain this invention. They do not limit the scope of protection of this invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0017] Example: Figure 2 As shown, an information transmission channel is set up between the first virtual machine management layer 11 of the source host 1 and the second virtual machine management layer 21 of the destination host 2. The first encryption component layer 12 interacts with the first encryption library 13, and the first encryption component layer interacts with the first virtual machine management layer; the second encryption component layer 22 interacts with the second encryption library 23, and the second encryption component layer interacts with the second virtual machine management layer; when the source host and the destination host exchange information, the first virtual machine management layer obtains the national cryptographic standard of the first encryption library to encrypt the information transmission channel once, or the second virtual machine management layer obtains the national cryptographic standard of the second encryption library to encrypt the information transmission channel once.

[0018] like Figure 1 As shown, a method for building an encrypted migration channel for a KVM virtual machine based on Chinese cryptographic algorithms includes the following steps: S1. Establish a data transmission channel between the first virtual machine management layer of the source host and the second virtual machine management layer of the destination host; S2. Configure the first encryption component layer and the first encryption library of the source host, and configure the second encryption component layer and the second encryption library of the destination host. S3. Construct a first transmission channel between the first virtual machine management layer and the first encryption component layer so that the first national cryptographic algorithm can be migrated to the first virtual machine management layer; construct a second transmission channel between the first encryption component layer and the first encryption library so that the second national cryptographic algorithm can be migrated to the second virtual machine management layer. S4. Construct a third transmission channel between the second virtual machine management layer and the second encryption component layer, and construct a fourth transmission channel between the second encryption component layer and the second encryption library.

[0019] The data transmission channel can be constructed using any one of the SSH, TCP, or TLS protocols.

[0020] The first virtual machine management layer extends the first configuration file, which includes a certificate directory, a certificate identifier, a certificate structure, and a first information configuration path. The first information configuration path is used to identify the first national cryptographic algorithm obtained through the first transmission channel.

[0021] The second virtual machine management layer extends the second configuration file, which includes a certificate directory, a certificate identifier, a certificate structure, and a second information configuration path. The second information configuration path is used to identify the second national cryptographic algorithm obtained through the second transmission channel.

[0022] The first encryption library stores the first national cryptographic algorithm.

[0023] The second encryption library stores the second national cryptographic algorithm.

[0024] The first national cryptographic algorithm and the second national cryptographic algorithm both include one or more of SM1, SM2, SM3, SM4, SM7, and SM9.

[0025] After the KVM virtual machine migration channel is set up, perform the following steps: The source host receives the virtual machine migration request issued by the cloud platform and stores the encapsulation information to the first sender of the first virtual machine management layer; The source host establishes a connection with the destination host through a data transmission channel; The source host migrates the first national cryptographic algorithm to the first virtual machine management layer through the first transmission channel; and obtains the identification information of the first national cryptographic algorithm through the first transmission channel; Retrieve the certificate directory, certificate identifier, and certificate structure from the first configuration subfile; The first encryption component layer initializes and verifies the legitimacy of the certificate structure, and performs a handshake verification on the certificate signature. After the certificate handshake is successful, the data transmission channel is encrypted once based on the first national cryptographic algorithm, and the encapsulated information is sent to the second virtual machine management layer through the encrypted data transmission channel.

[0026] In this embodiment, when the source host receives a virtual machine migration request from the cloud platform and stores the encapsulated information in the first sending end of the first virtual machine management layer, the encapsulated information needs to be sent to the second virtual machine management layer. To ensure the security of the encapsulated information transmission, the data transmission channel needs to be encrypted once. The first virtual machine management layer retrieves the certificate directory, certificate identifier, and certificate structure from the first configuration subfile. The legality of the certificate is verified by the first encryption component layer. After verification, the first national cryptographic algorithm of the first encryption library is retrieved to encrypt the data transmission channel once. Then, the encapsulated information is transmitted to the second virtual machine management layer through the encrypted data transmission channel, thus ensuring the security of the encapsulated information transmission.

[0027] The specific embodiments described above are preferred embodiments of a method for building a KVM virtual machine migration channel encryption based on the national cryptographic algorithm of the present invention. They are not intended to limit the specific implementation scope of the present invention. The scope of the present invention includes but is not limited to the specific embodiments described above. All equivalent changes made in accordance with the shape and structure of the present invention are within the protection scope of the present invention.

Claims

1. A method for encrypting the migration channel of a KVM virtual machine based on a national cryptographic algorithm, characterized in that, The method first constructs a system architecture for encryption, and then uses the system architecture to perform an encryption migration. The steps for constructing the system architecture include: S1. Establish a data transmission channel between the first virtual machine management layer of the source host and the second virtual machine management layer of the destination host; S2. Configure the first encryption component layer and the first encryption library of the source host, and configure the second encryption component layer and the second encryption library of the destination host. S3. Construct a first transmission channel between the first virtual machine management layer and the first encryption component layer so that the first national cryptographic algorithm can be migrated to the first virtual machine management layer; construct a second transmission channel between the first encryption component layer and the first encryption library so that the second national cryptographic algorithm can be migrated to the second virtual machine management layer. S4. Construct a third transmission channel between the second virtual machine management layer and the second encryption component layer, and construct a fourth transmission channel between the second encryption component layer and the second encryption library; And extend the first configuration file in the first virtual machine management layer. The first configuration file includes a certificate directory, a certificate identifier, a certificate structure, and a first information configuration path. The first information configuration path is used to identify the first national cryptographic algorithm obtained by the first transmission channel. The steps for performing encrypted migration using the system architecture include: The source host receives the virtual machine migration request issued by the cloud platform and stores the encapsulation information to the first sender of the first virtual machine management layer; The source host establishes a connection with the destination host through a data transmission channel; The source host migrates the first national cryptographic algorithm to the first virtual machine management layer through the first transmission channel; and obtains the identification information of the first national cryptographic algorithm through the first transmission channel; Retrieve the certificate directory, certificate identifier, and certificate structure from the first configuration file; The first encryption component layer initializes and verifies the legitimacy of the certificate structure, and performs a handshake verification on the certificate signature. After the certificate handshake is successful, the data transmission channel is encrypted once based on the first national cryptographic algorithm, and the encapsulated information is sent to the second virtual machine management layer through the encrypted data transmission channel.

2. The method for encrypting the migration channel of a KVM virtual machine based on a national cryptographic algorithm according to claim 1, characterized in that, The data transmission channel can be constructed using any one of the SSH, TCP, or TLS protocols.

3. The method for encrypting the migration channel of a KVM virtual machine based on a national cryptographic algorithm according to claim 1, characterized in that, The second virtual machine management layer extends the second configuration file, which includes a certificate directory, a certificate identifier, a certificate structure, and a second information configuration path; the second information configuration path is used to identify the second national cryptographic algorithm obtained through the second transmission channel.

4. The method for encrypting the migration channel of a KVM virtual machine based on a national cryptographic algorithm according to claim 1, characterized in that, The first encryption library stores the first national cryptographic algorithm.

5. The method for encrypting the migration channel of a KVM virtual machine based on a national cryptographic algorithm according to claim 3, characterized in that, The second encryption library stores the second national cryptographic algorithm.

6. A method for encrypting the migration channel of a KVM virtual machine based on a national cryptographic algorithm, as described in claim 5, characterized in that... The first national cryptographic algorithm and the second national cryptographic algorithm both include one or more of SM1, SM2, SM3, SM4, SM7, and SM9.

Images