A cloud cryptographic machine virtual machine live migration method

Abstract

The application discloses a kind of cloud cryptographic machine virtual machine hot migration method, cloud cryptographic machine has the physical cryptographic card of supporting SR-IOV virtualization technology, when creating virtual machine, physical cryptographic card virtually comes out virtual cryptographic card by SR-IOV virtualization technology, virtual cryptographic card is transmitted to the inside of virtual machine, to generate, save virtual cryptographic machine key;Physical cryptographic card virtually comes out a special virtual cryptographic card node, the node is managed to other virtual cryptographic card, export, import virtual machine key by the node;Using automatic snapshot technology, the running state of virtual machine is backed up regularly;When virtual machine migrates, using automatic snapshot technology realizes the migration of running state;Using shared storage technology realizes the image migration of source virtual machine and target virtual machine.The application can realize the hot migration of virtual cryptographic machine, guarantee the continuity of network and service in migration process, and the whole migration process is transparent and non-perception to user or application.

Description

Technical Field

[0001] This invention relates to the field of virtual machine hot migration technology, and more specifically to a method for hot migration of cloud cryptographic machine virtual machines. Background Technology

[0002] Virtualization technology forms the foundation of the rapidly developing cloud cryptographic machines. The core of virtualization is efficient resource scheduling and management. Through virtualization, hardware costs can be effectively reduced and resources can be allocated flexibly. Based on the advantages of virtualization—rapid deployment and on-demand use—cloud cryptographic machines are gradually replacing traditional cryptographic machines and are being used more and more widely in the cryptography industry.

[0003] Various cryptographic machine manufacturers utilize different virtualization technologies to virtualize their machines. Among them, SR-IOV virtualization technology offers the best isolation and is widely recognized in the industry. Virtual machine migration technology refers to restoring the data and operating state of one virtual machine to another, primarily used for balancing physical machine resource load or for disaster recovery and backup scenarios involving both physical and virtual machines.

[0004] Currently, there are two main methods for migrating virtual cryptographic machines:

[0005] 1) Offline manual migration: This is a "stop and copy" migration mode. It involves manually backing up the source cryptographic machine key and data using secure storage media, finding idle virtual machines with low load, manually restoring the key and data from the secure storage media to the target virtual machine, and releasing the source virtual machine to reduce the load on the source host.

[0006] 2) Online automatic cold migration: Back up the source virtual machine key and data using the control protocol, and restore the key and data to the target virtual machine using the control protocol.

[0007] Both of the above methods require restarting the virtual machine or reloading the key and data, which means that the user's business will be interrupted for a certain period of time. This cannot achieve the ideal effect of smooth virtual machine operation during the migration process and users not being able to perceive any difference.

[0008] Therefore, how to provide a virtual machine migration method that can achieve network and service continuity during the migration process is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0009] In view of this, the present invention provides a method for hot migration of cloud cryptographic machine virtual machines, which can realize hot migration of virtual cryptographic machines, ensure the continuity of network and services during the migration process, and the entire migration process is transparent and imperceptible to users or applications, greatly enhancing the high availability and load balancing capabilities of the cloud cryptographic machine system, and solving the drawbacks of service interruption during the migration process of existing technologies.

[0010] To achieve the above objectives, the present invention adopts the following technical solution:

[0011] A method for hot migration of cloud cryptographic machine virtual machines includes:

[0012] The physical cryptographic card uses SR-IOV virtualization technology to create a virtual cryptographic card and a virtual key management cryptographic card. The virtual cryptographic card and the virtual key management cryptographic card are then passed through to the virtual machine of the corresponding cloud cryptographic machine. The virtual cryptographic card is used to generate and store virtual machine keys, and the virtual key management cryptographic card manages the virtual cryptographic cards in each cloud cryptographic machine.

[0013] Encrypt and sign the key in the virtual machine, and back it up to the corresponding virtual password card periodically;

[0014] Regularly back up the images of each virtual machine and record image summaries;

[0015] The cloud cryptographic machine where the virtual machine to be hot-migrated resides is used as the source cloud cryptographic machine, and the virtual machine to be hot-migrated is used as the source virtual machine. The running status of the source virtual machine in the source cloud cryptographic machine is backed up regularly based on automatic snapshot technology.

[0016] Before automatic migration, the source virtual machine recalculates the image digest value, compares whether the image digest value has changed, and if it has changed, updates the image digest value and the image.

[0017] Obtain the target cloud cryptographic machine within the cluster, and find the virtual machine that is idle and has the same image ID as the source virtual machine in the target cloud cryptographic machine as the destination virtual machine;

[0018] Based on shared storage technology, the image of the source virtual machine is shared to the target cloud cryptographic machine. The image digest value is calculated to see if it has changed. If they are consistent, the image in the shared storage area is copied to the target virtual machine.

[0019] The virtual key management cryptographic card of the Yuanyun cryptographic machine decrypts the backup key and verifies the signature. After the signature verification is successful, the decrypted backup key is imported into the target virtual machine.

[0020] The source virtual machine was successfully migrated by restoring a snapshot of its running state using automatic snapshot technology.

[0021] Preferably, the process of acquiring the target cloud cryptographic machine within the cluster is as follows:

[0022] Obtain the resource utilization rate of all cloud cryptographic machine host machines in the cluster, sort the host machines that have not reached the upper limit threshold, and find the host machine with the lowest resource utilization rate as the target cloud cryptographic machine.

[0023] Preferably, the process also includes freezing and deleting the source virtual machine after the migration is complete, releasing the source virtual machine resources, recalculating the resource utilization rates of the source cloud cryptographic machine and the target cloud cryptographic machine, and updating them in the database.

[0024] Preferably, encryption and decryption are performed using digital envelope technology.

[0025] Preferably, the image includes a program, configuration file, and key, and the running status includes, but is not limited to, disk data, I / O data, network data, process data, and task data.

[0026] Preferably, it further includes: if there is no idle virtual machine in the target cloud cryptographic machine that has the same image ID as the source virtual machine, then create an idle virtual machine in the target cloud cryptographic machine that has the same image ID as the source virtual machine.

[0027] The present invention has the following effects:

[0028] 1) Use SR-IOV virtualization technology to virtualize the cryptographic card. The virtual cryptographic card enables key backup, enhancing the security of key storage and recovery.

[0029] 2) Use the virtual key management cryptographic card node to uniformly manage the virtual cryptographic cards of the source virtual machine and the destination virtual machine. Import and export keys through this node to save management expenses and increase key security.

[0030] 3) Use automatic snapshot technology to save the memory state of the source virtual machine. After the virtual machine is migrated, the memory state is restored to the destination virtual machine, and the tasks that were not completed by the source virtual machine are continued to be executed, so as to achieve uninterrupted business.

[0031] 4) Use shared storage technology during virtual machine image migration to enable the source virtual machine and the destination virtual machine to efficiently transfer and share data. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0033] Figure 1 The attached figure is a schematic diagram of a cloud cryptographic machine virtual machine hot migration method provided by the present invention.

[0034] Figure 2 The attached figure is a system schematic diagram corresponding to the cloud cryptographic machine virtual machine hot migration method provided by the present invention. Detailed Implementation

[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] This invention discloses a method for hot migration of cloud cryptographic machine virtual machines, such as... Figure 1 As shown, it includes:

[0037] S1: When creating a virtual machine, the physical cryptographic card uses SR-IOV virtualization technology to create a virtual cryptographic card and a virtual key management cryptographic card. The virtual cryptographic card and the virtual key management cryptographic card are then passed through to the virtual machine of the corresponding cloud cryptographic machine. The virtual cryptographic card is used to generate and store virtual machine keys, and the virtual key management cryptographic card manages the virtual cryptographic cards in each cloud cryptographic machine.

[0038] S2: Encrypt and sign the key in the virtual machine, and back it up to the corresponding virtual password card at regular intervals. The regular backup interval can be configured using the management system in this invention. The backup key is encrypted and signed using an envelope.

[0039] S3: Regularly back up images of each virtual machine and record image summaries. The images contain important data such as programs, configuration files, and keys in the virtual machine.

[0040] S4: As Figure 2 As shown, the cloud cryptographic machine where the virtual machine to be hot-migrated resides is used as the source cloud cryptographic machine, and the virtual machine to be hot-migrated is used as the source virtual machine. Automatic snapshot technology is used to back up the running status of the virtual machine in the source cloud cryptographic machine at regular intervals. The running status includes, but is not limited to, data such as disk, I / O, network, processes, and tasks.

[0041] S5: Before automatic migration, the source virtual machine regenerates the image summary value and compares it with the image summary value described in S3. If the summary value has changed, the image is backed up again and the image summary value is updated.

[0042] S6: Obtain the target cloud cryptographic machine within the cluster, and find the virtual machine that is idle and has the same image ID as the source virtual machine in the target cloud cryptographic machine as the destination virtual machine;

[0043] The system searches for an idle virtual machine in the target cloud cryptographic machine that matches the source virtual machine image ID and is used as the target virtual machine. This virtual machine is created using the same base image as the source virtual machine. The idle status of the virtual machine is marked by the management system when creating and allocating the virtual machine. If the target virtual machine does not exist, a virtual machine with the same image as the source virtual machine is created in the target cloud cryptographic machine.

[0044] S7: Use shared storage technology to share the image of the source virtual machine to the target cloud cryptographic machine, calculate the image digest value, and compare it with the digest value in S5 to determine if they are consistent. If they are consistent, copy the image data in the shared storage area to the target virtual machine. If the image digest values ​​are inconsistent, use shared storage technology to share the image of the source virtual machine to the target cloud cryptographic machine again. If they are still inconsistent and the number of sharing attempts exceeds the set number, stop the hot migration of the virtual machine and return an error message.

[0045] S8: The virtual key management cryptographic card of the source cloud cryptographic machine will decrypt the backup key using an envelope and verify the signature. If the signature verification is successful, the decrypted backup key will be imported into the virtual cryptographic card of the target virtual machine.

[0046] S9: Restore the snapshot of the source virtual machine's running state saved in S4 based on automatic snapshot technology. At this point, the source virtual machine migration is successful, and the business achieves seamless connection.

[0047] S10: After the migration is complete, freeze and delete the source virtual machine, release the source virtual machine resources, recalculate the resource utilization of the source cloud cryptographic machine and the target cloud cryptographic machine, and update it to the database.

[0048] Specifically, the process of obtaining the target cloud cryptographic machine within the cluster is as follows:

[0049] Collect the resource utilization rate of all cloud cryptographic machine host machines in the cluster, sort the host machines that have not reached the upper limit threshold, and find the host machine with the lowest resource utilization rate as the target cloud cryptographic machine.

[0050] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0051] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for hot migration of a cloud cryptographic machine virtual machine, characterized in that, include: The physical cryptographic card uses SR-IOV virtualization technology to create a virtual cryptographic card and a virtual key management cryptographic card. The virtual cryptographic card and the virtual key management cryptographic card are then passed through to the virtual machine of the corresponding cloud cryptographic machine. The virtual cryptographic card is used to generate and store virtual machine keys, and the virtual key management cryptographic card manages the virtual cryptographic cards in each cloud cryptographic machine. Encrypt and sign the key in the virtual machine, and back it up to the corresponding virtual password card periodically; Regularly back up the images of each virtual machine and record image summaries; The cloud cryptographic machine where the virtual machine to be hot-migrated resides is used as the source cloud cryptographic machine, and the virtual machine to be hot-migrated is used as the source virtual machine. The running status of the source virtual machine in the source cloud cryptographic machine is backed up regularly based on automatic snapshot technology. Before automatic migration, the source virtual machine recalculates the image digest value, compares whether the image digest value has changed, and if it has changed, updates the image digest value and the image. Obtain the target cloud cryptographic machine within the cluster, and find the virtual machine that is idle and has the same image ID as the source virtual machine in the target cloud cryptographic machine as the destination virtual machine; Based on shared storage technology, the image of the source virtual machine is shared to the target cloud cryptographic machine. The image digest value is calculated to see if it has changed. If they are consistent, the image in the shared storage area is copied to the target virtual machine. The virtual key management cryptographic card of the Yuanyun cryptographic machine decrypts the backup key and verifies the signature. After the signature verification is successful, the decrypted backup key is imported into the target virtual machine. The source virtual machine was successfully migrated by restoring a snapshot of its running state using automatic snapshot technology.

2. The cloud cryptographic machine virtual machine hot migration method according to claim 1, characterized in that, The process of obtaining the target cloud cryptographic machine within the cluster is as follows: Obtain the resource utilization rate of all cloud cryptographic machine host machines in the cluster, sort the host machines that have not reached the upper limit threshold, and find the host machine with the lowest resource utilization rate as the target cloud cryptographic machine.

3. The cloud cryptographic machine virtual machine hot migration method according to claim 1, characterized in that, This also includes freezing and deleting the source virtual machine after the migration is complete, releasing the source virtual machine resources, recalculating the resource utilization of the source cloud cryptographic machine and the target cloud cryptographic machine, and updating it to the database.

4. The cloud cryptographic machine virtual machine hot migration method according to claim 1, characterized in that, Encryption and decryption are performed using digital envelope technology.

5. The cloud cryptographic machine virtual machine hot migration method according to claim 1, characterized in that, The image includes programs, configuration files, and keys, and the running status includes, but is not limited to, disk data, I / O data, network data, process data, and task data.

6. The cloud cryptographic machine virtual machine hot migration method according to claim 1, characterized in that, Also includes: If there is no idle virtual machine with the same image ID as the source virtual machine in the target cloud cryptographic machine, then create an idle virtual machine with the same image ID as the source virtual machine in the target cloud cryptographic machine.

Images