A cluster creation method for virtualized cryptographic machines

Abstract

The present invention discloses a method for creating a cluster of virtualized cryptographic machines, relating to the field of information security technology. Specifically, the method uses KVM virtualization technology to assign a fixed virtual machine IP address to each virtual server cryptographic machine. The virtual server cryptographic machines and physical server cryptographic machines are bridged via a network bridge to achieve network connectivity between the physical and virtual server cryptographic machines. Furthermore, the virtual cryptographic machines within a cloud server cryptographic machine are divided into multiple virtual machine clusters, and keys are synchronized for the virtual cryptographic machines within the same cluster. In this method for creating a cluster of virtualized cryptographic machines, the number of virtual server cryptographic machines within a cluster can be increased as needed, improving the flexibility of the cluster. Furthermore, only the key information of the virtual server cryptographic machines within the cluster is synchronized, reducing the redundancy of information within the cloud server cryptographic machine and ensuring its security when multiple users frequently switch requests.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a cluster creation method for virtualized cryptographic machines. Background Art

[0002] my country's overall level of informatization continues to improve, and the economy and society are increasingly dependent on it. At the same time, information security incidents are occurring more frequently, creating an increasingly severe information security situation. In recent years, with the rapid development of cloud computing, cloud computing security issues have attracted increasing attention. With the country's increasing emphasis on information security, security in cloud environments is receiving increasing attention. With the widespread application and promotion of cloud computing technology, cloud server cryptographic machines, designed to address the security of cryptographic applications in virtualized environments, have been developed and produced.

[0003] In the existing technology, cloud server cryptographic machines mainly implement the provision of multiple virtual cryptographic machines on a physical cryptographic machine. Each virtual cryptographic machine can provide data encryption / decryption, integrity verification, true random number generation, key generation and management for the application system, maximizing the performance of hardware resources and providing information security services based on domestic cryptographic technology for the application system in the cloud environment. Because the virtual cryptographic machines in the cloud server cryptographic machine that provide data encryption / decryption, integrity verification, true random number generation, key generation and management for the application system are random, all virtual cryptographic machines in the cloud server cryptographic machine need to synchronize information, resulting in a large amount of duplicate information in the cloud server cryptographic machine, low scalability, and increased maintenance costs of the cloud server cryptographic machine. In addition, security is low when multiple users frequently switch requests. Therefore, in the actual use scenarios of virtual server cryptographic machines, designing a method that can provide high-availability and scalable cryptographic operation services to information systems is an urgent need in this field. Summary of the Invention

[0004] The present invention provides a cluster creation method for virtualized cryptographic machines, which solves the problem proposed in the above background technology that cloud server cryptographic machines contain a large amount of redundant information, have low scalability and low security.

[0005] The present invention provides the following technical solution: a cluster creation method for a virtualized cryptographic machine, which uses KVM virtualization technology to assign a fixed virtual machine IP address to each virtual server cryptographic machine, and the virtual server cryptographic machine and the physical server cryptographic machine are bridged through a network bridge to realize the network connection of the physical machine and virtual machine server cryptography, and the virtual cryptographic machines in the cloud server cryptographic machine are divided into multiple virtual machine clusters, and the keys of the virtual cryptographic machines in the same cluster are synchronized.

[0006] A method for creating a cluster of virtualized cryptographic machines comprises the following steps:

[0007] Step 1: The cloud server cryptography machine assigns a fixed virtual machine IP address to each virtual server cryptography machine. In the cloud server cryptography machine WEB management system, add an "Add Cluster" configuration function page, enter the cluster name, port number, and select the IP address of the virtual cryptography machine configured in the cluster.

[0008] Step 2: Use nginx proxy to configure the virtual cipher cluster name, port number, and internal IP address of the virtual cipher in step 1 into the nginx proxy nginx.conf configuration file, and use the ip_hash mode setting in the nginx.conf configuration file;

[0009] Step 3. After all configuration information is configured in the cluster, a cluster information is displayed on the "Cluster Management" page of the cloud server cryptographic machine's web management system. The "Cluster Management" page of the cloud server cryptographic machine's web management system supports operations such as editing cluster information, starting, stopping, and key synchronization. The cluster status of the newly created cluster is "Not Enabled" and the key status is "Not Synchronized";

[0010] Step 4: Synchronize the cluster's key information;

[0011] Step 5: Enable the virtual cryptographic machine cluster;

[0012] Step 6: Use the interface program of the virtual cryptographic machine to configure the cluster's IP and port in the configuration file of the interface program, and test the cryptographic operation service function to ensure that encryption, decryption and other cryptographic operation functions can be performed normally.

[0013] Compared with the prior art, the present invention has the following beneficial effects:

[0014] 1. The cluster creation method of the virtualized cryptographic machine adopts KVM virtualization technology to assign a fixed virtual machine IP address to each virtual server cryptographic machine. The virtual server cryptographic machine and the physical server cryptographic machine are bridged through a network bridge to realize the network connection between the physical machine and the virtual server cryptographic machine.

[0015] 2. The cluster creation method of the virtualized cipher machine can increase the number of virtual server cipher machines in the cluster according to demand, which improves the flexibility of the cluster. Only the key information of the virtual server cipher machines in the cluster is synchronized, which reduces the redundancy of information in the cloud server cipher machines and can ensure its security when multiple users frequently switch requests. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a schematic diagram of the working principle of the present invention. DETAILED DESCRIPTION

[0017] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0018] KVM stands for Kernel-based Virtual Machine, which is a kernel module of Linux that turns Linux into a hypervisor. KVM is an open source Linux-native full virtualization solution based on hardware virtualization extensions (Intel VT-d or AMD-V). In KVM, virtual machines are implemented as regular Linux processes and scheduled by the standard Linux scheduler. Each virtual CPU of the virtual machine is implemented as a regular Linux process. This enables KVM to use the existing functions of the Linux kernel. KVM technology combines the management service of qemu to manage the life cycle of virtual machines. The cloud server cryptography machine encapsulates the management instructions of qemu and presents them to users through the pages of the WEB management system.

[0019] The present invention provides a cluster creation method for virtualized cryptographic machines. The cloud server cryptographic machine in this method uses KVM virtualization technology to assign a fixed virtual machine IP address to each virtual server cryptographic machine, and the virtual server cryptographic machine and the physical server cryptographic machine are bridged through a network bridge to realize the network connection between the physical machine and the virtual machine server cryptographic machine.

[0020] The steps of the cluster creation method of the virtualized cryptographic machine in this application are as follows:

[0021] Step 1: The cloud server cryptography machine uses KVM virtualization technology to assign a fixed virtual machine IP address to each virtual server cryptography machine. The virtual server cryptography machine and the physical server cryptography machine are bridged through a network bridge to achieve network connection between the physical machine and the virtual server cryptography machine. The cloud server cryptography machine WEB management system develops and deploys a set of interface management services for each virtual cryptography machine in the cloud server cryptography machine, providing key backup and key recovery functions;

[0022] Step 2: Add a cluster configuration page in the cloud server cryptography machine WEB management system, add a "Add Cluster" configuration function page, enter the cluster name, port number, and select the IP address of the virtual cryptography machine configured in the cluster. This step can divide the virtual server cryptography machines in the cloud server cryptography machine into multiple clusters. The number of virtual server cryptography machines in the cluster can be selected according to demand, that is, the cluster is scalable;

[0023] Step 2: Use nginx proxy to configure the virtual cipher cluster name, port number, and internal IP address of the virtual cipher in step 1 into the nginx.conf configuration file. To meet the long connection calling method, use the ip_hash mode setting in the nginx.conf configuration file to map the ports of the cryptographic operation service to a cluster and provide external services through the cluster's port.

[0024] Step 3. After all configuration information is configured in the cluster, a cluster information is displayed on the "Cluster Management" page of the cloud server cryptographic machine's WEB management system. The displayed content includes cluster name, port number, IP address information of the included virtual cryptographic machine, cluster status, key synchronization status, synchronization time and other information. The "Cluster Management" page of the cloud server cryptographic machine's WEB management system supports the following operations: editing cluster information, starting, stopping and key synchronization. The cluster status of the newly created cluster is "Not Enabled" and the key status is "Not Synchronized".

[0025] Step 4. Click the "Key Synchronization" button in the "Cluster Management" of the cloud server cryptographic machine's WEB management system, select a virtual cryptographic machine in the cluster, and synchronize the key to other virtual cryptographic machines to synchronize the cluster's key information;

[0026] From the description of the above steps, it can be seen that the key information between the clusters in the cloud server cryptographic machine WEB management system will not be synchronized, while the key information in the virtual cryptographic machines in the same cluster is in a synchronized state, which greatly reduces the information redundancy in the cloud server cryptographic machine, improves the high availability of the cloud server cryptographic machine, and can improve the security of the information in the cloud server cryptographic machine.

[0027] Step 5. Click the "Enable" button to enable the virtual cipher cluster;

[0028] Step 6: Use the interface program of the virtual cryptographic machine to configure the cluster's IP and port in the configuration file of the interface program, and test the cryptographic operation service function to ensure that encryption, decryption and other cryptographic operation functions can be performed normally.

[0029] To sum up: when the virtualized cryptographic machine cluster created through the above steps is in use, the application information system accesses the virtualized cryptographic machines in the cluster through the cluster port. Each virtual cryptographic machine in the accessed cluster can provide data encryption / decryption, integrity verification, true random number generation, key generation and management for the application information system. At the same time, the virtual cryptographic machines in the cluster that have not been accessed do not work, reducing the computing power of the cloud service cryptographic machine WEB management system and improving the computing efficiency of the cloud service cryptographic machine WEB management system. In addition, key information synchronization operations are performed between the virtual cryptographic machines in the cluster, reducing the redundancy of information in the cloud service cryptographic machine WEB management system, and ensuring its security when multiple users frequently switch requests.

[0030] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field. Although the embodiments of the present invention have been shown and described, it is understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for creating a cluster of virtualized cryptographic machines, characterized in that: The following steps are involved: Step 1: The cloud server cryptography machine uses KVM virtualization technology. A fixed virtual machine IP address is assigned to each virtual server cryptography machine. In the cloud server cryptography machine WEB management system, an "Add Cluster" configuration function page is added. On the page, enter the cluster name, port number, and select the IP address of the virtual cryptography machine to be configured in the cluster. Step 2: Use nginx proxy to configure the virtual cipher cluster name, port number, and internal IP address of the virtual cipher in step 1 into the nginx proxy nginx.conf configuration file, and use the ip_hash mode setting in the nginx.conf configuration file; Step 3. After all configuration information is configured in the cluster, a cluster information item is displayed on the "Cluster Management" page of the cloud server cryptographic machine's web management system. The "Cluster Management" page of the cloud server cryptographic machine's web management system supports operations such as editing cluster information, starting, stopping, and synchronizing keys. The newly created cluster status is "Not Enabled" and the key status is "Not Synchronized". Step 4: Synchronize the cluster's key information; Step 5: Enable the virtual cryptographic machine cluster; Step 6: Use the interface program of the virtual cryptographic machine to configure the cluster's IP and port in the configuration file of the interface program, and test the cryptographic operation service function to ensure that encryption and decryption cryptographic operation functions can be performed normally.

2. The method for creating a cluster of virtualized cryptographic machines according to claim 1, wherein: The cluster information displayed in step 3 includes the cluster name, port number, IP address information of the included virtual cipher machine, cluster status, key synchronization status, and synchronization time information.

3. The method for creating a cluster of virtualized cryptographic machines according to claim 1, wherein: The cloud server cryptographic machine WEB management system develops and deploys a set of interface management services for each virtual cryptographic machine in the cloud server cryptographic machine, providing key backup and key recovery functions.

4. The method for creating a cluster of virtualized cryptographic machines according to claim 1, wherein: The operation of cluster key information synchronization in step 4 is: click the "Key Synchronization" button, select a virtual cipher machine in the cluster, and synchronize the key to other virtual cipher machines.

5. The method for creating a cluster of virtualized cryptographic machines according to claim 1, wherein: In step 5, click the "Enable" button to enable the virtual cryptographic machine cluster.

6. The method for creating a cluster of virtualized cryptographic machines according to claim 1, wherein: The purpose of using the ip_hash mode setting in step 2 is to map the ports of the cryptographic operation service to a cluster and provide external services through the cluster's ports.

Images