A data encryption protection method based on a trusted virtualization environment

Abstract

The application relates to a data encryption protection method based on a trusted virtualization environment and belongs to the field of data security. The application is based on an asymmetric encryption system, each user holds a public-private key pair, the public key of the user is saved by a trusted virtual machine management end, and the private key is saved by the user himself. A user public key pool and a user virtual machine serial number mapping table are constructed on the trusted virtual machine management end and are used for user identity authentication, data encryption transmission and data encryption storage. The communication between trusted virtual machines of different users needs to pass through the trusted virtual machine management end for identity authentication and then establish a communication connection. Under the mechanism, the user private key is self-managed, the security storage pressure faced by the key management system in the traditional method is reduced, and comprehensive encryption protection is provided for user shared data, user private data and communication data between virtual machines in the trusted virtualization environment.

Description

Technical Field

[0001] This invention belongs to the field of data security, specifically relating to a data encryption and protection method based on a trusted virtualization environment. Background Technology

[0002] While virtualization technology facilitates the sharing of server resources, it also introduces more severe security threats. In particular, the large-scale sharing of data in virtualized environments and the geographically dispersed storage of user data make them vulnerable to cyberattacks, posing a significant challenge to data security. In trusted virtualization environments, shared user data and private user data in cloud storage are key areas for protection, and the encryption and protection of communication data between user virtual machines is also crucial. Common methods address data security issues based on user identity characteristics, focusing on data encryption and decryption, key management, access control, and transmission security.

[0003] An existing data protection method and system for a trusted cloud environment. When data is generated, the user, application system, and platform system sequentially encrypt the data using their respective encryption keys. When the data is used, it is decrypted in the reverse order to restore the data to its visible state. The system's design philosophy is to encapsulate the data in a three-layer container; data can only be used if the triple encryption and decryption conditions are met, thus fully ensuring data security. This triple encryption mechanism based on the user, application system, and platform system can solve the problem of secure data interaction between the user's virtual machine application system and the platform system, but it does not protect communication data between different user virtual machines. Furthermore, this multi-key data encryption method also adds new challenges to key management.

[0004] Another method and system for end-to-end data encryption protection for big data platforms exists. This system includes an encryption / decryption algorithm module, a key management system, and big data components. When the big data component sends an encryption / decryption request to the encryption / decryption algorithm module, the module retrieves the key from the key management system to complete the encryption / decryption request. This end-to-end data encryption protection method for big data platforms relies on the key management system for authentication, ensuring data is not used by unauthorized users. However, the key management system presents significant security challenges, and the transmission of keys between the key management system and the encryption / decryption algorithm module is not encrypted, posing a risk of key interception. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] The technical problem to be solved by this invention is how to provide a data encryption protection method based on a trusted virtualization environment to solve the problem of key management difficulties in the prior art.

[0007] (II) Technical Solution

[0008] To address the aforementioned technical problems, this invention proposes a data encryption protection method based on a trusted virtualization environment. This method is based on a data encryption protection system, which comprises four parts: a client, a trusted virtual machine management terminal, a trusted virtual machine, and cloud storage. The method includes the following steps:

[0009] S11. The user virtual machine initiates a data storage or read request to the trusted virtual machine management terminal; there are four types of data request: shared data storage request, shared data read request, private data storage request, and private data read request;

[0010] S12. The trusted virtual machine management terminal determines whether a user's virtual machine request is a storage service or a read service by using the service identifier.

[0011] S13. The trusted virtual machine management terminal determines whether the data is shared or private based on the data type identifier.

[0012] S14. The trusted virtual machine management terminal performs corresponding storage or retrieval operations based on the business identifier and data type identifier;

[0013] S15. For data reading services, after the user's virtual machine receives the encrypted data, it uses the user's private key to decrypt it.

[0014] S16. The data storage / reading interaction between the user virtual machine and the trusted virtual machine management terminal ends.

[0015] Furthermore, the data encryption protection system is based on an asymmetric encryption system for data encryption and identity authentication; each user needs a public-private key pair, and the trusted virtual machine management terminal also has the management terminal's public-private key pair; the public key is responsible for data encryption and identity authentication, and the private key is responsible for data decryption and digital signature. The trusted virtual machine management terminal also stores the public keys of all users, thus constructing a user public key pool.

[0016] Furthermore, users initiate virtual machine creation, shutdown, and restart requests to the trusted virtual machine management terminal via the client. Each user can own multiple trusted virtual machines, each with a unique serial number for identification. A user's public key and the serial numbers of the multiple trusted virtual machines they create form a virtual machine serial number mapping table, which is stored on the trusted virtual machine management terminal. The trusted virtual machine management terminal can find all the virtual machines created by a user in the virtual machine serial number mapping table using the user's public key. The trusted virtual machine management terminal is the system's data relay station, responsible for receiving and distributing data. When the trusted virtual machine management terminal receives a data storage or retrieval request, it encrypts and stores the data in cloud storage or retrieves the relevant data from cloud storage. The trusted virtual machine management terminal also manages the establishment of communication between trusted virtual machines of different users, verifies the user identities of two trusted virtual machines, and forwards the communication establishment method.

[0017] Furthermore, in step S11, the data storage encryption method is as follows:

[0018] Shared data storage request: The user virtual machine encrypts the data using the public key of the trusted virtual machine management terminal and sends it to the trusted virtual machine management terminal;

[0019] Private data storage request: The user's virtual machine uses its own public key to encrypt private data and sends it to the trusted virtual machine management terminal.

[0020] Furthermore, in S14, the processing methods for each service are as follows:

[0021] Shared data storage service: The trusted virtual machine management terminal stores shared data, which has been encrypted with the public key of the trusted virtual machine management terminal, into the cloud storage data center;

[0022] Private data storage service: The user's virtual machine uses the user's public key to encrypt the generated private data, and uses the combination hash of the user's public key and timestamp as the key of the private data, and sends it to the trusted virtual machine management terminal in key-value format. After receiving the data, the trusted virtual machine management terminal also stores it in cloud storage in key-value format.

[0023] Shared data reading service: The trusted virtual machine management terminal reads encrypted data from the cloud storage data center, decrypts it using the private key of the trusted virtual machine management terminal, and then encrypts the data using the user's public key. The encrypted data is then sent to the requesting user's virtual machine, ensuring that the data is encrypted during both transmission processes.

[0024] Private data reading service: When a user's virtual machine reads private data in cloud storage, it needs to encrypt the key value used to store the private data using the public key of the trusted virtual machine management terminal and send it to the trusted virtual machine management terminal. After receiving the encrypted key value, the trusted virtual machine management terminal decrypts it using its own private key, indexes the corresponding private data from the cloud storage using the key, and sends it back to the user's virtual machine.

[0025] This invention also provides a data encryption protection method based on a trusted virtualization environment. This method is based on a data encryption protection system, which includes four parts: a client, a trusted virtual machine management terminal, a trusted virtual machine, and cloud storage. The method includes the following steps:

[0026] S21. Trusted Virtual Machine 1 requests the Trusted Virtual Machine Management Terminal to establish a communication connection with Trusted Virtual Machine 2;

[0027] S22. The trusted virtual machine management terminal performs identity authentication on virtual machine 1 and virtual machine 2;

[0028] S23. Determine the identity authentication result;

[0029] If there is an authentication problem with either Virtual Machine 1 or Virtual Machine 2, the inter-virtual machine communication establishment process will end; if there is no authentication problem, the process will continue.

[0030] S24. The trusted virtual machine management terminal sends the identity authentication information and communication establishment method of virtual machine 1 to virtual machine 2.

[0031] The trusted virtual machine management terminal uses the user's public key of virtual machine 2 to encrypt the identity authentication information and communication establishment method of virtual machine 1, and uses the private key of the virtual machine management terminal to perform digital signature to prevent data from being replaced.

[0032] S25. After receiving the message, virtual machine 2 first verifies it and then decrypts it, and chooses when to establish a connection based on its own application situation.

[0033] Virtual machine 2 uses the public key of the management terminal to verify messages, and then uses its own private key to decrypt the data, saves the communication establishment method with virtual machine 1, and decides when to establish communication with virtual machine 1.

[0034] S26. Virtual machine 2 uses the public key of virtual machine 1 to encrypt data and sends it to virtual machine 1;

[0035] S27. Virtual machine 1 uses the user's public key of virtual machine 2 to encrypt the response message and complete the establishment of the communication connection.

[0036] Furthermore, the data encryption protection system is based on an asymmetric encryption system for data encryption and identity authentication; each user needs a public-private key pair, and the trusted virtual machine management terminal also has the management terminal's public-private key pair; the public key is responsible for data encryption and identity authentication, and the private key is responsible for data decryption and digital signature. The trusted virtual machine management terminal also stores the public keys of all users, thus constructing a user public key pool.

[0037] Furthermore, users initiate virtual machine creation, shutdown, and restart requests to the trusted virtual machine management terminal via the client. Each user can own multiple trusted virtual machines, each identified by a unique serial number. A user's public key and the serial numbers of the multiple trusted virtual machines they create form a virtual machine serial number mapping table, stored on the trusted virtual machine management terminal. The trusted virtual machine management terminal can find all the virtual machines created by a user in the virtual machine serial number mapping table using the user's public key. The trusted virtual machine management terminal acts as the system's data relay station, responsible for receiving and distributing data. When the trusted virtual machine management terminal receives a data storage or retrieval request, it encrypts and stores the data in cloud storage or retrieves relevant data from cloud storage. The trusted virtual machine management terminal also manages the communication establishment between trusted virtual machines of different users, verifies the user identities of the two trusted virtual machines, and forwards the communication establishment method.

[0038] Furthermore, S21 specifically includes: the trusted virtual machine 1 packages its own and virtual machine 2's serial numbers, user public keys, and communication establishment methods into a package, encrypts the data using the public key of the trusted virtual machine management terminal, and digitally signs it using its own private key to prevent the data packet from being replaced.

[0039] Further, step S22 specifically includes: after receiving the message, the trusted virtual machine management terminal verifies the message using the public key of virtual machine 1, then decrypts it using the private key of the management terminal, and authenticates the identities of virtual machine 1 and virtual machine 2 through the user public key pool and virtual machine serial number mapping table of the trusted virtual machine management terminal.

[0040] (III) Beneficial Effects

[0041] This invention proposes a data encryption protection method based on a trusted virtualization environment. Based on an asymmetric encryption system, each user holds a public-private key pair. The user's public key is stored by the trusted virtual machine management terminal, while the user keeps their private key. A user public key pool and a user virtual machine serial number mapping table are constructed on the trusted virtual machine management terminal for user authentication, encrypted data transmission, and encrypted data storage. Communication between trusted virtual machines of different users requires authentication through the trusted virtual machine management terminal before establishing a communication connection. Under this mechanism, user private keys are self-managed, reducing the security storage pressure on key management systems in traditional methods; and it provides comprehensive encryption protection for user-shared data, user-private data, and inter-virtual machine communication data in the trusted virtualization environment. Attached Figure Description

[0042] Figure 1 This is a system architecture diagram of the present invention;

[0043] Figure 2 This is a flowchart illustrating an embodiment of the data security transmission of the present invention.

[0044] Figure 3 A flowchart illustrating an embodiment of establishing communication between virtual machines of different users according to the present invention. Detailed Implementation

[0045] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0046] The purpose of this invention is to propose a data encryption protection method in a trusted virtualization environment, which aims to solve the problem of key management difficulties in common methods, and to provide comprehensive encryption protection for data between user virtual machines and the platform, as well as between different user virtual machines.

[0047] Figure 1 This is a system architecture diagram of the present invention. (For example...) Figure 1 As shown, the data encryption protection system of the present invention includes four parts: a client, a trusted virtual machine management terminal, a trusted virtual machine, and cloud storage.

[0048] The data encryption and protection system is based on an asymmetric encryption architecture for data encryption and authentication. Each user requires a public-private key pair, and the trusted virtual machine management terminal also possesses its own public-private key pair. The public key is responsible for data encryption and authentication, while the private key is responsible for data decryption and digital signatures. The trusted virtual machine management terminal also stores the public keys of all users, constructing a user public key pool. Users can initiate requests to the trusted virtual machine management terminal through a client to create, shut down, or restart virtual machines. Each user can own multiple trusted virtual machines, each with a unique serial number for identification. A user's public key and the serial numbers of the multiple trusted virtual machines they create form a virtual machine serial number mapping table, stored on the trusted virtual machine management terminal. The trusted virtual machine management terminal can find all the virtual machines created by a user in the virtual machine serial number mapping table using the user's public key. The trusted virtual machine management terminal acts as the system's data relay station, responsible for receiving and distributing data. When the trusted virtual machine management terminal receives a data storage or retrieval request, it encrypts and stores the data in cloud storage or retrieves relevant data from cloud storage. The trusted virtual machine management terminal also manages the establishment of communication between trusted virtual machines of different users, verifies the user identities of two trusted virtual machines, and forwards the communication establishment method.

[0049] Figure 2 This is a flowchart illustrating an embodiment of the data security transmission of the present invention. Data transmission in a trusted virtualization environment is divided into two scenarios: one is the storage and retrieval of shared data by the user in cloud storage, and the other is the storage and retrieval of private data by the user in cloud storage. The encryption protection steps for data transmission in this invention are as follows:

[0050] S11. The user virtual machine initiates a data storage or read request to the trusted virtual machine management terminal. There are four types of data requests: shared data storage request, shared data read request, private data storage request, and private data read request. The data storage encryption method is as follows:

[0051] Shared data storage request: The user virtual machine encrypts the data using the public key of the trusted virtual machine management terminal and sends it to the trusted virtual machine management terminal.

[0052] Private data storage request: The user's virtual machine uses its own public key to encrypt private data and sends it to the trusted virtual machine management terminal.

[0053] S12. The trusted virtual machine management terminal determines whether a user's virtual machine request is a storage service or a read service by using the service identifier.

[0054] S13. The trusted virtual machine management terminal determines whether the data is shared or private based on the data type identifier.

[0055] S14. The trusted virtual machine management terminal performs corresponding storage or retrieval operations based on the business identifier and data type identifier.

[0056] Shared data storage service: The trusted virtual machine management terminal stores shared data, which has been encrypted with the public key of the trusted virtual machine management terminal, into the cloud storage data center.

[0057] Private data storage service: User virtual machines use the user's public key to encrypt the generated private data, and use the combined hash of the user's public key and timestamp as the key of the private data, which is sent to the trusted virtual machine management terminal in key-value format. After receiving the data, the trusted virtual machine management terminal also stores it in cloud storage in key-value format.

[0058] Shared data reading service: The trusted virtual machine management terminal reads encrypted data from the cloud storage data center, decrypts it using the trusted virtual machine management terminal's private key, then encrypts the data using the user's public key, and sends the encrypted data to the requesting user's virtual machine, ensuring that the data is encrypted during both transmission processes.

[0059] Private data reading service: When a user's virtual machine reads private data in cloud storage, it needs to encrypt the key value used to store the private data using the public key of the trusted virtual machine management terminal and send it to the trusted virtual machine management terminal. After receiving the encrypted key value, the trusted virtual machine management terminal decrypts it using its own private key, indexes the corresponding private data from the cloud storage using the key, and sends it back to the user's virtual machine.

[0060] S15. For data reading services, after the user's virtual machine receives the encrypted data, it decrypts it using the user's private key.

[0061] S16. The data storage / reading interaction between the user virtual machine and the trusted virtual machine management terminal ends.

[0062] Figure 3 This is a flowchart illustrating an embodiment of establishing communication between virtual machines of different users according to the present invention. In the trusted virtualization environment of the present invention, establishing communication between two users' virtual machines requires authentication through the trusted virtual machine management terminal and digital signature using a private key to prevent the communication establishment data from being replaced. The specific steps are as follows:

[0063] S21. Trusted Virtual Machine 1 requests the Trusted Virtual Machine Management Terminal to establish a communication connection with Trusted Virtual Machine 2.

[0064] Trusted Virtual Machine 1 packages its own and Virtual Machine 2's serial numbers, user public keys, and communication establishment methods into a package, encrypts the data using the public key of the Trusted Virtual Machine management terminal, and digitally signs it with its own private key to prevent the data packets from being replaced.

[0065] S22. The trusted virtual machine management terminal performs identity authentication on virtual machine 1 and virtual machine 2.

[0066] After receiving the message, the trusted virtual machine management terminal verifies the message using the public key of virtual machine 1, then decrypts it using the private key of the management terminal, and authenticates the identities of virtual machine 1 and virtual machine 2 through the user public key pool and virtual machine serial number mapping table of the trusted virtual machine management terminal.

[0067] S23. Determine the identity authentication result.

[0068] If there is an authentication problem with either Virtual Machine 1 or Virtual Machine 2, the inter-virtual machine communication establishment process will terminate. If there is no authentication problem, the process will continue.

[0069] S24. The trusted virtual machine management terminal sends the identity authentication information and communication establishment method of virtual machine 1 to virtual machine 2.

[0070] The trusted virtual machine management terminal uses the user's public key of virtual machine 2 to encrypt the identity authentication information and communication establishment method of virtual machine 1, and uses the private key of the virtual machine management terminal to perform digital signature to prevent data from being replaced.

[0071] S25. After receiving the message, virtual machine 2 first verifies it and then decrypts it, and then selects the appropriate method to establish a connection based on its own application.

[0072] Virtual machine 2 uses the public key of the management terminal to verify messages, then uses its own private key to decrypt the data, saves the communication establishment method with virtual machine 1, and decides when to establish communication with virtual machine 1.

[0073] S26. Virtual machine 2 uses the public key of virtual machine 1 to encrypt data and sends it to virtual machine 1.

[0074] S27. Virtual machine 1 uses the user's public key of virtual machine 2 to encrypt the response message and complete the establishment of the communication connection.

[0075] This invention is based on an asymmetric encryption system. Each user holds a public-private key pair. The user's public key is stored by the trusted virtual machine management terminal, while the user keeps their private key. A user public key pool and a user virtual machine serial number mapping table are constructed on the trusted virtual machine management terminal for user authentication, encrypted data transmission, and encrypted data storage. Communication between trusted virtual machines of different users requires authentication through the trusted virtual machine management terminal before establishing a communication connection. Under this mechanism, user private keys are self-managed, reducing the security storage pressure on key management systems in traditional methods; and providing comprehensive encryption protection for user-shared data, user-private data, and inter-virtual machine communication data in the trusted virtualization environment.

[0076] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A data encryption protection method based on a trusted virtualization environment, characterized in that, This method is based on a data encryption protection system, which includes four parts: a client, a trusted virtual machine management terminal, a trusted virtual machine, and cloud storage. The method includes the following steps: S11. The user virtual machine initiates a data storage or read request to the trusted virtual machine management terminal; there are four types of data request: shared data storage request, shared data read request, private data storage request, and private data read request; S12. The trusted virtual machine management terminal determines whether a user's virtual machine request is a storage service or a read service by using the service identifier. S13. The trusted virtual machine management terminal determines whether the data is shared or private based on the data type identifier. S14. The trusted virtual machine management terminal performs corresponding storage or retrieval operations based on the business identifier and data type identifier; S15. For data reading services, after the user's virtual machine receives the encrypted data, it uses the user's private key to decrypt it. S16. The data storage / reading interaction between the user virtual machine and the trusted virtual machine management terminal ends; in, This method is based on an asymmetric encryption system. Each user holds a public-private key pair. The user's public key is stored by the trusted virtual machine management terminal, while the user keeps the private key. The trusted virtual machine management terminal constructs a user public key pool and a user virtual machine serial number mapping table for user authentication, encrypted data transmission, and encrypted data storage. Communication between trusted virtual machines of different users requires authentication through the trusted virtual machine management terminal before establishing a communication connection.

2. The data encryption protection method based on a trusted virtualization environment as described in claim 1, characterized in that, The trusted virtual machine management terminal also possesses the public and private key pairs of the management terminal; the public key is responsible for data encryption and identity authentication, and the private key is responsible for data decryption and digital signature. The trusted virtual machine management terminal also stores the public keys of all users and builds a user public key pool.

3. The data encryption protection method based on a trusted virtualization environment as described in claim 2, characterized in that, Users initiate virtual machine creation, shutdown, and restart requests to the trusted virtual machine management terminal through the client. Each user can own multiple trusted virtual machines, and each trusted virtual machine is identified by a unique serial number. A user's public key and the serial numbers of the multiple trusted virtual machines created by that user form a virtual machine serial number mapping table, which is stored in the trusted virtual machine management terminal. The trusted virtual machine management terminal can find all the virtual machines created by a user in the virtual machine serial number mapping table using the user's public key. The trusted virtual machine management terminal is the system's data relay station, responsible for receiving and distributing data. When the trusted virtual machine management terminal receives a data storage or read request, it encrypts and stores the data in cloud storage or reads the relevant data from cloud storage. The trusted virtual machine management terminal also controls the establishment of communication between trusted virtual machines of different users, verifies the user identity of two trusted virtual machines, and forwards the communication establishment method.

4. The data encryption protection method based on a trusted virtualization environment as described in claim 3, characterized in that, In step S11, the data storage encryption method is as follows: Shared data storage request: The user virtual machine encrypts the data using the public key of the trusted virtual machine management terminal and sends it to the trusted virtual machine management terminal; Private data storage request: The user's virtual machine uses its own public key to encrypt private data and sends it to the trusted virtual machine management terminal.

5. The data encryption protection method based on a trusted virtualization environment as described in claim 4, characterized in that, In S14, the processing methods for each service are as follows: Shared data storage service: The trusted virtual machine management terminal stores shared data, which has been encrypted with the public key of the trusted virtual machine management terminal, into the cloud storage data center; Private data storage service: The user's virtual machine uses the user's public key to encrypt the generated private data, and uses the combination hash of the user's public key and timestamp as the key of the private data, and sends it to the trusted virtual machine management terminal in key-value format. After receiving the data, the trusted virtual machine management terminal also stores it in cloud storage in key-value format. Shared data reading service: The trusted virtual machine management terminal reads encrypted data from the cloud storage data center, decrypts it using the private key of the trusted virtual machine management terminal, and then encrypts the data using the user's public key. The encrypted data is then sent to the requesting user's virtual machine, ensuring that the data is encrypted during both transmission processes. Private data reading service: When a user's virtual machine reads private data in cloud storage, it needs to encrypt the key value used to store the private data using the public key of the trusted virtual machine management terminal and send it to the trusted virtual machine management terminal. After receiving the encrypted key value, the trusted virtual machine management terminal decrypts it using its own private key, indexes the corresponding private data from the cloud storage using the key, and sends it back to the user's virtual machine.

6. A data encryption protection method based on a trusted virtualization environment, characterized in that, This method is based on a data encryption protection system, which includes four parts: a client, a trusted virtual machine management terminal, a trusted virtual machine, and cloud storage. The method includes the following steps: S21. Trusted Virtual Machine 1 requests the Trusted Virtual Machine Management Terminal to establish a communication connection with Trusted Virtual Machine 2; S22. The trusted virtual machine management terminal performs identity authentication on virtual machine 1 and virtual machine 2; S23. Determine the identity authentication result; If there is an authentication problem with either Virtual Machine 1 or Virtual Machine 2, the inter-virtual machine communication establishment process will end; if there is no authentication problem, the process will continue. S24. The trusted virtual machine management terminal sends the identity authentication information and communication establishment method of virtual machine 1 to virtual machine 2. The trusted virtual machine management terminal uses the user's public key of virtual machine 2 to encrypt the identity authentication information and communication establishment method of virtual machine 1, and uses the private key of the virtual machine management terminal to perform digital signature to prevent data from being replaced. S25. After receiving the message, virtual machine 2 first verifies it and then decrypts it, and chooses when to establish a connection based on its own application situation. Virtual machine 2 uses the public key of the management terminal to verify messages, and then uses its own private key to decrypt the data, saves the communication establishment method with virtual machine 1, and decides when to establish communication with virtual machine 1. S26. Virtual machine 2 uses the public key of virtual machine 1 to encrypt data and sends it to virtual machine 1; S27. Virtual machine 1 uses the user's public key of virtual machine 2 to encrypt the response message and complete the establishment of the communication connection. in, This method is based on an asymmetric encryption system. Each user holds a public-private key pair. The user's public key is stored by the trusted virtual machine management terminal, while the user keeps the private key. The trusted virtual machine management terminal constructs a user public key pool and a user virtual machine serial number mapping table for user authentication, encrypted data transmission, and encrypted data storage. Communication between trusted virtual machines of different users requires authentication through the trusted virtual machine management terminal before establishing a communication connection.

7. The data encryption protection method based on a trusted virtualization environment as described in claim 6, characterized in that, The trusted virtual machine management terminal also possesses the public and private key pairs of the management terminal; the public key is responsible for data encryption and identity authentication, and the private key is responsible for data decryption and digital signature. The trusted virtual machine management terminal also stores the public keys of all users and builds a user public key pool.

8. The data encryption protection method based on a trusted virtualization environment as described in claim 7, characterized in that, Users initiate virtual machine creation, shutdown, and restart requests to the trusted virtual machine management terminal through the client. Each user can own multiple trusted virtual machines, and each trusted virtual machine is identified by a unique serial number. A user's public key and the serial numbers of the multiple trusted virtual machines created by that user form a virtual machine serial number mapping table, which is stored in the trusted virtual machine management terminal. The trusted virtual machine management terminal can find all the virtual machines created by a user in the virtual machine serial number mapping table using the user's public key. The trusted virtual machine management terminal is the system's data relay station, responsible for receiving and distributing data. When the trusted virtual machine management terminal receives a data storage or read request, it encrypts and stores the data in cloud storage or reads the relevant data from cloud storage. The trusted virtual machine management terminal also controls the establishment of communication between trusted virtual machines of different users, verifies the user identity of two trusted virtual machines, and forwards the communication establishment method.

9. The data encryption protection method based on a trusted virtualization environment as described in claim 8, characterized in that, S21 specifically includes: Trusted Virtual Machine 1 packages its own and Virtual Machine 2's serial numbers, user public keys, and communication establishment methods into a package, encrypts the data using the public key of the Trusted Virtual Machine Management Terminal, and digitally signs it using its own private key to prevent the data packet from being replaced.

10. The data encryption protection method based on a trusted virtualization environment as described in claim 9, characterized in that, Step S22 specifically includes: after receiving the message, the trusted virtual machine management terminal verifies the message using the public key of virtual machine 1, then decrypts it using the private key of the management terminal, and authenticates the identities of virtual machine 1 and virtual machine 2 through the user public key pool and virtual machine serial number mapping table of the trusted virtual machine management terminal.

Images