Method, device, equipment and storage medium for secure communication between virtual machines

Abstract

The embodiments of the present disclosure provide a method and device for secure communication between virtual machines, including: receiving a request from a first virtual machine to establish a session to communicate with a second virtual machine; generating corresponding first signature verification rules and second signature verification rules; sending the first signature verification rule to the first virtual machine to instruct the first virtual machine to sign a data packet based on a private key and send the signed data packet to the second virtual machine; sending the second signature verification rule to the second virtual machine to instruct the second virtual machine to verify the signed data packet based on a public key signature certificate. The present disclosure provides specific signature verification rules for each virtual machine through a newly deployed control platform with a unified signature verification rule management function, thereby achieving reliability and security of data packet transmission between virtual machines.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a method, device, electronic device and storage medium for secure communication between virtual machines. Background Art

[0002] With the continuous development of Internet technology, cloud platforms have been widely used. Virtual machines are one of the most active entities in cloud platforms, with advantages such as resource isolation, resource sharing and rapid deployment. By creating, managing and running virtual machine instances, applications and data can be hosted in the cloud platform.

[0003] Currently, virtual machine data packets transmitted between different virtual machines in the cloud platform are generally transmitted based on the TCP / IP protocol (Transmission Control Protocol / Internet Protocol), which is at risk of being counterfeited, tampered with, or replay attacks. Therefore, how to ensure the security of communication between virtual machines has become an urgent problem to be solved. Summary of the invention

[0004] Embodiments of the present disclosure provide a virtual machine security method, device, electronic device, and storage medium.

[0005] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0006] According to a first aspect of the present disclosure, a method for secure communication between virtual machines is provided, which is applied to a control platform, and includes: receiving a request for establishing a session sent by a first virtual machine to communicate with a second virtual machine; generating corresponding first signature verification rules and second signature verification rules in response to the request for establishing the session; sending the first signature verification rule to the first virtual machine; the first signature verification rule is used to instruct the first virtual machine to sign a data packet based on a pre-stored private key, and send the signed data packet to the second virtual machine; sending the second signature verification rule to the second virtual machine; the second signature verification rule contains a public key signature certificate corresponding to the private key; the second signature verification rule is used to instruct the second virtual machine to verify the signed data packet based on the public key signature certificate.

[0007] In an exemplary embodiment, generating the corresponding first signature verification rule and second signature verification rule includes: obtaining basic information of the first virtual machine and basic information of the second virtual machine; wherein the basic information includes life cycle information and business connection relationship; based on the basic information of the first virtual machine and the basic information of the second virtual machine, determining whether the first virtual machine is allowed to communicate with the second virtual machine; in response to determining that the first virtual machine is allowed to communicate with the second virtual machine, generating the corresponding first signature verification rule and second signature verification rule.

[0008] In an exemplary embodiment, the generating of the corresponding first signature verification rule and the second signature verification rule includes: generating the corresponding access control rule based on the session establishment request, and the basic information of the first virtual machine and the basic information of the second virtual machine; generating the corresponding first signature verification rule and the second signature verification rule based on the access control rule.

[0009] In an exemplary embodiment, the obtaining basic information of the first virtual machine and basic information of the second virtual machine includes: obtaining the basic information of the first virtual machine and basic information of the second virtual machine from a cloud management platform through a customized interface.

[0010] In an exemplary embodiment, the method also includes: the first signature verification rule is also used to instruct the first virtual machine to re-encapsulate the data packet; insert a session counter field into the data packet, and sign the data packet with the session counter field inserted based on the private key; the second signature verification rule is also used to instruct the second virtual machine to perform a first verification on the received data packet based on a standard value corresponding to the session counter field; and perform a second verification on the received data packet based on the public key signature certificate.

[0011] In an exemplary embodiment, the method also includes: receiving a public key sent by the first virtual machine; the public key is generated by the first virtual machine based on the first virtual machine identifier and corresponds to the private key; signing the public key through a public key infrastructure (PKI) to generate the public key signature certificate; and saving a correspondence table between the first virtual machine and the public key signature certificate.

[0012] In an exemplary embodiment, the generating the second signature verification rule includes: searching for the public key signature certificate corresponding to the first virtual machine according to the correspondence table; and generating the second signature verification rule according to the found public key signature certificate.

[0013] According to a second aspect of the present disclosure, a method for secure communication between virtual machines is provided, which is applied to a first virtual machine and includes: sending a request to a control platform to establish a session to communicate with a second virtual machine; receiving a first signature verification rule sent by the control platform; according to the first signature verification rule, signing a data packet based on a pre-stored private key, and sending the signed data packet to the second virtual machine.

[0014] In an exemplary embodiment, the first signature verification rule is generated by the control platform when it determines that the first virtual machine is allowed to communicate with the second virtual machine based on basic information of the first virtual machine and basic information of the second virtual machine; the basic information includes life cycle information and business connection relationship.

[0015] In an exemplary embodiment, signing the data packet based on a pre-stored private key includes: re-encapsulating the data packet based on the first virtual machine, inserting a session counter field into the data packet; and signing the data packet into which the session counter field is inserted using the private key.

[0016] In an exemplary embodiment, the method further includes: generating the corresponding private key and public key based on the first virtual machine identifier; pre-storing the private key, and sending the public key to the control platform.

[0017] According to a third aspect of the present disclosure, a method for secure communication between virtual machines is provided, which is applied to a second virtual machine, including: receiving a second signature verification rule sent by a control platform; the second signature verification rule includes a public key signature certificate corresponding to a private key pre-stored in a first virtual machine; receiving a signed data packet sent by the first virtual machine; the signed data packet is signed by the first virtual machine based on the first signature verification rule sent by the control platform and the private key; and verifying the signed data packet based on the second signature verification rule.

[0018] In an exemplary embodiment, the second signature verification rule is generated by the control platform when it determines that the first virtual machine is allowed to communicate with the second virtual machine based on basic information of the first virtual machine and basic information of the second virtual machine; the basic information includes life cycle information and business connection relationship.

[0019] In an exemplary embodiment, the verification of the signed data packet based on the second signature verification rule includes: performing a first verification on the signed data packet based on a standard value corresponding to a session counter field in the second signature verification rule; and performing a second verification on the signed data packet based on the public key signature certificate in the second signature verification rule.

[0020] In an exemplary embodiment, the first verification is performed on the signed data packet based on the standard value corresponding to the session counter field in the second signature verification rule, including: comparing the actual value of the session counter field in the signed data packet with the standard value corresponding to the session counter field in the second signature verification rule; if the comparison result is that the actual value meets the standard value, it is determined that the first verification of the signed data packet has passed.

[0021] According to a fourth aspect of the present disclosure, there is provided a secure communication device between virtual machines, which is configured on a control platform and includes: a first receiving module, configured to receive a request for establishing a session sent by a first virtual machine to communicate with a second virtual machine; a generating module, configured to generate corresponding first signature verification rules and second signature verification rules in response to the request for establishing a session; a first sending module, configured to send the first signature verification rule to the first virtual machine; the first signature verification rule is used to instruct the first virtual machine to sign a data packet based on a pre-stored private key, and send the signed data packet to the second virtual machine; the second sending module is configured to send the second signature verification rule to the second virtual machine; the second signature verification rule contains a public key signature certificate corresponding to the private key; the second signature verification rule is used to instruct the second virtual machine to verify the signed data packet based on the public key signature certificate.

[0022] According to a fifth aspect of the present disclosure, there is provided a secure communication device between virtual machines, which is configured on a first virtual machine and includes: a third sending module, configured to send a request to a control platform to establish a session to communicate with a second virtual machine; a second receiving module, configured to receive a first signature verification rule sent by the control platform; a signing module, configured to sign a data packet based on a pre-stored private key according to the first signature verification rule, and send the signed data packet to the second virtual machine.

[0023] According to a sixth aspect of the present disclosure, there is provided a secure communication device between virtual machines, which is configured in a second virtual machine and includes: a third receiving module, configured to receive a second signature verification rule sent by a control platform; the second signature verification rule includes a public key signature certificate corresponding to a private key pre-stored in the first virtual machine; a fourth receiving module, configured to receive a signed data packet sent by the first virtual machine; the signed data packet is signed by the first virtual machine based on the first signature verification rule sent by the control platform and the private key; and a verification module, configured to verify the signed data packet based on the second signature verification rule.

[0024] According to the seventh aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; a storage device configured to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the inter-virtual machine secure communication method as described in the above embodiments.

[0025] According to an eighth aspect of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for secure communication between virtual machines as described in the above embodiments is implemented.

[0026] In the above-mentioned secure communication method, apparatus, computer equipment and storage medium between virtual machines, the control platform receives a request from the first virtual machine to establish a session to communicate with the second virtual machine, and then generates first and second signature verification rules corresponding to the request to establish the session, sends the first signature verification rule to the first virtual machine to instruct the first virtual machine to sign the data packet based on the private key; sends the second signature verification rule to the second virtual machine to instruct the second virtual machine to verify the signed data packet based on the public key signature certificate. The present disclosure provides specific signature verification rules for each virtual machine through a newly deployed control platform with a unified signature verification rule management function, so that the first virtual machine as the sender signs the data packet based on the first signature verification rule, and the second virtual machine as the receiver verifies the data packet based on the second signature verification rule, thereby achieving reliability and security of data packet transmission between virtual machines.

[0027] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0029] Figure 1 An application scenario diagram of the method for secure communication between virtual machines in an embodiment of the present disclosure is shown;

[0030] Figure 2 A schematic diagram of a process flow of a secure communication method between virtual machines applied to a control platform in an embodiment of the present disclosure is shown;

[0031] Figure 3 A schematic diagram of a process for generating a first signature verification rule and a second signature verification rule in an embodiment of the present disclosure is shown;

[0032] Figure 4Another schematic diagram of a process for generating a first signature verification rule and a second signature verification rule in an embodiment of the present disclosure is shown;

[0033] Figure 5 A schematic diagram of a process for generating a public key signature certificate in an embodiment of the present disclosure is shown;

[0034] Figure 6 A schematic diagram of a process for generating a second signature verification rule in an embodiment of the present disclosure is shown;

[0035] Figure 7 A schematic diagram of a process of a secure communication method between virtual machines applied to a first virtual machine in an embodiment of the present disclosure is shown;

[0036] Figure 8 A schematic diagram of the process of signing a data packet in an embodiment of the present disclosure is shown;

[0037] Fig. 9 A structural diagram of a signed data packet in an embodiment of the present disclosure is shown;

[0038] Fig.10 A schematic diagram of the process of generating a private key and a public key in an embodiment of the present disclosure is shown;

[0039] Fig.11 A schematic diagram of a process flow of a method for secure communication between virtual machines applied to a second virtual machine in an embodiment of the present disclosure is shown;

[0040] Fig.12 A schematic diagram of a process flow of data packet verification in an embodiment of the present disclosure is shown;

[0041] Fig.13 A schematic diagram showing a flow chart of a method for secure communication between virtual machines in an embodiment of the present disclosure is shown;

[0042] Fig.14 A schematic diagram of the structure of a secure communication device between virtual machines configured on a control platform in an embodiment of the present disclosure is shown;

[0043] Fig.15 A schematic diagram of the structure of a secure communication device between virtual machines configured on a first virtual machine in an embodiment of the present disclosure is shown;

[0044] Fig.16 A schematic diagram of the structure of a secure communication device between virtual machines configured on a second virtual machine in an embodiment of the present disclosure is shown;

[0045] Fig.17 A schematic diagram of the structure of an electronic device suitable for implementing an exemplary embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0046] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0047] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0048] It should be noted that the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present disclosure are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects, and the descriptions of "first" and "second" do not limit the objects to be different.

[0049] The method for secure communication between virtual machines provided in the embodiments of the present disclosure can be applied to Figure 1 In the application environment shown in FIG. 1 , the cloud platform management domain includes the control platform, the cloud management platform and the public key infrastructure (PKI). The cloud platform business domain includes any number of business nodes, and each business node includes any number of virtual machines.

[0050] Specifically, the cloud platform can be a cloud platform scenario such as OpenStack, VMware, etc., and the control platform can be a micro-isolation control platform, including a virtual machine access connection relationship module, a signature verification rule generation module and a policy engine module. Among them, the virtual machine access connection relationship module is connected to the cloud management platform through a customized interface, and obtains and saves the virtual machine life cycle information and access business connection relationship from the cloud management platform. The policy engine module is used to provide policy control management. It is internally connected to the virtual machine access connection relationship module to obtain the virtual machine life cycle information and access business connection relationship, receive the virtual machine session request message externally, perform policy matching calculation, decide whether to allow the sender and receiver to establish a session, and generate access control rules and send them to the signature verification rule generation module. The signature verification rule generation module is responsible for the generation of signature certificates and signature verification rules. The cloud management platform is used to manage the life cycle information and access business connection relationship of each virtual machine. PKI is a framework for managing and distributing digital certificates. It provides a reliable way to verify identity, encrypt data and ensure the security of communication.

[0051] The virtual machine may include a micro-isolation agent. For example, if a micro-isolation agent is installed in each virtual machine, data can be transmitted between different virtual machines through the cloud platform network. The virtual machine serving as the data sender signs the data packet based on the micro-isolation agent, and the virtual machine serving as the data receiver verifies the data packet based on the micro-isolation agent. It can be understood that the virtual machine serving as the data sender and the virtual machine serving as the data receiver can be virtual machines located in the same business node or in different business nodes, and this embodiment does not impose any restrictions on this.

[0052] At present, virtual machine data packets transmitted between different virtual machines in the cloud platform are at risk of being forged, tampered with, or replayed. Each business system deployed on the cloud platform needs to separately configure relevant rules such as data packet signature verification, which makes the reliability and security of virtual machine communication poor.

[0053] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0054] Figure 2 FIG. 1 is a flow chart showing a method for secure communication between virtual machines in a control platform according to an embodiment of the present disclosure. Figure 2 As shown, a method for secure communication between virtual machines is provided in an embodiment of the present disclosure, and the method can be applied to a control platform and can include the following steps.

[0055] In step S201, a session establishment request sent by a first virtual machine to communicate with a second virtual machine is received.

[0056] The first virtual machine and the second virtual machine are any two different virtual machines in the cloud platform, and the control platform is a micro-isolation control platform in the cloud platform. Optionally, the virtual machine includes a micro-isolation agent, and the steps performed by the virtual machine in this embodiment are all performed by the micro-isolation agent installed in the virtual machine.

[0057] When the first virtual machine needs to establish communication with the second virtual machine, that is, when the first virtual machine needs to send a data packet to the second virtual machine, the first virtual machine as the data packet sender sends a session establishment request to the control platform in the cloud platform, and the control platform receives the session establishment request accordingly. The session establishment request contains relevant information of the corresponding data packet sender and data packet receiver.

[0058] In an exemplary embodiment, the session establishment request may carry a first virtual machine identifier, that is, identification information corresponding to the first virtual machine, such as an IP / MAC address (Internet Protocol / Media Access Control Address), etc. The session establishment request may also carry a second virtual machine identifier.

[0059] Optionally, the first virtual machine may send a corresponding session establishment request to the control platform only when communication with the second virtual machine needs to be established for the first time, or may send a corresponding session establishment request to the control platform each time communication with the second virtual machine needs to be established.

[0060] In step S202, in response to the session establishment request, a corresponding first signature verification rule and a second signature verification rule are generated.

[0061] The control platform generates a signature verification rule corresponding to the session establishment request in response to the session establishment request based on the relevant information of the corresponding data packet sender and data packet receiver included in the session establishment request. For example, the control platform determines a first virtual machine as a data packet sender and a second virtual machine as a data packet receiver, and generates a corresponding signature verification rule when it is determined that the first virtual machine is allowed to communicate with the second virtual machine.

[0062] Optionally, the control platform obtains the signing policy of the first virtual machine and the signing policy of the second virtual machine, and then determines to allow the first virtual machine to communicate with the second virtual machine when both the signing policy of the first virtual machine and the signing policy of the second virtual machine meet the communication requirements, and generates corresponding signature verification rules.

[0063] At the same time, since the first virtual machine and the second virtual machine are respectively the sender and receiver of the data packet, their corresponding signature verification rules are also different. The generated signature verification rules include a first signature verification rule corresponding to the first virtual machine and a second signature verification rule corresponding to the second virtual machine. The first signature verification rule is used to instruct the first virtual machine to sign the data packet. The second signature verification rule is used to instruct the second virtual machine to verify the signed data packet.

[0064] In step S203, the first signature verification rule is sent to the first virtual machine; the first signature verification rule is used to instruct the first virtual machine to sign the data packet based on a pre-stored private key, and send the signed data packet to the second virtual machine.

[0065] In the disclosed embodiment, the control platform sends a corresponding first signature verification rule to the first virtual machine. The first signature verification rule is used to instruct the first virtual machine to sign a data packet based on a pre-stored private key. In the disclosed embodiment, each virtual machine stores a private key locally before initiating a request to establish a session. In response to the first signature verification rule, the first virtual machine reads the pre-stored private key and signs the data packet based on the private key. At the same time, the first signature verification rule is also used to instruct the first virtual machine to send the signed data packet to the second virtual machine.

[0066] In an exemplary embodiment, each virtual machine in the cloud platform business domain needs to generate a set of corresponding private keys and public keys when applying for registration. Among them, the private key is pre-stored in the local virtual machine, and the public key is sent to the control platform. The private key corresponding to each virtual machine is generated independently, and the private key will not be transmitted in the network, which enhances the security of the private key. When the data packet is sent, the private key is used to sign the data packet sent from the local to other virtual machines.

[0067] In step S204, the second signature verification rule is sent to the second virtual machine; the second signature verification rule includes a public key signature certificate corresponding to the private key; the second signature verification rule is used to instruct the second virtual machine to verify the signed data packet based on the public key signature certificate.

[0068] In the disclosed embodiment, the control platform sends a corresponding second signature verification rule to the second virtual machine. The second signature verification rule contains the public key signature certificate corresponding to the private key of the first virtual machine described in the aforementioned step S203. The public key signature certificate is a public key signature certificate generated based on the public key corresponding to the private key, and is used to perform signature verification on a data packet signed based on the private key. The control platform may pre-save a public key signature certificate corresponding to the private key. The second signature verification rule is used to instruct the second virtual machine to verify the data packet signed by the first virtual machine based on the public key signature certificate.

[0069] As mentioned above, the private key and the public key are a set of corresponding keys pre-generated by the first virtual machine. The public key signature certificate can be used to perform signature verification on the data packet signed by the private key. The control platform sends the public key signature certificate to the second virtual machine through the second signature verification rule, so that the second virtual machine can verify the data packet signed by the first virtual machine.

[0070] In the above-mentioned secure communication method between virtual machines, the control platform receives a request from the first virtual machine to establish a session to communicate with the second virtual machine, and then generates first and second signature verification rules corresponding to the request to establish the session, sends the first signature verification rule to the first virtual machine to instruct the first virtual machine to sign the data packet based on the private key; sends the second signature verification rule to the second virtual machine to instruct the second virtual machine to verify the signed data packet based on the public key signature certificate. The present disclosure provides specific signature verification rules for each virtual machine through a newly deployed control platform with a unified signature verification rule management function, so that the first virtual machine as the sender signs the data packet based on the first signature verification rule, and the second virtual machine as the receiver verifies the data packet based on the second signature verification rule, thereby achieving reliability and security of data packet transmission between virtual machines.

[0071] In order to ensure the reliability of secure communication between virtual machines, based on the above embodiments, in one embodiment, it is possible to first determine whether the virtual machine meets the communication conditions based on the basic information of the virtual machine, and then generate the corresponding signature verification rules, such as Figure 3 As shown, the above S202 may include:

[0072] In step S301, basic information of a first virtual machine and basic information of a second virtual machine are obtained.

[0073] The basic information includes lifecycle information and business connection relationship. The lifecycle information of a virtual machine refers to the lifecycle information of the corresponding business virtual machine. The business connection relationship of a virtual machine can be an access business connection relationship of the virtual machine in the cloud platform, indicating an access relationship with physical resources, or indicating a business connection relationship with other virtual machines. The business connection relationship can be represented in the form of a view.

[0074] Optionally, basic information of the first virtual machine and basic information of the second virtual machine are obtained from the cloud management platform through a customized interface. The control platform is connected to the cloud management platform through a customized interface, so that when the first virtual machine as the sender of the data packet and the second virtual machine as the receiver of the data packet are determined, the basic information of the first virtual machine and the basic information of the second virtual machine are obtained from the cloud management platform.

[0075] For example, the control platform obtains the basic information of the first virtual machine and the basic information of the second virtual machine from the cloud management platform based on the virtual machine access connection relationship module, and then transmits the basic information of the first virtual machine and the second virtual machine from the virtual machine access connection relationship module to the policy causing module through the internal interface of the control platform.

[0076] In step S302, based on the basic information of the first virtual machine and the basic information of the second virtual machine, it is determined whether the first virtual machine is allowed to communicate with the second virtual machine.

[0077] The basic information also includes ACL (Access Control List), which can be used for contract policy matching and calculation. Based on the basic information of the first virtual machine and the basic information of the second virtual machine, combined with the contract policy of the first virtual machine and the contract policy of the second virtual machine, it can be decided whether to allow the first virtual machine to communicate with the second virtual machine.

[0078] For example, the control platform causes the module to decide whether to allow the first virtual machine to communicate with the second virtual machine based on the policy, and transmits the decision result to the signature verification rule generation module through the internal interface. If the life cycle information of the first virtual machine and the second virtual machine meets the communication conditions, and the business connection relationship between the first virtual machine and the second virtual machine meets the preset contract policy, it is determined that the first virtual machine is allowed to communicate with the second virtual machine; conversely, if any of the above conditions is not met, it is determined that the first virtual machine is not allowed to communicate with the second virtual machine.

[0079] In step S303, in response to determining that the first virtual machine is allowed to communicate with the second virtual machine, the corresponding first signature verification rule and the second signature verification rule are generated.

[0080] Specifically, the control platform dynamically generates a signature verification rule based on the basic information of the first virtual machine and the basic information of the second virtual machine. For example, the control platform generates the first signature verification rule and the second signature verification rule based on the signature verification rule generation module. Among them, the first signature verification rule can indicate the first virtual machine in what way to sign the data packet to be sent, and through what path to send the signed data packet to the second virtual machine. The second signature verification rule can indicate the second virtual machine in what way to verify the signed data packet after receiving the signed data packet sent by the first virtual machine.

[0081] The control platform pre-stores a public key signature certificate corresponding to the private key stored in each virtual machine. According to the first virtual machine identifier in the session establishment request, the public key signature certificate corresponding to the first virtual machine is read. The public key signature certificate is included in the second signature verification rule so that the second virtual machine can verify the signed data packet sent by the first virtual machine.

[0082] In this embodiment, the control platform obtains basic information of the first virtual machine and basic information of the second virtual machine, and determines whether to allow the first virtual machine to communicate with the second virtual machine based on the basic information of the first virtual machine and the basic information of the second virtual machine. Then, if it is determined that the first virtual machine and the second virtual machine are allowed to communicate, a signature verification rule corresponding to the session establishment request is generated. This can avoid the generation of signature verification rules when the virtual machines cannot communicate with each other, and realize unified management of signature verification rules of the cloud platform, without the need for business systems deployed on the cloud platform to separately configure relevant signature verification rules.

[0083] In order to configure signature verification compatible with virtual machines of different business systems, based on the above embodiments, in one embodiment, access control rules corresponding to the virtual machines can be generated first, and then signature verification rules can be generated based on the access control rules, such as Figure 4 As shown, the above S303 may include:

[0084] In step S401, a corresponding access control rule is generated based on a session establishment request, basic information of the first virtual machine, and basic information of the second virtual machine.

[0085] Based on the request to establish a session, the business mutual access requirements between the first virtual machine and the second virtual machine can be determined. At the same time, based on the business connection relationship in the basic information of the first virtual machine and the business connection relationship in the basic information of the second virtual machine, the achievable communication path between the first virtual machine and the second virtual machine can be determined. In combination with the business mutual access requirements and the achievable communication path between the first virtual machine and the second virtual machine, corresponding access control rules are generated.

[0086] For example, based on the policy engine module, the control platform obtains the basic information of the first virtual machine and the basic information of the second virtual machine from the virtual machine access connection relationship module through the internal interface, and then dynamically generates access control rules based on the business access requirements indicated by the session establishment request.

[0087] In step S402, the first signature verification rule and the second signature verification rule are generated based on the access control rule.

[0088] Furthermore, the signature verification rule generation module of the control platform applies for access control rules from the policy engine module through an internal interface, and generates signature verification rules based on the access control rules.

[0089] The signature verification rules include but are not limited to the first signature verification rule and the second signature verification rule. The first signature verification rule may indicate the first virtual machine in what manner to sign the data packet to be sent, and through what path to send the signed data packet to the second virtual machine. The second signature verification rule may indicate the second virtual machine in what manner to verify the signed data packet after receiving the signed data packet sent by the first virtual machine.

[0090] In this embodiment, the control node generates corresponding access control rules based on the session establishment request, the basic information of the first virtual machine, and the basic information of the second virtual machine, and generates signature verification rules corresponding to the session establishment request based on the access control rules. This can increase the reliability of the control platform's dynamic generation of signature verification rules and realize the unified linkage management of access control rules and signature verification rules by the cloud platform.

[0091] In an optional embodiment, the signature verification rule is further used to instruct the first virtual machine to re-encapsulate the data packet, insert a session counter field into the re-encapsulated data packet, and sign the data packet with the inserted session counter field based on the session key.

[0092] After receiving the first signature verification rule, the first virtual machine re-encapsulates the data packet to be sent to the second virtual machine under the instruction of the signature verification rule, and inserts the session counter field into the data packet, and then inserts the signature field into the data packet to implement the signature process of the data packet to be sent. The session counter field is used to prevent replay attacks, and the signature information is used to sign the entire data packet. In an exemplary embodiment, the session counter field and the signature information can be respectively contained in a 32-bit field.

[0093] In an optional embodiment, the second signature verification rule is used to instruct the second virtual machine to perform a first verification on the received data packet based on the standard value corresponding to the session counter field. The second signature verification rule is also used to perform a second verification on the received data packet based on the public key signature certificate.

[0094] After receiving the second signature verification rule and the signed data packet, the second virtual machine performs session counter verification and signature verification on the signed data packet under the instruction of the second signature verification rule, that is, the first verification and the second verification.

[0095] The second virtual machine obtains the standard value corresponding to the session counter field, which can be carried in the second signature verification rule, and then compares the actual value corresponding to the session counter field with the standard value to implement the first verification of the data packet. If the actual value matches the standard value, the first verification is determined to be passed; if the actual value does not match the standard value, the data packet is determined to be intercepted and the first verification fails.

[0096] Furthermore, the second virtual machine also obtains a public key signature certificate, which is included in the second signature verification rule. The second virtual machine performs a second verification on the signed data packet sent by the first virtual machine based on the public key signature certificate. If the second verification fails, it is determined that the data packet has been tampered with, the data packet is discarded, and the communication with the first virtual machine is disconnected.

[0097] Based on the above embodiments, in one embodiment, Figure 5 As shown, the above-mentioned method for secure communication between virtual machines also includes:

[0098] In step S501, a public key sent by the first virtual machine is received; the public key is generated by the first virtual machine based on a first virtual machine identifier and corresponds to the private key.

[0099] As mentioned above, before the first virtual machine sends a request to establish a session, the first virtual machine pre-generates a set of corresponding private keys and public keys. The set of private keys and public keys is generated based on the first virtual machine identifier. Among them, the private key is pre-stored in the local virtual machine, and the public key is sent to the control platform. The private key is used to sign the data packet, and the corresponding public key can perform signature verification on the signed data packet.

[0100] In an exemplary embodiment, each virtual machine in the cloud platform business domain needs to generate the above-mentioned set of corresponding private keys and public keys when applying for registration. Along with the virtual machine registration process, the private key is stored in the local virtual machine, and the corresponding public key is sent to the control platform.

[0101] In step S502, the public key is signed through PKI to generate the public key signature certificate.

[0102] In the disclosed embodiment, the signature verification rule generation module in the control platform is responsible for the generation of the signature certificate. The signature verification rule generation module receives the public key uploaded by the first virtual machine, and sends the public key to the PKI to sign the public key. As mentioned above, PKI is a framework for managing and distributing digital certificates. It provides a reliable way to verify identity, encrypt data, and ensure the security of communications. Using the PKI to sign the public key and generate a public key signature certificate can ensure that the public key signature certificate belongs to the relevant claimed owner and has not been tampered with. The public key signature certificate can perform signature verification on the data packet signed by the corresponding private key.

[0103] In step S503, a correspondence table between the first virtual machine and the public key signature certificate is saved.

[0104] In the disclosed embodiment, the control platform stores the public key signature certificates corresponding to each virtual machine. Therefore, it is necessary to maintain and store the correspondence table between each virtual machine and the public key signature certificate to ensure that in response to the session establishment request sent by the first virtual machine, the public key signature certificate corresponding to the first virtual machine is called to generate the corresponding second signature verification rule.

[0105] Based on the above embodiment, based on the correspondence table between the first virtual machine and the public key signature certificate saved in step S503, as shown in FIG. Figure 6 As shown, the generation of the second signature verification rule in the aforementioned step S202 may include:

[0106] In step S601, the public key signature certificate corresponding to the first virtual machine is searched according to the correspondence table.

[0107] In the disclosed embodiment, the control platform pre-stores the public key signature certificates corresponding to each virtual machine, and maintains a correspondence table between each virtual machine and the public key signature certificate. According to the correspondence table, the public key signature certificate corresponding to the first virtual machine is searched. The public key signature certificate can be used to perform signature verification on the data packet signed by the private key pre-stored in the first virtual machine.

[0108] In step S602, the second signature verification rule is generated according to the found public key signature certificate.

[0109] In the disclosed embodiment, the control platform generates a second signature verification rule that is sent to the second virtual machine for signature verification based on the public key signature certificate found. It should be noted that the second signature verification rule includes the public key signature certificate corresponding to the first virtual machine, but is not limited to this. The second signature verification rule may also include other indication information or other verification information. For example, the second signature verification rule may also include a standard value corresponding to the session counter field, so that the second virtual machine can perform a first verification on the received data packet.

[0110] The method for secure communication between virtual machines provided in the embodiments of the present disclosure pre-generates a private key and a public key pair locally in each virtual machine, wherein the private key is stored locally in the virtual machine, and the public key is sent to the control platform to generate a corresponding public key signature certificate. During secure communication between virtual machines, the sender signs the data packet based on the private key pre-stored locally, and the receiver verifies the signed data packet based on the corresponding public key signature certificate obtained from the control platform. During the entire communication process, the private key used to sign the data packet is not transmitted in the network, which further enhances the security of the private key, thereby further improving the security of virtual machine communications.

[0111] In one embodiment, Figure 7 As shown, a method for secure communication between virtual machines is provided, which is applied to a first virtual machine and includes the following steps:

[0112] S701: Send a session establishment request to a control platform to request communication with a second virtual machine.

[0113] The first virtual machine and the second virtual machine are any two different virtual machines in the cloud platform, and the control platform is a micro-isolation control platform in the cloud platform. Optionally, the first virtual machine includes a micro-isolation agent, and the execution subject of this method is the micro-isolation agent installed in the first virtual machine.

[0114] When the first virtual machine needs to establish communication with the second virtual machine, that is, when the first virtual machine needs to send a data packet to the second virtual machine, the first virtual machine as the data packet sender sends a session establishment request to the control platform in the cloud platform. The session establishment request contains relevant information of the corresponding data packet sender and data packet receiver. Specifically, the session establishment request carries the first virtual machine identifier, that is, the identification information corresponding to the first virtual machine, such as the IP / MAC address and other identification information. The session establishment request may also carry the second virtual machine identifier.

[0115] Optionally, the first virtual machine may send a corresponding session establishment request to the control platform only when communication with the second virtual machine needs to be established for the first time, or may send a corresponding session establishment request to the control platform each time communication with the second virtual machine needs to be established.

[0116] S702: Receive a first signature verification rule sent by the control platform.

[0117] The control platform generates a signature verification rule corresponding to the session establishment request in response to the session establishment request based on the relevant information of the corresponding data packet sender and data packet receiver included in the session establishment request. For example, the control platform determines a first virtual machine as a data packet sender and a second virtual machine as a data packet receiver, and generates a corresponding signature verification rule when it is determined that the first virtual machine is allowed to communicate with the second virtual machine.

[0118] At the same time, the generated signature verification rules include a first signature verification rule corresponding to the first virtual machine and a second signature verification rule corresponding to the second virtual machine. The first signature verification rule is used to instruct the first virtual machine to sign the data packet.

[0119] S703: According to the first signature verification rule, sign the data packet based on a pre-stored private key, and send the signed data packet to the second virtual machine.

[0120] According to the first signature verification rule, the first virtual machine signs the data packet to be sent to the second virtual machine based on the pre-stored private key, and after signing, sends the signed data packet to the second virtual machine.

[0121] Optionally, the first signature verification rule may indicate the first virtual machine how to sign the data packet to be sent, and the path through which to send the signed data packet to the second virtual machine.

[0122] In the above scheme, the first virtual machine sends a request to the control platform to establish a session to communicate with the second virtual machine, receives the signature verification rule sent by the control platform, signs the data packet based on the signature verification rule, and sends the signed data packet to the second virtual machine. This embodiment provides a specific signature verification rule for the first virtual machine through a newly deployed control platform with a unified signature verification rule management function, so that the first virtual machine as the sender signs the data packet based on the signature verification rule, thereby achieving reliability and security of data packet transmission between virtual machines.

[0123] In an optional embodiment, the first signature verification rule is generated by the control platform when it is determined that the first virtual machine is allowed to communicate with the second virtual machine based on the basic information of the first virtual machine and the basic information of the second virtual machine.

[0124] Basic information includes lifecycle information and business connection relationships. The lifecycle information of a virtual machine refers to the lifecycle information of the corresponding business virtual machine. The business connection relationship of a virtual machine can be an access business connection relationship of the virtual machine in the cloud platform, indicating the access relationship with physical resources, or indicating the business connection relationship with other virtual machines, etc. Among them, the business connection relationship can be expressed in the form of a view.

[0125] The basic information also includes ACL, which can be used for contract policy matching and calculation. Based on the basic information of the first virtual machine and the basic information of the second virtual machine, the control platform can decide whether to allow the first virtual machine to communicate with the second virtual machine in combination with the contract policy of the first virtual machine and the contract policy of the second virtual machine.

[0126] Further, in the case where it is determined that the first virtual machine is allowed to communicate with the second virtual machine, the control platform dynamically generates a signature verification rule based on the basic information of the first virtual machine and the basic information of the second virtual machine. The signature verification rule includes a first signature verification rule and a second signature verification rule. The first signature verification rule is used to instruct the first virtual machine to sign a data packet based on a pre-stored private key and send the signed data packet to the second virtual machine. The second signature verification rule is used to instruct the second virtual machine to verify the signed data packet based on a public key signature certificate.

[0127] In this way, it is possible to avoid generating signature verification rules when virtual machines cannot communicate with each other, thereby increasing the reliability of the control platform's dynamic generation of signature verification rules and achieving unified management of the cloud platform's signature verification rules. There is no need for the business systems deployed on the cloud platform to separately configure the signature verification rules.

[0128] In order to enhance the security of data packets transmitted in the secure communication process between virtual machines, based on the above embodiments, in one embodiment, a session counter and a data signature may be combined for processing, such as Figure 8 As shown, the above S703 may include:

[0129] S801: re-encapsulate a data packet based on the first virtual machine, and insert a session counter field into the data packet.

[0130] After receiving the first signature verification rule, the first virtual machine re-encapsulates the data packet to be sent to the second virtual machine under the instruction of the first signature verification rule. For example, the original data is converted into binary data, and then the binary data is divided into data segments, and the TCP header and IP header are encapsulated to obtain a network layer data packet.

[0131] Furthermore, a session counter field is inserted into the re-encapsulated data packet, wherein the session counter field may contain 32 bits. An attacker may send a data packet that has been received by the second virtual machine for communication authentication, thereby destroying the security of the communication. The actual value of the session counter field is used to indicate the number of sessions. During the communication between the first virtual machine and the second virtual machine, the actual value of the session counter field increases with the number of sessions. Therefore, the data packet after the session counter field is inserted can prevent replay attacks.

[0132] S802: Use the private key to sign the data packet inserted into the session counter field.

[0133] At the end of the data packet into which the session counter field has been inserted, a signature information field encrypted by the session key is added, wherein the signature information field is used to sign the entire data packet, and the signature information field may contain 32 bits. This embodiment does not limit the specific encryption method.

[0134] Optionally, the signed data packet structure is as follows Fig. 9 As shown, it contains 4 bits of version, 4 bits of header length, 8 bits of service type, total length of package, 16 bits of reassembly identifier, 3 bits of flag, 13 bits of segment offset, 8 bits of TTL, 8 bits of protocol, 16 bits of checksum, 32 bits of source IP address, 32 bits of destination IP address, optional options, user data, 32 bits of session counter field and 32 bits of signature field. Among them, the total length of the package is updated from the original 16 bits to increase the length of the session counter field and signature field.

[0135] In this embodiment, not only is a session counter field inserted into the data packet to implement anti-replay attack, but a signature field is also inserted for the second virtual machine to determine whether the data packet has been tampered with, thereby comprehensively improving the security of virtual machine communications.

[0136] Based on the above embodiments, in one embodiment, Fig.10 As shown, the above virtual machine communication method also includes:

[0137] In step S1001, the corresponding private key and public key are generated based on the first virtual machine identifier.

[0138] As mentioned above, before the first virtual machine sends a request to establish a session, the first virtual machine pre-generates a set of corresponding private keys and public keys. The set of private keys and public keys is generated based on the first virtual machine identifier. Among them, the private key is pre-stored in the local virtual machine, and the public key is sent to the control platform. The private key is used to sign the data packet, and the corresponding public key can perform signature verification on the signed data packet.

[0139] In an exemplary embodiment, each virtual machine in the cloud platform business domain needs to generate the above-mentioned set of corresponding private keys and public keys when applying for registration. Along with the virtual machine registration process, the private key is stored in the local virtual machine, and the corresponding public key is sent to the control platform.

[0140] In step S1002, the private key is pre-stored.

[0141] The first virtual machine stores the private key in a local virtual machine for signing the data packet.

[0142] In step S1003, the public key is sent to the control platform.

[0143] The first virtual machine sends the public key to the control platform. The control platform sends the public key to the PKI to sign the public key and generate a public key signature certificate. The public key signature certificate can perform signature verification on the data packet signed by the corresponding private key.

[0144] The method for secure communication between virtual machines provided in the embodiments of the present disclosure pre-generates a private key and a public key pair locally in each virtual machine, wherein the private key is stored locally in the virtual machine, and the public key is sent to the control platform to generate a corresponding public key signature certificate. During secure communication between virtual machines, the sender signs the data packet based on the private key pre-stored locally, and the receiver verifies the signed data packet based on the corresponding public key signature certificate obtained from the control platform. During the entire communication process, the private key used to sign the data packet is not transmitted in the network, which further enhances the security of the private key, thereby further improving the security of virtual machine communications.

[0145] In one embodiment, Fig.11 As shown, a method for secure communication between virtual machines is provided, which is applied to a second virtual machine and includes the following steps:

[0146] S1101, receiving a second signature verification rule sent by a control platform; the second signature verification rule includes a public key signature certificate corresponding to a private key pre-stored in the first virtual machine.

[0147] The first virtual machine and the second virtual machine are any two different virtual machines in the cloud platform, and the control platform is a micro-isolation control platform in the cloud platform. Optionally, the second virtual machine includes a micro-isolation agent, and the execution subject of the method is the micro-isolation agent installed in the second virtual machine.

[0148] Among them, the first virtual machine identifier is carried by the first virtual machine in the session establishment request sent to the control platform to communicate with the second virtual machine. The first virtual machine identifier, that is, the identification information corresponding to the first virtual machine, can be identification information such as IP / MAC address.

[0149] When determining that the first virtual machine is allowed to communicate with the second virtual machine, the control platform generates a first signature verification rule and a second signature verification rule, sends the first signature verification rule to the first virtual machine, and sends the second signature verification rule to the second virtual machine. The second signature verification rule includes a public key signature certificate corresponding to a private key pre-stored in the first virtual machine. The public key signature certificate can perform signature verification on a data packet signed by the corresponding private key.

[0150] S1102, receiving a signed data packet sent by the first virtual machine; the signed data packet is signed by the first virtual machine based on a first signature verification rule sent by the control platform and the private key.

[0151] The signed data packet is signed by the first virtual machine based on the first signature verification rule sent by the control platform and the pre-stored private key. After receiving the first signature verification rule sent by the control platform, the first virtual machine signs the data packet using the pre-stored private key under the instruction of the first signature verification rule, and sends the signed data packet to the second virtual machine. Correspondingly, the second virtual machine receives the signed data packet.

[0152] S1103: Verify the signed data packet based on the second signature verification rule.

[0153] Under the instruction of the second signature verification rule, the second virtual machine verifies the signed data packet, wherein the verification includes session counter verification and signature verification.

[0154] In the above scheme, the second virtual machine receives the second signature verification rule sent by the control platform, receives the signed data packet sent by the first virtual machine, and verifies the signed data packet based on the second signature verification rule. This embodiment provides a specific signature verification rule for the second virtual machine through a newly deployed control platform with a unified signature verification rule management function, so that the second virtual machine as the recipient verifies the data packet based on the signature verification rule, thereby achieving reliability and security of data packet transmission between virtual machines, and the signature uses a pre-generated private key and public key for signing and verification, which can further improve the security of virtual machine communication.

[0155] In an optional embodiment, the second signature verification rule is generated by the control platform when it is determined, based on the basic information of the first virtual machine and the basic information of the second virtual machine, that the first virtual machine is allowed to communicate with the second virtual machine.

[0156] Basic information includes lifecycle information and business connection relationships. The lifecycle information of a virtual machine refers to the lifecycle information of the corresponding business virtual machine. The business connection relationship of a virtual machine can be an access business connection relationship of the virtual machine in the cloud platform, indicating the access relationship with physical resources, or indicating the business connection relationship with other virtual machines, etc. Among them, the business connection relationship can be expressed in the form of a view.

[0157] The basic information also includes ACL, which can be used for contract policy matching and calculation. Based on the basic information of the first virtual machine and the basic information of the second virtual machine, the control platform can decide whether to allow the first virtual machine to communicate with the second virtual machine in combination with the contract policy of the first virtual machine and the contract policy of the second virtual machine.

[0158] Furthermore, when it is determined that the first virtual machine is allowed to communicate with the second virtual machine, the control platform dynamically generates a second signature verification rule based on the basic information of the first virtual machine and the basic information of the second virtual machine. Based on the first virtual machine, the corresponding public key signature certificate is found, and then the second signature verification rule is generated, which can be verified by the public key signature certificate.

[0159] In this way, it is possible to avoid generating signature verification rules when virtual machines cannot communicate with each other, thereby increasing the reliability of the control platform's dynamic generation of signature verification rules and achieving unified management of the cloud platform's signature verification rules. There is no need for the business systems deployed on the cloud platform to separately configure the signature verification rules.

[0160] In order to enhance the security of data packets transmitted in the virtual machine communication process, based on the above embodiments, in one embodiment, a session counter and a data signature may be combined for processing, such as Fig.12 As shown, the above S1103 may include:

[0161] S1201: Perform a first check on the signed data packet based on a standard value corresponding to a session counter field in the second signature verification rule.

[0162] After receiving the second signature verification rule and the signed data packet, the second virtual machine first performs a session counter verification on the signed data packet under the instruction of the second signature verification rule, that is, a first verification.

[0163] Specifically, the second virtual machine obtains the standard value corresponding to the session counter field, which can be carried in the second signature verification rule, and finds the session counter field from the signed data packet to obtain the actual value of the session counter field, and then compares the actual value corresponding to the session counter field with the standard value to achieve the first verification of the data packet.

[0164] The attacker will send a data packet that has been received by the second virtual machine to perform communication authentication, thereby destroying the security of the communication. The actual value of the session counter field is used to indicate the number of sessions. During the communication between the first virtual machine and the second virtual machine, the actual value of the session counter field increases with the number of sessions. Therefore, the data packet after inserting the session counter field can prevent replay attacks.

[0165] In an optional embodiment, the actual value of the session counter field in the signed data packet is compared with the standard value corresponding to the session counter field in the signature verification rule; if the comparison result is that the actual value meets the standard value, it is determined that the signed data packet has passed the first verification; if the comparison result is that the actual value does not meet the standard value, it is determined that the signed data packet has failed the first verification. In other words, when the actual value of the session counter field is equal to the standard value, it means that there is no risk of session replay attack in the current session.

[0166] S1202: Perform a second verification on the signed data packet based on the public key signature certificate in the second signature verification rule.

[0167] Based on the public key signature certificate in the second signature verification rule, the signed data packet is subjected to a second verification. Specifically, the signature information field added and encrypted by the session key is found at the end of the data packet, and the signature information field encrypted by the corresponding private key is verified using the public key signature certificate. The signature information field is used to sign the entire data packet, and the signature information field can contain 32 bits.

[0168] If the second check fails, it is determined that the data packet has been tampered with, the data packet is discarded, and the communication with the first virtual machine is disconnected.

[0169] In this embodiment, the first verification is performed based on the standard value corresponding to the session counter field, and the second verification is performed based on the public key signature certificate, which can not only prevent replay attacks, but also check whether the data packet has been tampered with, thereby comprehensively improving the security of virtual machine communications.

[0170] The method for secure communication between virtual machines provided in the embodiments of the present disclosure pre-generates a private key and a public key pair locally in each virtual machine, wherein the private key is stored locally in the virtual machine, and the public key is sent to the control platform to generate a corresponding public key signature certificate. During secure communication between virtual machines, the sender signs the data packet based on the private key pre-stored locally, and the receiver verifies the signed data packet based on the corresponding public key signature certificate obtained from the control platform. During the entire communication process, the private key used to sign the data packet is not transmitted in the network, which further enhances the security of the private key, thereby further improving the security of virtual machine communications.

[0171] In one embodiment, an optional example of a method for secure communication between virtual machines is provided, such as Fig.13 As shown, it includes a micro-isolation client A corresponding to the first virtual machine and a micro-isolation client B corresponding to the second virtual machine, as well as a cloud management platform, a PKI and a control platform. Among them, the micro-isolation client A is the data sending end, and the micro-isolation client B is the data receiving end.

[0172] Specifically, the process of the secure communication method between virtual machines is as follows:

[0173] In the first step, micro-isolation client A and micro-isolation client B install micro-isolation agents respectively.

[0174] In the second step, micro-isolation client A and micro-isolation client B respectively send virtual machine registration requests to the control platform.

[0175] In the third step, micro-isolation client A and micro-isolation client B generate a private key / public key pair based on their respective virtual machine identifiers, where the private key is stored locally and the public key is sent to the control platform.

[0176] In the fourth step, the control platform sends the public key to PKI to generate a public key signature certificate.

[0177] The fifth step is to control the platform to save the public key signature certificate.

[0178] In the sixth step, the cloud management platform sends the virtual machine life cycle information and business connection relationship to the control platform.

[0179] In the seventh step, the control platform generates access control rules based on lifecycle information and business connection relationships.

[0180] In the eighth step, micro-isolation client A sends a request to establish a session to the control platform.

[0181] In the ninth step, in response to the session establishment request, the control platform generates a first signature verification rule and a second signature verification rule based on the access control rule.

[0182] In the tenth step, the control platform applies the first signature verification rule and the second signature verification rule to micro-isolation client A and micro-isolation client B respectively.

[0183] In the eleventh step, the micro-isolation client A re-encapsulates the data packet based on the first signature verification rule, inserts the session counter field, and signs the data packet using a private key.

[0184] In the twelfth step, micro-isolation client A sends the signed data packet to micro-isolation client B.

[0185] In the thirteenth step, the micro-isolation client B performs session counter verification and signature verification on the signed data packet based on the second signature verification rule.

[0186] The specific process of the above steps can be found in the description of the above method embodiment. The implementation principles and technical effects are similar and will not be repeated here.

[0187] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0188] Based on the same inventive concept, the embodiment of the present disclosure provides a secure communication device between virtual machines, as described in the following embodiment. Since the principle of solving the problem in the embodiment of the device is similar to that in the above method embodiment, the implementation of the embodiment of the device can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0189] Fig.14 FIG. 1 is a schematic diagram showing a structure of a secure communication device between virtual machines configured on a control platform in an embodiment of the present disclosure. Fig.14 As shown, the inter-virtual machine secure communication device 1400 configured on the control platform may include: a first receiving module 1410 , a generating module 1420 , a first sending module 1430 , and a second sending module 1440 .

[0190] The first receiving module 1410 is configured to receive a session establishment request sent by the first virtual machine to communicate with the second virtual machine.

[0191] The generating module 1420 is configured to generate a corresponding first signature verification rule and a corresponding second signature verification rule in response to the session establishment request.

[0192] The first sending module 1430 is configured to send the first signature verification rule to the first virtual machine; the first signature verification rule is used to instruct the first virtual machine to sign the data packet based on a pre-stored private key and send the signed data packet to the second virtual machine.

[0193] The second sending module 1440 is configured to send the second signature verification rule to the second virtual machine; the second signature verification rule includes a public key signature certificate corresponding to the private key; the second signature verification rule is used to instruct the second virtual machine to verify the signed data packet based on the public key signature certificate.

[0194] In an exemplary embodiment, the generation module 1420 is also configured to obtain basic information of the first virtual machine and basic information of the second virtual machine; wherein the basic information includes life cycle information and business connection relationship; based on the basic information of the first virtual machine and the basic information of the second virtual machine, determine whether the first virtual machine is allowed to communicate with the second virtual machine; in response to determining that the first virtual machine is allowed to communicate with the second virtual machine, generate the corresponding first signature verification rule and the second signature verification rule.

[0195] In an exemplary embodiment, the generation module 1420 is also configured to generate corresponding access control rules based on the session establishment request, basic information of the first virtual machine and basic information of the second virtual machine; and generate corresponding first signature verification rules and second signature verification rules based on the access control rules.

[0196] In an exemplary embodiment, the generating module 1420 is further configured to obtain basic information of the first virtual machine and basic information of the second virtual machine from a cloud management platform through a customized interface.

[0197] In an exemplary embodiment, the inter-virtual machine secure communication device 1400 is also configured such that the first signature verification rule is also used to instruct the first virtual machine to re-encapsulate the data packet; insert a session counter field into the data packet, and sign the data packet with the session counter field inserted therein based on the private key; the second signature verification rule is also used to instruct the second virtual machine to perform a first verification on the received data packet based on a standard value corresponding to the session counter field; and perform a second verification on the received data packet based on the public key signature certificate.

[0198] In an exemplary embodiment, the inter-virtual machine secure communication device 1400 is also configured to receive a public key sent by the first virtual machine; the public key is generated by the first virtual machine based on the first virtual machine identifier and corresponds to the private key; the public key is signed through a public key infrastructure to generate the public key signature certificate; and a correspondence table between the first virtual machine and the public key signature certificate is saved.

[0199] In an exemplary embodiment, the generating module 1420 is further configured to search for the public key signature certificate corresponding to the first virtual machine according to the corresponding relationship table; and generate the second signature verification rule according to the searched public key signature certificate.

[0200] Fig.15 A schematic diagram of the structure of a secure communication device between virtual machines configured in a first virtual machine in an embodiment of the present disclosure is shown. Fig.15 As shown, the inter-virtual machine secure communication device 1500 configured in the first virtual machine may include: a third sending module 1510 , a second receiving module 1520 , and a signature module 1530 .

[0201] The third sending module 1510 is configured to send a session establishment request to the control platform for requesting to communicate with the second virtual machine.

[0202] The second receiving module 1520 is configured to receive the first signature verification rule sent by the control platform.

[0203] The signature module 1530 is configured to sign the data packet based on the pre-stored private key according to the first signature verification rule, and send the signed data packet to the second virtual machine.

[0204] In an exemplary embodiment, the inter-virtual machine secure communication device 1500 is also configured that the first signature verification rule is generated by the control platform when it determines that the first virtual machine is allowed to communicate with the second virtual machine based on the basic information of the first virtual machine and the basic information of the second virtual machine; the basic information includes life cycle information and business connection relationship.

[0205] In an exemplary embodiment, the signature module 1530 is further configured to re-encapsulate the data packet based on the first virtual machine, insert a session counter field into the data packet, and use the private key to sign the data packet into which the session counter field is inserted.

[0206] In an exemplary embodiment, the inter-virtual machine secure communication device 1500 is further configured to generate the corresponding private key and public key based on the first virtual machine identifier; pre-store the private key, and send the public key to the control platform.

[0207] Fig.16 A schematic diagram of the structure of a secure communication device between virtual machines configured in a second virtual machine in an embodiment of the present disclosure is shown. Fig.16 As shown, the inter-virtual machine secure communication device 1600 configured in the second virtual machine may include: a third receiving module 1610 , a fourth receiving module 1620 , and a verification module 1630 .

[0208] The third receiving module 1610 is configured to receive a second signature verification rule sent by the control platform; the second signature verification rule includes a public key signature certificate corresponding to a private key pre-stored in the first virtual machine.

[0209] The fourth receiving module 1620 is configured to receive a signed data packet sent by the first virtual machine; the signed data packet is signed by the first virtual machine based on the first signature verification rule sent by the control platform and the private key.

[0210] The verification module 1630 is configured to verify the signed data packet based on the second signature verification rule.

[0211] In an exemplary embodiment, the inter-virtual machine secure communication device 1600 is also configured that the second signature verification rule is generated by the control platform when it determines that the first virtual machine is allowed to communicate with the second virtual machine based on the basic information of the first virtual machine and the basic information of the second virtual machine; the basic information includes life cycle information and business connection relationship.

[0212] In an exemplary embodiment, the verification module 1630 is also configured to perform a first verification on the signed data packet based on a standard value corresponding to a session counter field in the second signature verification rule; and perform a second verification on the signed data packet based on the public key signature certificate in the second signature verification rule.

[0213] In an exemplary embodiment, the verification module 1630 is further configured to compare the actual value of the session counter field in the signed data packet with the standard value corresponding to the session counter field in the second signature verification rule; if the comparison result is that the actual value meets the standard value, it is determined that the first verification of the signed data packet has passed.

[0214] Fig.17 The structure diagram of the electronic device suitable for implementing the exemplary embodiment of the present disclosure is shown. Fig.17 1700 according to this embodiment of the present invention will be described. Fig.17 The electronic device 1700 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0215] like Fig.17As shown, the electronic device 1700 is in the form of a general computing device. The components of the electronic device 1700 may include, but are not limited to: the at least one processing unit 1710, the at least one storage unit 1720, a bus 1730 connecting different system components (including the storage unit 1720 and the processing unit 1710), and a display unit 1740.

[0216] The storage unit stores program codes, which can be executed by the processing unit 1710, so that the processing unit 1710 executes the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification.

[0217] The storage unit 1720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 17201 and / or a cache storage unit 17202 , and may further include a read-only storage unit (ROM) 17203 .

[0218] The storage unit 1720 may also include a program / utility 17204 having a set (at least one) of program modules 17205, such program modules 17205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0219] Bus 1730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0220] The electronic device 1700 may also communicate with one or more external devices 1770 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1700, and / or communicate with any device that enables the electronic device 1700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1750. Furthermore, the electronic device 1700 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1760. As shown, the network adapter 1760 communicates with other modules of the electronic device 1700 via a bus 1730. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0221] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0222] The program product for implementing the above method according to the embodiment of the present invention may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0223] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0224] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0225] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0226] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0227] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0228] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0229] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0230] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

[0231] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for secure communication between virtual machines, applied to a control platform, characterized in that: The method comprises: receiving a session establishment request sent by the first virtual machine to communicate with the second virtual machine; In response to the session establishment request, generating a corresponding first signature verification rule and a second signature verification rule; The first signature verification rule is sent to the first virtual machine; the first signature verification rule is used to instruct the first virtual machine to sign the data packet based on the pre-stored private key, and send the signed data packet to the second virtual machine; the first signature verification rule is also used to instruct the first virtual machine to re-encapsulate the data packet; insert a session counter field into the data packet, and sign the data packet into which the session counter field is inserted based on the private key; The second signature verification rule is sent to the second virtual machine; the second signature verification rule includes a public key signature certificate corresponding to the private key; the second signature verification rule is used to instruct the second virtual machine to verify the signed data packet based on the public key signature certificate; the second signature verification rule is also used to instruct the second virtual machine to perform a first verification on the received data packet based on the standard value corresponding to the session counter field; and perform a second verification on the received data packet based on the public key signature certificate.

2. The method according to claim 1, characterized in that: The generating of the corresponding first signature verification rule and second signature verification rule comprises: Obtaining basic information of the first virtual machine and basic information of the second virtual machine; wherein the basic information includes life cycle information and service connection relationship; Determining whether to allow the first virtual machine to communicate with the second virtual machine based on the basic information of the first virtual machine and the basic information of the second virtual machine; In response to determining that the first virtual machine is allowed to communicate with the second virtual machine, the corresponding first signature verification rule and the second signature verification rule are generated.

3. The method according to claim 1 or 2, characterized in that: The generating of the corresponding first signature verification rule and second signature verification rule comprises: Generate a corresponding access control rule based on the session establishment request, the basic information of the first virtual machine, and the basic information of the second virtual machine; Based on the access control rule, the corresponding first signature verification rule and the second signature verification rule are generated.

4. The method according to claim 2, characterized in that: The obtaining basic information of the first virtual machine and basic information of the second virtual machine includes: The basic information of the first virtual machine and the basic information of the second virtual machine are obtained from the cloud management platform through a customized interface.

5. The method according to claim 1, characterized in that The method further comprises: Receiving a public key sent by the first virtual machine; the public key is generated by the first virtual machine based on the first virtual machine identifier and corresponds to the private key; Signing the public key through a public key infrastructure (PKI) to generate the public key signature certificate; A correspondence table between the first virtual machine and the public key signature certificate is saved.

6. The method according to claim 5, characterized in that The generating of the second signature verification rule comprises: According to the correspondence table, searching for the public key signature certificate corresponding to the first virtual machine; The second signature verification rule is generated according to the found public key signature certificate.

7. A method for secure communication between virtual machines, applied to a first virtual machine, characterized in that: include: Sending a session establishment request to the control platform to communicate with the second virtual machine; Receiving a first signature verification rule sent by the control platform; According to the first signature verification rule, signing the data packet based on the pre-stored private key, and sending the signed data packet to the second virtual machine; The step of signing the data packet based on the pre-stored private key includes: re-encapsulating the data packet based on the first virtual machine, and inserting a session counter field into the data packet; The private key is used to sign the data packet inserted into the session counter field.

8. The method according to claim 7, characterized in that The first signature verification rule is generated by the control platform when it determines that the first virtual machine is allowed to communicate with the second virtual machine based on the basic information of the first virtual machine and the basic information of the second virtual machine; the basic information includes life cycle information and business connection relationship.

9. The method according to claim 7, characterized in that: The method further comprises: Generate the corresponding private key and public key based on the first virtual machine identifier; The private key is pre-stored, and the public key is sent to the control platform.

10. A method for secure communication between virtual machines, applied to a second virtual machine, characterized in that: include: Receiving a second signature verification rule sent by the control platform; the second signature verification rule includes a public key signature certificate corresponding to a private key pre-stored in the first virtual machine; Receiving a signed data packet sent by the first virtual machine; the signed data packet is signed by the first virtual machine based on the first signature verification rule sent by the control platform and the private key; Verifying the signed data packet based on the second signature verification rule includes: Performing a first verification on the signed data packet based on a standard value corresponding to a session counter field in the second signature verification rule; Based on the public key signature certificate in the second signature verification rule, a second verification is performed on the signed data packet.

11. The method according to claim 10, characterized in that The second signature verification rule is generated by the control platform when it determines that the first virtual machine is allowed to communicate with the second virtual machine based on the basic information of the first virtual machine and the basic information of the second virtual machine; the basic information includes life cycle information and business connection relationship.

12. The method according to claim 10, characterized in that The performing a first verification on the signed data packet based on the standard value corresponding to the session counter field in the second signature verification rule includes: Compare the actual value of the session counter field in the signed data packet with the standard value corresponding to the session counter field in the second signature verification rule; If the comparison result is that the actual value meets the standard value, it is determined that the first check of the signed data packet has passed.

13. A secure communication device between virtual machines, configured on a control platform, characterized in that: include: A first receiving module is configured to receive a session establishment request sent by the first virtual machine to communicate with the second virtual machine; A generating module, configured to generate corresponding first signature verification rules and second signature verification rules in response to the session establishment request; a first sending module, configured to send the first signature verification rule to the first virtual machine; the first signature verification rule is used to instruct the first virtual machine to sign the data packet based on a pre-stored private key, and send the signed data packet to the second virtual machine; the first signature verification rule is also used to instruct the first virtual machine to re-encapsulate the data packet; insert a session counter field into the data packet, and sign the data packet into which the session counter field is inserted based on the private key; A second sending module is configured to send the second signature verification rule to the second virtual machine; the second signature verification rule includes a public key signature certificate corresponding to the private key; The second signature verification rule is used to instruct the second virtual machine to verify the signed data packet based on the public key signature certificate; the second signature verification rule is also used to instruct the second virtual machine to perform a first verification on the received data packet based on the standard value corresponding to the session counter field; Based on the public key signature certificate, a second verification is performed on the received data packet.

14. A secure communication device between virtual machines, configured in a first virtual machine, characterized in that: include: A third sending module is configured to send a session establishment request to the control platform for requesting communication with the second virtual machine; A second receiving module is configured to receive a first signature verification rule sent by the control platform; a signature module, configured to sign the data packet based on a pre-stored private key according to the first signature verification rule, and send the signed data packet to the second virtual machine; The signing of the data packet based on the pre-stored private key includes: re-encapsulating the data packet based on the first virtual machine, and inserting a session counter field into the data packet; The private key is used to sign the data packet inserted into the session counter field.

15. A secure communication device between virtual machines, configured in a second virtual machine, characterized in that: include: A third receiving module is configured to receive a second signature verification rule sent by the control platform; the second signature verification rule includes a public key signature certificate corresponding to a private key pre-stored in the first virtual machine; a fourth receiving module, configured to receive a signed data packet sent by the first virtual machine; the signed data packet is signed by the first virtual machine based on the first signature verification rule sent by the control platform and the private key; The verification module is configured to verify the signed data packet based on the second signature verification rule, including: performing a first verification on the signed data packet based on a standard value corresponding to a session counter field in the second signature verification rule; Based on the public key signature certificate in the second signature verification rule, a second verification is performed on the signed data packet.

16. An electronic device, characterized in that: include: one or more processors; A storage device configured to store one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the method as described in any one of claims 1 to 6 or 7 to 9 or 10 to 12.

17. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6, 7 to 9 or 10 to 12 is implemented.

Images