A cloud host online migration data encryption method, device, equipment and medium

Abstract

The present invention relates to a cloud host online migration data encryption method, device, equipment and medium. The method comprises: querying whether a hardware accelerated migration encryption interface query is supported; if the query result is supported, a cloud management platform calling an online migration interface of a Libvirt component and specifying a "tls-hw-accel" parameter; the Libvirt component sending a qmp instruction to a QEMU component, specifying the parameter and cloud host online migration; the QEMU component executing the online migration, initializing an encryption acceleration engine object with the parameter value, and calling an interface of a gnutls library to register the encryption acceleration engine object with the gnutls library; calling an encryption and decryption interface of the gnutls library when data encryption and decryption is required during the cloud host migration process, the gnutls library calling back a callback interface of the encryption object registered by the QEMU component, and in the callback interface, the QEMU component using the encryption acceleration engine interface to perform encryption and decryption.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud host online migration, and in particular to a cloud host online migration data encryption method, device, equipment and storage medium. Background Art

[0002] Cloud host online migration technology allows cloud hosts to be migrated from one physical machine to another without interrupting services. Before the online migration begins, the cloud host runs on the source physical machine. After the online migration begins, the cloud host is started on the destination physical machine and set to paused. It continuously receives memory data from the source physical machine until the remaining memory on the source physical machine is sufficiently low. Finally, the source physical machine is paused and the remaining memory is copied all at once to the destination physical machine. For security reasons, the source physical machine can encrypt the migrated data during the online migration process. Upon receiving the encrypted data, the destination physical machine must decrypt it.

[0003] The source physical machine typically uses the CPU to encrypt memory data and the destination physical machine typically uses the CPU to decrypt memory data. If a hardware acceleration engine is available on the source or destination physical machine, it can be used to accelerate the encryption or decryption process. A hardware acceleration engine is a hardware module on the source or destination physical machine. The hardware acceleration engine here specifically refers to the hardware module used for encryption and decryption calculations. Summary of the Invention

[0004] Based on the above problems, the present invention provides a cloud host online migration data encryption method, device, equipment and medium.

[0005] In a first aspect, an embodiment of the present invention provides a cloud host online migration data encryption method, which is applied to a system including: a Libvirt component, a QEMU component, and a cloud management platform, including:

[0006] The cloud management platform calls the Libvirt component to query whether online migration supports hardware-accelerated migration encryption interface;

[0007] If the query result indicates that hardware-accelerated migration encryption interface query is supported, the cloud management platform calls the online migration interface of the Libvirt component and specifies the "tls-hw-accel" parameter;

[0008] The libvirt component sends the qmp command "migrate_set_parameter" to the QEMU component, specifying the "tls-hw-accel" parameter as the encryption acceleration engine to be used;

[0009] The Libvirt component sends the qmp command "migrate" to the QEMU component to start the cloud host online migration;

[0010] The QEMU component performs online migration of the cloud host, initializes the encryption acceleration engine object according to the value of the "tls-hw-accel" parameter specified by the Libvirt component, and calls the gnutls_crypto_register_cipher interface of the gnutls library to register the encryption acceleration engine object with the gnutls library;

[0011] When data encryption and decryption are required during cloud host migration, the encryption and decryption interface of the gnutls library is called. The gnutls library calls back to the callback interface of the encryption acceleration engine object registered by the QEMU component. In the callback interface, the QEMU component uses the interface of the encryption acceleration engine object for encryption and decryption.

[0012] Furthermore, the above-mentioned cloud host online migration data encryption method further includes:

[0013] If the query result shows that hardware accelerated migration encryption interface query is not supported,

[0014] Then return the corresponding error;

[0015] Furthermore, in the above-mentioned cloud host online migration data encryption method, the cloud management platform calls the Libvirt component's online migration encryption interface query to determine whether hardware-accelerated migration encryption is supported, by querying the hardware-accelerated migration encryption query interface added to the Libvirt component.

[0016] Furthermore, in the above-mentioned cloud host online migration data encryption method, the "tls-hw-accel" parameter is a parameter added to the virsh migrate command for initiating cloud host migration in the Libvirt component.

[0017] Furthermore, in the above-mentioned cloud host online migration data encryption method, the default value of the "tls-hw-accel" parameter is "off";

[0018] When the tls-hw-accel parameter is specified and its value is not off, the Libvirt component sends the qmp command "migrate_set_parameter" to the QEMU component, specifying the tls-hw-accel parameter as the encryption acceleration engine to be used.

[0019] Furthermore, in the above-mentioned cloud host online migration data encryption method, when the Libvirt component sends the qmp instruction "migrate_set_parameter" to the QEMU component, if the value of the "tls-hw-accel" parameter is not "off", the QEMU component stores the "tls-hw-accel" parameter.

[0020] Furthermore, the above-mentioned cloud host online migration data encryption method further includes:

[0021] When the Libvirt component sends the qmp command "migrate" to the QEMU component, the "tls-hw-accel" parameter stored by the QEMU component is retrieved and judged;

[0022] If the "tls-hw-accel" parameter is not "off", a hardware acceleration engine encryption object is constructed when constructing the encryption object, and the gnutls library's registration encryption object interface gnutls_crypto_register_cipher is called to register the hardware acceleration engine encryption object with the gnutls library, and the gnutls_cipher_init interface of the gnutls library is called to initialize it.

[0023] In a second aspect, an embodiment of the present invention further provides a cloud host online migration data encryption device, which is applied to a system including: a Libvirt component, a QEMU component and a cloud management platform, including:

[0024] Query module: used by the cloud management platform to call the Libvirt component's online migration to query whether it supports hardware-accelerated migration encryption interface;

[0025] The first designated module: If the query result indicates that hardware-accelerated migration encryption interface query is supported, the cloud management platform calls the online migration interface of the Libvirt component and specifies the "tls-hw-accel" parameter;

[0026] The second designated module: used by the Libvirt component to send the qmp command "migrate_set_parameter" to the QEMU component, specifying the "tls-hw-accel" parameter as the encryption acceleration engine to be used;

[0027] Cloud host online migration module: used by the Libvirt component to send the qmp command "migrate" to the QEMU component to start cloud host online migration;

[0028] Registration module: used by the QEMU component to perform cloud host online migration, initializes the encryption acceleration engine object according to the value of the "tls-hw-accel" parameter specified by the Libvirt component, and calls the gnutls_crypto_register_cipher interface of the gnutls library to register the encryption acceleration engine object with the gnutls library;

[0029] Encryption and decryption module: It is used to call the encryption and decryption interface of the gnutls library when data encryption and decryption are required during the cloud host migration process. The gnutls library calls back to the callback interface of the encryption acceleration engine object registered by the QEMU component. In the callback interface, the QEMU component uses the interface of the encryption acceleration engine object for encryption and decryption.

[0030] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising: a processor and a memory;

[0031] The processor is configured to execute any one of the cloud host online migration data encryption methods described above by calling the program or instruction stored in the memory.

[0032] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute a cloud host online migration data encryption method as described in any one of the above items.

[0033] The advantages of the embodiment of the present invention are as follows: the present invention calls the online migration of the Libvirt component through the cloud management platform to query whether the hardware accelerated migration encryption interface query is supported; if the query result is that the hardware accelerated migration encryption interface query is supported, the cloud management platform calls the online migration interface of the Libvirt component and specifies the "tls-hw-accel" parameter; the Libvirt component sends the qmp instruction "migrate_set_parameter" to the QEMU component, specifying the "tls-hw-accel" parameter as the encryption acceleration engine to be used; the Libvirt component sends the qmp instruction "migrate_set_parameter" to the QEMU component , start the cloud host online migration; the QEMU component executes the cloud host online migration, initializes the encryption acceleration engine object according to the value of the "tls-hw-accel" parameter specified by the Libvirt component, and calls the gnutls_crypto_register_cipher interface of the gnutls library to register the encryption acceleration engine object with the gnutls library; when data encryption and decryption are required during the cloud host migration process, the encryption and decryption interface of the gnutls library is called, and the gnutls library calls back to the callback interface of the encryption acceleration engine object registered by the QEMU component. In the callback interface, the QEMU component uses the interface of the encryption acceleration engine object for encryption and decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the conventional technology, the following briefly introduces the drawings required for use in the embodiments or the conventional technology descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0035] Figure 1 A schematic diagram of a cloud host online migration data encryption method provided by an embodiment of the present invention Figure 1 ;

[0036] Figure 2 A schematic diagram of a cloud host online migration data encryption method provided by an embodiment of the present invention Figure 2 ;

[0037] Figure 3 A schematic diagram of a cloud host online migration data encryption device provided by an embodiment of the present invention;

[0038] Figure 4 It is a schematic block diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0039] To make the above-mentioned objects, features, and advantages of the present invention more readily apparent, specific embodiments of the present invention are described in detail below with reference to the accompanying drawings. The following description sets forth numerous specific details to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways than those described herein, and those skilled in the art may make similar modifications without departing from the scope of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this invention pertains. The terms used in this specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0041] Figure 1 A schematic diagram of a cloud host online migration data encryption method provided by an embodiment of the present invention Figure 1 .

[0042] In the first aspect, an embodiment of the present invention provides a cloud host online migration data encryption method, which is applied to a system including: a Libvirt component, a QEMU component and a cloud management platform, and is combined with Figure 1, including six steps from S101 to S106:

[0043] S101: The cloud management platform calls the Libvirt component's online migration to query whether it supports hardware-accelerated migration encryption interface.

[0044] Specifically, in an embodiment of the present invention, the online migration of the cloud host is initiated by the Libvirt component and implemented by the QEMU component. It can be specified that data be encrypted for transmission during online migration. An interface is added to the Libvirt component to query whether hardware-accelerated migration encryption is supported for the cloud management platform to query.

[0045] S102: If the query result indicates that hardware-accelerated migration encryption interface query is supported, the cloud management platform calls the online migration interface of the Libvirt component and specifies the "tls-hw-accel" parameter.

[0046] Specifically, in an embodiment of the present invention, if the query result is a query that supports hardware accelerated migration encryption interface, the cloud management platform calls the online migration interface of the Libvirt component and specifies the "tls-hw-accel" parameter. The "tls-hw-accel" parameter specifies the encryption acceleration engine to be used.

[0047] S103: The Libvirt component sends the qmp instruction "migrate_set_parameter" to the QEMU component, specifying the "tls-hw-accel" parameter as the encryption acceleration engine to be used.

[0048] Specifically, in an embodiment of the present invention, when the Libvirt component initiates an online migration and sends the qmp instruction "migrate_set_parameter" to the QEMU process, it is necessary to add the "tls-hw-accel" parameter, whose value is used to specify a specific hardware acceleration engine. In this case, the QEMU component will encrypt the data and use the hardware acceleration engine for encryption.

[0049] S104: The Libvirt component sends the qmp command "migrate" to the QEMU component to start the cloud host online migration.

[0050] S105: The QEMU component performs online migration of the cloud host, initializes the encryption acceleration engine object according to the value of the "tls-hw-accel" parameter specified by the Libvirt component, and calls the gnutls_crypto_register_cipher interface of the gnutls library to register the encryption acceleration engine object with the gnutls library.

[0051] Specifically, in an embodiment of the present invention, the Libvirt component sends the qmp command "migrate" to the QEMU component to start the online migration of the cloud host. The QEMU component executes the online migration of the cloud host, initializes the encryption acceleration engine object according to the value of the "tls-hw-accel" parameter, and registers the encryption acceleration engine object with the gnutls library.

[0052] S106: When data encryption and decryption are required during the cloud host migration process, the encryption and decryption interface of the gnutls library is called. The gnutls library calls back the callback interface of the encryption acceleration engine object registered by the QEMU component. In the callback interface, the QEMU component uses the interface of the encryption acceleration engine object to perform encryption and decryption.

[0053] Specifically, in an embodiment of the present invention, QEMU executes the actual cloud host migration process. When data encryption and decryption are required during the migration process, the encryption and decryption interface of the gnutls library is called. The gnutls library will call back to the callback interface of the encryption acceleration engine object registered by QEMU. In this callback interface, the QEMU component will use the interface of the specific encryption acceleration engine object for encryption and decryption.

[0054] Figure 2 A schematic diagram of a cloud host online migration data encryption method provided by an embodiment of the present invention Figure 2 .

[0055] Furthermore, the above-mentioned cloud host online migration data encryption method is combined with Figure 2 , further comprising steps S201 to S202:

[0056] S201: If the query result is that hardware accelerated migration encryption interface query is not supported,

[0057] S202: Return the corresponding error.

[0058] Specifically, in an embodiment of the present invention, the cloud management platform calls Libvirt's online migration to query whether it supports hardware-accelerated migration encryption interface. If hardware-accelerated migration encryption is not supported, a corresponding error is returned. If hardware-accelerated migration encryption is supported, execution continues.

[0059] Furthermore, in the above-mentioned cloud host online migration data encryption method, the cloud management platform calls the Libvirt component's online migration encryption interface query to determine whether hardware-accelerated migration encryption is supported, by querying the hardware-accelerated migration encryption query interface added to the Libvirt component.

[0060] Furthermore, in the above-mentioned cloud host online migration data encryption method, the "tls-hw-accel" parameter is a parameter added to the virsh migrate command for initiating cloud host migration in the Libvirt component.

[0061] Specifically, in an embodiment of the present invention, the Libvirt component supports hardware acceleration of data encryption for online migration of cloud hosts. The virsh tool is a command-line tool provided by the Libvirt component. The command to initiate cloud host migration using the virsh tool is virsh migrate. The virsh migrate command can specify the --tls parameter. If the --tls parameter is specified, the Libvirt component will encrypt the data when initiating online migration. The "tls-hw-accel" parameter is added to the virsh migrate command, and this parameter needs to be used together with --tls.

[0062] Furthermore, in the above-mentioned cloud host online migration data encryption method, the default value of the "tls-hw-accel" parameter is "off";

[0063] When the tls-hw-accel parameter is specified and its value is not off, the Libvirt component sends the qmp command "migrate_set_parameter" to the QEMU component, specifying the tls-hw-accel parameter as the encryption acceleration engine to be used.

[0064] Specifically, in an embodiment of the present invention, the default value of the "tls-hw-accel" parameter is off. When the "tls-hw-accel" parameter is specified and the value of the "tls-hw-accel" parameter is not off, when the Libvirt component initiates online migration and sends the qmp instruction "migrate_set_parameter" to the QEMU process, it is necessary to add the "tls-hw-accel" parameter. Its value is used to specify a specific hardware acceleration engine. In this case, the QEMU component will encrypt the data and use the hardware acceleration engine for encryption.

[0065] Furthermore, in the above-mentioned cloud host online migration data encryption method, when the Libvirt component sends the qmp instruction "migrate_set_parameter" to the QEMU component, if the value of the "tls-hw-accel" parameter is not "off", the QEMU component stores the "tls-hw-accel" parameter.

[0066] Specifically, in the embodiment of the present invention, when the Libvirt component sends the qmp instruction "migrate_set_parameter" to the QEMU component, if the value of the "tls-hw-accel" parameter is not "off", the QEMU component stores the "tls-hw-accel" parameter.

[0067] Furthermore, the above-mentioned cloud host online migration data encryption method further includes:

[0068] When the Libvirt component sends the qmp command "migrate" to the QEMU component, the "tls-hw-accel" parameter stored by the QEMU component is retrieved and judged;

[0069] If the "tls-hw-accel" parameter is not "off", a hardware acceleration engine encryption object is constructed when constructing the encryption object, and the gnutls library's registration encryption acceleration engine object interface gnutls_crypto_register_cipher is called to register the hardware acceleration engine's encryption acceleration engine object with the gnutls library, and the gnutls library's gnutls_cipher_init interface is called to initialize it.

[0070] Specifically, in the embodiment of the present invention, after the QEMU component stores the "tls-hw-accel" parameter, when the Libvirt component sends the qmp instruction "migrate" to QEMU, the previously saved "tls-hw-accel" parameter is retrieved and judged. If it is not "off", an encryption object of the hardware acceleration engine is constructed when constructing the encryption object, and the interface of the registration encryption object of the gnutls library is called.

[0071] gnutls_crypto_register_cipher registers the encryption object of the hardware acceleration engine with gnutls and calls the gnutls_cipher_init interface of the gnutls library to initialize it. In the subsequent encryption process, gnutls will use the encryption object of the hardware acceleration engine for encryption operations.

[0072] Figure 3 A schematic diagram of a cloud host online migration data encryption device provided by an embodiment of the present invention.

[0073] In a second aspect, an embodiment of the present invention further provides a cloud host online migration data encryption device, which is applied to a system including: a Libvirt component, a QEMU component and a cloud management platform, including:

[0074] Query module 301: used for the cloud management platform to call the Libvirt component's online migration to query whether it supports hardware-accelerated migration encryption interface.

[0075] Specifically, in the embodiment of the present invention, the cloud management platform calls the query module 301 to query whether the online migration of the Libvirt component supports the hardware accelerated migration encryption interface.

[0076] The first specifying module 302 is used for, if the query result is that hardware accelerated migration encryption interface query is supported, the cloud management platform calls the online migration interface of the Libvirt component and specifies the "tls-hw-accel" parameter.

[0077] Specifically, in an embodiment of the present invention, if the query result of the query module 301 is a query that supports hardware accelerated migration encryption interface, the cloud management platform calls the online migration interface of the Libvirt component and specifies the "tls-hw-accel" parameter through the first specifying module 302.

[0078] The second specifying module 303 is used for the Libvirt component to send the qmp instruction "migrate_set_parameter" to the QEMU component, specifying the "tls-hw-accel" parameter as the encryption acceleration engine to be used.

[0079] Specifically, in the embodiment of the present invention, the Libvirt component sends the qmp instruction "migrate_set_parameter" to the QEMU component, and specifies the "tls-hw-accel" parameter as the encryption acceleration engine to be used through the second specifying module 303.

[0080] Cloud host online migration module 304: used for the Libvirt component to send the qmp command "migrate" to the QEMU component to start the cloud host online migration.

[0081] Specifically, in the embodiment of the present invention, the Libvirt component sends the qmp instruction "migrate" to the QEMU component, and the cloud host online migration module 304 starts the cloud host online migration.

[0082] Registration module 305: used by the QEMU component to perform cloud host online migration, initialize the encryption acceleration engine object according to the value of the "tls-hw-accel" parameter specified by the Libvirt component, and call the gnutls_crypto_register_cipher interface of the gnutls library to register the encryption acceleration engine object with the gnutls library.

[0083] Specifically, in an embodiment of the present invention, the Libvirt component sends the qmp command "migrate" to the QEMU component to start the online migration of the cloud host. The QEMU component executes the online migration of the cloud host, initializes the encryption acceleration engine object according to the value of the "tls-hw-accel" parameter, and registers the encryption acceleration engine object to the gnutls library through the registration module 305.

[0084] Encryption and decryption module 306: used to call the encryption and decryption interface of the gnutls library when data encryption and decryption are needed during the cloud host migration process. The gnutls library calls back to the callback interface of the encryption object registered by the QEMU component. In the callback interface, the QEMU component uses the interface of the encryption acceleration engine to perform encryption and decryption.

[0085] Specifically, in an embodiment of the present invention, QEMU executes the actual cloud host migration process. When data encryption and decryption are required during the migration process, the encryption and decryption interface of the gnutls library is called. The gnutls library will call back to the callback interface of the encryption object registered by QEMU. In this callback interface, the QEMU component will use the encryption and decryption module 306 for encryption and decryption.

[0086] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising: a processor and a memory;

[0087] The processor is configured to execute any one of the cloud host online migration data encryption methods described above by calling the program or instruction stored in the memory.

[0088] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute a cloud host online migration data encryption method as described in any one of the above items.

[0089] Figure 4 It is a schematic block diagram of an electronic device provided by an embodiment of the present disclosure.

[0090] like Figure 4 As shown, the electronic device includes: at least one processor 401, at least one memory 402 and at least one communication interface 403. The various components in the electronic device are coupled together through a bus system 404. The communication interface 403 is used to transmit information between external devices. It can be understood that the bus system 404 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 404 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 4 Various buses are labeled as bus system 404 .

[0091] It can be understood that the memory 402 in this embodiment can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories.

[0092] In some embodiments, the memory 402 stores the following elements, executable units or data structures, or a subset or an extended set thereof: an operating system and application programs.

[0093] The operating system includes various system programs, such as the framework layer, core library layer, and driver layer, which are used to implement various basic services and handle hardware-based tasks. Application programs include various application programs, such as media players and browsers, which are used to implement various application services. Programs that implement any of the methods in the cloud host online migration data encryption method provided in the embodiments of the present invention can be included in the application programs.

[0094] In an embodiment of the present invention, the processor 401 calls the program or instructions stored in the memory 402, specifically, the program or instructions stored in the application, and the processor 401 is used to execute the steps of each embodiment of a cloud host online migration data encryption method provided in an embodiment of the present invention.

[0095] The cloud management platform calls the Libvirt component to query whether online migration supports hardware-accelerated migration encryption interface;

[0096] If the query result indicates that hardware-accelerated migration encryption interface query is supported, the cloud management platform calls the online migration interface of the Libvirt component and specifies the "tls-hw-accel" parameter;

[0097] The libvirt component sends the qmp command "migrate_set_parameter" to the QEMU component, specifying the "tls-hw-accel" parameter as the encryption acceleration engine to be used;

[0098] The Libvirt component sends the qmp command "migrate" to the QEMU component to start the cloud host online migration;

[0099] The QEMU component performs online migration of the cloud host, initializes the encryption acceleration engine object according to the value of the "tls-hw-accel" parameter specified by the Libvirt component, and calls the gnutls_crypto_register_cipher interface of the gnutls library to register the encryption acceleration engine object with the gnutls library;

[0100] When data encryption and decryption are required during cloud host migration, the encryption and decryption interface of the gnutls library is called. The gnutls library calls back to the callback interface of the encryption acceleration engine object registered by the QEMU component. In the callback interface, the QEMU component uses the interface of the encryption acceleration engine object for encryption and decryption.

[0101] Any of the methods in the cloud host online migration data encryption method provided in the embodiment of the present invention can be applied to the processor 401, or implemented by the processor 401. The processor 401 can be an integrated circuit chip with signal capabilities. During the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 401 or the instructions in the form of software. The above processor 401 can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional device, etc.

[0102] Any of the steps in the cloud host online migration data encryption method provided in the embodiments of the present invention can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software units within the decoding processor. The software units can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. The storage medium is located in memory 402. Processor 401 reads the information in memory 402 and, in conjunction with its hardware, completes the steps of the cloud host online migration data encryption method.

[0103] Those skilled in the art will appreciate that although some embodiments described herein include some features and not others included in other embodiments, the combination of features from different embodiments is intended to be within the scope of the invention and to form different embodiments.

[0104] Those skilled in the art will understand that the description of each embodiment has its own focus, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0105] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and such modifications or substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A cloud host online migration data encryption method, characterized in that: Applicable to systems including Libvirt components, QEMU components, and cloud management platforms, including: The cloud management platform calls the Libvirt component to query whether online migration supports hardware-accelerated migration encryption interface; If the query result indicates that hardware-accelerated migration encryption interface query is supported, the cloud management platform calls the online migration interface of the Libvirt component and specifies the "tls-hw-accel" parameter; The libvirt component sends the qmp command "migrate_set_parameter" to the QEMU component, specifying the "tls-hw-accel" parameter as the encryption acceleration engine to be used; The Libvirt component sends the qmp command "migrate" to the QEMU component to start the cloud host online migration; The QEMU component performs online migration of the cloud host, initializes the encryption acceleration engine object according to the value of the "tls-hw-accel" parameter specified by the Libvirt component, and calls the gnutls_crypto_register_cipher interface of the gnutls library to register the encryption acceleration engine object with the gnutls library; When data needs to be encrypted and decrypted during cloud host migration, the encryption and decryption interface of the gnutls library is called, and the gnutls library calls back to the callback interface of the encryption acceleration engine object registered by the QEMU component. In the callback interface, the QEMU component uses the encryption acceleration engine interface for encryption and decryption.

2. A cloud host online migration data encryption method according to claim 1, characterized in that: The method further comprises: If the query result shows that hardware accelerated migration encryption interface query is not supported, The corresponding error is returned.

3. A cloud host online migration data encryption method according to claim 1, characterized in that: The cloud management platform calls the Libvirt component to query whether online migration supports hardware accelerated migration encryption interface by querying whether hardware accelerated migration encryption query interface is supported added to the Libvirt component.

4. A cloud host online migration data encryption method according to claim 1, characterized in that: The "tls-hw-accel" parameter is a parameter added to the virsh migrate command for initiating cloud host migration in the Libvirt component.

5. A cloud host online migration data encryption method according to claim 1, characterized in that: The default value of the "tls-hw-accel" parameter is "off"; When the tls-hw-accel parameter is specified and its value is not off, the Libvirt component sends the qmp command "migrate_set_parameter" to the QEMU component, specifying the tls-hw-accel parameter as the encryption acceleration engine to be used.

6. A cloud host online migration data encryption method according to claim 1, characterized in that: When the Libvirt component sends the qmp instruction "migrate_set_parameter" to the QEMU component, if the value of the "tls-hw-accel" parameter is not "off", the QEMU component stores the "tls-hw-accel" parameter.

7. A cloud host online migration data encryption method according to claim 6, characterized in that: The method further comprises: When the Libvirt component sends the qmp command "migrate" to the QEMU component, the "tls-hw-accel" parameter stored by the QEMU component is retrieved and judged; If the "tls-hw-accel" parameter is not "off", a hardware acceleration engine encryption object is constructed when constructing the encryption object, and the gnutls library's registration encryption object interface gnutls_crypto_register_cipher is called to register the hardware acceleration engine encryption object with the gnutls library, and the gnutls_cipher_init interface of the gnutls library is called to initialize it.

8. A cloud host online migration data encryption device, characterized in that: Applicable to systems including Libvirt components, QEMU components, and cloud management platforms, including: Query module: used by the cloud management platform to call the Libvirt component's online migration to query whether it supports hardware-accelerated migration encryption interface; The first designated module: If the query result indicates that hardware-accelerated migration encryption interface query is supported, the cloud management platform calls the online migration interface of the Libvirt component and specifies the "tls-hw-accel" parameter; The second designated module: used by the Libvirt component to send the qmp instruction "migrate_set_parameter" to the QEMU component, specifying the "tls-hw-accel" parameter as the encryption acceleration engine to be used; Cloud host online migration module: used by the Libvirt component to send the qmp command "migrate" to the QEMU component to start cloud host online migration; Registration module: used by the QEMU component to perform cloud host online migration, initialize the encryption acceleration engine object according to the value of the "tls-hw-accel" parameter specified by the Libvirt component, and call the gnutls_crypto_register_cipher interface of the gnutls library to register the encryption acceleration engine object with the gnutls library; Encryption and decryption module: used to call the encryption and decryption interface of the gnutls library when data encryption and decryption are required during the cloud host migration process. The gnutls library calls back to the callback interface of the encryption acceleration engine object registered by the QEMU component. In the callback interface, the QEMU component uses the encryption acceleration engine interface for encryption and decryption.

9. An electronic device, characterized in that: include: processor and memory; The processor is used to execute a cloud host online migration data encryption method as described in any one of claims 1 to 8 by calling the program or instruction stored in the memory.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute a cloud host online migration data encryption method according to any one of claims 1 to 8.

Images