Encryption method, decryption method and system based on cooperation of encryption equipment and operating system

Abstract

The invention provides an encryption method, decryption method and system based on cooperation of an encryption machine and an operating system, and is applied to the technical field of cloud computing. Through the mirror image initialization key and the mirror image data encryption key input by the user, in combination with the remote encryption machine and the local operating system, data encryption and integrity verification of the mirror image file are realized, the data encryption and decryption performance of the virtual machine mirror image file is improved, and meanwhile, the security of data and keys is ensured.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to an encryption method, a decryption method and a system based on the collaboration of an encryption machine and an operating system. Background Art

[0002] With the widespread application of cloud computing, data security has become a common focus of cloud vendors and users. In order to protect the large amount of data stored on the cloud platform, effective encryption and decryption must be performed. However, how to ensure data security without affecting the normal operation of cloud services is an urgent problem that cloud vendors need to solve. Especially in a virtualized environment, QEMU (QuickEmulator) is a commonly used virtual machine management tool, and the security of its stored image data is particularly important.

[0003] The existing QEMU encryption and decryption methods have many deficiencies: 1. Insufficient key protection: In the encryption and decryption method that comes with QEMU, the key is stored in plain text, lacking effective protection measures, which can easily lead to key leakage, thus bringing huge security risks. 2. Performance impact: The existing technology mainly relies on encryption cards or encryption machines to encrypt all data. This method has a significant impact on the performance of virtual machines. Due to the limitations of the PCI slot and performance specifications of the encryption card, the migration of virtual machines is also greatly restricted. 3. High resource usage: These technologies occupy a high amount of server resources during the encryption process, further affecting the stability and performance of the system.

[0004] Therefore, how to improve the data encryption and decryption performance of virtual machine image files has become a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] In view of the above problems, the present invention provides an encryption method, a decryption method and a system based on the collaboration of an encryption machine and an operating system to overcome the above problems or at least partially solve the above problems. The technical solution is as follows:

[0006] The encryption method, decryption method and system based on the collaboration of an encryption machine and an operating system provided by the present invention, for the encryption process: the user inputs an image initialization key and an image data encryption key when creating a virtual machine. The master key of the image initialization key is randomly generated using the QEMU tool, and its key hash value is generated and saved in the QCOW2 image header file of the virtual machine. The encryption key is generated based on the image initialization key. The internal index of the encryption machine corresponding to the encryption key is searched or bound in the distributed cache. The encryption and decryption algorithm is called using the internal index of the encryption machine to encrypt the random master key, generate an encryption master key, and store it in the LUKS header key slot of the image header file. Numerical conversion is performed based on the image data encryption key and the encryption master key to obtain the target key. On the local operating system, the data block of the QCOW2 file is encrypted based on the target key and the preset encryption and decryption algorithm. The encrypted data block is hashed to generate a data hash value, and the hash value is written into the image header file. The image data encryption key is stored in the distributed cache, and the key in the cache is cleared after the virtual machine is shut down. During the backup and recovery operations, it is identified whether the QCOW2 file carries an encryption mark to skip the decryption process of the encrypted data block. For the decryption process: read the key and data hash value in the QCOW2 file of the virtual machine. Generate the encryption key and find the corresponding encryption machine internal index. Use the encryption machine internal index to decrypt the encryption master key, obtain the random master key, and perform hash value verification. Perform numerical conversion based on the image data encryption key and the encryption master key to obtain the target key. Decrypt the encrypted data block in the QCOW2 file. System composition: The QEMU tool is used to encrypt and decrypt the QCOW2 file of the virtual machine and generate and save the data hash value. The key interaction module obtains the image initialization key and image data encryption key entered by the user. Key management module: Save and manage key hash values ​​and verify the correctness of file keys. Distributed cache module: Save the image data encryption key and clear the cache when the virtual machine is shut down. Encryption machine index management module: Manage the encryption machine internal index, query and write encryption keys. Virtual machine event monitoring module: Monitor the virtual machine status and trigger related operations when the virtual machine is shut down. Encryption machine summary generation module: Provide an interface to write the data hash value into the virtual machine image file header. Encryption machine interface: Encapsulate all encryption machine algorithms and provide encryption and summary generation interfaces. Encryption machine data encryption and decryption module: Use the encryption machine SM4 algorithm to encrypt and decrypt data. Local operating system summary generation module: Use the PBKDF2 algorithm to generate key hash values ​​and provide an interface to the QEMU tool. Local operating system data encryption and decryption module: Use the local operating system's SM4 algorithm to encrypt and decrypt QCOW2 files. Encryption machine: Provides encryption key index initialization, SM4 symmetric key encryption and decryption, and SM3 summary generation functions.

[0007] By means of the above technical scheme, the encryption method, decryption method and system based on the collaboration of the encryption machine and the operating system provided by the present invention significantly improve the performance of data encryption and decryption through the synergy of the remote encryption machine and the local operating system, while strengthening the security protection of keys and data, and avoiding the risk of plaintext key leakage. In addition, since the scale of the encrypted virtual machine is no longer limited by the server hardware, users can achieve horizontal expansion and stable operation of the encrypted virtual machine by increasing the number of encryption machines and applying highly available encryption service technology. This method not only improves the efficiency and data security of virtual machine image file encryption and decryption, but also provides a flexible and scalable solution without affecting the normal operation of cloud services.

[0008] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0010] Figure 1 A flow chart of an implementation of an encryption method based on collaboration between an encryption machine and an operating system provided in an embodiment of the present invention is shown;

[0011] Figure 2 The present invention also provides a flowchart of an implementation method of a decryption method based on collaboration between an encryption machine and an operating system;

[0012] Figure 3 The schematic diagram of the structure of the encryption and decryption system based on the collaboration of the encryption machine and the operating system is shown. DETAILED DESCRIPTION

[0013] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0014] The encryption method, decryption method and system based on the collaboration of the encryption machine and the operating system provided by the present invention can significantly improve the performance of data encryption and decryption through the synergy of the remote encryption machine and the local operating system, while strengthening the security protection of keys and data to avoid the risk of plaintext key leakage. In addition, since the scale of the encrypted virtual machine is no longer limited by the server hardware, the user can achieve horizontal expansion and stable operation of the encrypted virtual machine by increasing the number of encryption machines and applying highly available encryption service technology. This method not only improves the efficiency and data security of virtual machine image file encryption and decryption, but also provides a flexible and scalable solution without affecting the normal operation of cloud services, and has broad application prospects. For the local operating system, encryption and decryption are performed collaboratively using remote encryption services and local computing units, without the need to install drivers on the server, and can be adapted to various operating systems.

[0015] The encryption method and decryption method provided by the embodiment of the present invention for collaboration between the encryption machine and the operating system combine the computing power of the encryption machine and the local operating system, and have the following characteristics: Fast encryption and decryption: It realizes fast encryption and decryption of virtual machines in the information innovation environment, and makes full use of the computing power of the local operating system and the encryption machine. One virtual machine corresponds to one key: Each virtual machine corresponds to a unique key, which enhances security. User participation: User participation is required for virtual machine encryption and decryption to prevent unauthorized data leakage. Horizontal expansion capability: It supports horizontal expansion of the computing power of the encryption machine, increases the maximum supported scale of the encrypted virtual machine and the speed of data encryption and decryption. Breaking through performance bottlenecks: It solves the performance bottleneck problem caused by the performance limitations of the local server PCI slot and the encryption card. Optimizing performance: It provides a method for collaborative encryption and decryption, reduces the performance loss in the encryption and decryption process, and improves the user experience of cloud users. Through these improvements, the present invention improves the efficiency of virtual machine encryption and decryption and user experience while ensuring data security.

[0016] QEMU QCOW2 is a powerful virtual disk image format, widely used in virtualization platforms, with multiple functions such as dynamic allocation of disk space, creation of snapshots, data compression and built-in encryption. LUKS (Linux Unified Key Setup) is a standard disk encryption solution in Linux systems, providing powerful encryption algorithms, supporting multiple key slots and consistent key management mechanisms to ensure data security and flexibility.

[0017] Combining QCOW2 with LUKS can create encrypted virtual disk images in a virtualized environment. This combination not only takes full advantage of QCOW2's storage space saving and snapshot features, but also ensures data security in the virtual disk through data encryption provided by LUKS. It is very suitable for virtualization application scenarios that require high security and flexibility.

[0018] On this basis, the embodiment of the present invention collaboratively utilizes the encryption and decryption capabilities of the encryption machine and the local operating system to achieve secure and efficient encryption and decryption of virtual machine image files. This method combines the advantages of QCOW2 and LUKS, further improves the security and processing efficiency of virtual disk images, and provides a reliable solution for virtualization applications.

[0019] like Figure 1 As shown, a flowchart of an implementation of an encryption method based on collaboration between an encryption machine and an operating system provided in an embodiment of the present invention is provided. The encryption method may include:

[0020] S100: Obtain an image initialization key and an image data encryption key input by a user when creating a virtual machine.

[0021] The image initialization key is a key input by the user when creating a virtual machine and is used to initialize the encryption process of the virtual machine image.

[0022] The image data encryption key is the key that the user enters when creating a virtual machine and is used to actually encrypt data.

[0023] S110. Use the QEMU tool to randomly generate a random master key for the image initialization key.

[0024] Among them, the QEMU tool is an open source emulator and virtual machine manager tool used to create and manage virtual machine images.

[0025] The random master key is a highly random and unpredictable value, which is used to further encrypt and protect the image initialization key.

[0026] Specifically, the embodiment of the present invention can utilize the qemu-img component in the QEMU tool to generate a random master key through a random number generator (such as / dev / urandom or / dev / random on a Unix-like system).

[0027] S120: Generate a key hash value of the random master key, and save the key hash value to the image header file of the QCOW2 file of the virtual machine.

[0028] The key hash value is a value obtained by hashing the random master key.

[0029] Among them, QCOW2 (QEMUCopy On Write version 2) file is a QEMU image file format. The image header file is part of the QCOW2 file and is used to store metadata related to the image, including keys and encryption information.

[0030] S130: Generate an encryption key based on the image initialization key.

[0031] S140. Search or bind the encryption machine internal index corresponding to the encryption key in the distributed cache.

[0032] The encryption machine internal index is an internal identifier used in the encryption machine to identify and call a preset encryption and decryption algorithm.

[0033] Specifically, an embodiment of the present invention can search for the encryption machine internal index corresponding to the encryption key in the distributed cache. If found, the encryption machine internal index is returned. If not found, the encryption key is bound to the unbound encryption machine internal index and the encryption machine internal index is returned.

[0034] S150, using the internal index of the encryption machine to call the preset encryption and decryption algorithm to encrypt the random master key, obtain the encrypted master key, and store the encrypted master key in the key slot of the LUKS header of the image header file.

[0035] The LUKS header is used for the metadata storage area of ​​disk encryption, which contains multiple key slots. The LUKS header contains metadata of the encrypted volume, such as encryption key information, key slots, salt value, and iteration count.

[0036] S160: Perform numerical conversion based on the image data encryption key and the encryption master key to obtain a target key.

[0037] Specifically, the embodiment of the present invention may combine the mirror data encryption key and the encryption master key into a target key.

[0038] S170: On the local operating system, encrypt the data block of the QCOW2 file based on the target key and a preset encryption and decryption algorithm to obtain an encrypted data block.

[0039] S180. When the writing of each encrypted data block is completed, perform hash calculation on each encrypted data block to generate a data hash value, and write the data hash value into the image header file.

[0040] The encryption method based on the collaboration of the encryption machine and the operating system provided in the embodiment of the present invention, through a series of complex encryption operations and data management steps, collaboratively utilizes the encryption and decryption capabilities of the encryption machine and the local operating system to ensure the high security and integrity of the virtual machine image file data, thereby improving the data encryption and decryption performance of the virtual machine image file.

[0041] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, the preset encryption and decryption algorithm is the SM4 algorithm.

[0042] The embodiment of the present invention can conveniently process independent and short data blocks through the SM4 algorithm, thereby improving the encryption processing efficiency and effectively preventing data leakage. Optionally, the embodiment of the present invention can use the ECB mode or XTS mode of the SM4 algorithm to encrypt the random master key and the data block of the QCOW2 file.

[0043] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, generating a key hash value of a random master key may specifically include:

[0044] Generate a key hash value for a random master key using the PBKDF2 key derivation function.

[0045] Among them, the PBKDF2 (Password-Based Key Derivation Function 2) key derivation function is a password-based key derivation function. The working principle of the PBKDF2 key derivation function includes input parameters: Password: the password entered by the user. Salt: a randomly generated value. Iterations: the number of times the hash operation is repeated. Output key length: the length of the key to be generated. Initialization: perform an initial hash operation on the password and the salt value. Multiple iterations: repeatedly perform iterative hash operations on the initial hash value, and the number of iterations is specified by the user. The output of each iteration is used as the input of the next iteration. Final output: after multiple iterations, a derived key is generated, and the length is the output key length specified by the user.

[0046] The embodiment of the present invention utilizes the PBKDF2 key derivation function through multiple iterations and the use of salt values, which can adapt to different security requirements and encryption algorithms, increase the difficulty for attackers to crack the key, prevent exhaustive attacks and pre-calculation attacks, and improve the security, flexibility, compatibility and integrity of the key hash value.

[0047] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, generating an encryption key based on the image initialization key may specifically include:

[0048] Input the image initialization key into the PBKDF2 key derivation function to generate an encryption key.

[0049] The embodiment of the present invention inputs the image initialization key into the PBKDF2 key derivation function to generate an encryption key, which not only improves the security of the key and the flexibility of the system, but also ensures the standardization of the system and the security of data processing.

[0050] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, performing hash calculation on each encrypted data block to generate a data hash value may specifically include:

[0051] Use the SM3 algorithm to perform hash calculations on each encrypted data block to generate a data hash value.

[0052] Among them, the SM3 algorithm is a cryptographic hash function algorithm.

[0053] The embodiment of the present invention enhances the data integrity and tamper-proofness of the data hash value by utilizing the irreversibility and anti-collision properties of the SM3 algorithm.

[0054] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, the image data encryption key is stored in a distributed cache, and after the virtual machine is shut down, the image data encryption key in the distributed cache is cleared.

[0055] The embodiment of the present invention significantly reduces the risk of image data encryption key leakage and improves the overall security of data by storing the image data encryption key in a distributed cache and clearing it in time after the virtual machine is shut down.

[0056] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, after the data hash value is written into the image header file, the following may also be included:

[0057] Obtain a backup instruction for the QCOW2 file; in response to the backup instruction, add an encryption mark to the QCOW2 file, and identify whether the QCOW2 file carries the encryption mark. If so, skip the decryption process of each encrypted data block in the QCOW2 file and transfer the QCOW2 file to the target backup path.

[0058] Specifically, when the backup command is triggered, the embodiment of the present invention checks whether the QCOW2 file to be backed up is encrypted. If the check result shows that the file is encrypted, set the "ENCRYPT_BACKUP" mark for the QCOW2 file. During the backup process, it is necessary to read the data of the QCOW2 file in order to store it in the target backup path, and check whether the QCOW2 file has the "ENCRYPT_BACKUP" mark. If the QCOW2 file has the "ENCRYPT_BACKUP" mark, it is determined that the QCOW2 file is encrypted, so it will not be decrypted. The original file reading process is directly used to read and back up the encrypted data of the QCOW2 file.

[0059] For example: suppose there is a virtual disk file (such as a QCOW2 file) of a virtual machine, which has been encrypted by LUKS. The embodiment of the present invention can scan the QCOW2 file to be backed up, find that the QCOW2 file contains a LUKS header, determine that the QCOW2 file is encrypted, and set the "ENCRYPT_BACKUP" mark for the file to indicate that the QCOW2 file is encrypted. During the backup process, when reading the QCOW2 file, the "ENCRYPT_BACKUP" mark will be detected. At this time, no attempt will be made to decrypt the QCOW2 file, but the encrypted data will be directly read. The read encrypted data is directly stored in the backup target, maintaining the encrypted state of the data. The introduction of the "ENCRYPT_BACKUP" mark in the backup process helps to intelligently process encrypted files, avoid unnecessary decryption steps, improve backup efficiency, and ensure the security of data during the backup process. By identifying and processing the special needs of encrypted files, the "ENCRYPT_BACKUP" mark helps maintain data consistency and confidentiality.

[0060] The embodiment of the present invention avoids repeated decryption and re-encryption by adding an encryption mark to the QCOW2 file, identifying the mark and skipping the decryption operation during the backup process, thereby reducing the processing load of the system, saving computing resources, improving the overall efficiency of the backup operation, and avoiding potential decryption risks and data leakage.

[0061] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, after the QCOW2 file is transferred to the target backup path, the following may also be included:

[0062] Obtain a recovery instruction for the QCOW2 file; in response to the recovery instruction, identify whether the QCOW2 file in the backup target carries an encryption mark, and if so, skip the decryption process of each encrypted data block in the QCOW2 file and transfer the QCOW2 file to the target recovery path.

[0063] Specifically, the embodiment of the present invention reads the QCOW2 file to be restored from the backup storage according to the instruction of the recovery command entry. Check whether the QCOW2 file to be restored has the "ENCRYPT_BACKUP" mark. If the "ENCRYPT_BACKUP" mark is detected, no encryption or decryption operation will be performed, and the original data will be read directly. The read data is transferred to the target recovery path. This process may involve operations such as decompression and decryption, but these operations will be skipped when the "ENCRYPT_BACKUP" mark is carried.

[0064] For example: suppose you need to restore an encrypted QCOW2 file from a backup. The user can submit a recovery request at the recovery command entry and specify the encrypted QCOW2 file that needs to be restored. When it is detected that the QCOW2 file is encrypted, set the "ENCRYPT_BACKUP" mark. Initialize the recovery environment and parameters. Start reading the QCOW2 file in the backup storage at the read file entry. When the "ENCRYPT_BACKUP" mark is detected, it is known that the QCOW2 file is encrypted, so no encryption or decryption operation is performed, and the encrypted data of the read QCOW2 file is directly transferred to the target recovery path. Through the collaborative work of these two entries, the recovery system of the embodiment of the present invention can efficiently perform data recovery operations, and perform appropriate processing according to specific marks to ensure the security and integrity of the data recovery process.

[0065] The embodiment of the present invention ensures that the data remains encrypted during the recovery process by identifying the encryption mark and skipping the decryption operation, thereby avoiding potential decryption risks and data leakage. At the same time, repeated decryption and re-encryption operations are avoided, computing resource consumption and recovery time are reduced, and the overall efficiency and speed of data recovery are improved.

[0066] In order to facilitate understanding of the encryption method based on the collaboration of the encryption machine and the operating system provided in the embodiment of the present invention, an example is given here to illustrate: when creating a virtual machine, the user enters the image initialization key password1 and the image data encryption key password2. Qemu obtains and processes these keys, generates a random master key master_key1 for the image initialization key password1, and then generates a key hash value master_key1_digest of the random master key master_key1 and saves it in the QCOW2 image header file. The encryption key slot_key is derived based on the image initialization key password1, and the encryption machine internal index key_index1 is searched or bound in the distributed cache. The SM4 ECB algorithm is called using key_index1 to encrypt the random master key master_key1, and the encrypted encryption master key is stored in the key slot of the LUKS header. The user enters the image data encryption key password2, and generates the target key masterkey2 after numerical conversion with the encryption master key. The target key masterkey2 is used to call the SM4 ECB encryption algorithm of the local operating system to encrypt the data block. After the write operation of all data blocks is completed, the SM3 algorithm of the encryption machine is called to calculate the hash value of all data, and the hash value is written into the QCOW2 image header file.

[0067] and Figure 1 The encryption method shown is adapted, such as Figure 2 As shown, the embodiment of the present invention also provides a flowchart of an implementation of a decryption method based on collaboration between an encryption machine and an operating system. The decryption method may include:

[0068] S200: Obtain an image initialization key and an image data encryption key input by a user when creating a virtual machine.

[0069] S210, reading a first key hash value, a first data hash value, and an encrypted master key in a key slot of a LUKS header in an image header file of a QCOW2 file of a virtual machine.

[0070] S220: Generate an encryption key based on the image initialization key.

[0071] S230. Search the distributed cache for an encryption machine internal index corresponding to the encryption key.

[0072] S240. Use the internal index of the encryption machine to call the preset encryption and decryption algorithm to decrypt the encrypted master key to obtain a random master key.

[0073] S250: Generate a second key hash value of the random master key.

[0074] S260: Compare the second key hash value with the first key hash value to see if they are consistent. If yes, execute step S261.

[0075] S261. Perform numerical conversion based on the image data encryption key and the encryption master key to obtain a target key.

[0076] S270: Perform hash calculation on each encrypted data block in the QCOW2 file on the local operating system to generate a second data hash value.

[0077] S280: Compare the second data hash value with the first data hash value to see if they are consistent. If yes, execute step S281.

[0078] S281. Decrypt each encrypted data block using the target key and a preset encryption / decryption algorithm to obtain a decrypted data block.

[0079] It can be understood that the encryption and decryption algorithm systems used by the decryption method and the encryption method provided in the embodiment of the present invention also use the same hash calculation method.

[0080] The decryption method based on the collaboration of the encryption machine and the operating system provided in the embodiment of the present invention collaboratively utilizes the encryption and decryption capabilities of the encryption machine and the local operating system through a series of complex decryption operations and key management steps, which not only improves the security, integrity and reliability of the virtual machine data, but also optimizes the key management and data decryption processes, ensuring data security and stable system operation in complex environments.

[0081] Optionally, the preset encryption and decryption algorithm is the SM4 algorithm. The embodiment of the present invention can use the ECB mode or XTS mode of the SM4 algorithm to decrypt the encrypted master key and the data block of the QCOW2 file.

[0082] Optional, in the above Figure 2 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, generating a key hash value of a random master key may specifically include:

[0083] Generate a key hash value for a random master key using the PBKDF2 key derivation function.

[0084] Optional, in the above Figure 2 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, generating an encryption key based on the image initialization key may specifically include:

[0085] Input the image initialization key into the PBKDF2 key derivation function to generate an encryption key.

[0086] Optional, in the above Figure 2On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, a hash calculation is performed on each encrypted data block in the QCOW2 file on the local operating system to generate a second data hash value.

[0087] The SM3 algorithm is used on the local operating system to perform hash calculation on each encrypted data block in the QCOW2 file to generate a second data hash value.

[0088] In order to facilitate understanding of the decryption method based on the collaboration of the encryption machine and the operating system provided in the embodiment of the present invention, an example is given here to illustrate: obtain the image initialization key password1 and the image data encryption key password2 input by the user. Read the LUKS header, read the key hash value master_key1_digest of the random master key master_key1 in the LUKS header containing the encrypted random master key master_key1 encryption information and the key slot, and the salt value and number of iterations used to generate the key hash value master_key1_digest. Derive the key, use PBKDF2 to input the image initialization key password1 to generate the encryption key slot_key of the encryption master key. Image encryption machine index, search the encryption machine internal index key_index1 corresponding to the encryption key slot_key in the distributed cache, if not found, directly return an error, if found, return the encryption machine internal index key_index1. Decrypt the master key: use the encryption machine internal index key_index1 to call the encryption machine SM4ECB algorithm to decrypt the encryption master key in the key slot. Verify the master key hash value, use PBKDF2 to generate the key hash value master_key1_digest of the random master key master_key1, and compare it with the `master_key1_digest` stored in the QCOW2 header. If they are inconsistent, return that the key is incorrect. If they are consistent, mirror the data encryption key password2, and convert it with the encrypted master key to generate the target key masterkey2. The encryption machine uses the SM3 algorithm to calculate the hash value of the entire QCOW2 file. Use the hash value generated by the encryption machine to compare with the stored hash value to verify data integrity. After completion, continue to the next step. If incomplete, exit directly. Use the target key masterkey2 to decrypt the data block.

[0089] The encryption and decryption method based on the collaboration of the encryption machine and the operating system provided in the embodiment of the present invention not only improves the data security and operation efficiency in the virtualization environment, but also ensures the data integrity and security in various operations (such as snapshots, migration, backup and recovery), and meets the high requirements for data protection in the cloud computing environment.

[0090] Although operations are depicted in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order.Multitasking and parallel processing may be advantageous under certain circumstances.

[0091] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0092] The embodiment of the present invention also provides an encryption and decryption system based on the cooperation of an encryption machine and an operating system, and its structure is as follows: Figure 3 As shown, it includes: QEMU tool, key interaction module, key management module, distributed cache module, virtual machine event monitoring module, encryption machine interface and encryption machine, wherein the QEMU tool includes encryption machine index management module, encryption machine summary generation module, encryption machine data encryption and decryption module, local operating system summary generation module and local operating system data encryption and decryption module.

[0093] The QEMU tool is used to encrypt and decrypt the random master key in the image header file of the QCOW2 file of the virtual machine and generate a data hash value of the virtual machine data through the encryption machine index management module and the encryption machine data encryption and decryption module, and save the data hash value into the image header file; generate a key hash value of the random master key by calling the local operating system summary generation module, and save the key hash value into the image header file; encrypt and decrypt the virtual machine data by calling the local operating system data encryption and decryption module, and perform numerical conversion based on the image data encryption key and the encryption master key to obtain the target key.

[0094] Among them, the functional test script for creating an encrypted virtual machine process can be as follows:

[0095] "sh–x. / create_secret_xml.sh${uuid}${volume}

[0096] secuuid=$(virshsecret-list|grep${volume}|cut-d""-f2)

[0097] virshsecret-define${uuid}.xml

[0098] sh-xsecret_set.sh${uuid}

[0099] qemu-imgcreate--objectsecret,id=sec0,data=${uuid}

[0100] -fqcow2-oencrypt.format=luks,encrypt.key-secret=sec0${volume}1G

[0101] sh-x. / create_domain_xml.sh${uuid}${volume}

[0102] virshdefinedomain_${uuid}.xml

[0103] virshstart${uuid}".

[0104] The QEMU tool uses the image initialization key password1 to create an encryption key file. Define the required encryption algorithm and digest algorithm to ensure data encryption and integrity. The qemu-img tool uses random numbers to generate an initial master key masterkey1. After the masterkey1 and the image data encryption key password2 provided by the user are converted numerically, the final encryption key masterkey2 is formed. QEMU uses the final generated encryption key masterkey2 to encrypt and decrypt the virtual machine data to ensure the security of the data during storage and transmission. Through the above steps, the system can effectively protect the security of virtual machine data and prevent unauthorized access.

[0105] The key interaction module is used to obtain the image initialization key and image data encryption key entered by the user when creating a virtual machine, wherein the image initialization key is stored in the virtual host definition file of the virtual host management module, and the image data encryption key is stored in the distributed cache file system and is cleared from the cache after the virtual machine is shut down.

[0106] The sample code of the key interaction module may be as follows:

[0107]

[0108]

[0109]

[0110] The main function of the key interaction module is to implement key delivery from the management interface to QEMU and virtual machine image files, including password1 and password2. When creating a virtual machine, the user enters password1 and password2 from the management interface. After the password1 and password2 entered by the user are confused with the salt value, they are passed to QEMU and the virtual machine monitoring layer libvirtd through the SSL tunnel of the HTTPS protocol. After receiving password1, the virtual machine monitoring layer libvirtd performs the following operations: generates a virtual machine definition file, creates a virtual machine image key file, and stores the key file in base64 encoded form. Password2 is not saved in any system file. Every time the virtual machine is started, the user needs to re-enter password2. The key interaction module can ensure the security of the key during the transmission and storage process, and effectively prevent unauthorized access.

[0111] The key management module is used to save the key hash value of the image initialization key. The image initialization key is saved in the definition file and the key file of the virtual machine respectively in the form of a key hash value. When the virtual machine is started, the key hash value in the virtual machine definition file and the key hash value in the key file are compared to determine whether the file key is correct.

[0112] The distributed cache module is used to save the image data encryption key; it is saved in the form of a key-value pair, where the key is the UUID of the virtual machine and the value is the internal index of the encryption machine and the image data encryption key; when the virtual machine is shut down, the key management module is called to clear the image data encryption key saved in the distributed cache.

[0113] The encryption machine index management module is used to use the cache write interface to write the encryption key corresponding to the encrypted virtual machine; use the cache query interface to query the encryption machine internal index corresponding to the encrypted virtual machine, where the encryption machine internal index is used to call the encryption machine's SM4 algorithm to encrypt the random master key in the image.

[0114] The sample code of the encryption machine index management module is as follows:

[0115]

[0116]

[0117]

[0118] When creating a virtual machine, the encryption machine index management module saves the following information as key-value pairs in the distributed cache: virtual machine information (the virtual machine's uuid, the encryption and decryption key index value used inside the encryption machine, and the image encryption key password2) and the key-value pair storage format (the key is the virtual machine's uuid and the value is a JSON object containing password2 and the encryption machine index). The format is "{"password2": virtual machine image encryption key, "index": encryption machine encryption index}". When the virtual machine is started, the encryption machine index management module queries the distributed cache according to the virtual machine's uuid to obtain the corresponding encryption machine index and password2. Through these steps, the key information of the virtual machine can be effectively managed to ensure its security and availability.

[0119] The virtual machine event monitoring module is used to monitor the status of all virtual machines through the virtual machine monitor event HOOK interface; when the virtual machine is shut down, the interface provided by the key management module is called to clear the image data encryption key stored in the distributed cache, and the interface provided by the encryption machine summary generation module is called to generate the data hash value of the virtual machine image file and write it into the image header file.

[0120] The encryption machine summary generation module is used to provide a summary generation interface for calling the encryption machine, and is used to write the data hash value into the summary field of the virtual machine image file header structure after the write operation is completed or the virtual machine event monitoring module monitors that the virtual machine is shut down.

[0121] The encryption machine interface is used to encapsulate all the algorithms of the encryption machine. By modifying the IP address and encryption parameters in the configuration file, it provides the encryption machine's summary generation interface and data encryption interface, including symmetric encryption and decryption and asymmetric encryption and decryption.

[0122] The encryption machine data encryption and decryption module is used to use the encryption machine internal index corresponding to the virtual machine in the distributed cache to call the encryption machine's SM4 algorithm or SM2 algorithm to encrypt data, and the encrypted data is returned to the QEMU tool through the interface.

[0123] The sample code of the encryption machine data encryption and decryption module can be as follows:

[0124]

[0125]

[0126]

[0127]

[0128]

[0129] The encryption machine data encryption and decryption module encrypts and decrypts the virtual machine data by calling the encryption machine interface, and writes the result into the virtual machine image file.

[0130] The local operating system summary generation module is used to call the PBKDF2 algorithm provided by the local operating system to generate the key hash value of the image initialization key, write it into the image header file, and provide an interface for the QEMU tool to call.

[0131] The sample code of the local operating system summary generation module can be as follows:

[0132]

[0133]

[0134] The local operating system summary generation module receives a key as a parameter input from the user. The libgcrypt function library of the operating system is used for encryption operations. The input key is obfuscated with a salt value nsalt to enhance security. The obfuscated key is hashed for iterations times. Finally, a summary value out is generated as the result of the encryption process. Through the above steps, the security of the key can be effectively improved and simple keys can be prevented from being cracked.

[0135] The local operating system data encryption and decryption module is used to call the SM4 symmetric encryption algorithm provided by the local operating system and use the target key to encrypt and decrypt the QCOW2 file.

[0136] The sample code of the local operating system data encryption and decryption module may be as follows:

[0137]

[0138]

[0139]

[0140]

[0141] The local operating system data encryption and decryption module is responsible for implementing data encryption and decryption of the local operating system. You can use the encryption and decryption function library of the local operating system, such as libgcrypt. Pass in the symmetric encryption method gcryalg and encryption mode gcrymode. Use the above passed parameters to perform symmetric encryption and decryption operations on the data through the libgcrypt library. The local operating system data encryption and decryption module can effectively implement secure encryption and decryption processing of data.

[0142] The encryption machine is used to provide encryption key index initialization, SM4 symmetric key encryption and decryption, and SM3 summary generation functions; it provides a calling interface so that the QEMU tool can call the encryption machine to implement SM4 symmetric encryption and decryption and SM3 summary generation of data.

[0143] The encryption and decryption system based on the collaboration of the encryption machine and the operating system provided in the embodiment of the present invention realizes the following functions and advantages by encrypting and decrypting the virtual machine image through the collaboration of the remote encryption service and the local computing unit:

[0144] Rapid creation of virtual machine images: Through the collaboration of remote encryption services and local computing units, virtual machine image files can be quickly generated, improving the efficiency of virtual machine deployment.

[0145] Creation of virtual machine snapshots: Supports the creation of encrypted virtual machine snapshots to ensure that data is stored in encrypted form when taking snapshots, ensuring data security.

[0146] Reading and writing of virtual machine image files: Realize efficient reading and writing of encrypted virtual machine image files, encrypt and decrypt data through remote encryption services, and ensure the security of data during transmission and storage.

[0147] Virtual machine migration: Supports hot migration of encrypted virtual machines, that is, migrating encrypted virtual machines from one host to another without interrupting the operation of cloud services to ensure business continuity. Since the encryption index and image encryption key of the encryption machine corresponding to the virtual machine image are stored in the distributed cache, when performing virtual machine hot migration, the system reads the encryption machine index in the distributed cache and calls the encryption machine's preset decryption algorithm to obtain the encryption master key. Then, the target key is generated by performing a numerical conversion with the image encryption key in the distributed cache. The local operating system then uses the target key to perform the hot migration operation of the virtual machine. The entire migration process is consistent with the original virtual machine hot migration scenario.

[0148] Virtual machine backup and recovery: When performing virtual machine backup or recovery operations, data can be stored in encrypted form to prevent data leakage and enhance data protection.

[0149] User participation in virtual machine encryption and decryption: Allow users to participate in the encryption and decryption process of virtual machines, implement the "one virtual machine, one key" security policy, prevent administrators from unauthorized access to users' virtual machine data, and improve data privacy protection.

[0150] In the present invention, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0151] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0152] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0153] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. An encryption method based on the collaboration between an encryption machine and an operating system, characterized in that: include: Obtain the image initialization key and image data encryption key entered by the user when creating the virtual machine; Using the QEMU tool to randomly generate a random master key for the image initialization key; Generate a key hash value of the random master key, and save the key hash value to the image header file of the QCOW2 file of the virtual machine; Generate an encryption key based on the image initialization key; Searching or binding the encryption machine internal index corresponding to the encryption key in the distributed cache; Using the internal index of the encryption machine to call a preset encryption and decryption algorithm to encrypt the random master key, obtain an encrypted master key, and store the encrypted master key in the key slot of the LUKS header of the image header file; Performing numerical conversion based on the image data encryption key and the encryption master key to obtain a target key; On the local operating system, encrypting the data block of the QCOW2 file based on the target key and the preset encryption and decryption algorithm to obtain the encrypted data block; When the writing of each encrypted data block is completed, a hash calculation is performed on each encrypted data block to generate a data hash value, and the data hash value is written into the mirror header file.

2. The encryption method according to claim 1, characterized in that: The preset encryption and decryption algorithm is the SM4 algorithm.

3. The encryption method according to claim 1, characterized in that: Generating a key hash value of the random master key includes: A key hash value of the random master key is generated using the PBKDF2 key derivation function.

4. The encryption method according to claim 1, characterized in that: The generating an encryption key based on the image initialization key comprises: The image initialization key is input into the PBKDF2 key derivation function to generate an encryption key.

5. The encryption method according to claim 1, characterized in that: The step of performing hash calculation on each of the encrypted data blocks to generate a data hash value includes: The SM3 algorithm is used to perform hash calculation on each of the encrypted data blocks to generate a data hash value.

6. The encryption method according to claim 1, characterized in that: The image data encryption key is stored in the distributed cache, and the method further includes: After the virtual machine is shut down, the image data encryption key in the distributed cache is cleared.

7. The encryption method according to claim 1, characterized in that: After writing the data hash value into the image header file, the method further includes: Obtaining a backup instruction for the QCOW2 file; In response to the backup instruction, an encryption mark is added to the QCOW2 file, and it is identified whether the QCOW2 file carries the encryption mark. If so, the decryption process of each encrypted data block in the QCOW2 file is skipped, and the QCOW2 file is transferred to the target backup path.

8. The encryption method according to claim 7, characterized in that: After the QCOW2 file is transferred to the target backup path, the method further includes: Obtaining a recovery instruction for the QCOW2 file; In response to the recovery instruction, it is identified whether the QCOW2 file in the backup target carries the encryption mark. If so, the decryption process of each encrypted data block in the QCOW2 file is skipped, and the QCOW2 file is transmitted to the target recovery path.

9. A decryption method based on the collaboration between an encryption machine and an operating system, characterized in that: include: Obtain the image initialization key and image data encryption key entered by the user when creating the virtual machine; Read the first key hash value, the first data hash value and the encryption master key in the key slot of the LUKS header in the image header file of the QCOW2 file of the virtual machine; Generate an encryption key based on the image initialization key; Searching for an encryption machine internal index corresponding to the encryption key in a distributed cache; Using the internal index of the encryption machine to call the preset encryption and decryption algorithm to decrypt the encrypted master key to obtain a random master key; Generate a second key hash value of the random master key; Compare the second key hash value with the first key hash value to see whether they are consistent, and if so, perform numerical conversion based on the mirror data encryption key and the encryption master key to obtain a target key; Performing hash calculation on each encrypted data block in the QCOW2 file on the local operating system to generate a second data hash value; Compare the second data hash value with the first data hash value to see if they are consistent. If so, use the target key and the preset encryption and decryption algorithm to decrypt each of the encrypted data blocks to obtain the decrypted data blocks.

10. An encryption and decryption system based on the collaboration of an encryption machine and an operating system, characterized in that: include: QEMU tool, key interaction module, key management module, distributed cache module, virtual machine event monitoring module, encryption machine interface and encryption machine, wherein the QEMU tool includes an encryption machine index management module, an encryption machine summary generation module, an encryption machine data encryption and decryption module, a local operating system summary generation module and a local operating system data encryption and decryption module, The QEMU tool is used to encrypt and decrypt the random master key in the image header file of the QCOW2 file of the virtual machine and generate a data hash value of the virtual machine data through the encryption machine index management module and the encryption machine data encryption and decryption module, and save the data hash value into the image header file; generate a key hash value of the random master key by calling the local operating system summary generation module, and save the key hash value into the image header file, encrypt and decrypt the virtual machine data by calling the local operating system data encryption and decryption module, and perform numerical conversion based on the image data encryption key and the encryption master key to obtain the target key; The key interaction module is used to obtain the image initialization key and the image data encryption key input by the user when creating the virtual machine, wherein the image initialization key is stored in the virtual host definition file of the virtual host management module, and the image data encryption key is stored in the distributed cache file system and is cleared from the cache after the virtual machine is shut down; The key management module is used to save the key hash value of the image initialization key, which is saved in the definition file and the key file of the virtual machine respectively in the form of a key hash value; when starting the virtual machine, the key hash value in the virtual machine definition file is compared with the key hash value in the key file to determine whether the file key is correct; The distributed cache module is used to store the image data encryption key; it is stored in the form of a key-value pair, the key is the UUID of the virtual machine, and the value is the internal index of the encryption machine and the image data encryption key; when the virtual machine is shut down, the key management module is called to clear the image data encryption key stored in the distributed cache; The encryption machine index management module is used to use the cache write interface to write the encryption key corresponding to the encryption virtual machine; use the cache query interface to query the encryption machine internal index corresponding to the encryption virtual machine, wherein the encryption machine internal index is used to call the random master key in the encryption image of the SM4 algorithm of the encryption machine; The virtual machine event monitoring module is used to monitor the status of all virtual machines through the virtual machine monitor event HOOK interface; when the virtual machine is shut down, the interface provided by the key management module is called to clear the image data encryption key stored in the distributed cache, and the interface provided by the encryption machine summary generation module is called to generate the data hash value of the virtual machine image file, and write it into the image header file; The encryption machine summary generation module is used to provide a summary generation interface for calling the encryption machine, and is used to write the data hash value into the summary field of the virtual machine image file header structure after the write operation is completed or the virtual machine event monitoring module monitors that the virtual machine is shut down; The encryption machine interface is used to encapsulate all algorithms of the encryption machine, and provide a summary generation interface and a data encryption interface of the encryption machine by modifying the IP address and encryption parameters in the configuration file, including symmetric encryption and decryption and asymmetric encryption and decryption; The encryption machine data encryption and decryption module is used to call the SM4 algorithm or SM2 algorithm of the encryption machine to encrypt data using the internal index of the encryption machine corresponding to the virtual machine in the distributed cache, and the encrypted data is returned to the QEMU tool through the interface; The local operating system summary generation module is used to call the PBKDF2 algorithm provided by the local operating system to generate a key hash value of the image initialization key, write it into the image header file, and provide an interface for the QEMU tool to call; The local operating system data encryption and decryption module is used to call the SM4 algorithm provided by the local operating system and use the target key to encrypt and decrypt the QCOW2 file; The encryption machine is used to provide encryption key index initialization, SM4 symmetric key encryption and decryption, and SM3 summary generation functions; a calling interface is provided so that the QEMU tool calls the encryption machine to implement SM4 symmetric encryption and decryption and SM3 summary generation of data.

Images