Encryption method, decryption method and system based on collaboration between encryption machine and operating system

Abstract

The present invention provides an encryption method, decryption method, and system based on collaboration between an encryption machine and an operating system, which are applicable to the field of cloud computing technology. By using a user-entered image initialization key and image data encryption key, combined with a remote encryption machine and a local operating system, the present invention implements image file data encryption and integrity verification, improving the data encryption and decryption performance of virtual machine image files while ensuring data and key security.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to an encryption method, a decryption method and a system based on collaboration between an encryption machine and an operating system. Background Art

[0002] With the widespread adoption of cloud computing, data security has become a common concern for cloud vendors and users. Effective encryption and decryption are essential to protecting the vast amounts of data stored on cloud platforms. However, ensuring data security while not impacting the normal operation of cloud services is a pressing challenge for cloud vendors. In virtualized environments, the security of image data stored in QEMU (Quick Emulator), a commonly used virtual machine management tool, is particularly crucial.

[0003] Existing QEMU encryption and decryption methods have numerous shortcomings: 1. Inadequate key protection: In QEMU's built-in encryption and decryption methods, keys are stored in plaintext, lacking effective protection measures. This can easily lead to key leakage, posing a significant security risk. 2. Performance impact: Existing technologies primarily rely on encryption cards or encryption machines to encrypt all data, which significantly impacts virtual machine performance. Due to the limitations of the encryption card's PCI slot and performance specifications, virtual machine migration is also significantly restricted. 3. High resource usage: These technologies consume a high amount of server resources during the encryption process, further impacting system stability and performance.

[0004] Therefore, how to improve the data encryption and decryption performance of virtual machine image files has become a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0005] In view of the above problems, the present invention provides an encryption method, decryption method and system based on the collaboration between an encryption machine and an operating system to overcome the above problems or at least partially solve the above problems. The technical solution is as follows:

[0006] The present invention provides an encryption method, a decryption method, and a system based on the collaboration of an encryption machine and an operating system. Regarding the encryption process, the user enters an image initialization key and an image data encryption key when creating a virtual machine. The QEMU tool is used to randomly generate a master key for the image initialization key, and its key hash value is generated and saved in the QCOW2 image header file of the virtual machine. An encryption key is generated based on the image initialization key. The internal index of the encryption machine corresponding to the encryption key is searched or bound in the distributed cache. The encryption algorithm is called using the internal index of the encryption machine to encrypt the random master key, generate an encryption master key, and store it in the LUKS header key slot of the image header file. Numerical conversion is performed based on the image data encryption key and the encryption master key to obtain a target key. On the local operating system, the data block of the QCOW2 file is encrypted based on the target key and a preset encryption and decryption algorithm. The encrypted data block is hashed to generate a data hash value, and the hash value is written to the image header file. The image data encryption key is stored in the distributed cache, and the key in the cache is cleared after the virtual machine is shut down. During backup and recovery operations, it is identified whether the QCOW2 file carries an encryption mark to skip the decryption process of the encrypted data block. For the decryption process: Read the key and data hash value from the virtual machine's QCOW2 file. Generate an encryption key and look up the corresponding encryption engine internal index. Use the encryption engine internal index to decrypt the encryption master key, obtain a random master key, and perform hash value verification. Perform a numerical conversion based on the image data encryption key and the encryption master key to obtain the target key. Decrypt the encrypted data block in the QCOW2 file. System Components: The QEMU tool is used to encrypt and decrypt the virtual machine's QCOW2 file and generate and save data hash values. The key interaction module obtains the image initialization key and image data encryption key entered by the user. The key management module saves and manages key hash values ​​and verifies the correctness of file keys. The distributed cache module saves the image data encryption key and clears the cache when the virtual machine is shut down. The encryption engine index management module manages the encryption engine internal index and performs encryption key queries and writes. The virtual machine event monitoring module monitors the virtual machine status and triggers relevant operations when the virtual machine is shut down. The encryption engine digest generation module provides an interface for writing data hash values ​​into the virtual machine image file header. The encryption engine interface encapsulates all encryption engine algorithms and provides encryption and digest generation interfaces. Encryption Machine Data Encryption and Decryption Module: Uses the encryption machine's SM4 algorithm to encrypt and decrypt data. Local Operating System Digest Generation Module: Uses the PBKDF2 algorithm to generate key hash values ​​and provides an interface to the QEMU tool. Local Operating System Data Encryption and Decryption Module: Uses the local operating system's SM4 algorithm to encrypt and decrypt QCOW2 files. Encryption Machine: Provides encryption key index initialization, SM4 symmetric key encryption and decryption, and SM3 digest generation.

[0007] By means of the above technical solution, the encryption method, decryption method, and system based on the collaboration between the encryption machine and the operating system provided by the present invention significantly improve the performance of data encryption and decryption through the synergy between the remote encryption machine and the local operating system, while strengthening the security protection of keys and data and avoiding the risk of plaintext key leakage. In addition, since the scale of the encrypted virtual machine is no longer limited by the server hardware, users can achieve horizontal expansion and stable operation of the encrypted virtual machine by increasing the number of encryption machines and applying high-availability encryption service technology. This method not only improves the efficiency and data security of virtual machine image file encryption and decryption, but also provides a flexible and scalable solution without affecting the normal operation of cloud services.

[0008] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0010] Figure 1 A flow chart illustrating an implementation of an encryption method based on collaboration between an encryption machine and an operating system provided by an embodiment of the present invention is shown;

[0011] Figure 2 The embodiment of the present invention further provides a flowchart of an implementation of a decryption method based on collaboration between an encryption machine and an operating system;

[0012] Figure 3 The schematic diagram shows the structure of the encryption and decryption system based on the collaboration of the encryption machine and the operating system. DETAILED DESCRIPTION

[0013] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0014] The encryption method, decryption method and system based on the collaboration of the encryption machine and the operating system provided by the present invention can significantly improve the performance of data encryption and decryption through the collaborative effect of the remote encryption machine and the local operating system, while strengthening the security protection of keys and data and avoiding the risk of plaintext key leakage. In addition, since the scale of the encrypted virtual machine is no longer limited by the server hardware, users can achieve horizontal expansion and stable operation of the encrypted virtual machine by increasing the number of encryption machines and applying high-availability encryption service technology. This method not only improves the efficiency and data security of virtual machine image file encryption and decryption, but also provides a flexible and scalable solution without affecting the normal operation of cloud services, and has broad application prospects. For the local operating system, encryption and decryption are performed collaboratively using remote encryption services and local computing units, without the need to install drivers on the server, and can be adapted to various operating systems.

[0015] The encryption method and decryption method provided by the embodiment of the present invention for collaboration between the encryption machine and the operating system combine the computing power of the encryption machine and the local operating system, and have the following characteristics: Fast encryption and decryption: It realizes fast encryption and decryption of virtual machines in the information innovation environment, and fully utilizes the computing power of the local operating system and the encryption machine. One virtual machine corresponds to one key: Each virtual machine corresponds to a unique key, which enhances security. User participation: User participation is required for virtual machine encryption and decryption to prevent unauthorized data leakage. Horizontal expansion capability: It supports horizontal expansion of the computing power of the encryption machine, increases the maximum supported scale of the encrypted virtual machine and the speed of data encryption and decryption. Breakthrough performance bottleneck: It solves the performance bottleneck problem caused by the performance limitations of the local server PCI slot and encryption card. Optimize performance: It provides a method for collaborative encryption and decryption, reduces the performance loss in the encryption and decryption process, and improves the user experience of cloud users. Through these improvements, the present invention improves the efficiency of virtual machine encryption and decryption and user experience while ensuring data security.

[0016] QEMU QCOW2 is a powerful virtual disk image format widely used in virtualization platforms, offering features such as dynamic disk space allocation, snapshot creation, data compression, and built-in encryption. LUKS (Linux Unified Key Setup) is the standard disk encryption solution for Linux systems, providing a powerful encryption algorithm, support for multiple key slots, and consistent key management to ensure data security and flexibility.

[0017] Combining QCOW2 with LUKS allows you to create encrypted virtual disk images in virtualized environments. This combination not only leverages QCOW2's storage space savings and snapshot capabilities, but also ensures data security within the virtual disk through the data encryption provided by LUKS. It is ideal for virtualization scenarios that require high security and flexibility.

[0018] Building on this foundation, the present invention utilizes the encryption and decryption capabilities of the encryption engine and the local operating system to achieve secure and efficient encryption and decryption of virtual machine image files. This approach combines the advantages of QCOW2 and LUKS, further improving the security and processing efficiency of virtual disk images and providing a reliable solution for virtualization applications.

[0019] like Figure 1 As shown, a flowchart of an implementation of an encryption method based on collaboration between an encryption machine and an operating system provided by an embodiment of the present invention is provided. The encryption method may include:

[0020] S100: Obtain an image initialization key and an image data encryption key input by a user when creating a virtual machine.

[0021] The image initialization key is a key that is input by the user when creating a virtual machine and is used to initialize the encryption process of the virtual machine image.

[0022] The image data encryption key is the key that the user enters when creating a virtual machine and is used to actually encrypt data.

[0023] S110. Use the QEMU tool to randomly generate a random master key for the image initialization key.

[0024] Among them, the QEMU tool is an open source emulator and virtual machine manager tool used to create and manage virtual machine images.

[0025] The random master key is a highly random and unpredictable value, which is used to further encrypt and protect the image initialization key.

[0026] Specifically, the embodiment of the present invention can utilize the qemu-img component in the QEMU tool to generate a random master key through a random number generator (such as / dev / urandom or / dev / random on a Unix-like system).

[0027] S120: Generate a key hash value of the random master key, and save the key hash value to the image header file of the QCOW2 file of the virtual machine.

[0028] The key hash value is a value obtained by hashing the random master key.

[0029] QCOW2 (QEMUCopy On Write version 2) files are a QEMU image file format. The image header file is part of the QCOW2 file and is used to store image-related metadata, including keys and encryption information.

[0030] S130: Generate an encryption key based on the image initialization key.

[0031] S140: Search or bind the encryption machine internal index corresponding to the encryption key in the distributed cache.

[0032] The encryption machine internal index is an internal identifier used in the encryption machine to identify and call a preset encryption and decryption algorithm.

[0033] Specifically, an embodiment of the present invention can search for the encryption machine internal index corresponding to the encryption key in the distributed cache. If found, the encryption machine internal index is returned. If not found, the encryption key is bound to the unbound encryption machine internal index and the encryption machine internal index is returned.

[0034] S150: Use the internal index of the encryption machine to call the preset encryption and decryption algorithm to encrypt the random master key, obtain the encrypted master key, and store the encrypted master key in the key slot of the LUKS header of the image header file.

[0035] The LUKS header is used to store metadata for disk encryption and contains multiple key slots. The LUKS header contains metadata about the encrypted volume, such as encryption key information, key slots, salt value, and iteration count.

[0036] S160: Perform numerical conversion based on the image data encryption key and the encryption master key to obtain a target key.

[0037] Specifically, the embodiment of the present invention may combine the mirror data encryption key and the encryption master key into a target key.

[0038] S170 : On the local operating system, encrypt the data block of the QCOW2 file based on the target key and a preset encryption and decryption algorithm to obtain an encrypted data block.

[0039] S180 . When the writing of each encrypted data block is completed, perform hash calculation on each encrypted data block to generate a data hash value, and write the data hash value into the image header file.

[0040] The encryption method based on the collaboration of the encryption machine and the operating system provided in the embodiment of the present invention, through a series of complex encryption operations and data management steps, collaboratively utilizes the encryption and decryption capabilities of the encryption machine and the local operating system to ensure the high security and integrity of the virtual machine image file data, thereby improving the data encryption and decryption performance of the virtual machine image file.

[0041] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, the preset encryption and decryption algorithm is the SM4 algorithm.

[0042] The embodiments of the present invention utilize the SM4 algorithm to facilitate processing of independent, short data blocks, thereby improving encryption processing efficiency and effectively preventing data leakage. Alternatively, the embodiments of the present invention may utilize the ECB mode or XTS mode of the SM4 algorithm to encrypt the random master key and the data blocks of the QCOW2 file.

[0043] Optional, in the above Figure 1 Based on one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, generating a key hash value of a random master key may specifically include:

[0044] Generates a key hash value for a random master key using the PBKDF2 key derivation function.

[0045] The PBKDF2 (Password-Based Key Derivation Function 2) key derivation function is a password-based key derivation function. The PBKDF2 key derivation function works by taking the following input parameters: Password: The password entered by the user. Salt: A randomly generated value. Iterations: The number of times the hash operation is repeated. Output key length: The desired key length. Initialization: An initial hash operation is performed on the password and salt. Multiple iterations: The initial hash value is repeatedly hashed for a user-specified number of iterations. The output of each iteration serves as the input for the next iteration. Final output: After multiple iterations, a derived key is generated with a length specified by the user.

[0046] The embodiments of the present invention utilize the PBKDF2 key derivation function through multiple iterations and the use of salt values ​​to adapt to different security requirements and encryption algorithms, increase the difficulty for attackers to crack the key, prevent exhaustive attacks and pre-computation attacks, and improve the security, flexibility, compatibility, and integrity of the key hash value.

[0047] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, generating an encryption key based on the image initialization key may specifically include:

[0048] Input the image initialization key into the PBKDF2 key derivation function to generate an encryption key.

[0049] The embodiment of the present invention inputs the mirror initialization key into the PBKDF2 key derivation function to generate an encryption key, which not only improves the security of the key and the flexibility of the system, but also ensures the standardization of the system and the security of data processing.

[0050] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, performing hash calculation on each encrypted data block to generate a data hash value may specifically include:

[0051] Use the SM3 algorithm to perform hash calculations on each encrypted data block to generate a data hash value.

[0052] Among them, the SM3 algorithm is a cryptographic hash function algorithm.

[0053] The embodiment of the present invention enhances the data integrity and tamper resistance of the data hash value by utilizing the irreversibility and collision resistance of the SM3 algorithm.

[0054] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, the image data encryption key is stored in a distributed cache, and after the virtual machine is shut down, the image data encryption key in the distributed cache is cleared.

[0055] The embodiment of the present invention significantly reduces the risk of image data encryption key leakage and improves the overall security of data by storing the image data encryption key in a distributed cache and clearing it in time after the virtual machine is shut down.

[0056] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, another optional embodiment provided by the embodiment of the present invention may further include, after writing the data hash value into the image header file:

[0057] Obtain a backup instruction for the QCOW2 file; in response to the backup instruction, add an encryption mark to the QCOW2 file, and identify whether the QCOW2 file carries the encryption mark. If so, skip the decryption process of each encrypted data block in the QCOW2 file and transfer the QCOW2 file to the target backup path.

[0058] Specifically, when a backup command is triggered, an embodiment of the present invention checks whether the QCOW2 file to be backed up is encrypted. If the check result indicates that the file is encrypted, the "ENCRYPT_BACKUP" flag is set for the QCOW2 file. During the backup process, it is necessary to read the data of the QCOW2 file in order to store it in the target backup path, and the QCOW2 file is checked to see if it has the "ENCRYPT_BACKUP" flag. If the QCOW2 file has the "ENCRYPT_BACKUP" flag, the QCOW2 file is deemed encrypted, and therefore no decryption operation is performed on it. Instead, the original file reading process is used to directly read and back up the encrypted data of the QCOW2 file.

[0059] For example: suppose there is a virtual disk file of a virtual machine (such as a QCOW2 file), which has been encrypted by LUKS. The embodiment of the present invention can scan the QCOW2 file to be backed up, find that the QCOW2 file contains a LUKS header, determine that the QCOW2 file is encrypted, and set the "ENCRYPT_BACKUP" mark for the file to indicate that the QCOW2 file is encrypted. During the backup process, when the QCOW2 file is read, the "ENCRYPT_BACKUP" mark will be detected. At this time, no attempt will be made to decrypt the QCOW2 file, but the encrypted data will be read directly. The read encrypted data is directly stored in the backup target, maintaining the encryption status of the data. The introduction of the "ENCRYPT_BACKUP" mark in the backup process helps to intelligently process encrypted files, avoid unnecessary decryption steps, improve backup efficiency, and ensure the security of data during the backup process. By identifying and processing the special needs of encrypted files, the "ENCRYPT_BACKUP" mark helps maintain data consistency and confidentiality.

[0060] The embodiment of the present invention avoids repeated decryption and re-encryption by adding an encryption mark to the QCOW2 file, identifying the mark and skipping the decryption operation during the backup process, thereby reducing the processing load of the system, saving computing resources, improving the overall efficiency of the backup operation, and avoiding potential decryption risks and data leakage.

[0061] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, another optional embodiment provided by the embodiment of the present invention may further include, after the QCOW2 file is transferred to the target backup path:

[0062] Obtain a restore instruction for the QCOW2 file; in response to the restore instruction, identify whether the QCOW2 file in the backup target carries an encryption mark. If so, skip the decryption process of each encrypted data block in the QCOW2 file and transfer the QCOW2 file to the target recovery path.

[0063] Specifically, according to the instructions of the recovery command entry, this embodiment of the present invention reads the QCOW2 file to be restored from backup storage. It then checks whether the QCOW2 file to be restored has the "ENCRYPT_BACKUP" flag. If the "ENCRYPT_BACKUP" flag is detected, no encryption or decryption operations are performed, and the original data is directly read. The read data is then transferred to the target recovery path. This process may involve operations such as decompression and decryption, but if the "ENCRYPT_BACKUP" flag is present, these operations are skipped.

[0064] For example: suppose an encrypted QCOW2 file needs to be restored from a backup. The user can submit a recovery request at the recovery command entry and specify the encrypted QCOW2 file that needs to be restored. When it is detected that the QCOW2 file is encrypted, the "ENCRYPT_BACKUP" flag is set. Initialize the recovery environment and parameters. Start reading the QCOW2 file in the backup storage at the read file entry. When the "ENCRYPT_BACKUP" flag is detected, it is known that the QCOW2 file is encrypted, so no encryption or decryption operation is performed, and the encrypted data of the read QCOW2 file is directly transferred to the target recovery path. Through the collaborative work of these two entries, the embodiment of the present invention enables the recovery system to efficiently perform data recovery operations and perform appropriate processing based on specific tags to ensure the security and integrity of the data recovery process.

[0065] This embodiment of the present invention ensures that data remains encrypted during the data recovery process by identifying encryption markers and skipping decryption operations, thus avoiding potential decryption risks and data leaks. Furthermore, repeated decryption and re-encryption operations are avoided, reducing computing resource consumption and recovery time, thereby improving the overall efficiency and speed of data recovery.

[0066] To facilitate understanding of the encryption method based on collaboration between the encryption machine and the operating system provided in an embodiment of the present invention, an example is provided here: When creating a virtual machine, the user enters the image initialization key password1 and the image data encryption key password2. Qemu obtains and processes these keys, generates a random master key master_key1 for the image initialization key password1, and then generates a key hash value master_key1_digest of the random master key master_key1 and saves it to the QCOW2 image header file. Based on the image initialization key password1, the encryption key slot_key is derived, and the encryption machine internal index key_index1 is searched or bound in the distributed cache. The SM4 ECB algorithm is called using key_index1 to encrypt the random master key master_key1, and the encrypted encryption master key is stored in the key slot of the LUKS header. The user enters the image data encryption key password2, and after performing a numerical conversion with the encryption master key, the target key masterkey2 is generated. The target key masterkey2 is used to call the local operating system's SM4 ECB encryption algorithm to encrypt the data block. After the write operation of all data blocks is completed, the SM3 algorithm of the encryption machine is called to calculate the hash value of all data and write the hash value into the QCOW2 image header file.

[0067] and Figure 1 The encryption method shown is adapted, such as Figure 2 As shown, the embodiment of the present invention also provides a flowchart of an implementation of a decryption method based on collaboration between an encryption machine and an operating system. The decryption method may include:

[0068] S200: Obtain an image initialization key and an image data encryption key input by a user when creating a virtual machine.

[0069] S210 : Read the first key hash value, the first data hash value, and the encryption master key in the key slot of the LUKS header in the image header file of the QCOW2 file of the virtual machine.

[0070] S220: Generate an encryption key based on the image initialization key.

[0071] S230: Search the distributed cache for an encryption machine internal index corresponding to the encryption key.

[0072] S240. Use the internal index of the encryption machine to call the preset encryption and decryption algorithm to decrypt the encrypted master key to obtain a random master key.

[0073] S250: Generate a second key hash value of the random master key.

[0074] S260: Compare the second key hash value with the first key hash value to see if they are consistent. If so, execute step S261.

[0075] S261. Perform numerical conversion based on the image data encryption key and the encryption master key to obtain a target key.

[0076] S270: Perform hash calculation on each encrypted data block in the QCOW2 file on the local operating system to generate a second data hash value.

[0077] S280: Compare the second data hash value with the first data hash value to see if they are consistent. If yes, execute step S281.

[0078] S281. Decrypt each encrypted data block using the target key and a preset encryption / decryption algorithm to obtain a decrypted data block.

[0079] It is understandable that the encryption and decryption algorithm systems used in the decryption method and encryption method provided in the embodiment of the present invention also use the same hash calculation method.

[0080] The decryption method based on the collaboration between the encryption machine and the operating system provided in the embodiment of the present invention, through a series of complex decryption operations and key management steps, collaboratively utilizes the encryption and decryption capabilities of the encryption machine and the local operating system, which not only improves the security, integrity and reliability of virtual machine data, but also optimizes key management and data decryption processes, ensuring data security and stable system operation in complex environments.

[0081] Optionally, the preset encryption and decryption algorithm is the SM4 algorithm. In the embodiment of the present invention, the ECB mode or the XTS mode of the SM4 algorithm can be used to decrypt the encrypted master key and the data block of the QCOW2 file.

[0082] Optional, in the above Figure 2 Based on one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, generating a key hash value of a random master key may specifically include:

[0083] Generates a key hash value for a random master key using the PBKDF2 key derivation function.

[0084] Optional, in the above Figure 2 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, generating an encryption key based on the image initialization key may specifically include:

[0085] Input the image initialization key into the PBKDF2 key derivation function to generate an encryption key.

[0086] Optional, in the above Figure 2On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, a hash calculation is performed on each encrypted data block in the QCOW2 file on the local operating system to generate a second data hash value.

[0087] The SM3 algorithm is used on the local operating system to perform a hash calculation on each encrypted data block in the QCOW2 file to generate a second data hash value.

[0088] To facilitate understanding of the decryption method based on collaboration between the encryption machine and the operating system provided in an embodiment of the present invention, an example is provided here to illustrate: Obtain the user-input image initialization key password1 and the image data encryption key password2. Read the LUKS header, and read the key hash value master_key1_digest of the random master key master_key1 in the LUKS header containing the encrypted information of the random master key master_key1 and the key slot, as well as the salt value and number of iterations used to generate the key hash value master_key1_digest. Derive the key, using PBKDF2 to input the image initialization key password1 to generate the encryption key slot_key for the encryption master key. Image the encryption machine index, and search the distributed cache for the encryption machine internal index key_index1 corresponding to the encryption key slot_key. If not found, directly return an error; if found, return the encryption machine internal index key_index1. Decrypt the master key: Use the encryption machine internal index key_index1 to call the encryption machine SM4ECB algorithm to decrypt the encryption master key in the key slot. Verify the master key hash value. Use PBKDF2 to generate the key hash value (master_key1_digest) of the random master key (master_key1). Compare this hash value with the `master_key1_digest` stored in the QCOW2 header. If they are inconsistent, the key is incorrect. If they are consistent, the data encryption key (password2) is mirrored and converted numerically with the encryption master key to generate the target key (masterkey2). The encryptor uses the SM3 algorithm to calculate the hash value of the entire QCOW2 file. Compare the generated hash value with the stored hash value to verify data integrity. If complete, proceed to the next step. If incomplete, exit. Decrypt the data block using the target key (masterkey2).

[0089] The encryption and decryption method based on the collaboration of the encryption machine and the operating system provided in the embodiment of the present invention not only improves data security and operational efficiency in a virtualized environment, but also ensures data integrity and security in various operations (such as snapshots, migration, backup and recovery), meeting the high requirements for data protection in a cloud computing environment.

[0090] Although the operations are depicted in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order.Multitasking and parallel processing may be advantageous under certain circumstances.

[0091] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0092] The embodiment of the present invention also provides an encryption and decryption system based on the collaboration of an encryption machine and an operating system, the structure of which is as follows: Figure 3 As shown, it includes: QEMU tool, key interaction module, key management module, distributed cache module, virtual machine event monitoring module, encryption machine interface and encryption machine, among which the QEMU tool includes encryption machine index management module, encryption machine summary generation module, encryption machine data encryption and decryption module, local operating system summary generation module and local operating system data encryption and decryption module.

[0093] The QEMU tool is used to encrypt and decrypt the random master key in the image header file of the virtual machine's QCOW2 file and generate a data hash value of the virtual machine data through the encryption machine index management module and the encryption machine data encryption and decryption module, and save the data hash value to the image header file; generate a key hash value of the random master key by calling the local operating system summary generation module, and save the key hash value to the image header file; encrypt and decrypt the virtual machine data by calling the local operating system data encryption and decryption module, and perform numerical conversion based on the image data encryption key and the encryption master key to obtain the target key.

[0094] The functional test script for creating an encrypted virtual machine process can be as follows:

[0095] "sh–x. / create_secret_xml.sh${uuid}${volume}

[0096] secuuid=$(virshsecret-list|grep${volume}|cut-d""-f2)

[0097] virshsecret-define${uuid}.xml

[0098] sh-xsecret_set.sh${uuid}

[0099] qemu-imgcreate--objectsecret,id=sec0,data=${uuid}

[0100] -fqcow2-oencrypt.format=luks,encrypt.key-secret=sec0${volume}1G

[0101] sh-x. / create_domain_xml.sh${uuid}${volume}

[0102] virshdefinedomain_${uuid}.xml

[0103] virshstart${uuid}".

[0104] The QEMU tool creates an encryption key file using the image initialization key, password1. The required encryption and digest algorithms are defined to ensure data encryption and integrity. The qemu-img tool generates an initial master key, masterkey1, using random numbers. Masterkey1 is combined with the user-provided image data encryption key, password2, through numerical conversion to form the final encryption key, masterkey2. QEMU uses the resulting encryption key, masterkey2, to encrypt and decrypt virtual machine data, ensuring data security during storage and transmission. Through these steps, the system effectively protects virtual machine data and prevents unauthorized access.

[0105] The key interaction module is used to obtain the image initialization key and image data encryption key entered by the user when creating a virtual machine. The image initialization key is saved in the virtual host definition file of the virtual host management module, and the image data encryption key is saved in the distributed cache file system and is cleared from the cache after the virtual machine is shut down.

[0106] The sample code of the key interaction module can be as follows:

[0107]

[0108]

[0109]

[0110] The key interaction module's main function is to implement key transfer, including password1 and password2, from the management interface to QEMU and the virtual machine image file. When creating a virtual machine, the user enters password1 and password2 in the management interface. Password1 and password2 are obfuscated with a salt value and then passed to QEMU and the virtual machine monitor layer, libvirtd, via an SSL tunnel using the HTTPS protocol. After receiving password1, the virtual machine monitor layer, libvirtd, performs the following operations: generates a virtual machine definition file, creates a virtual machine image key file, and stores the key file in base64 encoding. Password2 is not saved in any system files. The user must re-enter password2 each time the virtual machine is started. The key interaction module ensures the security of keys during transfer and storage, effectively preventing unauthorized access.

[0111] The key management module is used to save the key hash value of the image initialization key. The image initialization key is saved in the virtual machine definition file and the key file respectively, and is saved in the form of a key hash value. When the virtual machine is started, the key hash value in the virtual machine definition file and the key hash value in the key file are compared to determine whether the file key is correct.

[0112] The distributed cache module is used to store the image data encryption key; it is stored in the form of a key-value pair, where the key is the UUID of the virtual machine and the value is the internal index of the encryption machine and the image data encryption key; when the virtual machine is shut down, the key management module is called to clear the image data encryption key stored in the distributed cache.

[0113] The encryption machine index management module is used to use the cache write interface to write the encryption key corresponding to the encrypted virtual machine; and use the cache query interface to query the encryption machine internal index corresponding to the encrypted virtual machine, where the encryption machine internal index is used to call the encryption machine's SM4 algorithm to encrypt the random master key in the image.

[0114] The sample code of the encryption machine index management module is as follows:

[0115]

[0116]

[0117]

[0118] When creating a virtual machine, the encryption machine index management module saves the following information as key-value pairs in the distributed cache: virtual machine information (the virtual machine's UUID, the encryption and decryption key index value used internally by the encryption machine, and the image encryption key password2) and the key-value pair storage format (the key is the virtual machine's UUID and the value is a JSON object containing password2 and the encryption machine index). The format is "{"password2": virtual machine image encryption key, "index": encryption machine encryption index}". When the virtual machine is started, the encryption machine index management module queries the distributed cache based on the virtual machine's UUID to obtain the corresponding encryption machine index and password2. Through these steps, the virtual machine's key information can be effectively managed to ensure its security and availability.

[0119] The virtual machine event monitoring module is used to monitor the status of all virtual machines through the virtual machine monitor event HOOK interface; when the virtual machine is shut down, the interface provided by the key management module is called to clear the image data encryption key stored in the distributed cache, and the interface provided by the encryption machine summary generation module is called to generate the data hash value of the virtual machine image file and write it into the image header file.

[0120] The encryption machine summary generation module is used to provide a summary generation interface for calling the encryption machine, and is used to write the data hash value into the summary field of the virtual machine image file header structure after the write operation is completed or the virtual machine event monitoring module monitors that the virtual machine is shut down.

[0121] The encryption machine interface is used to encapsulate all the algorithms of the encryption machine. By modifying the IP address and encryption parameters in the configuration file, it provides the encryption machine's summary generation interface and data encryption interface, including symmetric encryption and decryption and asymmetric encryption and decryption.

[0122] The encryption machine data encryption and decryption module is used to use the encryption machine internal index corresponding to the virtual machine in the distributed cache to call the encryption machine's SM4 algorithm or SM2 algorithm to encrypt data. The encrypted data is returned to the QEMU tool through the interface.

[0123] The sample code of the encryption machine data encryption and decryption module can be as follows:

[0124]

[0125]

[0126]

[0127]

[0128]

[0129] The encryption module encrypts and decrypts virtual machine data by calling the encryption interface and writes the result into the virtual machine image file.

[0130] The local operating system digest generation module is used to call the PBKDF2 algorithm provided by the local operating system to generate the key hash value of the image initialization key, write it into the image header file, and provide an interface for the QEMU tool to call.

[0131] The sample code for the local operating system summary generation module can be as follows:

[0132]

[0133]

[0134] The local operating system digest generation module receives a key as input from the user. It performs encryption using the operating system's libgcrypt library. It obfuscates the input key with a salt value, nsalt, to enhance security. It then performs a hash operation on the obfuscated key, iterations times. Finally, it generates a digest value, out, as the result of the encryption process. These steps effectively enhance key security and prevent simple keys from being cracked.

[0135] The local operating system data encryption and decryption module is used to call the SM4 symmetric encryption algorithm provided by the local operating system and use the target key to encrypt and decrypt QCOW2 files.

[0136] The sample code of the local operating system data encryption and decryption module can be as follows:

[0137]

[0138]

[0139]

[0140]

[0141] The local operating system data encryption and decryption module is responsible for implementing data encryption and decryption within the local operating system. It utilizes the local operating system's encryption and decryption libraries, such as libgcrypt. It passes in the symmetric encryption method gcryalg and the encryption mode gcrymode. Using these parameters, the libgcrypt library performs symmetric encryption and decryption of the data. This module effectively implements secure data encryption and decryption.

[0142] The encryption machine is used to provide encryption key index initialization, SM4 symmetric key encryption and decryption, and SM3 digest generation functions; it provides a calling interface so that the QEMU tool can call the encryption machine to implement SM4 symmetric encryption and decryption and SM3 digest generation of data.

[0143] The encryption and decryption system based on the collaboration between the encryption machine and the operating system provided by the embodiment of the present invention realizes the following functions and advantages by encrypting and decrypting virtual machine images through the collaboration between the remote encryption service and the local computing unit:

[0144] Rapid creation of virtual machine images: Through the collaborative work of remote encryption services and local computing units, virtual machine image files can be quickly generated, improving the efficiency of virtual machine deployment.

[0145] Creation of virtual machine snapshots: Supports the creation of encrypted virtual machine snapshots, ensuring that data is stored in encrypted form when taking snapshots to ensure data security.

[0146] Reading and writing virtual machine image files: Enable efficient reading and writing of encrypted virtual machine image files, encrypt and decrypt data through remote encryption services, and ensure data security during transmission and storage.

[0147] Virtual Machine Migration: Supports live migration of encrypted virtual machines, enabling the migration of encrypted virtual machines from one host to another without interrupting cloud services, ensuring business continuity. Since the encryption key and encryption key corresponding to the virtual machine image are stored in the distributed cache, during virtual machine live migration, the system retrieves the encryption key by reading the encryption key index from the distributed cache and calling the encryption key's preset decryption algorithm to obtain the encryption master key. The target key is then converted to the target key by comparing it with the image encryption key in the distributed cache. The local operating system then uses the target key to perform the virtual machine live migration. The entire migration process remains consistent with the existing virtual machine live migration scenario.

[0148] Virtual machine backup and recovery: When performing virtual machine backup or recovery operations, data can be stored in encrypted form to prevent data leakage and enhance data protection.

[0149] User participation in virtual machine encryption and decryption: Allows users to participate in the virtual machine encryption and decryption process, implementing the "one virtual machine, one key" security policy, preventing administrators from unauthorized access to user virtual machine data and improving data privacy protection.

[0150] In the present invention, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0151] Each embodiment in this specification is described in a related manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiment is generally similar to the method embodiment, so the description is relatively simple. For related parts, refer to the description of the method embodiment.

[0152] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

[0153] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention are included in the scope of protection of the present invention.

Claims

1. An encryption method based on the collaboration between an encryption machine and an operating system, characterized in that: include: Obtain the image initialization key and image data encryption key entered by the user when creating the virtual machine; Using QEMU to generate a random master key for the image initialization key. Generate a key hash value of the random master key, and save the key hash value to the image header file of the QCOW2 file of the virtual machine; Generate an encryption key based on the image initialization key; Searching or binding the encryption machine internal index corresponding to the encryption key in the distributed cache; Using the internal index of the encryption machine to call a preset encryption and decryption algorithm to encrypt the random master key, obtain an encrypted master key, and store the encrypted master key in the key slot of the LUKS header of the image header file; Performing a numerical conversion based on the mirror data encryption key and the encryption master key to obtain a target key; On the local operating system, encrypting the data block of the QCOW2 file based on the target key and the preset encryption and decryption algorithm to obtain the encrypted data block; When the writing of the encrypted data blocks is completed, a hash calculation is performed on the encrypted data blocks to generate a data hash value, and the data hash value is written into the mirror header file.

2. The encryption method according to claim 1, wherein: The preset encryption and decryption algorithm is the SM4 algorithm.

3. The encryption method according to claim 1, wherein: Generating a key hash value of the random master key includes: A key hash value of the random master key is generated using the PBKDF2 key derivation function.

4. The encryption method according to claim 1, wherein: The generating of an encryption key based on the image initialization key includes: The image initialization key is input into the PBKDF2 key derivation function to generate an encryption key.

5. The encryption method according to claim 1, wherein: The performing hash calculation on each of the encrypted data blocks to generate a data hash value includes: The SM3 algorithm is used to perform hash calculation on each of the encrypted data blocks to generate a data hash value.

6. The encryption method according to claim 1, wherein: The image data encryption key is stored in the distributed cache, and the method further includes: After the virtual machine is shut down, the image data encryption key in the distributed cache is cleared.

7. The encryption method according to claim 1, wherein: After writing the data hash value into the image header file, the method further includes: Obtaining a backup instruction for the QCOW2 file; In response to the backup instruction, an encryption mark is added to the QCOW2 file, and it is identified whether the QCOW2 file carries the encryption mark. If so, the decryption process of each encrypted data block in the QCOW2 file is skipped, and the QCOW2 file is transferred to the target backup path.

8. The encryption method according to claim 7, wherein: After transferring the QCOW2 file to the target backup path, the method further includes: Obtaining a recovery instruction for the QCOW2 file; In response to the recovery instruction, it is identified whether the QCOW2 file in the backup target carries the encryption mark. If so, the decryption process of each encrypted data block in the QCOW2 file is skipped, and the QCOW2 file is transferred to the target recovery path.

9. A decryption method based on the collaboration between an encryption machine and an operating system, characterized in that: include: Obtain the image initialization key and image data encryption key entered by the user when creating the virtual machine; Read the first key hash value, the first data hash value, and the encryption master key in the key slot of the LUKS header in the image header file of the QCOW2 file of the virtual machine; Generate an encryption key based on the image initialization key; Searching for an internal index of the encryption machine corresponding to the encryption key in the distributed cache; Decrypt the encrypted master key using the internal index of the encryption machine to call the preset encryption and decryption algorithm to obtain a random master key; generating a second key hash value of the random master key; Comparing the second key hash value with the first key hash value to see whether they are consistent; if so, performing numerical conversion based on the mirrored data encryption key and the encryption master key to obtain a target key; Performing a hash calculation on each encrypted data block in the QCOW2 file on the local operating system to generate a second data hash value; Compare the second data hash value with the first data hash value to see if they are consistent. If so, decrypt the encrypted data blocks using the target key and the preset encryption / decryption algorithm to obtain the decrypted data blocks.

10. An encryption and decryption system based on the collaboration of an encryption machine and an operating system, characterized in that: include: QEMU tool, key interaction module, key management module, distributed cache module, virtual machine event monitoring module, encryption machine interface and encryption machine, wherein the QEMU tool includes encryption machine index management module, encryption machine summary generation module, encryption machine data encryption and decryption module, local operating system summary generation module and local operating system data encryption and decryption module, The QEMU tool is configured to encrypt and decrypt the random master key in the image header file of the virtual machine's QCOW2 file and generate a data hash value of the virtual machine data through the encryption machine index management module and the encryption machine data encryption and decryption module, and save the data hash value in the image header file; generate a key hash value of the random master key by calling the local operating system summary generation module, save the key hash value in the image header file, encrypt and decrypt the virtual machine data by calling the local operating system data encryption and decryption module, and perform numerical conversion based on the image data encryption key and the encryption master key to obtain a target key; The key interaction module is used to obtain the image initialization key and the image data encryption key input by the user when creating the virtual machine, wherein the image initialization key is stored in the virtual host definition file of the virtual host management module, and the image data encryption key is stored in the distributed cache file system and is cleared from the cache after the virtual machine is shut down; The key management module is used to store a key hash value of the image initialization key, which is stored in the virtual machine definition file and the key file respectively in the form of a key hash value; when starting the virtual machine, the key hash value in the virtual machine definition file is compared with the key hash value in the key file to determine whether the file key is correct; The distributed cache module is used to store the image data encryption key; it is stored in the form of a key-value pair, where the key is the UUID of the virtual machine and the value is the internal index of the encryption machine and the image data encryption key; when the virtual machine is shut down, the key management module is called to clear the image data encryption key stored in the distributed cache; The encryption machine index management module is used to use the cache write interface to write the encryption key corresponding to the encryption virtual machine; use the cache query interface to query the encryption machine internal index corresponding to the encryption virtual machine, wherein the encryption machine internal index is used to call the random master key in the encryption image of the SM4 algorithm of the encryption machine; The virtual machine event monitoring module is used to monitor the status of all virtual machines through the virtual machine monitor event HOOK interface; when the virtual machine is shut down, it calls the interface provided by the key management module to clear the image data encryption key stored in the distributed cache, and calls the interface provided by the encryption machine digest generation module to generate the data hash value of the virtual machine image file and write it into the image header file; The encryption machine summary generation module is used to provide a summary generation interface for calling the encryption machine, and is used to write the data hash value into the summary field of the virtual machine image file header structure after the write operation is completed or the virtual machine event monitoring module monitors that the virtual machine is shut down; The encryption machine interface is used to encapsulate all the algorithms of the encryption machine, and provides the summary generation interface and data encryption interface of the encryption machine by modifying the IP address and encryption parameters in the configuration file, including symmetric encryption and decryption; The encryption machine data encryption and decryption module is used to call the SM4 algorithm or SM2 algorithm of the encryption machine using the internal index of the encryption machine corresponding to the virtual machine in the distributed cache to encrypt data, and the encrypted data is returned to the QEMU tool through the interface; The local operating system digest generation module is used to call the PBKDF2 algorithm provided by the local operating system to generate a key hash value of the image initialization key, write it into the image header file, and provide an interface for the QEMU tool to call; The local operating system data encryption and decryption module is used to call the SM4 algorithm provided by the local operating system and use the target key to encrypt and decrypt the QCOW2 file; The encryption machine is used to provide encryption key index initialization, SM4 symmetric key encryption and decryption, and SM3 summary generation functions; a calling interface is provided so that the QEMU tool calls the encryption machine to implement SM4 symmetric encryption and decryption and SM3 summary generation of data.

Images