Virtual machine snapshot verification method and device, computer equipment, medium and product

Abstract

The invention relates to a virtual machine snapshot verification method and device, computer equipment, a medium and a product. The method comprises the following steps: slicing a virtual machine snapshot by utilizing a preset slicing strategy to obtain a plurality of snapshot slices; processing each snapshot slice by using a preset signature algorithm to obtain an initial signature result of each snapshot slice; the preset signature algorithm comprises a first signature algorithm and a second signature algorithm; under the condition that an integrity verification instruction is received, processing each snapshot slice by using a preset signature algorithm to obtain a target signature result of each snapshot slice; and according to each initial signature result and each target signature result, determining an integrity verification result of the virtual machine snapshot. According to the embodiment of the invention, the virtual machine snapshot can be segmented into a plurality of snapshot slices, the snapshot slices are subjected to signature processing in parallel, and parallel verification of a plurality of snapshot files can be realized by adopting distributed storage nodes, so that the efficiency of integrity verification of the virtual machine snapshot can be greatly improved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a method, device, computer equipment, medium and product for verifying a virtual machine snapshot. Background Art

[0002] With the development of virtual machine technology, virtual machine snapshot files have emerged. Since virtual machine snapshot files store important business data of virtual machines, it is necessary to perform integrity verification on virtual machine snapshot files.

[0003] However, the traditional technology has the problem of low efficiency in integrity verification of virtual machine snapshot files. Summary of the invention

[0004] Based on this, it is necessary to provide a virtual machine snapshot verification method, device, computer equipment, medium and product that can improve the efficiency of integrity verification of virtual machine snapshot files in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for verifying a virtual machine snapshot, comprising:

[0006] Using the preset slicing strategy, the virtual machine snapshot is sliced ​​to obtain multiple snapshot slices;

[0007] Using a preset signature algorithm to process each of the snapshot slices to obtain an initial signature result of each of the snapshot slices; the preset signature algorithm includes a first signature algorithm and a second signature algorithm;

[0008] When receiving the integrity check instruction, each of the snapshot slices is processed using the preset signature algorithm to obtain a target signature result of each of the snapshot slices;

[0009] An integrity check result of the virtual machine snapshot is determined according to each of the initial signature results and each of the target signature results.

[0010] In one embodiment, the using a preset signature algorithm to process each of the snapshot slices to obtain an initial signature result of each of the snapshot slices includes:

[0011] Performing a first signature processing on each of the snapshot slices according to the first signature algorithm to obtain a first signature result of each of the snapshot slices;

[0012] According to each of the first signature results and the second signature algorithm, each of the initial signature results is obtained.

[0013] In one embodiment, obtaining each of the initial signature results according to each of the first signature results and the second signature algorithm includes:

[0014] Perform a second signature process on each of the first signature results according to the second signature algorithm to obtain each of the initial signature results.

[0015] In one embodiment, determining the integrity check result of the virtual machine snapshot according to each of the initial signature results and each of the target signature results includes:

[0016] Obtaining integrity verification results of each of the snapshot slices according to each of the initial signature results and each of the target signature results;

[0017] The integrity check result of the virtual machine snapshot is determined according to the integrity check result of each of the snapshot slices.

[0018] In one of the embodiments, determining the integrity check result of the virtual machine snapshot according to the integrity check result of each of the snapshot slices includes:

[0019] If the integrity check results of each of the snapshot slices are successful, it is determined that the integrity check result of the virtual machine snapshot is passed.

[0020] In one embodiment, the method further comprises:

[0021] Obtaining the read and write performance consumption of a storage node; the storage node is used to store each of the snapshot slices;

[0022] If the read / write performance consumption is not less than a preset threshold, the preset slicing strategy is adjusted according to the remaining read / write performance data to generate a new slicing strategy.

[0023] In a second aspect, the present application also provides a virtual machine snapshot verification device, including:

[0024] A slicing module is used to slice the virtual machine snapshot using a preset slicing strategy to obtain multiple snapshot slices;

[0025] A first signature module, used to process each of the snapshot slices using a preset signature algorithm to obtain an initial signature result of each of the snapshot slices; the preset signature algorithm includes a first signature algorithm and a second signature algorithm;

[0026] A second signature module is used to process each of the snapshot slices using the preset signature algorithm to obtain a target signature result of each of the snapshot slices when receiving an integrity check instruction;

[0027] The verification module is used to determine the integrity verification result of the virtual machine snapshot according to each of the initial signature results and each of the target signature results.

[0028] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method in any one of the embodiments of the first aspect are implemented.

[0029] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method in any one of the embodiments of the first aspect are implemented.

[0030] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the method in any one of the embodiments of the first aspect are implemented.

[0031] The above-mentioned virtual machine snapshot verification method, device, computer equipment, medium and product use a preset slicing strategy to slice the virtual machine snapshot to obtain multiple snapshot slices; use a preset signature algorithm to process each snapshot slice to obtain the initial signature result of each snapshot slice; the preset signature algorithm includes a first signature algorithm and a second signature algorithm; when receiving an integrity verification instruction, use the preset signature algorithm to process each snapshot slice to obtain the target signature result of each snapshot slice; determine the integrity verification result of the virtual machine snapshot based on each initial signature result and each target signature result. The embodiment of the present application can divide the virtual machine snapshot into multiple snapshot slices, and perform signature processing on each snapshot slice in parallel, and can use distributed storage nodes to realize parallel verification of multiple snapshot files, so it can greatly improve the efficiency of integrity verification for virtual machine snapshots. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 A diagram of an application environment of a method for verifying a virtual machine snapshot in one embodiment;

[0034] Figure 2 A flowchart of a method for verifying a virtual machine snapshot in one embodiment is shown;

[0035] Figure 3 A schematic diagram of a process flow of the first signature processing step in an embodiment;

[0036] Figure 4 A schematic diagram of a process for determining an integrity check result in one embodiment;

[0037] Figure 5 It is a flowchart of a method for verifying a virtual machine snapshot in another embodiment;

[0038] Figure 6 It is a flowchart of a method for verifying a virtual machine snapshot in an optional embodiment;

[0039] Figure 7 It is a structural block diagram of a verification device for a virtual machine snapshot in one embodiment;

[0040] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0042] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0043] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0044] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0045] With the development of virtual machine technology, virtual machine snapshot files have emerged. Virtual machine snapshot files are a complete copy of the virtual machine state during the operation of the virtual machine, recording all the state information of the virtual machine at the preset characteristic time point. For example, all the state information can include but is not limited to memory, disk, network configuration and other information. Through snapshots, users can easily save, restore and roll back the virtual machine state, effectively improving the reliability and flexibility of the virtual machine environment. Therefore, virtual machine snapshot files are of great significance for the development and testing of applications. However, with the development of cloud computing, the boundaries of cloud computing are becoming increasingly blurred, and the application security and data security of the cloud environment are facing serious threats. In addition, since virtual machine snapshot files store important business data of virtual machines, they have also become one of the key attack targets of hackers in the cloud environment. Once a virtual machine snapshot file is maliciously attacked, it is likely to be implanted with malicious code when the virtual machine is restored or a new virtual machine is created through a snapshot. Then the malicious code will penetrate the entire cloud environment, causing a huge network security incident. Therefore, it is necessary to perform integrity verification on virtual machine snapshot files.

[0046] In the traditional technology, the integrity of the virtual machine snapshot file is mainly verified by a centralized verification method, and the security of the virtual machine snapshot file is ensured by the integrity verification result. However, the verification speed of the integrity verification using the centralized verification method is slow, so the traditional technology has the problem of low efficiency in the integrity verification of the virtual machine snapshot file.

[0047] After introducing the background technology of the virtual machine snapshot verification method provided by the embodiment of the present application, the following briefly describes the implementation environment involved in the virtual machine snapshot verification method provided by the embodiment of the present application. The virtual machine snapshot verification method provided by the embodiment of the present application can be applied to Figure 1In the cloud computing system shown. The cloud computing system includes a control platform 11, at least one computer device 12, and a spine-leaf switching system in a cloud environment. The computer device 12 includes an underlying controller 121, at least one computing node 122, and at least one storage node 123. The control platform 11 is a unified management device for the entire network cloud infrastructure. The control platform 11 is used to create a virtual machine snapshot policy and a configuration verification policy, and provide a visual operation page for the user; the underlying controller 121 is used to receive the snapshot policy and verification policy issued by the control platform 11, and issue the snapshot policy and the locally stored slice policy to the computing node 122, and issue the verification policy to the storage node 123. ; The client Client in the computing node 122 is used to create virtual machines (VM, VMware) and virtual machine snapshots according to the snapshot strategy, and to slice the virtual machine snapshots according to the slicing strategy; the storage node 123 is integrated with the hardware verification module HVU, which supports integrity verification of data blocks through the HMAC-SM3 algorithm, and sends the integrity verification results to the underlying controller 121 for storage; the distributed storage node is used to provide storage space, and can simultaneously implement distributed integrity verification of snapshot files; the Spine-leaf switching system includes a spine layer (SpineLayer) and a leaf layer (Leaf Layer), and the Spine-leaf switching system is used to ensure that the entire cloud computing system network IP (Internet Protocol) is reachable.

[0048] Those skilled in the art will understand that Figure 1 The structure shown in the figure is only a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the distributed storage system to which the scheme of the present application is applied. The specific distributed storage system may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0049] In one embodiment, Figure 2 As shown, a virtual machine snapshot verification method is provided, and the method is applied to Figure 1 The application to computer equipment is taken as an example to illustrate, including the following steps:

[0050] S201, using a preset slicing strategy, slicing a virtual machine snapshot to obtain a plurality of snapshot slices.

[0051] Among them, a virtual machine snapshot refers to a file generated by copying all the state information of the virtual machine during the operation of the virtual machine, a snapshot slice refers to the slice data obtained after slicing the virtual machine snapshot, and a preset slicing strategy is a strategy for slicing the virtual machine snapshot. The preset slicing strategy may include but is not limited to the slice size, slicing frequency, etc. It should be noted that the preset slicing strategy in the embodiment of the present application can be adjusted in real time according to the resource consumption of the storage node to ensure that the storage node is not overloaded.

[0052] In an embodiment of the present application, the user terminal can create a virtual machine snapshot policy on the control platform in advance, so that the control platform can create a virtual machine and bind the virtual machine snapshot policy, and can create a virtual machine snapshot according to the virtual machine snapshot policy, and can send the virtual machine snapshot policy to the underlying controller in the computer device. Among them, the virtual machine snapshot policy may include but is not limited to the snapshot frequency, snapshot storage location, etc. Thus, the underlying controller in the computer device can receive the virtual machine snapshot policy, and can obtain the preset slicing policy locally, and then the virtual machine snapshot policy and the preset slicing policy can be sent to the computing node in the computer device. The computing node in the computer device can create a virtual machine snapshot according to the virtual machine snapshot policy, and use the preset slicing policy to slice the virtual machine snapshot to obtain multiple snapshot slices. In addition, the computing node in the computer device can also send multiple snapshot slices to the distributed storage node in the computer device for storage.

[0053] S202, using a preset signature algorithm to process each snapshot slice to obtain an initial signature result of each snapshot slice; the preset signature algorithm includes a first signature algorithm and a second signature algorithm.

[0054] The preset signature algorithm refers to the algorithm used to sign each snapshot slice. The preset signature algorithm includes the first signature algorithm and the second signature algorithm. The first signature algorithm and the second signature algorithm may include but are not limited to any one of the signature algorithms such as the HMAC-SM3 algorithm and the MD5 signature algorithm. The HMAC-SM3 algorithm is a hash function algorithm for data integrity verification. The SM3 national secret algorithm key used by the HMAC-SM3 algorithm is provided by a hardware encryption machine. The initial signature result refers to the signature result obtained by automatically signing each snapshot slice after generating multiple snapshot slices.

[0055] In an embodiment of the present application, the user terminal can trigger a target verification strategy among multiple verification strategy options on the snapshot strategy creation page on the control platform, so that the control platform can determine the target verification strategy and send the target verification strategy to the underlying controller in the computer device. Among them, the trigger operation may include but is not limited to any of the operations such as checking and clicking, and the target verification strategy includes a preset signature algorithm. Afterwards, the underlying controller in the computer device can send the target verification strategy to the storage node in the computer device, so that the storage node in the computer device can automatically process each snapshot slice using the preset signature algorithm in the target verification strategy to obtain the initial signature result of each snapshot slice.

[0056] S203: When receiving the integrity verification instruction, each snapshot slice is processed using a preset signature algorithm to obtain a target signature result of each snapshot slice.

[0057] The integrity check instruction refers to the check instruction triggered by the user terminal on the control platform, and the integrity check instruction is used to perform a second signature process on each snapshot slice. The target signature result refers to the signature result obtained by signing each snapshot slice after generating multiple snapshot slices and receiving the integrity check instruction manually triggered by the user.

[0058] In an embodiment of the present application, the user terminal can trigger the generation of an integrity check instruction on the control platform, so that the control platform can generate a check strategy corresponding to the integrity check instruction when receiving the integrity check instruction, wherein the check strategy includes a preset signature algorithm. Afterwards, the control platform can send the check strategy corresponding to the integrity check instruction to the underlying controller in the computer device, so that the underlying controller in the computer device can send the user terminal information, the check strategy corresponding to the integrity check instruction, and the identification of each snapshot slice to each distributed storage node respectively, and then, the storage node in the computer device can process each snapshot slice in parallel using the preset signature algorithm according to the identification of each snapshot slice to obtain the target signature result of each snapshot slice. It should be noted that the preset signature algorithm used in the process of obtaining the target signature result is the same as the preset signature algorithm used in the process of obtaining the initial signature result. Among them, the identification of each snapshot slice may include but is not limited to the serial number, identification code, etc. of each snapshot slice.

[0059] S204: Determine the integrity verification result of the virtual machine snapshot according to each initial signature result and each target signature result.

[0060] In an embodiment of the present application, the storage node in the computer device can send the initial signature result of each snapshot slice and the target signature result of each snapshot slice to the underlying controller in the computer device, so that, optionally, the underlying controller in the computer device can directly determine the integrity check result of the virtual machine snapshot based on each initial signature result and each target signature result; or, the underlying controller in the computer device can also first determine the integrity check result of each snapshot slice based on each initial signature result and each target signature result, and then determine the integrity check result of the virtual machine snapshot based on the integrity check result of each snapshot slice. Of course, the embodiment of the present application does not limit the specific implementation method for determining the integrity check result. Among them, the integrity check result may include the integrity check passing or the integrity check failing.

[0061] In the above-mentioned verification method of virtual machine snapshot, a preset slicing strategy is used to slice the virtual machine snapshot to obtain multiple snapshot slices; each snapshot slice is processed using a preset signature algorithm to obtain the initial signature result of each snapshot slice; the preset signature algorithm includes a first signature algorithm and a second signature algorithm; when an integrity verification instruction is received, each snapshot slice is processed using a preset signature algorithm to obtain the target signature result of each snapshot slice; the integrity verification result of the virtual machine snapshot is determined based on each initial signature result and each target signature result. The embodiment of the present application can divide the virtual machine snapshot into multiple snapshot slices, and perform signature processing on each snapshot slice in parallel, and can use distributed storage nodes to realize parallel verification of multiple snapshot files, so it can greatly improve the efficiency of integrity verification for virtual machine snapshots.

[0062] In one embodiment, a method for implementing the first signature processing of each snapshot slice is provided, that is, "processing each snapshot slice using a preset signature algorithm to obtain an initial signature result of each snapshot slice" in the above S202, such as Figure 3 As shown, including:

[0063] S301: Perform a first signature process on each snapshot slice according to a first signature algorithm to obtain a first signature result of each snapshot slice.

[0064] In the embodiment of the present application, if the first signature algorithm is an MD5 signature algorithm, the distributed storage node in the computer device can call the hardware verification unit (HVU) built in the distributed storage node to perform an MD5 data signature on each snapshot slice, and obtain the first signature result of each snapshot slice, so as to implement the first signature processing on each snapshot slice. The first signature result is the MD5 signature result.

[0065] S302: Obtain each initial signature result according to each first signature result and the second signature algorithm.

[0066] In an embodiment of the present application, specific implementation methods for obtaining each initial signature result may include the following two methods: First, the distributed storage node in the computer device can call the hardware verification unit (HVU) built in the distributed storage node, and perform a second signature processing on each snapshot slice according to the second signature algorithm to obtain the second signature result of each snapshot slice. Thus, the distributed storage node in the computer device can fuse the first signature result of each snapshot slice and the second signature result of each snapshot slice to obtain the initial signature result of each snapshot slice.

[0067] In a second manner, in one embodiment, S302 includes: performing a second signature process on each first signature result according to a second signature algorithm to obtain each initial signature result.

[0068] In an embodiment of the present application, the distributed storage node in the computer device can use the first signature result as the intermediate verification data, call the hardware verification unit (HVU) built into the distributed storage node, and use the second signature algorithm to perform a second signature process on each first signature result to obtain each initial signature result. For example, the second signature algorithm can be the HMAC-SM3 national encryption algorithm. In addition, the distributed storage node in the computer device can also send the user terminal information, the identifier of each snapshot slice, and each initial signature result to the underlying controller in the computer device for storage. It should be noted that the embodiment of the present application can perform distributed integrity verification through the storage node by building a hardware verification unit into the storage node, without the need to separately build an independent server cluster or verification network for data signing, which can not only reduce the overall construction cost and maintenance cost of the cloud computing system, but also reduce the overall network burden, and at the same time can achieve full data integrity verification without blind spots.

[0069] In this embodiment, a first signature processing can be performed on each snapshot slice according to the first signature algorithm, and the first signature result of each snapshot slice can be quickly obtained. Then, a signature processing is performed once according to each first signature result and the second signature algorithm to obtain each initial signature result. Then, a double data signature algorithm can be used for secondary data signing, which can not only improve the efficiency of data signing, but also meet the compliance requirements of the cryptographic law.

[0070] In one embodiment, a method for determining the integrity check result of a virtual machine snapshot is provided, that is, "determining the integrity check result of the virtual machine snapshot according to each initial signature result and each target signature result" in the above S204, such as Figure 4 As shown, including:

[0071] S401, obtaining the integrity verification result of each snapshot slice according to each initial signature result and each target signature result.

[0072] In the embodiment of the present application, optionally, the bottom-level controller in the computer device can compare each initial signature result and each target signature result in parallel to obtain the integrity verification result of each snapshot slice; or, the bottom-level controller in the computer device can also compare each initial signature result and each target signature result in sequence according to the order of the identifiers (1, 2, ..., i, ..., n) of each snapshot slice, so as to obtain the integrity verification result of each snapshot slice. Exemplarily, if the initial signature result of any snapshot slice i is consistent with the target signature result of the snapshot slice i, the integrity verification result of the snapshot slice i can be determined as successful, and the signature comparison of the next snapshot slice i+1 can be continued; if the initial signature result of any snapshot slice i is inconsistent with the target signature result of the snapshot slice i, the bottom-level controller in the computer device can directly determine the integrity verification result as a failure, and send a termination instruction to the distributed storage node to terminate the subsequent signature process, so as to save the processing performance of the storage node and shorten the verification time.

[0073] S402: Determine the integrity check result of the virtual machine snapshot according to the integrity check results of each snapshot slice.

[0074] In an embodiment of the present application, after determining the integrity check results of each snapshot slice, the underlying controller in the computer device can determine the integrity check result of the virtual machine snapshot based on the integrity check results of each snapshot slice. In one embodiment, if the integrity check results of each snapshot slice are successful, the underlying controller in the computer device can determine that the integrity check result of the virtual machine snapshot is a pass. In another embodiment, if there is a snapshot slice whose integrity check result fails, the underlying controller in the computer device can directly determine that the integrity check result of the virtual machine snapshot is a fail. At this time, an integrity check failure alarm can also be issued, and the buttons for restoring the snapshot and creating a virtual machine can be grayed out synchronously to remind the user that the virtual machine snapshot has security risks and avoid further security incidents.

[0075] In this embodiment, the block comparison method can be used to compare each initial signature result with each target signature result, so that the integrity verification result of each snapshot slice can be quickly obtained, so that the integrity verification result of the virtual machine snapshot can be accurately and quickly determined based on the integrity verification result of each snapshot slice. In addition, if the integrity verification result of any snapshot slice is determined to be a failure, the signing and comparison of subsequent snapshot slices can be stopped immediately, which can further shorten the verification time of the virtual machine snapshot.

[0076] In one embodiment, a method for adjusting a preset slicing strategy is provided, such as Figure 5As shown, the above virtual machine snapshot verification method also includes:

[0077] S205, obtaining the read and write performance consumption of the storage node; the storage node is used to store each snapshot slice.

[0078] S206: If the read / write performance consumption is not less than the preset threshold, the preset slicing strategy is adjusted according to the remaining read / write performance data to generate a new slicing strategy.

[0079] In an embodiment of the present application, the underlying controller in the computer device can also pre-set a preset threshold, and can monitor and obtain the read and write performance consumption of the storage node in the computer device in real time. Among them, the storage node is used to store each snapshot slice, and the read and write performance consumption is used to characterize the IO read and write performance consumption of the distributed storage node when receiving multiple snapshot slices. If it is determined that the read and write performance consumption exceeds (that is, greater than or equal to) the preset threshold, the underlying controller in the computer device can adjust the preset slicing strategy according to the remaining read and write performance data, generate a new slicing strategy, and can synchronize the new slicing strategy to the computing node in the computer device, so that the computing node in the computer device can slice the virtual machine snapshot according to the latest slicing strategy.

[0080] In this embodiment, the read and write performance consumption of the storage node can be obtained, wherein the storage node is used to store each snapshot slice. Thus, when the read and write performance consumption is not less than a preset threshold, the preset slice strategy can be adjusted according to the remaining read and write performance data to generate a new slice strategy. In this way, the preset slice strategy can be automatically adjusted by using slice adaptive technology, thereby avoiding storage node overload and affecting data reading and writing, so as to minimize the impact of snapshot slices on business performance.

[0081] Based on all the above embodiments, the present application also provides a complete virtual machine snapshot verification method, such as Figure 6 As shown, the method includes:

[0082] S501, the control platform can configure a virtual machine snapshot policy, and determine a target verification policy according to a triggering operation of a target verification policy among multiple verification policy options by a user terminal on a snapshot policy creation page on the control platform;

[0083] S502, the control platform can create a virtual machine and bind a virtual machine snapshot policy, and can create a virtual machine snapshot according to the virtual machine snapshot policy;

[0084] S503, the control platform may send the virtual machine snapshot policy and the target verification policy to the bottom controller in the computer device;

[0085] S504, the bottom-level controller in the computer device may receive the virtual machine snapshot policy and the target verification policy, and may obtain the preset slicing policy locally, after which the bottom-level controller may send the virtual machine snapshot policy and the preset slicing policy to the computing node in the computer device, and send the target verification policy to the storage node in the computer device;

[0086] S505, the computing node in the computer device may create a virtual machine snapshot according to the virtual machine snapshot policy, and slice the virtual machine snapshot using a preset slice policy to obtain a plurality of snapshot slices;

[0087] S506, the computing node in the computer device may send the multiple snapshot slices to the distributed storage node in the computer device for storage, so that the multiple snapshot slices of the core may be automatically scheduled to the distributed storage node of the built-in hardware verification module HVU for storage, which can meet the needs of user service hierarchical management and flexible cost control;

[0088] S507, the distributed storage node in the computer device may call a hardware verification unit (HVU) built in the distributed storage node, and use a first signature algorithm to perform a first signature process on each snapshot slice to obtain a first signature result of each snapshot slice;

[0089] S508, the distributed storage node in the computer device may use the first signature result as the intermediate verification data, call the hardware verification unit (HVU) built in the distributed storage node to use the second signature algorithm to perform a second signature process on each first signature result, and obtain each initial signature result;

[0090] S509, the distributed storage node in the computer device may send the user terminal information, the identifier of each snapshot slice, and each initial signature result to the bottom layer controller in the computer device for storage;

[0091] S510, the user terminal may trigger the generation of an integrity check instruction on the control platform, so that the control platform may generate a check strategy corresponding to the integrity check instruction when receiving the integrity check instruction, and then the control platform may send the check strategy corresponding to the integrity check instruction to the bottom-level controller in the computer device, so that the bottom-level controller in the computer device may send the user terminal information, the check strategy corresponding to the integrity check instruction and the identifier of each snapshot slice to each distributed storage node respectively;

[0092] S511, the storage node in the computer device may process each snapshot slice using a preset signature algorithm according to the identifier of each snapshot slice, obtain a target signature result of each snapshot slice, and send the target signature result of each snapshot slice to the bottom layer controller in the computer device;

[0093] S512, the bottom-level controller in the computer device may compare each initial signature result with each target signature result in sequence according to the order of the identifiers (1, 2, ..., i, ..., n) of each snapshot slice;

[0094] S513, the bottom-level controller in the computer device may determine whether the initial signature result of the snapshot slice i is consistent with the target signature result of the snapshot slice i; if the initial signature result of the snapshot slice i is consistent with the target signature result of the snapshot slice i, S514 is executed; if the initial signature result of the snapshot slice i is inconsistent with the target signature result of the snapshot slice i, S517 is executed;

[0095] S514, the bottom-level controller in the computer device may determine the integrity check result of the snapshot slice i as successful, and continue to perform the signature comparison of the next snapshot slice i+1;

[0096] S515, the bottom-level controller in the computer device may determine whether the integrity check results of all snapshot slices are obtained; if the integrity check results of all snapshot slices are obtained, S516 is executed; if the integrity check results of all snapshot slices are not obtained, the next snapshot slice of the current snapshot slice is used as a new snapshot slice i, and the process returns to S513;

[0097] S516, if the integrity check results of each snapshot slice are successful, the bottom layer controller in the computer device may determine that the integrity check result of the virtual machine snapshot is passed;

[0098] S517, the bottom controller in the computer device can directly determine the integrity check result as failed, and directly determine the integrity check result of the virtual machine snapshot as failed, and send a termination instruction to the distributed storage node to terminate the subsequent signing process, and simultaneously gray out the buttons for restoring the snapshot and creating a virtual machine, so as to restrict the use of the virtual machine snapshot that failed the verification;

[0099] S518, the bottom layer controller in the computer device may monitor and obtain the read and write performance consumption of the storage node in the computer device in real time;

[0100] S519, the bottom controller in the computer device determines whether the read-write performance consumption is not less than a preset threshold; if it is determined that the read-write performance consumption is not less than the preset threshold, execute S520; if it is determined that the read-write performance consumption is less than the preset threshold, return to execute S518;

[0101] S520, the underlying controller in the computer device can adjust the preset slicing strategy according to the remaining read and write performance data, generate a new slicing strategy, and synchronize the new slicing strategy to the computing nodes in the computer device, so that the computing nodes in the computer device can slice the virtual machine snapshots according to the latest slicing strategy.

[0102] In the above-mentioned verification method of virtual machine snapshot, a preset slicing strategy is used to slice the virtual machine snapshot to obtain multiple snapshot slices; each snapshot slice is processed using a preset signature algorithm to obtain the initial signature result of each snapshot slice; the preset signature algorithm includes a first signature algorithm and a second signature algorithm; when an integrity verification instruction is received, each snapshot slice is processed using a preset signature algorithm to obtain the target signature result of each snapshot slice; the integrity verification result of the virtual machine snapshot is determined according to each initial signature result and each target signature result. The embodiment of the present application can divide the virtual machine snapshot into multiple snapshot slices, and perform signature processing on each snapshot slice in parallel, and can use distributed storage nodes to realize parallel verification of multiple snapshot files, so it can greatly improve the efficiency of integrity verification for virtual machine snapshots, improve verification accuracy, reduce the complexity of using cloud computing systems, and meet the evaluation requirements of commercial cryptographic application security.

[0103] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0104] Based on the same inventive concept, the embodiment of the present application also provides a virtual machine snapshot verification device for implementing the virtual machine snapshot verification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the verification device for one or more virtual machine snapshots provided below can refer to the limitations of the virtual machine snapshot verification method above, and will not be repeated here.

[0105] In an exemplary embodiment, Figure 7As shown, a virtual machine snapshot verification device is provided, including: a slicing module 31, a first signature module 32, a second signature module 33 and a verification module 34, wherein:

[0106] The slicing module 31 is used to slice the virtual machine snapshot using a preset slicing strategy to obtain multiple snapshot slices;

[0107] The first signature module 32 is used to process each snapshot slice using a preset signature algorithm to obtain an initial signature result of each snapshot slice; the preset signature algorithm includes a first signature algorithm and a second signature algorithm;

[0108] The second signature module 33 is used to process each snapshot slice using a preset signature algorithm to obtain a target signature result of each snapshot slice when receiving an integrity check instruction;

[0109] The verification module 34 is used to determine the integrity verification result of the virtual machine snapshot according to each initial signature result and each target signature result.

[0110] In one embodiment, the first signature module 32 includes:

[0111] A first signature processing unit, configured to perform a first signature processing on each snapshot slice according to a first signature algorithm to obtain a first signature result of each snapshot slice;

[0112] The initial signature result obtaining unit is used to obtain each initial signature result according to each first signature result and the second signature algorithm.

[0113] In one embodiment, the initial signature result obtaining unit is specifically used to:

[0114] A second signature process is performed on each first signature result according to the second signature algorithm to obtain each initial signature result.

[0115] In one embodiment, the verification module 34 includes:

[0116] An integrity check result acquisition unit, used to acquire the integrity check result of each snapshot slice according to each initial signature result and each target signature result;

[0117] The integrity check unit is used to determine the integrity check result of the virtual machine snapshot according to the integrity check results of each snapshot slice.

[0118] In one embodiment, the integrity checking unit is specifically used to:

[0119] If the integrity check results of each snapshot slice are successful, it is determined that the integrity check result of the virtual machine snapshot is passed.

[0120] In one embodiment, the virtual machine snapshot verification device further includes:

[0121] The read / write performance consumption acquisition module is used to obtain the read / write performance consumption of the storage node; the storage node is used to store each snapshot slice;

[0122] The preset slicing strategy adjustment module is used to adjust the preset slicing strategy according to the remaining read-write performance data and generate a new slicing strategy when the read-write performance consumption is not less than the preset threshold.

[0123] Each module in the above-mentioned virtual machine snapshot verification device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0124] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 8 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a method for verifying a virtual machine snapshot is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0125] Those skilled in the art will understand that Figure 8The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0126] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0127] Using the preset slicing strategy, the virtual machine snapshot is sliced ​​to obtain multiple snapshot slices;

[0128] Using a preset signature algorithm to process each snapshot slice to obtain an initial signature result of each snapshot slice; the preset signature algorithm includes a first signature algorithm and a second signature algorithm;

[0129] When receiving the integrity verification instruction, each snapshot slice is processed using a preset signature algorithm to obtain a target signature result for each snapshot slice;

[0130] The integrity check result of the virtual machine snapshot is determined based on each initial signature result and each target signature result.

[0131] In one embodiment, each snapshot slice is processed using a preset signature algorithm to obtain an initial signature result of each snapshot slice, and the processor further implements the following steps when executing the computer program:

[0132] Perform a first signature process on each snapshot slice according to the first signature algorithm to obtain a first signature result of each snapshot slice;

[0133] According to each first signature result and the second signature algorithm, each initial signature result is obtained.

[0134] In one embodiment, according to each first signature result and the second signature algorithm, each initial signature result is obtained, and when the processor executes the computer program, the following steps are also implemented:

[0135] A second signature process is performed on each first signature result according to the second signature algorithm to obtain each initial signature result.

[0136] In one embodiment, the integrity check result of the virtual machine snapshot is determined according to each initial signature result and each target signature result, and the processor further implements the following steps when executing the computer program:

[0137] According to each initial signature result and each target signature result, the integrity verification result of each snapshot slice is obtained;

[0138] The integrity check result of the virtual machine snapshot is determined based on the integrity check result of each snapshot slice.

[0139] In one embodiment, the integrity check result of the virtual machine snapshot is determined according to the integrity check result of each snapshot slice, and the processor further implements the following steps when executing the computer program:

[0140] If the integrity check results of each snapshot slice are successful, it is determined that the integrity check result of the virtual machine snapshot is passed.

[0141] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0142] Get the read and write performance consumption of the storage node; the storage node is used to store each snapshot slice;

[0143] If the read / write performance consumption is not less than the preset threshold, the preset slicing strategy is adjusted according to the remaining read / write performance data to generate a new slicing strategy.

[0144] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0145] Using the preset slicing strategy, the virtual machine snapshot is sliced ​​to obtain multiple snapshot slices;

[0146] Using a preset signature algorithm to process each snapshot slice to obtain an initial signature result of each snapshot slice; the preset signature algorithm includes a first signature algorithm and a second signature algorithm;

[0147] When receiving the integrity verification instruction, each snapshot slice is processed using a preset signature algorithm to obtain a target signature result for each snapshot slice;

[0148] The integrity check result of the virtual machine snapshot is determined based on each initial signature result and each target signature result.

[0149] In one embodiment, each snapshot slice is processed using a preset signature algorithm to obtain an initial signature result of each snapshot slice, and the computer program further implements the following steps when executed by the processor:

[0150] Perform a first signature process on each snapshot slice according to the first signature algorithm to obtain a first signature result of each snapshot slice;

[0151] According to each first signature result and the second signature algorithm, each initial signature result is obtained.

[0152] In one embodiment, according to each first signature result and the second signature algorithm, each initial signature result is obtained, and when the computer program is executed by the processor, the following steps are also implemented:

[0153] A second signature process is performed on each first signature result according to the second signature algorithm to obtain each initial signature result.

[0154] In one embodiment, the integrity check result of the virtual machine snapshot is determined according to each initial signature result and each target signature result, and the computer program further implements the following steps when executed by the processor:

[0155] According to each initial signature result and each target signature result, the integrity verification result of each snapshot slice is obtained;

[0156] The integrity check result of the virtual machine snapshot is determined based on the integrity check result of each snapshot slice.

[0157] In one embodiment, the integrity check result of the virtual machine snapshot is determined according to the integrity check result of each snapshot slice, and the computer program further implements the following steps when executed by the processor:

[0158] If the integrity check results of each snapshot slice are successful, it is determined that the integrity check result of the virtual machine snapshot is passed.

[0159] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0160] Get the read and write performance consumption of the storage node; the storage node is used to store each snapshot slice;

[0161] If the read / write performance consumption is not less than the preset threshold, the preset slicing strategy is adjusted according to the remaining read / write performance data to generate a new slicing strategy.

[0162] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0163] Using the preset slicing strategy, the virtual machine snapshot is sliced ​​to obtain multiple snapshot slices;

[0164] Using a preset signature algorithm to process each snapshot slice to obtain an initial signature result of each snapshot slice; the preset signature algorithm includes a first signature algorithm and a second signature algorithm;

[0165] When receiving the integrity verification instruction, each snapshot slice is processed using a preset signature algorithm to obtain a target signature result for each snapshot slice;

[0166] The integrity check result of the virtual machine snapshot is determined based on each initial signature result and each target signature result.

[0167] In one embodiment, each snapshot slice is processed using a preset signature algorithm to obtain an initial signature result of each snapshot slice, and the computer program further implements the following steps when executed by the processor:

[0168] Perform a first signature process on each snapshot slice according to the first signature algorithm to obtain a first signature result of each snapshot slice;

[0169] According to each first signature result and the second signature algorithm, each initial signature result is obtained.

[0170] In one embodiment, according to each first signature result and the second signature algorithm, each initial signature result is obtained, and when the computer program is executed by the processor, the following steps are also implemented:

[0171] A second signature process is performed on each first signature result according to the second signature algorithm to obtain each initial signature result.

[0172] In one embodiment, the integrity check result of the virtual machine snapshot is determined according to each initial signature result and each target signature result, and the computer program further implements the following steps when executed by the processor:

[0173] According to each initial signature result and each target signature result, the integrity verification result of each snapshot slice is obtained;

[0174] The integrity check result of the virtual machine snapshot is determined based on the integrity check result of each snapshot slice.

[0175] In one embodiment, the integrity check result of the virtual machine snapshot is determined according to the integrity check result of each snapshot slice, and the computer program further implements the following steps when executed by the processor:

[0176] If the integrity check results of each snapshot slice are successful, it is determined that the integrity check result of the virtual machine snapshot is passed.

[0177] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0178] Get the read and write performance consumption of the storage node; the storage node is used to store each snapshot slice;

[0179] If the read / write performance consumption is not less than the preset threshold, the preset slicing strategy is adjusted according to the remaining read / write performance data to generate a new slicing strategy.

[0180] It should be noted that the user information (including but not limited to user terminal information, user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0181] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0182] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0183] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for verifying a virtual machine snapshot, characterized in that: The method comprises: Using the preset slicing strategy, the virtual machine snapshot is sliced ​​to obtain multiple snapshot slices; Using a preset signature algorithm to process each of the snapshot slices to obtain an initial signature result of each of the snapshot slices; the preset signature algorithm includes a first signature algorithm and a second signature algorithm; When receiving the integrity check instruction, each of the snapshot slices is processed using the preset signature algorithm to obtain a target signature result of each of the snapshot slices; An integrity check result of the virtual machine snapshot is determined according to each of the initial signature results and each of the target signature results.

2. The method according to claim 1, characterized in that The using a preset signature algorithm to process each of the snapshot slices to obtain an initial signature result of each of the snapshot slices includes: Performing a first signature processing on each of the snapshot slices according to the first signature algorithm to obtain a first signature result of each of the snapshot slices; According to each of the first signature results and the second signature algorithm, each of the initial signature results is obtained.

3. The method according to claim 2, characterized in that The obtaining, according to each of the first signature results and the second signature algorithm, each of the initial signature results comprises: Perform a second signature process on each of the first signature results according to the second signature algorithm to obtain each of the initial signature results.

4. The method according to any one of claims 1 to 3, characterized in that Determining the integrity check result of the virtual machine snapshot according to each of the initial signature results and each of the target signature results includes: Obtaining integrity verification results of each of the snapshot slices according to each of the initial signature results and each of the target signature results; The integrity check result of the virtual machine snapshot is determined according to the integrity check result of each of the snapshot slices.

5. The method according to claim 4, characterized in that Determining the integrity check result of the virtual machine snapshot according to the integrity check result of each of the snapshot slices includes: If the integrity check results of each of the snapshot slices are successful, it is determined that the integrity check result of the virtual machine snapshot is passed.

6. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Obtaining the read and write performance consumption of a storage node; the storage node is used to store each of the snapshot slices; If the read / write performance consumption is not less than a preset threshold, the preset slicing strategy is adjusted according to the remaining read / write performance data to generate a new slicing strategy.

7. A virtual machine snapshot verification device, characterized in that: The device comprises: A slicing module is used to slice the virtual machine snapshot using a preset slicing strategy to obtain multiple snapshot slices; A first signature module, used to process each of the snapshot slices using a preset signature algorithm to obtain an initial signature result of each of the snapshot slices; the preset signature algorithm includes a first signature algorithm and a second signature algorithm; A second signature module is used to process each of the snapshot slices using the preset signature algorithm to obtain a target signature result of each of the snapshot slices when receiving an integrity check instruction; The verification module is used to determine the integrity verification result of the virtual machine snapshot according to each of the initial signature results and each of the target signature results.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images