Vtpm-based secret key backup recovery method and device for OpenStack platform virtual machine

Abstract

The invention provides a vtpm-based secret key backup recovery method and device for an OpenStack platform virtual machine, a service is encrypted by using a secret key generated by vtpm on an openStack platform, and although the security of the secret key is guaranteed due to the strong correlation between the secret key and the platform, when the virtual machine platform goes wrong, a method is needed to recover the secret key. Based on the above problems, a key backup recovery method is provided, and after receiving a backup parent key generation request, a CA key management center generates a backup master key and sends the backup master key to a service virtual machine. Generating a backup key pair and a backup key seed by using the backup master key through the encryption key with the business virtual backup characteristic; and the information is sent to the CA key management center for storage. After the CA management center receives a key recovery command, the backup encryption key is imported into the vtpm through the backup master key, identity management of the encryption key of the service virtual machine is achieved in the CA management center, encryption (signature) and decryption (signature verification) of the service virtual machine are achieved, and key safety is guaranteed.

Description

Technical Field

[0001] The present application relates to the technical field of cloud computing, and in particular to a method and device for backing up and restoring a key of an OpenStack platform virtual machine based on vtpm. Background Art

[0002] OpenStack is an open source cloud computing management platform project. Virtual machines are a core component of the OpenStack platform. They are isolated operating environments created on physical hardware through virtualization technology. In order to ensure the security of cloud computing, encryption of virtual machines is crucial.

[0003] When a business virtual machine needs to be encrypted through a Trusted Platform Module (TPM) key, first generate a master key through a seed key and a template, then create a key through TPM2_Create, and use the master key as the parent key to wrap (encrypt) this key, and return the wrapped key pair (encryption key) to the caller. The caller stores this key outside the TPM, possibly on a disk. In order to use this key, the user must use TPM2_Load to load it into the TPM first, and then encrypt and decrypt the file or verify the signature. Therefore, the TPM key and the vtpm hardware are strongly associated. If the vtpm of the business virtual machine is damaged or the virtual machine crashes, there is no way to import the encryption key, and there is no way to decrypt the ciphertext encrypted by the vtpm of this business virtual machine.

[0004] However, the existing technology has technical problems of low security and reliability of virtual machine management. Summary of the invention

[0005] The present application provides a vtpm-based key backup and recovery method and device for an OpenStack platform virtual machine to solve the technical problems of low security and reliability of virtual machine management in the prior art.

[0006] In a first aspect, the present application provides a key backup and recovery method based on vtpm for a virtual machine on an OpenStack platform, including:

[0007] The nova-api service of the control node of the Openstack cluster receives the command request for the virtual machine key backup, and transparently transmits the command request for the key backup to the nova-compute service of the computing node;

[0008] After receiving the command request for key backup, the nova-compute service sends the command request for key backup to the business virtual machine;

[0009] After receiving the command request for the key backup, the business virtual machine checks whether the current key file is complete. If it is determined that the current key file is complete, a request to generate a backup parent key is sent to the CA key management center, wherein the checking whether the current key file is complete is used to check whether the current key file includes an encryption key and whether the encryption key has a backup feature;

[0010] After receiving the request to generate a backup parent key, the CA key management center generates a backup master key and sends the backup master key to the business virtual machine;

[0011] The business virtual machine imports the backup master key into the trusted platform module tpm to convert it into a backup master key context that supports the business virtual machine identity;

[0012] The business virtual machine imports the backup master key, and exports the encryption key pair context saved by the tpm to generate a backup key pair and a backup key seed;

[0013] The business virtual machine sends the backup key pair and the backup key seed to the CA key management center.

[0014] Optionally, the above method further includes:

[0015] The CA key management center imports the public key in the backup key pair into a parent key context;

[0016] The CA key management center imports the backup public key and the backup private key in the backup key pair and the backup key seed into the parent key context;

[0017] The CA key management center imports the backup public key and the backup private key in the backup key pair and the backup key seed into the tpm to generate a parent key context, wherein the key context is used to decrypt the ciphertext encrypted by the business virtual machine in the CA key management center.

[0018] Optionally, the CA key management center imports the public key in the backup key pair into a parent key context, including:

[0019] The CA key management center imports the public key in the backup key pair into a parent key context through the private key tpm2_load command for encryption.

[0020] Optionally, the control node nova-api service of the Openstack cluster receives a command request for a virtual machine key backup, and transparently transmits the command request for the key backup to the computing node nova-compute service, including:

[0021] The nova-api service of the control node of the Openstack cluster receives the command request for virtual machine key backup and checks the status of the current virtual machine;

[0022] If the state of the current virtual machine is the active state, and the current virtual machine is a trusted virtual machine built by vtpm, the command request for the key backup is transparently transmitted to the computing node nova-compute service.

[0023] Optionally, the encryption key pair context is created through a backup strategy session.

[0024] Optionally, after receiving the request to generate a backup parent key, the CA key management center generates a master key, including:

[0025] After receiving the request to generate a backup parent key, the CA key management center generates a primary key by using the tpm2_createprimary command for creating a primary key.

[0026] Optionally, generating a backup key pair according to the master key includes:

[0027] The backup key pair is generated by using the generated master key and the asymmetric algorithm RSA through tpm2_create.

[0028] In a second aspect, the present application provides a key backup and recovery device based on vtpm for a virtual machine on an OpenStack platform, comprising:

[0029] The first transceiver module is used for the control node nova-api service of the Openstack cluster to receive a command request for virtual machine key backup, and transparently transmit the command request for key backup to the computing node nova-compute service;

[0030] A second transceiver module is used for sending the key backup command request to the business virtual machine after the nova-compute service receives the key backup command request;

[0031] The first processing module is used for the business virtual machine to check whether the current key file is complete after receiving the command request for the key backup, and if it is determined that the current key file is complete, send a request to generate a backup parent key to the CA key management center, wherein the checking whether the current key file is complete is used to check whether the current key file includes an encryption key, and is used to check whether the encryption key has a backup feature;

[0032] The second processing module is used for the CA key management center to generate a backup master key after receiving the request to generate a backup parent key, and send the backup master key to the business virtual machine;

[0033] A third processing module is used for the business virtual machine to import the backup master key into a trusted platform module TPM to convert it into a backup master key context that supports the identity of the business virtual machine;

[0034] A fourth processing module is used for the business virtual machine to import the backup master key, and to export the encryption key pair context saved by the TPM to generate a backup key pair and a backup key seed;

[0035] The third transceiver module is used for the business virtual machine to send the backup key pair and the backup key seed to the CA key management center.

[0036] Optionally, the above device further includes:

[0037] A fifth processing module, used for the CA key management center to import the public key in the backup key pair into a parent key context;

[0038] A sixth processing module, configured for the CA key management center to import the backup public key and the backup private key in the backup key pair and the backup key seed into a parent key context;

[0039] The seventh processing module is used for the CA key management center to import the backup public key and backup private key in the backup key pair and the backup key seed into TPM to generate a parent key context, wherein the key context is used to decrypt the ciphertext encrypted by the business virtual machine in the CA key management center.

[0040] Optionally, the fifth processing module is specifically configured to:

[0041] The CA key management center imports the public key in the backup key pair into a parent key context through the private key tpm2_load command for encryption.

[0042] Optionally, the first transceiver module is specifically used to:

[0043] The nova-api service of the control node of the Openstack cluster receives the command request for virtual machine key backup and checks the status of the current virtual machine;

[0044] If the state of the current virtual machine is the active state, and the current virtual machine is a trusted virtual machine built by vtpm, the command request for the key backup is transparently transmitted to the computing node nova-compute service.

[0045] Optionally, the encryption key pair context is created through a backup strategy session.

[0046] Optionally, the second processing module is specifically configured to:

[0047] After receiving the request to generate a backup parent key, the CA key management center generates a primary key by using the tpm2_createprimary command for creating a primary key.

[0048] Optionally, the second processing module is further specifically configured to:

[0049] The backup key pair is generated by using the generated master key and the asymmetric algorithm RSA through tpm2_create.

[0050] In a third aspect, the present application provides a key backup and recovery device based on vtpm for a virtual machine on an OpenStack platform, comprising: at least one processor and a memory;

[0051] The memory stores computer-executable instructions;

[0052] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the key backup and recovery method based on vtpm for the OpenStack platform virtual machine as described in the first aspect and various possible designs of the first aspect.

[0053] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the key backup and recovery method based on vtpm for an OpenStack platform virtual machine as described in the first aspect and various possible designs of the first aspect is implemented.

[0054] In a fifth aspect, the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the key backup and recovery method based on vtpm for an OpenStack platform virtual machine as described in the first aspect and various possible designs of the first aspect.

[0055] The present application provides a key backup and recovery method and device for an OpenStack platform virtual machine based on vtpm, wherein the implementation of the method is applied to an OpenStack platform virtual machine, and the key generated by vtpm is used to encrypt the business on the openstack platform. Because of the strong correlation between the key and the platform, that is, encryption and decryption can only be performed when the key is imported on a legitimate platform. Although the security of the key is guaranteed, when a problem occurs on the virtual machine platform, a method is needed to recover the key. Based on the above problems, the embodiment of the present application proposes a key backup and recovery method, and the specific process is as follows: after receiving a request to generate a backup parent key, the CA key management center generates a backup master key and sends it to the business virtual machine. The encryption key with backup characteristics of the business virtual machine uses the backup master key to generate a backup key pair and a backup key seed; and sends it to the CA key management center for storage. When the CA management center receives the key recovery command, the backup encryption key is imported into vtpm through the backup master key, and the identity management of the encryption key of the business virtual machine is realized in the CA management center, and the encryption (signature) and decryption (signature verification) of the business virtual machine are realized to ensure the security of the key. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0057] Figure 1 A schematic diagram of a key backup and recovery system architecture based on vtpm for an OpenStack platform virtual machine provided in an embodiment of the present application;

[0058] Figure 2 A flow chart of a key backup and recovery method based on vtpm for a virtual machine on an OpenStack platform provided in an embodiment of the present application;

[0059] Figure 3 A schematic diagram of generating a backup key pair and a backup key seed in a Tpm key backup process provided in an embodiment of the present application;

[0060] Figure 4 A schematic diagram of key context generation in a Tpm key recovery process provided in an embodiment of the present application;

[0061] Figure 5 A schematic diagram of the interactive process of a method for backing up and restoring a password of a virtual machine on an OpenStack platform based on vtpm provided in an embodiment of the present application;

[0062] Figure 6 A schematic diagram of the structure of a key backup and recovery device based on vtpm for an OpenStack platform virtual machine provided in an embodiment of the present application;

[0063] Figure 7 A schematic diagram of the structure of a key backup and recovery device based on vtpm for an OpenStack platform virtual machine provided in an embodiment of the present application.

[0064] The above drawings show clear embodiments of the present disclosure, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present disclosure to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0065] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0066] The terms "first", "second", "third", and "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0067] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0068] When a business virtual machine needs to be encrypted by a TPM key, first a master key is generated by a seed key and a template, then a key is created by TPM2_Create, and the master key is used as the parent key to encapsulate the key, and the encapsulated key pair is returned to the caller. The caller stores this key outside the TPM, possibly on a disk. In order to use this key, the user must use TPM2_Load to load it into the TPM first, and then encrypt and decrypt the file or verify the signature. Therefore, the tpm key and the vtpm hardware are strongly associated. If the vtpm of the business virtual machine is damaged or the virtual machine crashes, there is no way to import the encryption key, and there is no way to decrypt the ciphertext encrypted by the vtpm of this business virtual machine. However, if the hardware vtpm of the vtpm key that implements virtual machine management is damaged, or the business virtual machine crashes, the file encrypted (signed) by the business virtual machine tpm key cannot be decrypted (verified). The prior art has the technical problem of low security and reliability of virtual machine management.

[0069] In order to solve the above technical problems, an embodiment of the present application provides a key backup and recovery method and device based on vtpm for an OpenStack platform virtual machine. The method exports the vtpm key from the business virtual machine to the CA key management center for backup through key backup. If a recovery scenario is required, the key is re-imported in the CA key management center for recovery.

[0070] Optionally, the business is encrypted using the key generated by vtpm on the openstack platform. Because of the strong correlation between the key and the platform, encryption and decryption can only be performed by importing the key on a legitimate platform. Although the security of the key is guaranteed, when a problem occurs on the virtual machine platform, a method is needed to recover the key. Based on the above problems, an embodiment of the present application proposes a key backup and recovery method. The specific process is as follows: after receiving a request to generate a backup parent key, the CA key management center generates a backup master key and sends it to the business virtual machine. The encryption key with backup characteristics of the business virtual machine uses the backup master key to generate a backup key pair and a backup key seed; and sends it to the CA key management center for storage. When the CA management center receives the key recovery command, it imports the backup encryption key into vtpm through the backup master key, realizes the identity management of the encryption key of the business virtual machine in the CA management center, realizes encryption (signature) and decryption (signature verification) of the business virtual machine, and ensures the security of the key.

[0071] Optional, Figure 1 A schematic diagram of a key backup and recovery system architecture for an OpenStack platform virtual machine based on vtpm is provided in an embodiment of the present application. Figure 1 In the above architecture, the CA key management center 101, the business virtual machine 102 and the shared volume 103 are included.

[0072] Any two of the CA key management center 101 , the business virtual machine 102 and the shared volume 103 can achieve communication connection.

[0073] Optionally, the overall architecture and inventive concept of the embodiments of the present application are as follows:

[0074] like Figure 1 In step (1), the CA key management center first generates a first master key as a backup master key using the EK seed key, and then sends the backup master key to the service virtual machine.

[0075] The service virtual machine generates the second master key through the seed key in step (2), and then generates the encryption key through the second master key. Then, through the TPM key copy command, the backup encryption key is generated through the backup master key and the encryption key.

[0076] In step (3), the business virtual machine backup encryption key is sent to the CA key management center.

[0077] If the business virtual machine crashes, the ciphertext stored in the shared volume (corresponding to the drive letter / dev / vda exposed by the virtual machine) cannot be decrypted by the business virtual machine.

[0078] First, through step (4), in the CA management center, import the backup master key and the backup encryption key to generate the encryption key B in the context of the CA management center. Then the shared volume of the business virtual machine is mounted to the CA key management center through (6). Then the ciphertext is decrypted using the encryption key B.

[0079] It is understandable that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the key backup and recovery system architecture based on vtpm for OpenStack platform virtual machines. In other feasible implementations of the present application, the above architecture may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown may be implemented in hardware, software, or a combination of software and hardware.

[0080] In addition, the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0081] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0082] Figure 2 A flow chart of a key backup and recovery method based on vtpm for a virtual machine on an OpenStack platform provided in an embodiment of the present application. The embodiment of the present application can be applied to Figure 1 The OpenStack platform virtual machine in the vtpm-based key backup and recovery system can be determined based on the actual application scenario. Figure 2 As shown, the method comprises the following steps:

[0083] S201: The nova-api service of the control node of the Openstack cluster receives a command request for a virtual machine key backup, and transparently transmits the command request for the key backup to the nova-compute service of the computing node.

[0084] Optionally, the nova-api service of the control node of the Openstack cluster receives a command request for a virtual machine key backup, and transparently transmits the command request for the key backup to the nova-compute service of the computing node, including: the nova-api service of the control node of the Openstack cluster receives a command request for a virtual machine key backup, and checks the status of the current virtual machine; if the status of the current virtual machine is an active running state, and the current virtual machine is a trusted virtual machine built by vtpm, the key backup command request is transparently transmitted to the nova-compute service of the computing node.

[0085] S202: After receiving the key backup command request, the nova-compute service sends the key backup command request to the business virtual machine.

[0086] S203: After receiving the key backup command request, the business virtual machine checks whether the current key file is complete. If it is determined that the current key file is complete, a request to generate a backup parent key is sent to the CA key management center.

[0087] Among them, checking whether the current key file is complete is used to check whether the current key file includes an encryption key, and is used to check whether the encryption key has a backup feature.

[0088] The current key file here refers to the key file stored in the business virtual machine.

[0089] Optionally, the parent key here refers to the parent key corresponding to the business virtual machine.

[0090] S204: After receiving the request to generate a backup parent key, the CA key management center generates a backup master key and sends the backup master key to the business virtual machine.

[0091] Optionally, after receiving the request to generate a backup parent key, the CA key management center generates a primary key, including: after receiving the request to generate a backup parent key, the CA key management center generates the primary key by using a tpm2_createprimary command for creating a primary key.

[0092] Optionally, generating a backup key pair according to the master key includes: generating the backup key pair by using the generated master key and an asymmetric algorithm RSA through a key creation program tpm2_create.

[0093] In a possible implementation, after receiving a command request to generate a backup parent key, the CA key management center generates a primary key through the tpm2_createprimary command, and then generates a backup key pair (public key new_parent.pub and private key new_parent.prv) through tpm2_create using the generated primary key and the asymmetric algorithm RSA, and returns the public key new_parent.pub to the business virtual machine.

[0094] S205: The business virtual machine imports the backup master key into the trusted platform module TPM to convert it into a backup master key context that supports the business virtual machine identity.

[0095] In a possible implementation, the service virtual machine imports the backup master key new_parent.pub generated by the CA key management center into the tpm through the tpm2_loadexternal command to convert it into the backup master key context new_parent.ctx that supports the service virtual machine identity.

[0096] S206: The service virtual machine imports the backup master key, and exports the encryption key pair context saved by the TPM to generate a backup key pair and a backup key seed.

[0097] Optionally, an encryption key pair context is created via a backup policy session.

[0098] Optionally, Figure 3 A schematic diagram of generating a backup key pair and a backup key seed in a Tpm key backup process provided by an embodiment of the present application. Figure 3As shown, in a possible implementation, the backup master key new_parent.ctx is imported through tpm2_duplicate, and the encryption key pair context key.ctx saved by tpm is exported to generate a backup key pair (dup.dpriv-s dup.seed) and a backup key seed dup.seed.

[0099] Note that the encryption key pair saved by TPM must be created through the backup policy session when it is created, and when used, it is imported into TPM through tpm_load to generate key.ctx.

[0100] S207: The business virtual machine sends the backup key pair and the backup key seed to the CA key management center.

[0101] Specifically, the backup key pair (dup.dpriv-s dup.seed) and the backup key seed dup.seed file are sent to the CA key management center.

[0102] Among them, the above scheme is a tpm key backup method.

[0103] Below, the tpm recovery process is introduced:

[0104] Optionally, the above method further includes:

[0105] The CA key management center imports the public key in the backup key pair and converts it into a parent key context; the CA key management center imports the backup public key, backup private key and backup key seed in the backup key pair into the parent key context; the CA key management center imports the backup public key, backup private key and backup key seed in the backup key pair into tpm to generate a parent key context, wherein the key context is used to decrypt the ciphertext encrypted by the business virtual machine at the CA key management center.

[0106] Optionally, the CA key management center imports the public key in the backup key pair into the parent key context, including: the CA key management center imports the public key in the backup key pair into the parent key context through the private key tpm2_load command for encryption. Optionally, it can also be imported into vtpm.

[0107] Specifically, the tpm recovery process is as follows:

[0108] Recovery step 1, tpm2_load imports the parent key public key new_parent.pub and converts it into the parent key context new_parent.ctx (the corresponding public key and private key mapping information in this context is still empty).

[0109] Recovery step 2: Use tpm2_import to import the backup public key dup.pub, backup private key dup.prv, and backup key seed dup.seed information into the parent key context new_parent.ctx (this context is associated with the public key and private key).

[0110] Optionally, Figure 4 A schematic diagram of key context generation in a Tpm key recovery process provided by an embodiment of the present application. Figure 4 As shown, restore step 3 and import new_parent.ctx and the backup key through tpm2_load to generate a new key context dup.ctx. This dup.ctx can decrypt the ciphertext encrypted by the business virtual machine in the CA key management center.

[0111] Optionally, Figure 5 A schematic diagram of the interactive process of a method for backing up and restoring a password of a virtual machine on an OpenStack platform based on vtpm provided in an embodiment of the present application, using Figure 5 In the method, the embodiment of the present application exports the vtpm key from the business virtual machine to the CA key management center for backup through the vtpm key backup method. If a recovery scenario is required, the key is re-imported in the CA key management center for recovery. The problem that the hardware vtpm of the vtpm key managed by the virtual machine is damaged, or the business virtual machine crashes, resulting in the inability to decrypt (verify the signature) of the file encrypted (signed) by the business virtual machine tpm key, is solved, ensuring the stability and security of cloud computing.

[0112] In the openstack platform, the key generated by vtpm is used to encrypt the business. Because of the strong correlation between the key and the platform, that is, encryption and decryption can only be performed when the key is imported on a legal platform. Although the security of the key is guaranteed, when there is a problem with the virtual machine platform, a method is needed to recover the key. Based on the above problems, an embodiment of the present application proposes a key backup and recovery method. The specific process is as follows: after the CA key management center receives a request to generate a backup parent key, it generates a backup master key and sends it to the business virtual machine. The encryption key with backup characteristics of the business virtual machine uses the backup master key to generate a backup key pair and a backup key seed; and sends it to the CA key management center for storage. When the CA management center receives the key recovery command, it imports the backup encryption key into vtpm through the backup master key, realizes the identity management of the encryption key of the business virtual machine in the CA management center, realizes encryption (signature) and decryption (signature verification) of the business virtual machine, and ensures the security of the key.

[0113] Figure 6 A schematic diagram of a key backup and recovery device based on vtpm for an OpenStack platform virtual machine provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, the device of the embodiment of the present application includes: a first transceiver module 601, a second transceiver module 602, a first processing module 603, a second processing module 604, a third processing module 605, a fourth processing module 606 and a third transceiver module 607. Among them, the key backup and recovery device based on vtpm of the OpenStack platform virtual machine here can be a server or a terminal device, or a chip or integrated circuit that realizes the function of the server or terminal device. It should be noted here that the division of the first transceiver module 601, the second transceiver module 602, the first processing module 603, the second processing module 604, the third processing module 605, the fourth processing module 606 and the third transceiver module 607 is only a division of logical functions, and the two can be integrated or independent physically.

[0114] Among them, the first transceiver module is used for the control node nova-api service of the Openstack cluster to receive the command request for virtual machine key backup, and transparently transmit the command request for key backup to the computing node nova-compute service;

[0115] The second transceiver module is used for sending the key backup command request to the business virtual machine after the nova-compute service receives the key backup command request;

[0116] The first processing module is used for the business virtual machine to check whether the current key file is complete after receiving the key backup command request, and if it is determined that the current key file is complete, send a request to generate a backup parent key to the CA key management center;

[0117] The second processing module is used for the CA key management center to generate a backup master key after receiving the request to generate a backup parent key, and send the backup master key to the business virtual machine;

[0118] The third processing module is used for the business virtual machine to import the backup master key into the trusted platform module TPM and convert it into a backup master key context that supports the business virtual machine identity;

[0119] The fourth processing module is used for importing the backup master key into the business virtual machine, exporting the encryption key pair context saved by the tpm to generate a backup key pair and a backup key seed;

[0120] The third transceiver module is used for the business virtual machine to send the backup key pair and the backup key seed to the CA key management center.

[0121] Optionally, the above device further includes:

[0122] The fifth processing module is used for the CA key management center to import the public key in the backup key pair into a parent key context;

[0123] The sixth processing module is used for the CA key management center to import the backup public key and the backup private key in the backup key pair and the backup key seed into the parent key context;

[0124] The seventh processing module is used for the CA key management center to import the backup public key, backup private key and backup key seed in the backup key pair into the tpm to generate a parent key context, wherein the key context is used to decrypt the ciphertext encrypted by the business virtual machine in the CA key management center.

[0125] Optionally, the fifth processing module is specifically configured to:

[0126] The CA key management center uses the tpm2_load command to import the public key in the backup key pair into the parent key context.

[0127] Optionally, the first transceiver module is specifically used for:

[0128] The nova-api service of the control node of the Openstack cluster receives the command request for virtual machine key backup and checks the status of the current virtual machine;

[0129] If the current virtual machine is in the active state and is a trusted virtual machine built by vtpm, the key backup command request is transparently transmitted to the nova-compute service on the computing node.

[0130] Optionally, an encryption key pair context is created via a backup policy session.

[0131] Optionally, the second processing module is specifically used for:

[0132] After receiving the request to generate a backup parent key, the CA key management center generates a primary key by using the tpm2_createprimary command used to create a primary key.

[0133] Optionally, the second processing module is further specifically configured to:

[0134] Use tpm2_create to create a key and generate a backup key pair using the generated master key and the asymmetric algorithm RSA.

[0135] refer to Figure 7, which shows a schematic diagram of the structure of a key backup and recovery device based on vtpm for an OpenStack platform virtual machine suitable for implementing an embodiment of the present disclosure, and the key backup and recovery device based on vtpm for an OpenStack platform virtual machine can be a terminal device or a server. The terminal device can include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, personal digital assistants (PDAs), tablet computers (Portable Android Devices, PADs), portable multimedia players (PMPs), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The illustrated key backup and recovery device based on vtpm for the OpenStack platform virtual machine is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0136] like Figure 7 As shown, the key backup and recovery device based on vtpm of the OpenStack platform virtual machine may include a processing device (such as a central processing unit, a graphics processor, etc.) 701, which can perform various appropriate actions and processes according to the program stored in the read-only memory (Read Only Memory, referred to as ROM) 702 or the program loaded from the storage device 708 to the random access memory (Random Access Memory, referred to as RAM) 703. In RAM 703, various programs and data required for the operation of the key backup and recovery device based on vtpm of the OpenStack platform virtual machine are also stored. The processing device 701, ROM 702 and RAM 703 are connected to each other through a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0137] Typically, the following devices can be connected to the I / O interface 705: input devices 706 such as touch screens, touch pads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 such as liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 708 such as magnetic tapes, hard disks, etc.; and communication devices 709. The communication device 709 can allow the OpenStack platform virtual machine to communicate with other devices wirelessly or by wire to exchange data based on the key backup and recovery device of the vtpm. Figure 7The key backup and recovery device based on vtpm of the OpenStack platform virtual machine with various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0138] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 709, or installed from a storage device 708, or installed from a ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0139] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0140] The computer-readable medium may be included in the vtpm-based key backup and recovery device for the OpenStack platform virtual machine; or may exist independently without being assembled into the vtpm-based key backup and recovery device for the OpenStack platform virtual machine.

[0141] The computer-readable medium carries one or more programs. When the one or more programs are executed by the vtpm-based key backup and recovery device of the OpenStack platform virtual machine, the vtpm-based key backup and recovery device of the OpenStack platform virtual machine executes the method shown in the above embodiment.

[0142] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0143] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0144] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0145] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the application disclosed herein. This application is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0146] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A key backup and recovery method based on vtpm for a virtual machine on an OpenStack platform, characterized in that: include: The nova-api service of the control node of the Openstack cluster receives the command request for the virtual machine key backup, and transparently transmits the command request for the key backup to the nova-compute service of the computing node; After receiving the command request for key backup, the nova-compute service sends the command request for key backup to the business virtual machine; After receiving the command request for the key backup, the business virtual machine checks whether the current key file is complete. If it is determined that the current key file is complete, a request to generate a backup parent key is sent to the CA key management center, wherein the checking whether the current key file is complete is used to check whether the current key file includes an encryption key and whether the encryption key has a backup feature; After receiving the request to generate a backup parent key, the CA key management center generates a backup master key and sends the backup master key to the business virtual machine; The business virtual machine imports the backup master key into the trusted platform module tpm to convert it into a backup master key context that supports the business virtual machine identity; The business virtual machine imports the backup master key, and exports the encryption key pair context saved by the tpm to generate a backup key pair and a backup key seed; The business virtual machine sends the backup key pair and the backup key seed to the CA key management center.

2. The method according to claim 1, characterized in that Also includes: The CA key management center imports the public key in the backup key pair into a parent key context; The CA key management center imports the backup public key and the backup private key in the backup key pair and the backup key seed into the tpm to generate a parent key context; The CA key management center imports the backup public key and the backup private key in the backup key pair and the backup key seed into the tpm to generate a parent key context, wherein the key context is used to decrypt the ciphertext encrypted by the business virtual machine in the CA key management center.

3. The method according to claim 2, characterized in that The CA key management center imports the public key in the backup key pair into a parent key context, including: The CA key management center imports the public key in the backup key pair into a parent key context through the private key tpm2_load command for encryption.

4. The method according to any one of claims 1 to 3, characterized in that: The nova-api service of the control node of the Openstack cluster receives a command request for a virtual machine key backup, and transparently transmits the command request for the key backup to the nova-compute service of the computing node, including: The nova-api service of the Openstack cluster's control node receives a command request for virtual machine key backup and checks the status of the current virtual machine. If the state of the current virtual machine is the active state, and the current virtual machine is a trusted virtual machine built by vtpm, the command request for the key backup is transparently transmitted to the computing node nova-compute service.

5. The method according to any one of claims 1 to 3, characterized in that: The encryption key pair context is created through the backup policy session.

6. The method according to any one of claims 1 to 3, characterized in that: After receiving the request to generate a backup parent key, the CA key management center generates a master key, including: After receiving the request to generate a backup parent key, the CA key management center generates a primary key by using the tpm2_createprimary command for creating a primary key.

7. The method according to any one of claims 1 to 3, characterized in that: The step of generating a backup key pair according to the master key comprises: The backup key pair is generated by using the generated master key and the asymmetric algorithm RSA through tpm2_create.

8. A key backup and recovery device based on vtpm for a virtual machine on an OpenStack platform, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the key backup and recovery method based on vtpm for an OpenStack platform virtual machine according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the key backup and recovery method based on vtpm for an OpenStack platform virtual machine according to any one of claims 1 to 7.

Images