Key backup and recovery method and device based on vtpm for OpenStack platform virtual machines

Abstract

This application provides a key backup and recovery method and device for OpenStack platform virtual machines based on VTPM. On the OpenStack platform, keys generated by VTPM are used to encrypt business applications. Due to the strong correlation between the key and the platform, although key security is guaranteed, a method for key recovery is needed when the virtual machine platform encounters problems. To address this issue, a key backup and recovery method is proposed. After receiving a request to generate a backup parent key, the CA key management center generates a backup master key and sends it to the business virtual machine. The business virtual machine, possessing backup-capable encryption keys, uses the backup master key to generate backup key pairs and backup key seeds; these are then sent to the CA key management center for storage. When the CA management center receives a key recovery command, it imports the backup encryption key into VTPM using the backup master key, enabling identity management of the business virtual machine's encryption keys at the CA management center. This allows for encryption (signing) and decryption (signature verification) of the business virtual machine, ensuring key security.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a method and device for key backup and recovery of OpenStack platform virtual machines based on vtpm. Background Art

[0002] OpenStack is an open-source cloud computing management platform project. Virtual machines are a core component of the OpenStack platform, representing an isolated runtime environment created on physical hardware using virtualization technology. Encryption of virtual machines is crucial for ensuring the security of cloud computing.

[0003] When a business virtual machine needs to encrypt data using a Trusted Platform Module (TPM) key, a master key is first generated using a seed key and a template. Then, a new key is created using `TPM2_Create`, and this key is wrapped (encrypted) using the master key as the parent key. The wrapped key pair (encryption key) is returned to the caller. The caller stores this key outside the TPM, possibly on disk. To use this key, the user must use `TPM2_Load` to load it into the TPM, and then perform encryption / decryption or signature verification on the file. Therefore, the TPM key and the VTPM hardware are strongly correlated. If the business virtual machine's VTPM is corrupted or the virtual machine crashes, making it impossible to import the encryption key and decrypt ciphertext encrypted using that business virtual machine's VTPM, the encryption will fail.

[0004] However, existing technologies suffer from low security and reliability in virtual machine management. Summary of the Invention

[0005] This application provides a method and device for key backup and recovery of virtual machines on the OpenStack platform based on VTPM, in order to solve the technical problems of low security and reliability of virtual machine management in the prior art.

[0006] Firstly, this application provides a method for key backup and recovery of OpenStack platform virtual machines based on VTPM, including:

[0007] When the OpenStack cluster's control node nova-api service receives a command request for virtual machine key backup, it forwards the command request to the compute node nova-compute service.

[0008] After receiving the key backup command request, the nova-compute service sends the key backup command request to the business virtual machine.

[0009] After receiving the key backup command request, the business virtual machine checks whether the current key file is complete. If the current key file is complete, it sends a request to generate a backup parent key to the CA key management center. The check for the completeness of the current key file is used to check whether the current key file includes an encryption key and whether the encryption key has backup characteristics.

[0010] After receiving the request to generate a backup parent key, the CA key management center generates a backup master key and sends the backup master key to the business virtual machine.

[0011] The business virtual machine imports the backup master key into the Trusted Platform Module (tpm) and converts it into a backup master key context that supports the identity of the business virtual machine.

[0012] The business virtual machine imports the backup master key and exports the encryption key pair context saved in tpm to generate backup key pairs and backup key seeds;

[0013] The business virtual machine sends the backup key pair and the backup key seed to the CA key management center.

[0014] Optionally, the above method further includes:

[0015] The CA key management center imports the public key from the backup key pair and converts it into a parent key context.

[0016] The CA key management center imports the backup public key and backup private key from the backup key pair, as well as the backup key seed, into the parent key context;

[0017] The CA key management center imports the backup public key and backup private key from the backup key pair, as well as the backup key seed, into tpm to generate a parent key context. The key context is used to decrypt the ciphertext encrypted by the business virtual machine in the CA key management center.

[0018] Optionally, the CA key management center imports the public key from the backup key pair and converts it into a parent key context, including:

[0019] The CA key management center imports the public key from the backup key pair and converts it into a parent key context using the tpm2_load command for encryption.

[0020] Optionally, the OpenStack cluster's control node nova-api service receives a command request for virtual machine key backup and then forwards the key backup command request to the compute node nova-compute service, including:

[0021] The OpenStack cluster's control node, nova-api service, receives a command request to back up the virtual machine key and checks the current status of the virtual machine.

[0022] If the current virtual machine is in an active state and is a trusted virtual machine built using VTPM, then the command request for key backup is forwarded to the compute node nova-compute service.

[0023] Optionally, the encryption key pair context is created through a backup policy session.

[0024] Optionally, after receiving the request to generate a backup parent key, the CA key management center generates a master key, including:

[0025] After receiving the request to generate a backup parent key, the CA key management center generates a primary key using the tpm2_createprimary command.

[0026] Optionally, generating a backup key pair based on the master key includes:

[0027] The backup key pair is generated using the master key tpm2_create and the asymmetric algorithm RSA.

[0028] Secondly, this application provides a key backup and recovery device for OpenStack platform virtual machines based on VTPM, comprising:

[0029] The first transceiver module is used to pass through the command request for key backup from the control node nova-api service of the OpenStack cluster to the compute node nova-compute service when the control node nova-api service receives the command request for key backup.

[0030] The second transceiver module is used to send the key backup command request to the business virtual machine after the nova-compute service receives the key backup command request;

[0031] The first processing module is used to check whether the current key file is complete after the business virtual machine receives the command request for key backup. If the current key file is complete, the module sends a request to generate a backup parent key to the CA key management center. The check whether the current key file is complete is used to check whether the current key file includes an encryption key and to check whether the encryption key has backup characteristics.

[0032] The second processing module is used to generate a backup master key after the CA key management center receives the request to generate a backup parent key, and then send the backup master key to the business virtual machine.

[0033] The third processing module is used for the business virtual machine to import the backup master key into the trusted platform module tpm and convert it into a backup master key context that supports the identity of the business virtual machine;

[0034] The fourth processing module is used to import the backup master key into the business virtual machine, and export the encryption key pair context saved by tpm to generate backup key pairs and backup key seeds.

[0035] The third transceiver module is used by the business virtual machine to send the backup key pair and the backup key seed to the CA key management center.

[0036] Optionally, the above-mentioned device further includes:

[0037] The fifth processing module is used by the CA key management center to import the public key from the backup key pair and convert it into a parent key context;

[0038] The sixth processing module is used by the CA key management center to import the backup public key and backup private key in the backup key pair and the backup key seed into the parent key context;

[0039] The seventh processing module is used by the CA key management center to import the backup public key and backup private key and the backup key seed from the backup key pair into the tpm to generate a parent key context, wherein the key context is used by the CA key management center to decrypt the ciphertext encrypted by the business virtual machine.

[0040] Optionally, the fifth processing module is specifically used for:

[0041] The CA key management center imports the public key from the backup key pair and converts it into a parent key context using the tpm2_load command for encryption.

[0042] Optionally, the first transceiver module is specifically used for:

[0043] The OpenStack cluster's control node, nova-api service, receives a command request to back up the virtual machine key and checks the current status of the virtual machine.

[0044] If the current virtual machine is in an active state and is a trusted virtual machine built using VTPM, then the command request for key backup is forwarded to the compute node nova-compute service.

[0045] Optionally, the encryption key pair context is created through a backup policy session.

[0046] Optionally, the second processing module is specifically used for:

[0047] After receiving the request to generate a backup parent key, the CA key management center generates a primary key using the tpm2_createprimary command.

[0048] Optionally, the second processing module is further specifically used for:

[0049] The backup key pair is generated using the master key tpm2_create and the asymmetric algorithm RSA.

[0050] Thirdly, this application provides an OpenStack platform virtual machine key backup and recovery device based on vtpm, including: at least one processor and memory;

[0051] The memory stores computer-executable instructions;

[0052] The at least one processor executes the computer execution instructions stored in the memory, causing the at least one processor to perform the OpenStack platform virtual machine key backup and recovery method based on vtpm as described in the first aspect and various possible designs of the first aspect.

[0053] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the OpenStack platform virtual machine key backup and recovery method based on VTPM as described in the first aspect and various possible designs of the first aspect.

[0054] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the OpenStack platform virtual machine key backup and recovery method based on VTPM as described in the first aspect and various possible designs of the first aspect.

[0055] This application provides a key backup and recovery method and device for OpenStack platform virtual machines based on VTPM. The method is implemented on OpenStack platform virtual machines, where keys generated by VTPM are used to encrypt services on the OpenStack platform. Due to the strong correlation between the key and the platform—encryption and decryption can only be performed by importing the key onto a legitimate platform—while key security is ensured, a method for key recovery is needed when the virtual machine platform encounters problems. Based on these issues, this application proposes a key backup and recovery method. The specific process is as follows: After receiving a request to generate a backup parent key, the CA key management center generates a backup master key and sends it to the service virtual machine. The service virtual machine, possessing backup-capable encryption keys, uses the backup master key to generate backup key pairs and backup key seeds; these are then sent to the CA key management center for storage. When the CA management center receives a key recovery command, it imports the backup encryption key into VTPM using the backup master key, enabling identity management of the service virtual machine's encryption keys at the CA management center. This allows for encryption (signing) and decryption (signature verification) of the service virtual machine, ensuring key security. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 A schematic diagram of an OpenStack platform virtual machine key backup and recovery system architecture based on VTPM is provided for an embodiment of this application;

[0058] Figure 2 A flowchart illustrating a method for key backup and recovery of OpenStack platform virtual machines based on VTPM, provided in an embodiment of this application;

[0059] Figure 3 This application provides a schematic diagram of the generation of backup key pairs and backup key seeds in a Tpm key backup process.

[0060] Figure 4 This application provides a schematic diagram of key context generation for a Tpm key recovery process.

[0061] Figure 5 A schematic diagram illustrating the interactive process of an OpenStack platform virtual machine password backup and recovery method based on vtpm, provided in an embodiment of this application;

[0062] Figure 6 A schematic diagram of the structure of an OpenStack platform virtual machine key backup and recovery device based on VTPM provided in this application embodiment;

[0063] Figure 7 This is a schematic diagram of the structure of an OpenStack platform virtual machine key backup and recovery device based on vtpm, provided in an embodiment of this application.

[0064] The accompanying drawings have illustrated specific embodiments of this disclosure, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this disclosure to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0065] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0066] The terms “first,” “second,” “third,” and “fourth,” etc. (if present), in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0067] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0068] When a business virtual machine needs to encrypt data using a TPM key, a master key is first generated using a seed key and a template. Then, a key is created using `TPM2_Create`, and this key is encapsulated using the master key as the parent key. The encapsulated key pair is then returned to the caller. The caller stores this key outside the TPM, possibly on disk. To use this key, the user must use `TPM2_Load` to load it into the TPM, and then encrypt, decrypt, or sign / verify the file. Therefore, the TPM key and the VTPM hardware are strongly correlated. If the business virtual machine's VTPM is corrupted or the virtual machine crashes, it becomes impossible to import the encryption key, and thus impossible to decrypt ciphertext encrypted using the business virtual machine's VTPM. Furthermore, if the hardware implementing the VTPM key for virtual machine management is corrupted, or if the business virtual machine crashes, files encrypted (signed) using the business virtual machine's TPM key cannot be decrypted (verified). Existing technologies suffer from low security and reliability in virtual machine management.

[0069] To address the aforementioned technical issues, this application provides a method and device for key backup and recovery of OpenStack platform virtual machines based on VTPM. This method involves exporting the VTPM key from the business virtual machine to the CA key management center for backup. If recovery is required, the key is re-imported from the CA key management center for recovery.

[0070] Optionally, the business encryption is performed using a key generated by VTPM on the OpenStack platform. Due to the strong correlation between the key and the platform—meaning encryption and decryption can only be performed by importing the key onto a legitimate platform—while key security is ensured, a method for key recovery is needed when the virtual machine platform encounters problems. Based on these issues, this application proposes a key backup and recovery method. The specific process is as follows: After receiving a request to generate a backup parent key, the CA key management center generates a backup master key and sends it to the business virtual machine. The business virtual machine, possessing backup-capable encryption keys, uses the backup master key to generate a backup key pair and a backup key seed; these are then sent to the CA key management center for storage. When the CA management center receives a key recovery command, it imports the backup encryption key into VTPM using the backup master key, enabling identity management of the business virtual machine's encryption keys at the CA management center, and facilitating encryption (signing) and decryption (signature verification) of the business virtual machine, thus ensuring key security.

[0071] Optional, Figure 1 This is a schematic diagram of an OpenStack platform virtual machine key backup and recovery system architecture based on VTPM, provided as an embodiment of this application. Figure 1 The aforementioned architecture includes a CA key management center 101, a business virtual machine 102, and a shared volume 103.

[0072] Communication connections can be established between any two of the CA key management center 101, business virtual machine 102, and shared volume 103.

[0073] Optionally, the overall architecture and inventive concept of the embodiments of this application are as follows:

[0074] like Figure 1 In step (1), the CA key management center first generates a first master key as a backup master key using the EK seed key. Then, the backup master key is sent to the business virtual machine.

[0075] The business virtual machine generates a second master key through the seed key in step (2), and then generates an encryption key through the second master key. Then, through the tpm key copy command, a backup encryption key is generated by backing up the master key and the encryption key.

[0076] The encryption key for the business virtual machine is backed up and sent to the CA key management center through step (3).

[0077] If the business virtual machine crashes, the encrypted data stored in the shared volume (corresponding to the disk letter / dev / vda exposed by the virtual machine) cannot be decrypted by the business virtual machine.

[0078] First, through step (4), the backup master key and backup encryption key are imported into the CA management center to generate encryption key B in the CA management center context. Then, the shared volume of the business virtual machine is mounted to the CA key management center through step (6). Then, the ciphertext is decrypted using encryption key B.

[0079] It is understood that the structure illustrated in the embodiments of this application does not constitute a specific limitation on the architecture of the OpenStack platform virtual machine key backup and recovery system based on VTPM. In other feasible embodiments of this application, the above architecture may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown can be implemented in hardware, software, or a combination of both.

[0080] Furthermore, the network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0081] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0082] Figure 2 This application provides a flowchart illustrating a method for key backup and recovery of OpenStack platform virtual machines based on VTPM. This application can be applied to... Figure 1 The OpenStack platform virtual machines in the system utilize a VTPM key backup and recovery system; the specific execution entity can be determined based on the actual application scenario. For example... Figure 2 As shown, the method includes the following steps:

[0083] S201: The OpenStack cluster's control node nova-api service receives a command request for virtual machine key backup and forwards the command request to the compute node nova-compute service.

[0084] Optionally, when the OpenStack cluster's control node nova-api service receives a command request for virtual machine key backup, it forwards the key backup command request to the compute node nova-compute service. This includes: when the OpenStack cluster's control node nova-api service receives the command request for virtual machine key backup, it checks the current status of the virtual machine; if the current virtual machine is in an active running state and the current virtual machine is a trusted virtual machine built through VTPM, then it forwards the key backup command request to the compute node nova-compute service.

[0085] S202: After receiving the key backup command request, the nova-compute service sends the key backup command request to the business virtual machine.

[0086] S203: After receiving the command request for key backup, the business virtual machine checks whether the current key file is complete. If it is determined that the current key file is complete, it sends a request to generate a backup parent key to the CA key management center.

[0087] The function of checking whether the current key file is complete is used to check whether the current key file includes an encryption key and to check whether the encryption key has backup capabilities.

[0088] Here, the current key file refers to the key file stored in the business virtual machine.

[0089] Optionally, the parent key here refers to the parent key corresponding to the business virtual machine.

[0090] S204: After receiving the request to generate a backup parent key, the CA key management center generates a backup master key and sends the backup master key to the business virtual machine.

[0091] Optionally, after receiving the request to generate a backup parent key, the CA key management center generates a master key, including: after receiving the request to generate a backup parent key, the CA key management center generates a master key using the tpm2_createprimary command used to create the master key.

[0092] Optionally, generating a backup key pair based on the master key includes: generating the backup key pair using the generated master key and the asymmetric algorithm RSA through the key tpm2_create used to create the key.

[0093] In one possible implementation, after receiving a command request to generate a backup parent key, the CA key management center generates a primary key using the `tpm2_createprimary` command, and then uses `tpm2_create` to generate a backup key pair (i.e., public key `new_parent.pub` and private key `new_parent.prv`) using the generated primary key and the asymmetric algorithm RSA. The public key `new_parent.pub` is then returned to the business virtual machine.

[0094] S205: The business virtual machine imports the backup master key into the Trusted Platform Module (tpm) and converts it into a backup master key context that supports the business virtual machine's identity.

[0095] In one possible implementation, the business virtual machine imports the backup master key new_parent.pub generated by the CA key management center into tpm via the tpm2_loadexternal command, and converts it into a backup master key context new_parent.ctx that supports the identity of the business virtual machine.

[0096] S206: Import the backup master key into the business virtual machine, and export the encryption key pair context saved by tpm to generate backup key pairs and backup key seeds.

[0097] Optionally, the encryption key pair context is created via a backup policy session.

[0098] Optionally, Figure 3 This diagram illustrates the generation of backup key pairs and backup key seeds in a Tpm key backup process, as provided in an embodiment of this application. Figure 3As shown, in one possible implementation, the backup master key new_parent.ctx is imported via tpm2_duplicate, and the encryption key pair context key.ctx saved by tpm is exported to generate the backup key pair (dup.dpriv-s dup.seed) and the backup key seed dup.seed.

[0099] Note that the encryption key pairs saved by tpm are always created using the backup strategy session. When using them, import them into tpm to generate key.ctx.

[0100] S207: The business virtual machine sends the backup key pair and backup key seed to the CA key management center.

[0101] Specifically, the backup key pair (dup.dpriv-s dup.seed) and the backup key seed dup.seed file are sent to the CA key management center.

[0102] The above scheme is a TPM key backup method.

[0103] The following describes the TPM recovery process:

[0104] Optionally, the above method further includes:

[0105] The CA Key Management Center imports the public key from the backup key pair and converts it into a parent key context. The CA Key Management Center then imports the backup public key, backup private key, and backup key seed from the backup key pair into the parent key context. Finally, the CA Key Management Center imports the backup public key, backup private key, and backup key seed from the backup key pair into the tpm to generate the parent key context. The key context is used to decrypt the ciphertext encrypted by the business virtual machine in the CA Key Management Center.

[0106] Optionally, the CA Key Management Center imports the public key from the backup key pair into a parent key context, including: the CA Key Management Center imports the public key from the backup key pair into a parent key context using the `tpm2_load` command for the private key used for encryption. Optionally, it can also be imported into vtpm.

[0107] Specifically, the TPM recovery process is as follows:

[0108] Recovery Step 1: tpm2_load imports the parent key public key new_parent.pub and converts it into the parent key context new_parent.ctx (the public and private key mapping information in this context is still empty).

[0109] Recovery step 2: Import the backup public key dup.pub, backup private key dup.prv, and backup key seed dup.seed into the parent key context new_parent.ctx (this context is associated with the public and private keys) using tpm2_import.

[0110] Optionally, Figure 4 This diagram illustrates the key context generation process for a Tpm key recovery procedure, as provided in an embodiment of this application. Figure 4 As shown, in recovery step 3, the new_parent.ctx and backup key are imported using tpm2_load to generate a new key context dup.ctx. This dup.ctx can be used in the CA key management center to decrypt the ciphertext encrypted by the business virtual machine.

[0111] Optionally, Figure 5 This is a schematic diagram illustrating the interactive process of an OpenStack platform virtual machine password backup and recovery method based on VTPM, provided in an embodiment of this application. Figure 5 The method described in this application involves backing up the VTPM key by exporting it from the business virtual machine to the CA key management center. If a recovery is needed, the key is re-imported from the CA key management center. This solves the problem that files encrypted (signed) using the business virtual machine's VTPM key cannot be decrypted (verified) due to hardware VTPM damage or business virtual machine crashes, thus ensuring the stability and security of cloud computing.

[0112] On the OpenStack platform, encryption of business applications is performed using keys generated by VTPM. Due to the strong correlation between the key and the platform—meaning encryption and decryption can only be performed on a legitimate platform—while key security is ensured, a method for key recovery is needed when the virtual machine platform encounters problems. Based on these issues, this application proposes a key backup and recovery method. The specific process is as follows: After receiving a request to generate a backup parent key, the CA key management center generates a backup master key and sends it to the business virtual machine. The business virtual machine, possessing backup capabilities, uses the backup master key to generate a backup key pair and a backup key seed; these are then sent to the CA key management center for storage. When the CA management center receives a key recovery command, it imports the backup encryption key into VTPM using the backup master key, enabling identity management of the business virtual machine's encryption key at the CA management center. This allows for encryption (signing) and decryption (signature verification) of the business virtual machine, ensuring key security.

[0113] Figure 6 A schematic diagram of a key backup and recovery device for OpenStack platform virtual machines based on VTPM provided in this application embodiment is shown below. Figure 6 As shown, the apparatus in this embodiment includes: a first transceiver module 601, a second transceiver module 602, a first processing module 603, a second processing module 604, a third processing module 605, a fourth processing module 606, and a third transceiver module 607. The OpenStack platform virtual machine key backup and recovery device based on VTPM can be a server or a terminal device, or a chip or integrated circuit that implements the functions of a server or terminal device. It should be noted that the division of the first transceiver module 601, the second transceiver module 602, the first processing module 603, the second processing module 604, the third processing module 605, the fourth processing module 606, and the third transceiver module 607 is only a logical functional division; physically, they can be integrated or independent.

[0114] The first transceiver module is used to receive a command request for virtual machine key backup from the control node nova-api service of the OpenStack cluster and then pass the command request for key backup to the compute node nova-compute service.

[0115] The second transceiver module is used to send the key backup command request to the business virtual machine after the nova-compute service receives the key backup command request;

[0116] The first processing module is used to check whether the current key file is complete after the business virtual machine receives the command request for key backup. If it is determined that the current key file is complete, it sends a request to generate a backup parent key to the CA key management center.

[0117] The second processing module is used to generate a backup master key after the CA key management center receives a request to generate a backup parent key, and then send the backup master key to the business virtual machine.

[0118] The third processing module is used for the business virtual machine to import the backup master key into the trusted platform module tpm and convert it into a backup master key context that supports the identity of the business virtual machine.

[0119] The fourth processing module is used to import the backup master key into the business virtual machine, and export the encryption key pair context saved by tpm to generate backup key pairs and backup key seeds.

[0120] The third transceiver module is used by the business virtual machine to send the backup key pair and backup key seed to the CA key management center.

[0121] Optionally, the above-mentioned device further includes:

[0122] The fifth processing module is used by the CA key management center to import the public key from the backup key pair and convert it into the parent key context;

[0123] The sixth processing module is used by the CA key management center to import the backup public key, backup private key, and backup key seed from the backup key pair into the parent key context.

[0124] The seventh processing module is used by the CA key management center to import the backup public key, backup private key and backup key seed from the backup key pair into the tpm to generate a parent key context. The key context is used to decrypt the ciphertext encrypted by the business virtual machine in the CA key management center.

[0125] Optionally, the fifth processing module is specifically used for:

[0126] The CA Key Management Center imports the public key from the backup key pair and converts it into the parent key context using the tpm2_load command for the private key used for encryption.

[0127] Optionally, the first transceiver module is specifically used for:

[0128] The OpenStack cluster's control node, nova-api service, receives a command request to back up the virtual machine key and checks the current status of the virtual machine.

[0129] If the current virtual machine is in an active state and is a trusted virtual machine built using VTPM, then the command request for key backup will be forwarded to the compute node nova-compute service.

[0130] Optionally, the encryption key pair context is created via a backup policy session.

[0131] Optionally, the second processing module is specifically used for:

[0132] After receiving the request to generate a backup parent key, the CA Key Management Center generates the primary key using the tpm2_createprimary command used to create the primary key.

[0133] Optionally, the second processing module is also specifically used for:

[0134] The backup key pair is generated using the master key tpm2_create and the asymmetric algorithm RSA.

[0135] refer to Figure 7This document illustrates a schematic diagram of a key backup and recovery device for OpenStack platform virtual machines based on VTPM, suitable for implementing embodiments of the present disclosure. This OpenStack platform virtual machine VTPM-based key backup and recovery device can be a terminal device or a server. The terminal device can include, but is not limited to, mobile terminals such as mobile phones, laptops, digital radio receivers, personal digital assistants (PDAs), portable Android devices (PADs), portable media players (PMPs), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 7 The OpenStack platform virtual machine key backup and recovery device based on vtpm shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments disclosed herein.

[0136] like Figure 7 As shown, the OpenStack platform virtual machine key backup and recovery device based on VTPM may include a processing unit (such as a central processing unit, graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to programs stored in read-only memory (ROM) 702 or programs loaded from storage device 708 into random access memory (RAM) 703. RAM 703 also stores various programs and data required for the operation of the OpenStack platform virtual machine key backup and recovery device based on VTPM. The processing unit 701, ROM 702, and RAM 703 are interconnected via bus 704. Input / output (I / O) interface 705 is also connected to bus 704.

[0137] Typically, the following devices can be connected to I / O interface 705: input devices 706 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 708 including, for example, magnetic tapes, hard drives, etc.; and communication devices 709. Communication device 709 allows OpenStack platform virtual machines to wirelessly or wiredly communicate with other devices to exchange data via VTPM-based key backup and recovery devices. Although... Figure 7The diagram illustrates a virtual machine key backup and recovery appliance for the OpenStack platform with various devices, based on VTPM. However, it should be understood that implementing or having all of the devices shown is not required. More or fewer devices may be implemented alternatively.

[0138] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 709, or installed from storage device 708, or installed from ROM 702. When the computer program is executed by processing device 701, it performs the functions defined in the methods of embodiments of this disclosure.

[0139] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0140] The aforementioned computer-readable medium may be included in the aforementioned OpenStack platform virtual machine-based vtpm key backup and recovery device; or it may exist independently and not be assembled into the OpenStack platform virtual machine-based vtpm key backup and recovery device.

[0141] The aforementioned computer-readable medium carries one or more programs, which, when executed by the OpenStack platform virtual machine based on the vtpm key backup and recovery device, cause the OpenStack platform virtual machine based on the vtpm key backup and recovery device to perform the method shown in the above embodiments.

[0142] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0143] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0144] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0145] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0146] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method for key backup and recovery of virtual machines on the OpenStack platform based on VTPM, characterized in that, include: When the OpenStack cluster's control node nova-api service receives a command request for virtual machine key backup, it forwards the command request to the compute node nova-compute service. After receiving the key backup command request, the nova-compute service sends the key backup command request to the business virtual machine. After receiving the key backup command request, the business virtual machine checks whether the current key file is complete. If the current key file is complete, it sends a request to generate a backup parent key to the CA key management center. The check for the completeness of the current key file is used to check whether the current key file includes an encryption key and whether the encryption key has backup characteristics. After receiving the request to generate a backup parent key, the CA key management center generates a backup master key and sends the backup master key to the business virtual machine. The business virtual machine imports the backup master key into the Trusted Platform Module (tpm) and converts it into a backup master key context that supports the identity of the business virtual machine. The business virtual machine imports the backup master key and exports the encryption key pair context saved in tpm to generate backup key pairs and backup key seeds; The business virtual machine sends the backup key pair and the backup key seed to the CA key management center.

2. The method according to claim 1, characterized in that, Also includes: The CA key management center imports the public key from the backup key pair and converts it into a parent key context. The CA key management center imports the backup public key and backup private key from the backup key pair, as well as the backup key seed, into tpm to generate a parent key context. The CA key management center imports the backup public key and backup private key from the backup key pair, as well as the backup key seed, into tpm to generate a parent key context. The key context is used to decrypt the ciphertext encrypted by the business virtual machine in the CA key management center.

3. The method according to claim 2, characterized in that, The CA key management center imports the public key from the backup key pair and converts it into a parent key context, including: The CA key management center imports the public key from the backup key pair and converts it into a parent key context using the tpm2_load command for encryption.

4. The method according to any one of claims 1 to 3, characterized in that, The OpenStack cluster's control node, nova-api service, receives a command request for virtual machine key backup and forwards the command request to the compute node, nova-compute service, including: The OpenStack cluster's control node, nova-api service, receives a command request to back up the virtual machine key and checks the current status of the virtual machine. If the current virtual machine is in an active running state and is a trusted virtual machine built using VTPM, then the command request for key backup is forwarded to the compute node nova-compute service.

5. The method according to any one of claims 1 to 3, characterized in that, The encryption key pair context is created through the backup policy session.

6. The method according to any one of claims 1 to 3, characterized in that, After receiving the request to generate a backup parent key, the CA key management center generates a master key, including: After receiving the request to generate a backup parent key, the CA key management center generates a primary key using the tpm2_createprimary command.

7. The method according to any one of claims 1 to 3, characterized in that, The step of generating a backup key pair based on the master key includes: The backup key pair is generated using the master key tpm2_create and the asymmetric algorithm RSA.

8. A virtual machine key backup and recovery device based on VTPM for the OpenStack platform, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the OpenStack platform virtual machine key backup and recovery method based on vtpm as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the OpenStack platform virtual machine key backup and recovery method based on vtpm as described in any one of claims 1 to 7.

Images