Virtual machine encryption method and system

Abstract

The invention relates to a virtual machine encryption method, which comprises the following encryption steps: S1, an administrator checks and prepares configuration for a server environment in which a to-be-encrypted virtual machine is located, marks each disk partition in the virtual machine, records the disk capacity and the partition format, opens up a cache region in a server memory, and stores the cache region in the server memory; the storage module is used for storing encrypted data and encrypted key information; s2, encryption key generation, wherein a key generation module independently generates a group of unique encryption keys for each virtual machine disk needing to be encrypted; and extracting feature information from a hardware identifier built in the server. According to the method, encryption means is adopted for all disk data, the data are stored on the server in a ciphertext mode, after the virtual machine is encrypted, the data disk cannot be mounted to other virtual machines, after the virtual machine is exported, the data disk cannot be used on other platforms, sensitive data are prevented from being illegally stolen, and personal privacy safety of a user is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a virtual machine encryption method and system. Background Art

[0002] A virtual machine is a complete computer system with complete hardware system functions that runs in a completely isolated environment and simulated by software. With the rapid development of information technology, virtualization technology has been widely used in various fields. Virtual machines can simulate multiple independent and isolated computing environments on a physical host, which brings many conveniences to enterprises, scientific research institutions and individual users. For example, in enterprise data centers, virtual machines can realize server integration, improve hardware resource utilization, and facilitate system management and maintenance. In the software development and testing stage, developers can use virtual machines to quickly build test environments with different operating systems and configurations, effectively improving the compatibility and quality inspection efficiency of software. However, the data stored in virtual machines and the data interactions involved in runtime also face severe security challenges. In the current network environment, data leakage and illegal access security incidents occur frequently, and the privacy and integrity protection of data carried by virtual machines are becoming more and more important. At present, the security protection measures for virtual machines are mainly concentrated in network access control and conventional security reinforcement at the operating system level. However, there are still many deficiencies in the dynamic protection of data stored in virtual machines and data during operation, which makes many users worry about the privacy of personal information. In this regard, we propose a virtual machine encryption method and system. Summary of the invention

[0003] The present invention aims at the technical problems existing in the prior art and provides a virtual machine encryption method and system to solve the above-mentioned problems of data leakage and illegal access.

[0004] The technical solution of the present invention to solve the above technical problem is as follows: a virtual machine encryption method, the encryption step includes: S1. The administrator checks and prepares the configuration of the server environment where the virtual machine to be encrypted is located, marks each disk partition in the virtual machine, records the disk capacity and partition format, and opens up a cache area in the server memory to store the encrypted data and encryption key information; S2, encryption key generation, the key generation module generates a unique encryption key for each virtual machine disk that needs to be encrypted; extracts feature information from the server's built-in hardware identifier, combines the current system timestamp with a predefined set of complex random seed data, and generates an encryption key based on a hash operation algorithm; S3. The key is initially encrypted using the public key of an asymmetric encryption algorithm, and the corresponding private key is obtained for decryption after passing the authorization verification process. The encrypted key is divided into data fragments and stored in the cache area. When all the correct fragments are extracted and reassembled in a specific order, the complete and usable encryption key can be restored. S4. Encrypt the data in the virtual machine disk block by block. The encryption module reads the data content in the disk in order according to the physical sectors and logical data blocks stored in the disk, and uses the generated corresponding encryption key in combination with the symmetric encryption algorithm to encrypt and convert each data block. The encrypted ciphertext data is written back to the original storage location of the disk in real time, overwriting the original plaintext data, and the encryption process is completed. S5. A security access mechanism is established based on the security access module to verify the current accessing user. If the user passes the verification, the subsequent access operation to the encrypted disk is allowed normally. If the verification fails, the corresponding alarm mechanism will be triggered to prevent illegal access to the disk. S6. Mark and set the underlying partition table of the disk and the driver level of the operating system so that the data disk cannot be mounted on other virtual machines at will, ensuring security.

[0005] Preferably, in step S1, the disk partition marking is performed based on the disk management tool in the virtual machine, and the disk capacity and partition format are recorded by copying the information into a text file; the administrator checks the overall hardware configuration of the server, checks the processor performance of the server, and checks the memory capacity of the server. If the memory is insufficient, expansion and optimization adjustment measures are required.

[0006] Preferably, in step S2, feature information is collected in advance from the server hardware level to obtain the system environment information of the current server. After collecting the basic information, a set of pre-set complex random seed data is introduced. The complex random seed data includes irregularly arranged numbers and character elements. The collected hardware feature information and system environment information are fused and spliced ​​with the set of random seed data, and they are combined into a data string of a new length in sequence. Based on the hash algorithm, the data string is operated to obtain the key.

[0007] Preferably, the encryption key formula generated by the hash operation algorithm in step S2 is:

[0008] Among them, || represents the data concatenation operation. After P, ID, T and R are concatenated in order, they are input into the hash function H as a whole. After calculation, the encryption key K is finally obtained. H represents the operation of the hash function, P represents a string, ID represents the number of the virtual machine disk, T represents the corresponding timestamp, and R is a randomly generated hexadecimal string. They are concatenated and sent to the hash function for calculation. The obtained hash value is the encryption key K.

[0009] Preferably, the algorithm used for the initial encryption in step S3 is the RSA algorithm. For the generated key, two different large prime numbers A and B are selected, and their product is calculated, that is, c=A*B, and the Euler function value of c is calculated. , select an integer d whose value range is 1<d<α(c), and find an integer e by extending the Euclidean algorithm so that d*e=1. At this time, the public key is (d, c) and the private key is (e, c); When the public key is used to encrypt the secret key for the first time, the encryption formula is f=K d ; Where f is the ciphertext obtained after encryption, and K is the key obtained by the algorithm; the authorization verification method is based on facial recognition and fingerprint recognition, and decryption can only be performed after authorization.

[0010] Preferably, in step S4, the physical sectors and logical data blocks possessed by the disk storage are used as reading units to perform a reading operation on the data content in the disk. The physical sectors of the disk are the basic physical units of the disk storage, carrying binary data; the logical data blocks are data units that are convenient for management and reading and writing. The encryption module can locate each location of the data that needs to be read, and the encryption module scans and reads the data content contained therein in turn. After reading the data block, the corresponding encryption key is generated, and the encryption conversion operation is performed in real time. After the encryption conversion is completed, the corresponding ciphertext data is generated, and the encryption module writes the ciphertext data back to the original storage location of the disk.

[0011] Preferably, in step S5, quantum key distribution is used for verification in the security access module. The service provider randomly generates a sequence of quantum bits, and converts the states of the quantum bits into 0 and 1 states under two different bases. The sender sends these quantum bits to users who try to access resources through a quantum channel. Without knowing the basis used by the sender, the user randomly selects a basis to measure the received quantum bits, and obtains a sequence of measurement results after measurement.

[0012] Preferably, the user attempting to access the resource informs the sender through the classical channel of the basis sequence selected for measurement. The sender compares and selects the quantum bit positions where both parties use the same basis. If the measurement results are consistent, the two parties generate a set of shared keys. The user uses the key to encrypt specific verification information and send it to the service provider. The service provider uses its own stored copy of the key for decryption verification. If the decryption is successful and the information is consistent, the user is verified to be a legitimate user.

[0013] Preferably, the mark setting step in step S6 is set through a disk editing tool, the corresponding disk is selected, the partition table editing mode is entered, the partition type identification byte corresponding to the data disk partition to be marked is found, and its original standard value is modified to a custom hexadecimal value. After the modification is completed, the setting is saved. At this time, the partition has this mark, and when other virtual machines are mounted according to the normal process, they cannot recognize the current disk and refuse to mount.

[0014] A virtual machine encryption system, comprising: a key generation module, an encryption module, a security access module and a marking module; The key generation module is used to generate a unique encryption key for each virtual machine disk that needs to be encrypted; The encryption module is used to encrypt the data in the virtual machine disk block by block; The security access module is used to establish a security access mechanism and verify the current access user; The marking module is used to mark and set the underlying partition table of the disk and the driver level of the operating system.

[0015] The beneficial effects of the present invention are as follows: by encrypting all disk data, the data is stored in ciphertext on the server. After the virtual machine is encrypted, the data disk cannot be mounted to other virtual machines. After the virtual machine is exported, it cannot be used on other platforms, thereby preventing sensitive data from being illegally stolen and protecting the user's personal privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a flowchart of the virtual machine encryption method of the present invention; Figure 2 This is a framework diagram of the encryption system of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0018] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0019] In the description of the present application, the term "for example" is used to mean "used as an example, illustration or description". Any embodiment described as "for example" in the present application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0020] Example 1 Reference Figure 1 As shown, a virtual machine encryption method, the encryption steps include: S1. The administrator checks and prepares the configuration of the server environment where the virtual machine to be encrypted is located, marks each disk partition in the virtual machine, records the disk capacity and partition format, and opens up a cache area in the server memory to store the encrypted data and encryption key information; S2, encryption key generation, the key generation module generates a unique encryption key for each virtual machine disk that needs to be encrypted; extracts feature information from the server's built-in hardware identifier, combines the current system timestamp with a predefined set of complex random seed data, and generates an encryption key based on a hash operation algorithm; S3. The key is initially encrypted using the public key of an asymmetric encryption algorithm, and the corresponding private key is obtained for decryption after passing the authorization verification process. The encrypted key is divided into data fragments and stored in the cache area. When all the correct fragments are extracted and reassembled in a specific order, the complete and usable encryption key can be restored. S4. Encrypt the data in the virtual machine disk block by block. The encryption module reads the data content in the disk in order according to the physical sectors and logical data blocks stored in the disk, and uses the generated corresponding encryption key in combination with the symmetric encryption algorithm to encrypt and convert each data block. The encrypted ciphertext data is written back to the original storage location of the disk in real time, overwriting the original plaintext data, and the encryption process is completed. S5. A security access mechanism is established based on the security access module to verify the current accessing user. If the user passes the verification, the subsequent access operation to the encrypted disk is allowed normally. If the verification fails, the corresponding alarm mechanism will be triggered to prevent illegal access to the disk. S6. Mark and set the underlying partition table of the disk and the driver level of the operating system so that the data disk cannot be mounted on other virtual machines at will, ensuring security.

[0021] By checking and preparing the server environment configuration, this application can discover potential hardware performance deficiencies and software compatibility issues in advance, ensure that subsequent encryption operations can be carried out stably and efficiently, and generate a unique encryption key for each virtual machine disk. This fundamentally ensures that even if the key of a certain disk is cracked, the data on other disks remains safe, greatly improving the confidentiality of the data. The public key of the asymmetric encryption algorithm is used to initially encrypt the key. With the characteristics of asymmetric encryption, even if the public key is disclosed within a certain range, it is difficult to reversely derive the private key from the public key to obtain the original encryption key, thereby ensuring the security of the key in the transmission and storage links. Block-by-block encryption is performed based on the physical sectors and logical data blocks of the disk, achieving comprehensive and detailed encryption protection for the virtual machine disk data, ensuring that every part of the data on the disk is in an encrypted state, leaving no security blind spots, and preventing the illegal theft and interpretation of data to the greatest extent.

[0022] Example 2 In step S1, the disk partition marking is performed based on the disk management tool in the virtual machine. The disk capacity and partition format are recorded by copying the information into a text file. The administrator checks the overall hardware configuration of the server, checks the processor performance of the server, and checks the memory capacity of the server. If the memory is insufficient, expansion and optimization adjustment measures are required.

[0023] This application uses a unified disk management tool inside a virtual machine to perform labeling operations, which helps to form a standardized and normalized management process, and records key information such as disk capacity and partition format in the form of a text file, so that administrators or other relevant personnel can view these important data in a very intuitive and clear manner.

[0024] In step S2, feature information is collected from the server hardware level in advance to obtain the system environment information of the current server. After collecting the basic information, a set of pre-set complex random seed data is introduced. The complex random seed data includes irregularly arranged numbers and character elements. The collected hardware feature information and system environment information are fused and spliced ​​with this set of random seed data, and they are combined into a data string of a new length in sequence. Based on the hash algorithm, the data string is operated to obtain the key.

[0025] The hardware feature information of this application reflects the actual physical configuration of the server, so that the generated key is deeply associated with the server's own hardware environment. After combining the hardware feature information, it further enriches the data sources involved in key generation, making it more difficult for external attackers to predict the key generation mode by analyzing the rules.

[0026] The formula for generating the encryption key using the hash operation algorithm in step S2 is:

[0027] Among them, || represents the data concatenation operation. After P, ID, T and R are concatenated in order, they are input into the hash function H as a whole. After calculation, the encryption key K is finally obtained. H represents the operation of the hash function, P represents a string, ID represents the number of the virtual machine disk, T represents the corresponding timestamp, and R is a randomly generated hexadecimal string. They are concatenated and sent to the hash function for calculation. The obtained hash value is the encryption key K.

[0028] The algorithm used for the initial encryption in step S3 is the RSA algorithm. For the generated key, two different large prime numbers A and B are selected, and their product is calculated, that is, c=A*B, and the Euler function value of c is calculated. , select an integer d whose value range is 1<d<α(c), and find an integer e by extending the Euclidean algorithm so that d*e=1. At this time, the public key is (d, c) and the private key is (e, c); When the public key is used to encrypt the secret key for the first time, the encryption formula is f=K d ; Where f is the ciphertext obtained after encryption, and K is the key obtained by the algorithm; the authorization verification method is based on facial recognition and fingerprint recognition, and decryption can only be performed after authorization.

[0029] The RSA algorithm of this application is an asymmetric encryption algorithm, which uses a public key for encryption and a private key for decryption. The public key can be publicly distributed within a certain range without affecting the security of the key. The public key can be easily passed to parties that need the encrypted key. Each party uses the public key to encrypt the key and then transmits it back or stores it, while the private key is properly kept by a specific authorized entity. Combining facial recognition and fingerprint recognition as an authorization verification method is an application form of multi-factor authentication. It comprehensively utilizes different types of biometrics, further increasing the difficulty for attackers to break through the verification mechanism.

[0030] In step S4, the physical sectors and logical data blocks of the disk storage are used as reading units to perform a reading operation on the data content in the disk. The physical sectors of the disk are the basic physical units of disk storage and carry binary data; the logical data blocks are data units that are easy to manage and read and write. The encryption module can locate each location of the data that needs to be read. The encryption module scans and reads the data content contained therein in turn. After reading the data block, the corresponding encryption key is generated, and the encryption conversion operation is performed in real time. After the encryption conversion is completed, the corresponding ciphertext data is generated, and the encryption module writes the ciphertext data back to the original storage location of the disk.

[0031] The present application reads data in units of established physical sectors and logical data blocks. The encryption module can process each unit in turn in a sequential scanning manner and generate a corresponding encryption key for each data block, which means that different data blocks have their own exclusive encryption protection method. Even if a key is accidentally leaked or the encryption information of a data block is partially cracked, since the keys of other data blocks are different, it will not affect the security of the remaining data, thereby greatly improving the confidentiality of the entire disk data.

[0032] In step S5, quantum key distribution is used for verification in the security access module. The service provider randomly generates a sequence of quantum bits and converts the states of the quantum bits into 0 and 1 states under two different bases. The sender sends these quantum bits through the quantum channel to the user who tries to access the resource. Without knowing the basis used by the sender, the user randomly selects a basis to measure the received quantum bits and obtains a sequence of measurement results after measurement.

[0033] The quantum key distribution of this application is based on the non-cloning theorem of quantum states, that is, unknown quantum states cannot be accurately copied. The service provider randomly generates a string of quantum bit sequences each time to generate keys, which means that each key is dynamically changing and unique. After receiving the quantum bits, the user measures and feeds back the basis sequence of his own choice to the service provider. The two parties generate a shared key based on the measurement results under the same basis selected by both parties. This mechanism ensures that the service provider and the user can eventually obtain consistent key content.

[0034] The user who attempts to access the resource informs the sender through the classical channel of the basis sequence he or she selected for measurement. The sender compares and selects the quantum bit positions where both parties use the same basis. If the measurement results are consistent, the two parties generate a set of shared keys. The user uses the key to encrypt specific verification information and send it to the service provider. The service provider uses its own stored copy of the key to decrypt and verify. If the decryption is successful and the information is consistent, the user is verified to be a legitimate user.

[0035] The entire process of this application starts with quantum key distribution, which generates quantum bit sequences and determines shared keys based on the unique properties of quantum mechanics. In the process of generating shared keys, since the service provider randomly generates the quantum bit sequence each time, and the final key is determined based on the screening of both parties under specific conditions, each shared key generated is unique and random.

[0036] The mark setting step in step S6 is set through the disk editing tool. Select the corresponding disk, enter the partition table editing mode, find the partition type identification byte corresponding to the data disk partition that needs to be marked, and change its original standard value to a custom hexadecimal value. After the modification is completed, save the setting. At this time, the partition has this mark. When other virtual machines are mounted according to the normal process, they cannot recognize the current disk and refuse to mount.

[0037] This application modifies the partition type identification byte of the disk partition into a custom hexadecimal value, so that when other virtual machines try to mount the disk according to the normal process, the system will refuse the mounting operation because its partition type cannot be normally identified.

[0038] Example 3 Reference Figure 2 As shown, a virtual machine encryption system includes: a key generation module, an encryption module, a security access module and a marking module; The key generation module is used to generate a unique encryption key for each virtual machine disk that needs to be encrypted; The encryption module is used to encrypt the data in the virtual machine disk block by block; The security access module is used to establish a security access mechanism and verify the current access user; The marking module is used to mark and set the underlying partition table of the disk and the driver level of the operating system.

[0039] This application generates a unique encryption key for each virtual machine disk that needs to be encrypted, which means that each disk has its own "security lock". Even if the encryption key of a disk is accidentally leaked or cracked, the data of other disks can still be kept safe with their own independent and different keys and will not be affected; The data in the virtual machine disk is encrypted block by block, ensuring that every data block in the disk can be encrypted without missing any part, thus achieving all-round and no-dead-angle protection for the disk data.

[0040] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0041] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0042] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A virtual machine encryption method, characterized in that: The encryption steps include: S1. The administrator checks and prepares the configuration of the server environment where the virtual machine to be encrypted is located, marks each disk partition in the virtual machine, records the disk capacity and partition format, and opens up a cache area in the server memory to store the encrypted data and encryption key information; S2, encryption key generation, the key generation module generates a unique encryption key for each virtual machine disk that needs to be encrypted; extracts feature information from the server's built-in hardware identifier, combines the current system timestamp with a predefined set of complex random seed data, and generates an encryption key based on a hash operation algorithm; S3. The key is initially encrypted using the public key of an asymmetric encryption algorithm, and the corresponding private key is obtained for decryption after passing the authorization verification process. The encrypted key is divided into data fragments and stored in the cache area. When all the correct fragments are extracted and reassembled in a specific order, the complete and usable encryption key can be restored. S4. Encrypt the data in the virtual machine disk block by block. The encryption module reads the data content in the disk in order according to the physical sectors and logical data blocks stored in the disk, and uses the generated corresponding encryption key in combination with the symmetric encryption algorithm to encrypt and convert each data block. The encrypted ciphertext data is written back to the original storage location of the disk in real time, overwriting the original plaintext data, and the encryption process is completed. S5. A security access mechanism is established based on the security access module to verify the current accessing user. If the user passes the verification, the subsequent access operation to the encrypted disk is allowed normally. If the verification fails, the corresponding alarm mechanism will be triggered to prevent illegal access to the disk. S6. Mark and set the underlying partition table of the disk and the driver level of the operating system so that the data disk cannot be mounted on other virtual machines at will, ensuring security.

2. The virtual machine encryption method according to claim 1, characterized in that: In step S1, the disk partition marking is performed based on the disk management tool in the virtual machine, and the disk capacity and partition format are recorded by copying the information into a text file; The administrator checks the overall hardware configuration of the server, checks the server's processor performance, and verifies the server's memory capacity. If the memory is insufficient, expansion and optimization measures are required.

3. The virtual machine encryption method according to claim 1, characterized in that: In step S2, feature information is collected from the server hardware level in advance to obtain the system environment information of the current server. After collecting the basic information, a set of pre-set complex random seed data is introduced. The complex random seed data includes irregularly arranged numbers and character elements. The collected hardware feature information and system environment information are fused and spliced ​​with this set of random seed data, and they are combined into a data string of a new length in sequence. Based on the hash algorithm, the data string is operated to obtain the key.

4. The virtual machine encryption method according to claim 1, characterized in that: The formula for generating the encryption key using the hash operation algorithm in step S2 is: Among them, || represents the data concatenation operation. After P, ID, T and R are concatenated in order, they are input into the hash function H as a whole. After calculation, the encryption key K is finally obtained. H represents the operation of the hash function, P represents a string, ID represents the number of the virtual machine disk, T represents the corresponding timestamp, and R is a randomly generated hexadecimal string. They are concatenated and sent to the hash function for calculation. The obtained hash value is the encryption key K.

5. The virtual machine encryption method according to claim 1, characterized in that: The algorithm used for the initial encryption in step S3 is the RSA algorithm. For the generated key, two different large prime numbers A and B are selected, and their product is calculated, that is, c=A*B, and the Euler function value of c is calculated. , select an integer d whose value range is 1<d<α(c), and find an integer e by extending the Euclidean algorithm so that d*e=1. At this time, the public key is (d, c) and the private key is (e, c); When the public key is used to encrypt the secret key for the first time, the encryption formula is f=K d ; Where f is the ciphertext obtained after encryption, and K is the key obtained by the algorithm; the authorization verification method is based on facial recognition and fingerprint recognition, and decryption can only be performed after authorization.

6. The virtual machine encryption method according to claim 1, characterized in that: In step S4, the physical sectors and logical data blocks of the disk storage are used as reading units to perform a reading operation on the data content in the disk. The physical sectors of the disk are the basic physical units of disk storage and carry binary data; the logical data blocks are data units that are easy to manage and read and write. The encryption module can locate each location of the data that needs to be read. The encryption module scans and reads the data content contained therein in turn. After reading the data block, the corresponding encryption key is generated, and the encryption conversion operation is performed in real time. After the encryption conversion is completed, the corresponding ciphertext data is generated, and the encryption module writes the ciphertext data back to the original storage location of the disk.

7. The virtual machine encryption method according to claim 1, characterized in that: In step S5, quantum key distribution is used for verification in the security access module. The service provider randomly generates a sequence of quantum bits and converts the states of the quantum bits into 0 and 1 states under two different bases. The sender sends these quantum bits through the quantum channel to the user who tries to access the resource. Without knowing the basis used by the sender, the user randomly selects a basis to measure the received quantum bits and obtains a sequence of measurement results after measurement.

8. The virtual machine encryption method according to claim 7, characterized in that: The user who attempts to access the resource informs the sender through the classical channel of the basis sequence he or she selected for measurement. The sender compares and selects the quantum bit positions where both parties use the same basis. If the measurement results are consistent, the two parties generate a set of shared keys. The user uses the key to encrypt specific verification information and send it to the service provider. The service provider uses its own stored copy of the key to decrypt and verify. If the decryption is successful and the information is consistent, the user is verified to be a legitimate user.

9. The virtual machine encryption method according to claim 1, characterized in that: The mark setting step in step S6 is set through the disk editing tool. Select the corresponding disk, enter the partition table editing mode, find the partition type identification byte corresponding to the data disk partition that needs to be marked, and change its original standard value to a custom hexadecimal value. After the modification is completed, save the setting. At this time, the partition has this mark. When other virtual machines are mounted according to the normal process, they cannot recognize the current disk and refuse to mount.

10. A virtual machine encryption system, applied to any of the above virtual machine encryption methods, characterized in that: include: Key generation module, encryption module, security access module and marking module; The key generation module is used to generate a unique encryption key for each virtual machine disk that needs to be encrypted; The encryption module is used to encrypt the data in the virtual machine disk block by block; The security access module is used to establish a security access mechanism and verify the current access user; The marking module is used to mark and set the underlying partition table of the disk and the driver level of the operating system.

Images