A virtual machine encryption method and system

Abstract

The present application relates to a kind of virtual machine encryption methods, and encryption step includes: S1, administrator is configured to the server environment of the virtual machine to be encrypted in preparation of check, mark each disk partition in virtual machine, record the disk capacity size and partition format, open out buffer area in server memory, to store the data in encryption and the key information of encryption;S2, encryption key generation, key generation module generates a set of unique encryption key for each virtual machine disk needing encryption;Feature information is extracted from the hardware identifier built-in server.The present application stores data in the form of ciphertext on the server by taking encryption means to all disk data, after virtual machine encryption, data disk cannot be mounted to other virtual machine, virtual machine export, also cannot be used in other platform, avoid sensitive data being illegally stolen, guarantee user personal privacy security.

Description

Technical Field

[0001] This invention relates to the field of security technology, specifically to a virtual machine encryption method and system. Background Technology

[0002] A virtual machine (VM) is a complete computer system simulated by software, possessing full hardware system functionality and running in a completely isolated environment. With the rapid development of information technology, virtualization technology has been widely applied in various fields. VMs, with their ability to simulate multiple independent and isolated computing environments on a single physical host, bring numerous conveniences to enterprises, research institutions, and individual users. For example, in enterprise data centers, VMs can be used to consolidate servers, improve hardware resource utilization, and facilitate system management and maintenance. In software development and testing, developers can use VMs to quickly build test environments with different operating systems and configurations, effectively improving software compatibility and quality testing efficiency. However, the data stored in VMs and the data interactions involved during runtime also face severe security challenges. In the current network environment, data leaks and unauthorized access security incidents occur frequently, making the protection of data privacy and integrity carried by VMs increasingly important. Currently, security protection measures for VMs mainly focus on network access control and conventional security hardening at the operating system level. However, there are still many shortcomings in the dynamic protection of data stored inside VMs and data during operation, causing many users to worry about the privacy of their personal information. To address this, we propose a VM encryption method and system. Summary of the Invention

[0003] This invention addresses the technical problems existing in the prior art by providing a virtual machine encryption method and system, thus solving the aforementioned problems of data leakage and unauthorized access.

[0004] The technical solution of this invention to solve the above-mentioned technical problems is as follows: A virtual machine encryption method, the encryption steps of which include:

[0005] S1. The administrator checks and prepares the configuration of the server environment where the virtual machine to be encrypted is located, marks each disk partition in the virtual machine, records the disk capacity and partition format, and allocates a cache area in the server memory to store the data to be encrypted and the encryption key information.

[0006] S2. Encryption Key Generation: The key generation module generates a unique encryption key for each virtual machine disk that needs to be encrypted. It extracts feature information from the server's built-in hardware identifiers, combines the current system timestamp with a predefined set of complex random seed data, and generates an encryption key based on a hash algorithm.

[0007] S3. The key is initially encrypted using the public key of an asymmetric encryption algorithm. After passing the authorization and verification process, the corresponding private key is obtained for decryption. The encrypted key is divided into data fragments and stored in the cache area. When all the correct fragments are extracted and recombined in a specific order, the complete and usable encryption key can be restored.

[0008] S4. Encrypt the data in the virtual machine disk block by block. The encryption module reads the data content in the disk in sequence according to the physical sectors and logical data blocks of the disk storage. It uses the generated corresponding encryption key and combines the symmetric encryption algorithm to encrypt each data block. The encrypted ciphertext data is written back to the original storage location of the disk in real time to overwrite the original plaintext data and complete the encryption process.

[0009] S5. Establish a secure access mechanism based on the secure access module to verify the current user. If the verification is successful, subsequent access operations to the encrypted disk are allowed. If the verification fails, the corresponding alarm mechanism will be triggered and unauthorized access to the disk will be blocked.

[0010] S6. Mark and set the disk's underlying partition table and the operating system's driver level to prevent the data disk from being arbitrarily mounted on other virtual machines, thus ensuring security.

[0011] Preferably, in step S1, disk partition marking is performed using disk management tools within the virtual machine, and the disk capacity and partition format are recorded by copying the information to a text file; the administrator checks the overall hardware configuration of the server, examines the server's processor performance, and verifies the server's memory capacity. If the memory is insufficient, expansion and optimization measures are required.

[0012] Preferably, in step S2, feature information is collected from the server hardware level in advance to obtain the system environment information of the current server. After collecting the basic information, a set of pre-set complex random seed data is introduced. The complex random seed data includes irregularly arranged numbers and characters. The collected hardware feature information, system environment information and this set of random seed data are fused and spliced ​​together, and they are combined into a data string of a new length in sequence. Based on the hash algorithm, the data string is processed to obtain the key.

[0013] Preferably, the formula for generating the encryption key using the hash algorithm in step S2 is:

[0014]

[0015] Where || represents the data concatenation operation, P, ID, T and R are concatenated in order and then input as a whole into the hash function H. After calculation, the encryption key K is finally obtained. H represents the hash function operation, P represents a string, ID represents the virtual machine disk number, T represents the corresponding timestamp, and R is a randomly generated hexadecimal string. These strings are concatenated and then fed into the hash function for calculation. The resulting hash value is the encryption key K.

[0016] Preferably, the initial encryption algorithm used in step S3 is the RSA algorithm. For the generated key, two different large prime numbers A and B are selected, their product is calculated, i.e., c = A * B, and the Euler's totient function value of c is calculated. Choose an integer d, whose value range is 1 < d < α(c). Find an integer e through the extended Euclidean algorithm such that d*e = 1. At this time, the public key is (d, c) and the private key is (e, c).

[0017] When using the public key to initially encrypt the key, the encryption formula is f=K. d Where f is the encrypted ciphertext and K is the key obtained by the algorithm; the authorization verification method is based on facial recognition and fingerprint recognition, and decryption can only be performed after authorization.

[0018] Preferably, in step S4, the physical sectors and logical data blocks of the disk storage are used as the reading units to perform reading operations on the data content in the disk. The physical sector of the disk is the basic physical unit of the disk storage, carrying binary data; the logical data block is a data unit that is easy to manage and read / write. The encryption module can locate the location of each piece of data that needs to be read. The encryption module scans and reads the data content contained therein in sequence. After reading the data block, the corresponding encryption key is generated, and the encryption conversion operation is performed in real time. After the encryption conversion is completed, the corresponding ciphertext data is generated, and the encryption module writes the ciphertext data back to the original storage location of the disk.

[0019] Preferably, in step S5, the secure access module uses quantum key distribution for verification. The service provider randomly generates a sequence of qubits and sets the state of the qubits to 0 and 1 states under two different bases. The sender sends these qubits to the user attempting to access the resource through a quantum channel. Without knowing the base used by the sender, the user randomly selects a base to measure the received qubits and obtains a measurement result sequence.

[0020] Preferably, the user attempting to access the resource informs the sender of the basis sequence they selected for measurement via a classical channel. The sender compares and selects the positions of qubits using the same basis. If the measurement results are consistent, the two parties generate a shared key. The user uses this key to encrypt specific verification information and sends it to the service provider. The service provider decrypts and verifies the information using a copy of the key they have stored. If the decryption is successful and the information matches, the user is verified as a legitimate user.

[0021] Preferably, the marking setting step in step S6 is set using a disk editing tool. Select the corresponding disk, enter the partition table editing mode, find the partition type identifier byte corresponding to the data disk partition that needs to be marked, modify its original standard value to a custom hexadecimal value, save the settings after modification, and at this time the partition will have this mark. When other virtual machines mount it according to the normal process, they will not be able to recognize the current disk and will refuse to mount it.

[0022] A virtual machine encryption system includes: a key generation module, an encryption module, a secure access module, and a tagging module;

[0023] The key generation module is used to generate a unique set of encryption keys for each virtual machine disk that needs to be encrypted.

[0024] The encryption module is used to encrypt data on the virtual machine disk block by block;

[0025] The secure access module is used to establish a secure access mechanism and verify the currently accessing user;

[0026] The tagging module is used to tag and set data at the disk's underlying partition table and the operating system's driver level.

[0027] The beneficial effects of this invention are: by encrypting all disk data, the data is stored on the server in encrypted form. After the virtual machine is encrypted, the data disk cannot be mounted to other virtual machines, and after the virtual machine is exported, it cannot be used on other platforms, thus preventing sensitive data from being illegally stolen and protecting the privacy and security of users. Attached Figure Description

[0028] Figure 1 This is a flowchart of the virtual machine encryption method of the present invention;

[0029] Figure 2 This is a framework diagram of the encryption system of the present invention. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0032] In the description of this application, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0033] Example 1

[0034] Reference Figure 1 As shown, a virtual machine encryption method includes the following encryption steps:

[0035] S1. The administrator checks and prepares the configuration of the server environment where the virtual machine to be encrypted is located, marks each disk partition in the virtual machine, records the disk capacity and partition format, and allocates a cache area in the server memory to store the data to be encrypted and the encryption key information.

[0036] S2. Encryption Key Generation: The key generation module generates a unique encryption key for each virtual machine disk that needs to be encrypted. It extracts feature information from the server's built-in hardware identifiers, combines the current system timestamp with a predefined set of complex random seed data, and generates an encryption key based on a hash algorithm.

[0037] S3. The key is initially encrypted using the public key of an asymmetric encryption algorithm. After passing the authorization and verification process, the corresponding private key is obtained for decryption. The encrypted key is divided into data fragments and stored in the cache area. When all the correct fragments are extracted and recombined in a specific order, the complete and usable encryption key can be restored.

[0038] S4. Encrypt the data in the virtual machine disk block by block. The encryption module reads the data content in the disk in sequence according to the physical sectors and logical data blocks of the disk storage. It uses the generated corresponding encryption key and combines the symmetric encryption algorithm to encrypt each data block. The encrypted ciphertext data is written back to the original storage location of the disk in real time to overwrite the original plaintext data and complete the encryption process.

[0039] S5. Establish a secure access mechanism based on the secure access module to verify the current user. If the verification is successful, subsequent access operations to the encrypted disk are allowed. If the verification fails, the corresponding alarm mechanism will be triggered and unauthorized access to the disk will be blocked.

[0040] S6. Mark and set the disk's underlying partition table and the operating system's driver level to prevent the data disk from being arbitrarily mounted on other virtual machines, thus ensuring security.

[0041] This application, by checking and preparing the server environment configuration, can identify potential hardware performance deficiencies and software compatibility issues in advance, ensuring that subsequent encryption operations can be carried out stably and efficiently. It generates a unique encryption key for each virtual machine disk, fundamentally guaranteeing that even if the key of one disk is cracked, the data on other disks remains secure, greatly improving data confidentiality. It uses an asymmetric encryption algorithm's public key to initially encrypt the key. Leveraging the characteristics of asymmetric encryption, even if the public key is publicly available within a certain scope, it is very difficult to deduce the private key from the public key to obtain the original encryption key, ensuring the security of the key during transmission and storage. It encrypts the data block by block, using physical sectors and logical data blocks of the disk, achieving comprehensive and meticulous encryption protection for virtual machine disk data. This ensures that every part of the data on the disk is encrypted, leaving no security blind spots and preventing data from being illegally stolen and deciphered to the greatest extent possible.

[0042] Example 2

[0043] In step S1, disk partition marking is performed using disk management tools within the virtual machine. The disk capacity and partition format are recorded by copying the information to a text file. The administrator checks the overall hardware configuration of the server, examines the server's processor performance, and verifies the server's memory capacity. If the memory is insufficient, expansion and optimization measures are required.

[0044] This application utilizes a unified disk management tool within the virtual machine to perform marking operations, which helps to form a standardized and regulated management process. Key information such as disk capacity and partition format is recorded in the form of text files, enabling administrators or other relevant personnel to view this important data in a very intuitive and clear way.

[0045] In step S2, feature information is collected from the server hardware level in advance to obtain the system environment information of the current server. After collecting the basic information, a set of pre-set complex random seed data is introduced. The complex random seed data includes irregularly arranged numbers and characters. The collected hardware feature information, system environment information and this set of random seed data are fused and spliced ​​together, and they are combined into a data string of a new length in sequence. Based on the hash algorithm, the data string is processed to obtain the key.

[0046] The hardware feature information in this application reflects the actual physical configuration of the server, making the generated key deeply associated with the server's own hardware environment. Combined with the hardware feature information, the data sources involved in key generation are further enriched, making it more difficult for external attackers to predict the key generation pattern by analyzing the patterns.

[0047] The formula for generating the encryption key using the hash algorithm in step S2 is:

[0048]

[0049] Where || represents the data concatenation operation, P, ID, T and R are concatenated in order and then input as a whole into the hash function H. After calculation, the encryption key K is finally obtained. H represents the hash function operation, P represents a string, ID represents the virtual machine disk number, T represents the corresponding timestamp, and R is a randomly generated hexadecimal string. These strings are concatenated and then fed into the hash function for calculation. The resulting hash value is the encryption key K.

[0050] In step S3, the initial encryption uses the RSA algorithm. For the generated key, two distinct large prime numbers A and B are selected, their product is calculated (c = A * B), and the Euler's totient function value of c is determined. Choose an integer d, whose value range is 1 < d < α(c). Find an integer e through the extended Euclidean algorithm such that d*e = 1. At this time, the public key is (d, c) and the private key is (e, c).

[0051] When using the public key to initially encrypt the key, the encryption formula is f=K. d Where f is the encrypted ciphertext and K is the key obtained by the algorithm; the authorization verification method is based on facial recognition and fingerprint recognition, and decryption can only be performed after authorization.

[0052] The RSA algorithm presented in this application, as an asymmetric encryption algorithm, uses a public key for encryption and a private key for decryption. The public key can be publicly distributed within a certain scope without affecting the security of the key. The public key can be easily transmitted to parties that need the encryption key. Each party uses the public key to encrypt the key and then transmits it back or stores it. The private key is properly kept by a specific authorized entity. Combining facial recognition and fingerprint recognition as an authorization verification method is an application of multi-factor authentication. It comprehensively utilizes different types of biometric features, further increasing the difficulty for attackers to break through the verification mechanism.

[0053] In step S4, the physical sectors and logical data blocks of the disk storage are used as the reading units to read the data content on the disk. The physical sector of the disk is the basic physical unit of disk storage, carrying binary data; the logical data block is a data unit that is easy to manage and read / write. The encryption module can locate the location of each piece of data that needs to be read. The encryption module scans and reads the data content contained therein in turn. After reading the data block, the corresponding encryption key is generated and the encryption conversion operation is performed in real time. After the encryption conversion is completed, the corresponding ciphertext data is generated and the encryption module writes the ciphertext data back to the original storage location on the disk.

[0054] This application reads data in units of predetermined physical sectors and logical data blocks. The encryption module can process each unit sequentially by scanning in a sequential manner, generating a corresponding encryption key for each data block. This means that different data blocks have their own exclusive encryption protection methods. Even if a key is accidentally leaked or the encryption information of a data block is partially cracked, the security of the remaining data will not be affected because the keys of other data blocks are different, which greatly improves the confidentiality of the entire disk data.

[0055] In step S5, the secure access module uses quantum key distribution for verification. The service provider randomly generates a sequence of qubits and sets the states of the qubits to 0 and 1 states under two different bases. The sender sends these qubits to the user attempting to access the resource through a quantum channel. Without knowing the base used by the sender, the user randomly selects a base to measure the received qubits and obtains a measurement result sequence.

[0056] This application's quantum key distribution is based on the no-cloning theorem of quantum states, which states that an unknown quantum state cannot be precisely copied. The service provider randomly generates a sequence of qubits each time to generate a key, meaning that each key is dynamically changing and unique. After receiving the qubits, the user measures them and feeds back the basis sequence they have chosen to the service provider. Both parties generate a shared key based on the measurement results under the same mutually selected basis. This mechanism ensures that the service provider and the user can ultimately obtain consistent key content.

[0057] Users attempting to access resources inform the sender of the basis sequence they selected for measurement via a classical channel. The sender compares and selects the positions of qubits using the same basis. If the measurement results are consistent, the two parties generate a shared key. The user uses this key to encrypt specific verification information and sends it to the service provider. The service provider decrypts and verifies the information using its stored copy of the key. If decryption is successful and the information matches, the user is verified as a legitimate user.

[0058] The entire process of this application begins with quantum key distribution, which generates a sequence of qubits and determines a shared key based on the unique properties of quantum mechanics. During the generation of the shared key, the service provider randomly generates the sequence of qubits each time, and the final key is determined by both parties under specific conditions, which makes each generated shared key unique and random.

[0059] In step S6, the marking settings are configured using a disk editing tool. Select the corresponding disk, enter the partition table editing mode, find the partition type identifier byte corresponding to the data disk partition that needs to be marked, modify its original standard value to a custom hexadecimal value, and save the settings after modification. At this point, the partition will have this mark, and other virtual machines will not be able to recognize the current disk and will refuse to mount it when mounting it using the normal process.

[0060] This application modifies the partition type identifier byte of the disk partition to a custom hexadecimal value, so that when other virtual machines try to mount the disk according to the normal process, the system will refuse the mount operation because its partition type cannot be properly recognized.

[0061] Example 3

[0062] Reference Figure 2 As shown, a virtual machine encryption system includes: a key generation module, an encryption module, a secure access module, and a tagging module;

[0063] The key generation module is used to generate a unique set of encryption keys for each virtual machine disk that needs to be encrypted.

[0064] The encryption module is used to encrypt data on the virtual machine disk block by block;

[0065] The secure access module is used to establish a secure access mechanism and verify the currently accessing user;

[0066] The tagging module is used to tag and set data at the disk's underlying partition table and the operating system's driver level.

[0067] This application generates a unique encryption key for each virtual machine disk that needs encryption, meaning that each disk has its own exclusive "security lock". Even if the encryption key of a certain disk is accidentally leaked or cracked, the data on other disks can still remain secure with their own independent and different keys and will not be affected.

[0068] By encrypting data block by block in the virtual machine disk, every data block in the disk is encrypted without missing any part, achieving comprehensive and seamless protection of disk data.

[0069] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0070] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0071] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A virtual machine encryption method, characterized in that, The encryption steps include: S1. The administrator checks and prepares the configuration of the server environment where the virtual machine to be encrypted is located, marks each disk partition in the virtual machine, records the disk capacity and partition format, and allocates a cache area in the server memory to store the data to be encrypted and the encryption key information. S2. Encryption Key Generation: The key generation module generates a unique encryption key for each virtual machine disk that needs to be encrypted. It extracts feature information from the server's built-in hardware identifiers, combines the current system environment information with a predefined set of complex random seed data, and generates an encryption key based on a hash algorithm. S3. The encryption key generated in step S2 is initially encrypted using the public key of an asymmetric encryption algorithm. After passing the authorization verification process, the corresponding private key is obtained for decryption. The encryption key after the initial encryption is divided into data fragments and stored in the cache area. When all the correct fragments are extracted and recombined in a specific order, the complete and usable encryption key after the initial encryption can be restored. S4. Encrypt the data in the virtual machine disk block by block. The encryption module reads the data content in the disk in sequence according to the physical sectors and logical data blocks of the disk storage. It uses the generated corresponding encryption key and combines the symmetric encryption algorithm to encrypt each data block. The encrypted ciphertext data is written back to the original storage location of the disk in real time to overwrite the original plaintext data and complete the encryption process. S5. Establish a secure access mechanism based on the secure access module to verify the current user. If the verification is successful, subsequent access operations to the encrypted disk are allowed. If the verification fails, the corresponding alarm mechanism will be triggered and unauthorized access to the disk will be blocked. S6. Mark and set the disk's underlying partition table and the operating system's driver level to prevent the data disk from being arbitrarily mounted on other virtual machines, thus ensuring security.

2. The virtual machine encryption method according to claim 1, characterized in that, In step S1, disk partition marking is performed using disk management tools within the virtual machine. The administrator checks the overall hardware configuration of the server, examines the server's processor performance, and verifies the server's memory capacity. If the memory is insufficient, expansion and optimization measures are required.

3. The virtual machine encryption method according to claim 1, characterized in that, In step S2, feature information is collected from the server hardware level in advance to obtain the system environment information of the current server. After collecting the basic information, a set of pre-set complex random seed data is introduced. The complex random seed data includes irregularly arranged numbers and characters. The collected hardware feature information, system environment information and this set of random seed data are fused and spliced ​​together, and they are combined into a data string of a new length in sequence. Based on the hash algorithm, the data string is processed to obtain the key.

4. The virtual machine encryption method according to claim 1, characterized in that, The formula for generating the encryption key using the hash algorithm in step S2 is: in The operation involves concatenating P, ID, T, and R in sequence, then inputting the result as a whole into the hash function H. After processing, the encryption key K is obtained. H represents the hash function operation, P represents the string corresponding to the feature information extracted from the server's built-in hardware identifier, ID represents the virtual machine disk number, T represents the corresponding timestamp, and R is a randomly generated hexadecimal string. These strings are concatenated and then fed into the hash function for calculation. The resulting hash value is the encryption key K.

5. The virtual machine encryption method according to claim 1, characterized in that, In step S3, the initial encryption uses the RSA algorithm. For the generated key, two different large prime numbers A and B are selected, and their product is calculated, i.e., c = A * B. The Euler's totient function value of c is calculated, α(c) = (A-1) * (B-1). An integer d is selected, whose value range is 1 < d < α(c). An integer e is found through the extended Euclidean algorithm, such that d * e = 1. At this time, the public key is (d, c) and the private key is (e, c). When using the public key to initially encrypt the key, the encryption formula is f=K. d Where f is the encrypted ciphertext and K is the key obtained by the algorithm; the authorization verification method is based on facial recognition and fingerprint recognition, and decryption can only be performed after authorization.

6. The virtual machine encryption method according to claim 1, characterized in that, In step S4, the physical sectors and logical data blocks of the disk storage are used as the reading units to read the data content in the disk. The physical sector of the disk is the basic physical unit of disk storage, carrying binary data; the logical data block is a data unit that is easy to manage and read / write. The encryption module can locate the location of each piece of data that needs to be read. The encryption module scans and reads the data content contained therein in turn. After reading the data block, the corresponding encryption key is generated and the encryption conversion operation is performed. After the encryption conversion is completed, the corresponding ciphertext data is generated and the encryption module writes the ciphertext data back to the original storage location of the disk.

7. The virtual machine encryption method according to claim 1, characterized in that, In step S5, the secure access module uses quantum key distribution for verification. The server randomly generates a sequence of qubits and sets the states of the qubits to 0 and 1 states under two different bases. The server sends these qubits to the user attempting to access the resource through a quantum channel. Without knowing the base used by the server, the user randomly selects a base to measure the received qubits and obtains a measurement result sequence.

8. The virtual machine encryption method according to claim 7, characterized in that, Users attempting to access resources inform the server of the basis sequence they selected for measurement via a classical channel. The server compares and selects the positions of qubits using the same basis from both parties. If the measurement results are consistent, both parties generate a shared key. The user uses this key to encrypt specific verification information and sends it to the server. The server decrypts and verifies the information using its stored copy of the key. If the decryption is successful and the information matches, the user is verified as a legitimate user.

9. The virtual machine encryption method according to claim 1, characterized in that, In step S6, the marking settings are configured using a disk editing tool. Select the corresponding disk, enter the partition table editing mode, find the partition type identifier byte corresponding to the data disk partition that needs to be marked, modify its original standard value to a custom hexadecimal value, and save the settings after modification. At this point, the partition will have this mark, and other virtual machines will not be able to recognize the current disk and will refuse to mount it when mounting it using the normal process.

10. A virtual machine encryption system, applied to any of the above-mentioned virtual machine encryption methods, characterized in that, include: Key generation module, encryption module, secure access module, and tagging module; The key generation module is used to generate a unique set of encryption keys for each virtual machine disk that needs to be encrypted. The encryption module is used to encrypt data on the virtual machine disk block by block; The secure access module is used to establish a secure access mechanism and verify the currently accessing user; The tagging module is used to tag and set data at the disk's underlying partition table and the operating system's driver level.

Images