Data processing method, device, equipment and medium

Abstract

The present application discloses a data processing method, apparatus, device, and medium in the field of computer technology. The virtual machine manager in the present application sets different keys for different virtual machines, and for the encrypted data sent by each server, encrypts the encrypted data based on the target virtual machine bound to the corresponding server and using the key corresponding to the target virtual machine, and stores the encrypted ciphertext in the trusted storage area belonging to the target virtual machine. In this solution, each virtual machine corresponds to a different encryption key, and the data of different virtual machines is stored in the same virtual machine manager in ciphertext form. The data security risk of a single virtual machine will not affect the data of other virtual machines, thereby improving the security of all virtual machine data under the virtual machine manager.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, apparatus, device, and medium. Background Art

[0002] Currently, data from different virtual machines is stored in the same virtual machine manager. If a virtual machine has a data security risk, the virtual machine creates a security exposure, causing all virtual machine data under the virtual machine manager to have security risks.

[0003] Therefore, how to improve the security of all virtual machine data under the virtual machine manager is a problem that those skilled in the art need to solve. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a data processing method, apparatus, device and medium to improve the security of all virtual machine data under the virtual machine manager.

[0005] In the first aspect, the present application provides a data processing method, which is applied to a virtual machine manager, in which multiple virtual machines are provided, including: receiving connection requests sent by each server; selecting idle virtual machines from the multiple virtual machines according to the connection requests, and binding the selected virtual machines to each server respectively; wherein each virtual machine corresponds to a different key; if data to be encrypted is received from a target server among the servers, in a target virtual machine bound to the target server, the data to be encrypted is encrypted using the key corresponding to the target virtual machine, and the encrypted ciphertext is stored in the trusted storage area to which the target virtual machine belongs.

[0006] In the second aspect, the present application provides a data processing device, which is applied to a virtual machine manager, in which multiple virtual machines are provided, including: a receiving module, which is used to receive connection requests sent by each server; a binding module, which is used to select idle virtual machines from the multiple virtual machines according to the connection request, and bind the selected virtual machines to each server respectively; wherein each virtual machine corresponds to a different key; a storage module, which is used to encrypt the data to be encrypted in the target virtual machine bound to the target server using the key corresponding to the target virtual machine if the data to be encrypted is received from the target server among the servers, and store the encrypted ciphertext in the trusted storage area to which the target virtual machine belongs.

[0007] In a third aspect, the present application provides an electronic device, comprising: a memory for storing a computer program; and a processor for executing the computer program to implement the aforementioned disclosed data processing method.

[0008] In a fourth aspect, the present application provides a non-volatile storage medium for storing a computer program, wherein the computer program implements the aforementioned disclosed data processing method when executed by a processor.

[0009] In a fifth aspect, the present application provides a computer program product, comprising a computer program / instruction, which implements the steps of the aforementioned disclosed data processing method when executed by a processor.

[0010] It can be seen from the above scheme that the present application provides a data processing method, which is applied to a virtual machine manager, in which multiple virtual machines are provided, including: receiving connection requests sent by each server; selecting idle virtual machines from the multiple virtual machines according to the connection request, and binding the selected virtual machines to each server respectively; wherein each virtual machine corresponds to a different key; if the data to be encrypted is received from the target server among the servers, in the target virtual machine bound to the target server, the data to be encrypted is encrypted using the key corresponding to the target virtual machine, and the encrypted ciphertext is stored in the trusted storage area to which the target virtual machine belongs.

[0011] As can be seen, the virtual machine manager in this application sets different keys for different virtual machines. For the encrypted data sent by each server, it encrypts the encrypted data based on the target virtual machine bound to the corresponding server and using the key corresponding to the target virtual machine, and stores the encrypted ciphertext in the trusted storage area belonging to the target virtual machine. In this solution, each virtual machine has a different encryption key, and the data of different virtual machines is stored in ciphertext form in the same virtual machine manager. Data security risks in a single virtual machine will not affect the data of other virtual machines, thereby improving the security of all virtual machine data under the virtual machine manager.

[0012] Correspondingly, the data processing device, equipment and medium provided by this application also have the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0014] Figure 1 A flow chart of a data processing method disclosed in this application;

[0015] Figure 2 A schematic diagram of a data processing system disclosed in this application;

[0016] Figure 3 A schematic diagram of a data processing device disclosed in this application;

[0017] Figure 4 A schematic diagram of an electronic device disclosed in this application;

[0018] Figure 5 A server structure diagram provided for this application;

[0019] Figure 6 This is a terminal structure diagram provided for this application. DETAILED DESCRIPTION

[0020] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments of this application, all other examples obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0021] Currently, data from different virtual machines is stored in the same virtual machine manager. If a virtual machine has a data security risk, that virtual machine creates a security exposure, potentially exposing the data of all virtual machines under the virtual machine manager to security risks. Therefore, this application provides a data processing solution that enables each virtual machine to have a different encryption key. The data of different virtual machines is stored in encrypted form in the same virtual machine manager. A data security risk in a single virtual machine will not affect the data of other virtual machines, thereby improving the security of all virtual machine data under the virtual machine manager.

[0022] See also Figure 1 As shown, an embodiment of the present application discloses a data processing method, which is applied to a virtual machine manager, wherein the virtual machine manager is provided with multiple virtual machines, including:

[0023] S101: Receive connection requests sent by each server.

[0024] In this embodiment, a security hardening model, TDX, is implemented within the virtual machine manager. TDX is a trusted medium that provides interfaces for creating, deleting, and scheduling Trust Domain execution. This intermediary, independent of the virtual machine manager's control, manages the key ID provided by MKTME (Total Memory-Encryption Multi-Key), isolating the virtual machine manager from the trusted storage area. TDX can address data trust issues at the physical level, but TDX-based processors are expensive. Therefore, in this embodiment, TDX is implemented only within the virtual machine manager to save costs. Trusted storage areas can be partitioned from trusted memory within the TDX trust domain.

[0025] It should be noted that the virtual machine manager creates multiple virtual machines based on TDX. In other words, each virtual machine has its own corresponding trusted storage area, and the relevant data of each virtual machine is trusted based on TDX. Each server that is connected to the virtual machine manager is used to run user tasks. The user data generated during the operation is filtered and sent as encrypted data to the virtual machine manager for storage. In one embodiment, the creation process of any virtual machine includes: determining an available trusted storage area (i.e., an idle trusted storage area); creating the current virtual machine in the available trusted storage area; and generating a key corresponding to the current virtual machine based on the current virtual machine's creation timestamp, identification code (i.e., UUID), and virtual machine identification information (i.e., virtual machine ID). Specifically, the creation timestamp, identification code, and virtual machine identification information can be concatenated to obtain the key.

[0026] S102 . Select idle virtual machines from multiple virtual machines according to the connection request, and bind the selected virtual machines to the servers respectively; wherein each virtual machine corresponds to a different key.

[0027] In one embodiment, binding the selected virtual machines to the servers includes: binding the virtual machine identification information of each selected virtual machine to the server identification information of each server on a one-to-one basis. The virtual machine identification information may include information such as the virtual machine IP address and the virtual machine code; and the server identification information may include information such as the server IP address and the server device code.

[0028] S103. If the encrypted data is received from the target server among the servers, the encrypted data is encrypted in the target virtual machine bound to the target server using the key corresponding to the target virtual machine, and the encrypted ciphertext is stored in the trusted storage area belonging to the target virtual machine.

[0029] In one embodiment, data to be encrypted is encrypted in a target virtual machine bound to a target server using a key corresponding to the target virtual machine, including: running the target virtual machine in a trusted storage area and causing the target virtual machine to encrypt the data to be encrypted using the key. The data to be encrypted is obtained by the target server by filtering its own global data to be stored based on its own unique data filtering policy. The data filtering policies of different servers can be the same or different.

[0030] To ensure the accuracy of the encrypted data during transmission, before encrypting the encrypted data using the key corresponding to the target virtual machine in the target virtual machine bound to the target server, the process also includes: verifying the encrypted data; if the verification passes, then executing the step of encrypting the encrypted data using the key corresponding to the target virtual machine in the target virtual machine bound to the target server and subsequent steps. If the verification fails, then sending a retransmission message to the target server to cause the target server to resend the encrypted data, and executing the step of verifying the encrypted data and subsequent steps until the verification passes.

[0031] In one example, the process by which a target server obtains its stored data from a virtual machine manager includes: the target server sends a data retrieval request to the virtual machine manager; the virtual machine manager, based on the request, queries and obtains the corresponding data ciphertext in the trusted storage area belonging to the target virtual machine; decrypts the data ciphertext to obtain the data plaintext; and returns the plaintext data to the target server, thereby enabling flexible querying of important data. Accordingly, the process by which a target server updates data stored in the virtual machine manager includes: the target server sends a data update request to the virtual machine manager; the virtual machine manager, based on the request, updates the corresponding data ciphertext in the trusted storage area belonging to the target virtual machine; and returns an update completion message to the target server, thereby enabling flexible updating of encrypted data in the virtual machine manager.

[0032] As can be seen, the virtual machine manager in this embodiment sets different keys for different virtual machines. For encrypted data sent by each server, the virtual machine manager encrypts the encrypted data using the key corresponding to the target virtual machine based on the target server's binding, and then stores the encrypted data in the trusted storage area belonging to the target virtual machine. In this solution, each virtual machine has a different encryption key, and the data of different virtual machines is stored in encrypted form in the same virtual machine manager. Data security risks in a single virtual machine do not affect the data of other virtual machines, thus improving the security of all virtual machine data under the virtual machine manager.

[0033] See Figure 2In the intranet, a server SUT0 is set up as a master control station, where a TDX-based deployment is implemented to securely protect important user data on all servers within the LAN. Specifically, each of the servers SUT1 to SUT4 within the LAN has a data screening strategy to filter important data from the global data to be stored on the corresponding server as data to be encrypted. Servers SUT1 to SUT4 report the filtered important data to the master control station via the TCP / IP network. After receiving the data, the master control station uses the TDX deployment environment to encrypt the data. After the data is encrypted, the encrypted data is stored locally. When the user updates this data, the updated data is actively reported to the master control station, which then updates the corresponding stored data.

[0034] In this embodiment, a plurality of virtual machines are provided in the main control console, and one virtual machine is bound to one server. A specific data encryption storage process includes: the server SUT1 sends a connection request to the main control machine SUT0, and after receiving the connection request, the main control machine SUT0 binds the virtual machine ID to the server SUT1, and responds to confirm the server SUT1, so that the corresponding virtual machine in the main control machine SUT0 successfully establishes a connection with the server SUT1; the server SUT1 sends the data to be encrypted to the main control machine, and then the virtual machine bound to the server SUT1 successfully verifies the encrypted data, encrypts the encrypted data in the trusted storage area corresponding to the virtual machine, and completes the storage. If the data verification is unsuccessful, an instruction is returned to the server SUT1, requiring the server SUT1 to retransmit the data, and then re-verify it until the verification is successful and then encrypt it. The process of server SUT1 obtaining encrypted data is the opposite of the above process and will not be repeated here.

[0035] It's important to note that in a TDX trusted domain, keys must be globally unique for each VM name to avoid duplication. Therefore, the key can include a timestamp, UUID, and VM ID. UUID, short for Universally Unique Identifier, is a software construction standard and part of the Open Software Foundation's distributed computing environment. For example, VM1's key consists of: VM1 creation time + UUID1 + VM1's ID; VM2's key consists of: VM2 creation time + UUID2 + VM2's ID. This creates a data shield between VM1 and VM2.

[0036] In other words, data between each virtual machine is isolated. That is, VM 1, VM 2, VM 3, and VM 4 cannot share or exchange data with each other, ensuring data security between different virtual machine services. This isolation is achieved by assigning different keys to each virtual machine through MKTME. These keys are the key to TDX encryption, which is hardware-based and performed jointly by the TDX CPU and memory. Consequently, from the user's perspective, user data on the server corresponding to each virtual machine is isolated, ensuring data security for each user.

[0037] In one example, a data processing flow includes:

[0038] Step 1: Deploy the master TDX server and enable the TDX function.

[0039] Specifically, deploy a TDX-based server SUT0 and install the latest version of CentOS on it. Then modify the grub.cfg startup item to enable the TDX function, compile the TDX installation package, install and create TDX.Repo, and then restart the operating system to confirm that the TDX function is enabled successfully.

[0040] Step 2: Deploy the controlled server and configure the network.

[0041] Deploy common servers SUT1, SUT2, SUT3, etc., install the latest version of CentOS system on them, set the network address IP of the server, and ensure that the server is successfully connected to the network.

[0042] Step 3: Connect to the network to achieve interconnection between the master TDX server and the controlled server.

[0043] Specifically, TCP / IP (Transmission Control Protocol / Internet Protocol), RDMA (Remote Direct Memory Access), etc. can be used to enable controlled servers such as SUT1, SUT2, and SUT3 to successfully connect to SUT0.

[0044] Step 4: Deploy a unique important data screening strategy in the controlled server to provide TDX security protection for important user data.

[0045] Each common server deploys its own unique important data screening strategy to extract important user data, and then reports the extracted data to SUT0 via the TCP / IP network, which is encrypted and stored by SUT0.

[0046] This embodiment can use the TDX function to encrypt and store important data as needed, and user data in different controlled servers are isolated from each other, which can prevent data leakage and loss and realize data protection function.

[0047] A data processing device provided in an embodiment of the present application is introduced below. The data processing device described below can be referenced with other embodiments described herein.

[0048] See also Figure 3 As shown, an embodiment of the present application discloses a data processing device, which is applied to a virtual machine manager, in which multiple virtual machines are provided, including: a receiving module, which is used to receive connection requests sent by each server; a binding module, which is used to select idle virtual machines from multiple virtual machines according to the connection request, and bind the selected virtual machines to each server respectively; wherein each virtual machine corresponds to a different key; a storage module, which is used to encrypt the encrypted data sent by the target server among the servers, in the target virtual machine bound to the target server, using the key corresponding to the target virtual machine to encrypt the data, and store the encrypted ciphertext in the trusted storage area to which the target virtual machine belongs.

[0049] In one embodiment, the binding module is specifically configured to: perform one-to-one binding between the virtual machine identification information of each selected virtual machine and the server identification information of each server.

[0050] In one embodiment, the storage module is specifically configured to: run a target virtual machine in the trusted storage area, and enable the target virtual machine to encrypt the data to be encrypted using a key.

[0051] In one embodiment, before encrypting the data to be encrypted using the key corresponding to the target virtual machine in the target virtual machine bound to the target server, the method further includes: a verification module for verifying the data to be encrypted; if the verification passes, the step of encrypting the data to be encrypted using the key corresponding to the target virtual machine in the target virtual machine bound to the target server and subsequent steps are executed. If the verification fails, a retransmission message is sent to the target server to cause the target server to resend the data to be encrypted, and the step of verifying the data to be encrypted and subsequent steps are executed until the verification passes.

[0052] In one embodiment, the creation process of any virtual machine includes: determining an available trusted storage area; creating a current virtual machine in the available trusted storage area; and generating a key corresponding to the current virtual machine based on the creation timestamp, identification code and virtual machine identification information of the current virtual machine.

[0053] In one embodiment, the data to be encrypted is obtained by the target server by screening its own global data to be stored based on its own exclusive data screening policy.

[0054] Among them, for more specific working processes of each module and unit in this embodiment, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0055] It can be seen that this embodiment provides a data processing device that can make each virtual machine correspond to a different encryption key, and the data of different virtual machines are stored in the same virtual machine manager in encrypted form. The data security risk of a single virtual machine will not affect the data of other virtual machines, thereby improving the security of all virtual machine data under the virtual machine manager.

[0056] An electronic device provided in an embodiment of the present application is introduced below. The electronic device described below can be referenced with other embodiments described herein.

[0057] See also Figure 4 As shown, an embodiment of the present application discloses an electronic device, including: a memory 401 for storing a computer program; a processor 402 for executing the computer program to implement the method disclosed in any of the above embodiments.

[0058] In this embodiment, when the processor executes the computer program stored in the memory, it can specifically implement the following steps: receiving connection requests sent by each server; selecting idle virtual machines from multiple virtual machines according to the connection requests, and binding the selected virtual machines to each server respectively; wherein each virtual machine corresponds to a different key; if the encrypted data is received from the target server among the servers, in the target virtual machine bound to the target server, the encrypted data is encrypted using the key corresponding to the target virtual machine, and the encrypted ciphertext is stored in the trusted storage area to which the target virtual machine belongs.

[0059] In this embodiment, when the processor executes the computer program stored in the memory, the following steps may be specifically implemented: binding the virtual machine identification information of each selected virtual machine with the server identification information of each server in a one-to-one manner.

[0060] In this embodiment, when the processor executes the computer program stored in the memory, the following steps may be specifically implemented: running a target virtual machine in the trusted storage area, and enabling the target virtual machine to encrypt the data to be encrypted using a key.

[0061] In this embodiment, when the processor executes the computer program stored in the memory, it can specifically implement the following steps: verifying the encrypted data; if the verification passes, executing the step of encrypting the encrypted data in the target virtual machine bound to the target server using the key corresponding to the target virtual machine and other subsequent steps.

[0062] In this embodiment, when the processor executes the computer program stored in the memory, it can specifically implement the following steps: if the verification fails, a retransmission message is sent to the target server to enable the target server to resend the data to be encrypted, and execute the step of verifying the data to be encrypted and other subsequent steps until the verification passes.

[0063] In this embodiment, when the processor executes the computer program stored in the memory, it can specifically implement the following steps: determine an available trusted storage area; create a current virtual machine in the available trusted storage area; and generate a key corresponding to the current virtual machine based on the creation timestamp, identification code and virtual machine identification information of the current virtual machine.

[0064] Furthermore, the embodiment of the present application also provides an electronic device. The electronic device can be Figure 5 The server shown can also be Figure 6 Terminal shown. Figure 5 and Figure 6 Each of the diagrams is a structural diagram of an electronic device according to an exemplary embodiment, and the contents in the diagrams cannot be considered as any limitation on the scope of use of the present application.

[0065] Figure 5 This is a schematic diagram of the structure of a server provided in an embodiment of the present application. The server may specifically include: at least one processor, at least one memory, a power supply, a communication interface, an input / output interface, and a communication bus. The memory is used to store a computer program, which is loaded and executed by the processor to implement the relevant steps of the data processing disclosed in any of the aforementioned embodiments.

[0066] In this embodiment, the power supply is used to provide operating voltage for each hardware device on the server; the communication interface can create a data transmission channel between the server and external devices. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface is used to obtain external input data or output data to the outside world. The specific interface type can be selected according to specific application needs and is not specifically limited here.

[0067] In addition, the memory as a carrier for resource storage can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon include operating system, computer programs and data, etc. The storage method can be temporary storage or permanent storage.

[0068] The operating system is used to manage and control the hardware devices and computer programs on the server, enabling the processor to operate and process data in the memory. It can be Windows Server, NetWare, Unix, Linux, etc. In addition to computer programs capable of performing the data processing methods disclosed in any of the aforementioned embodiments, computer programs can also include computer programs capable of performing other specific tasks. Data can include data such as application update information and other data such as application developer information.

[0069] Figure 6 This is a schematic diagram of the structure of a terminal provided in an embodiment of the present application. The terminal may specifically include but is not limited to a smartphone, tablet computer, laptop computer or desktop computer.

[0070] Generally, the terminal in this embodiment includes: a processor and a memory.

[0071] The processor may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor may be implemented in at least one of the following hardware forms: a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), or a PLA (Programmable Logic Array). The processor may also include a main processor and a coprocessor. The main processor is used to process data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing content required to be displayed on the display. In some embodiments, the processor may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0072] The memory may include one or more computer non-volatile storage media, which may be non-transitory. The memory may also include high-speed random access memory, and non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory is used to store at least the following computer program, wherein, after the computer program is loaded and executed by the processor, it can implement the relevant steps in the data processing method performed by the terminal side disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory may also include an operating system and data, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system may include Windows, Unix, Linux, etc. The data may include but is not limited to update information of the application.

[0073] In some embodiments, the terminal may further include a display screen, an input and output interface, a communication interface, a sensor, a power supply, and a communication bus.

[0074] Those skilled in the art will understand that Figure 6 The structure shown in the figure does not constitute a limitation to the terminal, and may include more or fewer components than shown in the figure.

[0075] A non-volatile storage medium provided in an embodiment of the present application is introduced below. The non-volatile storage medium described below can be referenced with other embodiments described herein.

[0076] A non-volatile storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the data processing method disclosed in the aforementioned embodiment. The non-volatile storage medium is a computer-readable non-volatile storage medium that, as a carrier for resource storage, may be a read-only memory, random access memory, a magnetic disk, or an optical disk. The resources stored thereon include an operating system, a computer program, and data, and the storage method may be either temporary or permanent.

[0077] In this embodiment, when the processor executes the computer program stored in the non-volatile storage medium, it can specifically implement the following steps: receiving connection requests sent by each server; selecting idle virtual machines from multiple virtual machines according to the connection requests, and binding the selected virtual machines to each server respectively; wherein each virtual machine corresponds to a different key; if the encrypted data is received from the target server among the servers, in the target virtual machine bound to the target server, the encrypted data is encrypted using the key corresponding to the target virtual machine, and the encrypted ciphertext is stored in the trusted storage area to which the target virtual machine belongs.

[0078] In this embodiment, when the processor executes the computer program stored in the non-volatile storage medium, the following steps may be specifically implemented: binding the virtual machine identification information of each selected virtual machine with the server identification information of each server on a one-to-one basis.

[0079] In this embodiment, when the processor executes the computer program stored in the non-volatile storage medium, the following steps may be specifically implemented: running a target virtual machine in the trusted storage area, and causing the target virtual machine to encrypt the data to be encrypted using a key.

[0080] In this embodiment, when the processor executes the computer program stored in the non-volatile storage medium, it can specifically implement the following steps: verifying the encrypted data; if the verification passes, executing the step of encrypting the encrypted data in the target virtual machine bound to the target server using the key corresponding to the target virtual machine and other subsequent steps.

[0081] In this embodiment, when the processor executes the computer program stored in the non-volatile storage medium, it can specifically implement the following steps: if the verification fails, a retransmission message is sent to the target server to enable the target server to resend the data to be encrypted, and execute the step of verifying the data to be encrypted and other subsequent steps until the verification passes.

[0082] In this embodiment, when the processor executes the computer program stored in the non-volatile storage medium, it can specifically implement the following steps: determine an available trusted storage area; create a current virtual machine in the available trusted storage area; and generate a key corresponding to the current virtual machine based on the creation timestamp, identification code and virtual machine identification information of the current virtual machine.

[0083] A computer program product provided in an embodiment of the present application is introduced below. The computer program product described below can be referenced with other embodiments described herein.

[0084] A computer program product comprises a computer program / instruction, which implements the steps of the aforementioned data processing method when executed by a processor.

[0085] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0086] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of non-volatile storage medium known in the art.

[0087] This document uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A data processing method, characterized in that: Applied to a virtual machine manager, wherein the virtual machine manager is provided with multiple virtual machines, including: Receive connection requests sent by each server; Selecting idle virtual machines from the multiple virtual machines according to the connection request, and binding the selected virtual machines to the servers respectively; wherein each virtual machine corresponds to a different key; If the encrypted data is received from a target server among the servers, the encrypted data is encrypted in the target virtual machine bound to the target server using the key corresponding to the target virtual machine, and the encrypted ciphertext is stored in the trusted storage area to which the target virtual machine belongs; Wherein, in the target virtual machine bound to the target server, before encrypting the data to be encrypted using the key corresponding to the target virtual machine, the method further includes: Verifying the data to be encrypted; If the verification passes, the step of encrypting the data to be encrypted using the key corresponding to the target virtual machine bound to the target server and other subsequent steps are executed; The process of creating any virtual machine includes: Identify available trusted storage areas; Create a current virtual machine in the available trusted storage area; Generate a key corresponding to the current virtual machine based on the creation timestamp, identification code and virtual machine identification information of the current virtual machine.

2. The method according to claim 1, characterized in that Bind the selected virtual machines to each server separately, including: Bind the virtual machine identification information of each selected virtual machine to the server identification information of each server one-to-one.

3. The method according to claim 1, characterized in that In a target virtual machine bound to the target server, encrypting the data to be encrypted using a key corresponding to the target virtual machine includes: The target virtual machine is run in the trusted storage area, and the target virtual machine is enabled to encrypt the data to be encrypted using the key.

4. The method according to claim 1, wherein Also includes: If the verification fails, a retransmission message is sent to the target server to enable the target server to resend the data to be encrypted, and perform the step of verifying the data to be encrypted and other subsequent steps until the verification passes.

5. The method according to any one of claims 1 to 4, characterized in that The data to be encrypted is obtained by the target server screening its own global data to be stored based on its own exclusive data screening strategy.

6. A data processing device, characterized in that: Applied to a virtual machine manager, wherein the virtual machine manager is provided with multiple virtual machines, including: A receiving module, used for receiving connection requests sent by each server; a binding module, configured to select idle virtual machines from the plurality of virtual machines according to the connection request, and bind the selected virtual machines to the servers respectively; wherein each virtual machine corresponds to a different key; a storage module configured to, upon receiving data to be encrypted sent by a target server among the servers, encrypt the data to be encrypted in a target virtual machine bound to the target server using a key corresponding to the target virtual machine, and store the encrypted ciphertext in a trusted storage area to which the target virtual machine belongs; Wherein, in the target virtual machine bound to the target server, before encrypting the data to be encrypted using the key corresponding to the target virtual machine, the method further includes: a verification module for verifying the data to be encrypted; if the verification passes, executing the step of encrypting the data to be encrypted in the target virtual machine bound to the target server using the key corresponding to the target virtual machine and subsequent other steps; The process of creating any virtual machine includes: Identify available trusted storage areas; Create a current virtual machine in the available trusted storage area; Generate a key corresponding to the current virtual machine based on the creation timestamp, identification code and virtual machine identification information of the current virtual machine.

7. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to execute the computer program to implement the method according to any one of claims 1 to 5.

8. A non-volatile storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images