Virtual machine creation method and device, equipment and storage medium

Abstract

The invention provides a virtual machine creation method and device, equipment and a storage medium, and relates to the technical field of computers, the method can realize creation of a virtual machine with an encrypted memory, and ensures confidentiality and integrity of data of the virtual machine during operation. The method comprises the steps that a creation request is received, the creation request is used for requesting to create a virtual machine on a host machine, under the condition that available resources of the host machine meet preset conditions, target resources needed by operation of the virtual machine are applied to the host machine based on the creation request, and when the creation request indicates that the type of the virtual machine is an encryption type, an XML file is obtained, the XML file is used for representing the configuration required for creating the virtual machine, configuring a startup security configuration parameter in the XML file, configuring the type of the startup security configuration parameter as TDX, and creating the virtual machine on the host machine based on the XML file and the target resource. The method and the device can be used in the creation process of the virtual machine, and are used for solving the problem that data in the virtual machine is easy to leak to cause security risks.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for creating a virtual machine. Background Art

[0002] With the widespread adoption of cloud computing and virtualization technologies, virtual machines (VMs) have become critical infrastructure for many businesses and organizations, and the security of these machines has become increasingly prominent. A VM is a complete computer system that simulates the full functionality of a hardware system through software, running in a completely isolated environment. By simulating hardware devices, it can run multiple operating systems simultaneously on a single physical computer.

[0003] Because virtual machines store a large amount of sensitive data, such as passwords, encryption keys, and private keys, if the sensitive data in the virtual machine is not encrypted, other users or attackers can exploit vulnerabilities in the virtual machine and gain access to the virtual machine using exploit tools. They can then access or steal the sensitive data in the virtual machine, leading to data leaks and security risks. Therefore, ensuring the security of virtual machines is an urgent issue that needs to be addressed. Summary of the Invention

[0004] The present application provides a virtual machine creation method, apparatus, device and storage medium, which can create a memory-encrypted virtual machine to ensure the confidentiality and integrity of the virtual machine data during runtime.

[0005] In a first aspect, the present application provides a virtual machine creation method, which is applied to an OpenStack cloud platform; the method includes: receiving a creation request; the creation request is used to request the creation of a virtual machine on a host machine; when the available resources of the host machine meet preset conditions, applying to the host machine for target resources required for the operation of the virtual machine based on the creation request; when the creation request indicates that the type of the virtual machine is an encryption type, obtaining an extensible markup language (XML) file; the XML file is used to represent the configuration required for creating the virtual machine; configuring startup security configuration parameters in the XML file, and configuring the type of the startup security configuration parameters to be trust domain extension technology (TDX); creating the virtual machine on the host machine based on the XML file and the target resources.

[0006] The virtual machine creation method provided in this application is that the OpenStack cloud platform can receive a creation request to create a virtual machine on a host machine. When the available resources of the host machine meet preset conditions, the OpenStack cloud platform applies to the host machine for the target resources required for the operation of the virtual machine based on the creation request. When the creation request indicates that the type of the virtual machine is an encrypted type, the platform obtains an XML file, configures startup security configuration parameters in the XML file, and configures the startup security configuration parameters to be of TDX type, thereby creating a virtual machine on the host machine based on the XML file and the target resources. The virtual machine creation method of this application combines the OpenStack cloud platform with TDX technology, thereby supporting memory encryption configuration of virtual machines based on TDX technology, building a trusted environment within the virtual machine, and realizing the creation of memory-encrypted virtual machines, thereby avoiding security risks caused by data leakage of virtual machines and ensuring the confidentiality and integrity of virtual machine data during operation.

[0007] In one possible implementation, an XML file is used to indicate that the boot loader file path of the virtual machine is the location of the file of the Unified Extensible Firmware Interface (UEFI) firmware, the controller configuration of the virtual machine enables the input / output memory management unit (IOMMU) function, and the network interface configuration of the virtual machine enables the IOMMU function and disables the read-only memory (ROM) function.

[0008] In another possible implementation, the preset conditions include: available resources of the host machine satisfying target resources required for running the virtual machine, and rated virtual machine usage of the host machine being lower than a preset threshold.

[0009] In another possible implementation, the host machine's hardware is configured to enable Intel's TDX and software guard extensions (SGX) security features; the quick emulator (QEMU), Kernel, and Libvirt in the host machine's software are configured as target versions; the target version is used to indicate the version that supports TDX.

[0010] In another possible implementation, the hardware configuration of the host machine includes: the full encryption function of the memory is configured to be enabled, the bypass mode of the memory encryption is configured to be automatic, the multi-tenant function of the memory encryption is configured to be enabled, the memory integrity check is configured to be disabled, TDX is configured to be enabled, the value of Intel TDX key splitting is configured to be non-zero, SGX is configured to be enabled, the SGX registration server is configured to be automatic, and the delayed authentication mode is configured to be disabled.

[0011] In another possible implementation, before receiving the creation request, the method further includes: modifying the properties of the image to configure the startup security configuration parameters of the virtual machine; the properties of the image include: the firmware type of the image is UEFI, the machine type of the image is Q35, and the image enables TDX encryption; installing EDK2 and configuring the OVMF_CODE.fd file to use TDX encryption when the virtual machine starts.

[0012] In another possible implementation, before receiving the creation request, the method further includes: determining the rated virtual machine usage on the host machine; after creating the virtual machine, the method further includes: updating the rated virtual machine usage in the host machine.

[0013] In a second aspect, the present application provides a virtual machine creation device, which includes: a receiving module, an application module, an acquisition module, a configuration module and a creation module.

[0014] The receiving module is used to receive a creation request; the creation request is used to request the creation of a virtual machine on a host machine; the application module is used to apply to the host machine for target resources required for the operation of the virtual machine based on the creation request when the available resources of the host machine meet preset conditions; the acquisition module is used to obtain an XML file when the creation request indicates that the type of the virtual machine is an encryption type; the XML file is used to represent the configuration required for creating the virtual machine; the configuration module is used to configure startup security configuration parameters in the XML file, and configure the type of the startup security configuration parameters to be TDX; the creation module is used to create a virtual machine on the host machine based on the XML file and the target resources.

[0015] In one possible implementation, the XML file is used to indicate that the boot loader file path of the virtual machine is the location of the UEFI firmware file, the virtual machine's controller configuration enables the IOMMU function, the virtual machine's network interface configuration enables the IOMMU function, and disables the ROM function.

[0016] In another possible implementation, the preset conditions include: available resources of the host machine satisfying target resources required for running the virtual machine, and rated virtual machine usage of the host machine being lower than a preset threshold.

[0017] In another possible implementation, the host machine's hardware is configured to enable Intel's TDX and SGX security features; QEMU, Kernel, and Libvirt in the host machine's software are configured as target versions; the target version is used to indicate a version that supports TDX.

[0018] In another possible implementation, the hardware configuration of the host machine includes: the full encryption function of the memory is configured to be enabled, the bypass mode of the memory encryption is configured to be automatic, the multi-tenant function of the memory encryption is configured to be enabled, the memory integrity check is configured to be disabled, TDX is configured to be enabled, the value of Intel TDX key splitting is configured to be non-zero, SGX is configured to be enabled, the SGX registration server is configured to be automatic, and the delayed authentication mode is configured to be disabled.

[0019] In another possible implementation, the device also includes: a modification module and an installation module; the modification module is used to configure the startup security configuration parameters of the virtual machine; the attributes of the image include: the firmware type of the image is UEFI, the machine type of the image is Q35, and the image enables TDX encryption; the installation module is used to install EDK2 and configure the OVMF_CODE.fd file so that TDX encryption is used when the virtual machine starts.

[0020] In another possible implementation, the device further includes a determination module and an update module; the determination module is used to determine the rated virtual machine usage on the host machine; and the update module is used to update the rated virtual machine usage in the host machine.

[0021] In a third aspect, the present application provides an electronic device comprising: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the electronic device implements the method of the first aspect above.

[0022] In a fourth aspect, the present application provides a computer-readable storage medium, which includes: computer software instructions; when the computer software instructions are executed in an electronic device, the electronic device implements the method of the first aspect above.

[0023] In a fifth aspect, the present application provides a computer program product. When the computer program product is run on a computer, it enables the computer to execute the steps of the relevant method described in the first aspect to implement the method of the first aspect.

[0024] The beneficial effects of the second to fifth aspects mentioned above refer to the corresponding description of the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A schematic diagram of the application environment of a virtual machine creation method provided in this application;

[0026] Figure 2 A schematic diagram of the basic architecture of the TDX technology provided in this application;

[0027] Figure 3 A flowchart of a virtual machine creation method provided in this application;

[0028] Figure 4 A flowchart of another virtual machine creation method provided in this application;

[0029] Figure 5 A flowchart of another virtual machine creation method provided in this application;

[0030] Figure 6 A schematic diagram of the composition of a virtual machine creation device provided in this application;

[0031] Figure 7 A schematic diagram of the composition of an electronic device provided in this application. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0033] It should be noted that in the embodiments of this application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described in the embodiments of this application as "exemplarily" or "for example" should not be interpreted as being more preferred or advantageous than other embodiments or designs. Rather, the use of words such as "exemplarily" or "for example" is intended to present the relevant concepts in a concrete manner.

[0034] In order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

[0035] With the widespread adoption of cloud computing, virtualization has become a core technology in data centers. Virtual machines, at the core of virtualization, enable the running of multiple operating system instances on a single physical server, achieving efficient resource utilization. OpenStack, an open-source cloud computing management platform, is widely used to build and manage cloud environments and create virtual machines. However, with data security becoming increasingly prominent, ensuring virtual machine data security in OpenStack environments has become a critical issue. Currently, virtual machine data security issues primarily manifest in two areas: first, data in virtual machines can be illegally accessed by other users; second, data in virtual machines can be illegally tampered with by administrators or operational users.

[0036] In the related art, data encryption in virtual machines is often performed using encryption keys to encrypt data with different permissions. Administrators and users with different permissions only have encryption keys corresponding to their permissions. However, this encryption method makes the encryption keys for virtual machine data vulnerable to theft or tampering by other users or attackers, posing a serious security risk. Therefore, ensuring the security of virtual machine data is an urgent issue.

[0037] In summary, there is an urgent need for a method to ensure the security of virtual machine data. Based on this, an embodiment of the present application provides a virtual machine creation method, in which the OpenStack cloud platform can receive a creation request to create a virtual machine on a host machine, and when the available resources of the host machine meet the preset conditions, the platform applies to the host machine for the target resources required for the operation of the virtual machine based on the creation request, and when the creation request indicates that the type of the virtual machine is an encryption type, obtains an XML file, configures the startup security configuration parameters in the XML file, and configures the type of the startup security configuration parameters to TDX, thereby creating a virtual machine on the host machine based on the XML file and the target resources. The virtual machine creation method of the present application combines the OpenStack cloud platform with TDX technology, thereby supporting the memory encryption configuration of the virtual machine based on TDX technology, building a trusted environment within the virtual machine, and realizing the creation of a memory encrypted virtual machine, avoiding security risks caused by the leakage of virtual machine data, and ensuring the confidentiality and integrity of the virtual machine data during operation.

[0038] The virtual machine creation method provided in this application can be applied to Figure 1 In the application environment shown. Figure 1 As shown, the application environment includes: an OpenStack cloud platform 101 and a host machine 102. The OpenStack cloud platform 101 and the host machine 102 are connected to each other.

[0039] In some embodiments, the OpenStack cloud platform 101 may be a server cluster consisting of multiple servers, or a single server, or a computer, or a processor or processing chip in a server or computer, etc. The embodiments of the present application do not limit the specific device form of the OpenStack cloud platform 101. Figure 1 In the figure, the OpenStack cloud platform 101 is taken as a single server as an example.

[0040] In some embodiments, the host machine 102 may be a server cluster consisting of multiple servers, or a single server, or a computer, or a processor or processing chip in a server or computer, etc. The embodiments of the present application do not limit the specific device form of the host machine 102. Figure 1 In the figure, the host machine 102 is taken as a single server as an example.

[0041] In some embodiments, the OpenStack cloud platform 101 may receive a creation request from a user for applying to create a virtual machine, and verify whether the available resources of the host machine 102 meet preset conditions based on the creation request. When the available resources of the host machine 102 meet the preset conditions, the OpenStack cloud platform may apply to the host machine 102 for the target resources required for the operation of the virtual machine, and when the creation request indicates that the type of the virtual machine is an encryption type, obtain an XML file, thereby configuring startup security configuration parameters in the XML file, and configuring the type of the startup security configuration parameters to TDX, and finally creating the virtual machine on the host machine 102 based on the XML file and the target resources.

[0042] Figure 2 A schematic diagram of the basic architecture of a TDX technology provided in an embodiment of the present application is shown as follows: Figure 2 As shown in Figure 2, TDX introduces a new hardware-isolated virtual machine workload model, known as a trust domain. TDX is a typical confidential computing technology that provides a system-level secure and trusted execution environment for tenants' workloads on their untrusted cloud infrastructure, while ensuring the confidentiality and integrity of the tenant's operating environment.

[0043] In some embodiments, the computer hardware architecture (core, cache, and devices) consists of a core that independently executes tasks, improving overall processor performance. A cache is a fast memory used to store frequently accessed data, reducing the number of accesses to main memory. Devices include displays, keyboards, mice, printers, and so on.

[0044] In some embodiments, the Intel TDX host hypervisor is a virtualization technology used to run operating systems and applications in virtual machines, providing isolation and security between different operating systems, allowing different operating systems to run on the same computer without interfering with each other or causing security issues.

[0045] In some embodiments, the Intel TDX module (using the Intel TDX instruction set architecture (ISA)) is used to provide hardware-level security protection for systems running sensitive workloads, using the Intel TDX ISA to manage security features such as access control, memory keyed transactional memory extension (MKTME), and secure extended page table (EPT). Among them, MKTME is an extended memory protection mechanism that can provide an independent memory space for each application and ensure that its memory space is not accessed by other applications. Secure EPT is an extended page table mechanism for managing memory access rights of virtual machines. It ensures that the virtual machine can only access its authorized memory areas by establishing a secure mapping relationship between the virtual machine and the host machine.

[0046] In some embodiments, the interface between the TDX module and the host is used to support the Intel TDX module to run under the host operating system and use the Intel TDX ISA to manage security functions such as access control, MKTME and Secure EPT.

[0047] In some embodiments, the communication interface between the TDX module and the operating system is used to implement data transmission and control interaction between the operating system and the Intel TDX module so that the Intel TDX module can manage the secure execution of the operating system.

[0048] In some embodiments, a traditional virtual machine simulates a hardware environment to run an operating system and applications. Applications achieve secure and reliable isolation and resource management through interaction between the Intel TDX module and the host. Drivers control and manage various hardware devices. The operating system manages the system's software and hardware resources, providing unified interfaces and services for users and applications.

[0049] In some embodiments, a trust domain, which is used to describe the relationship between the Intel TDX host hypervisor and the Intel TDX module (using the Intel TDX ISA), constitutes a secure computing environment that provides functions such as access control and resource management to protect the secure execution of sensitive workloads. Unmodified applications can run in the trust domain and obtain the security protection and management functions provided by the Intel TDX module. Unmodified drivers can obtain a secure execution environment under the isolation and management of the Intel TDX module and the host hypervisor, thereby protecting the security of sensitive data and applications. The operating system based on Intel TDX technology is used to provide a secure and reliable environment to run sensitive workloads. The Intel TDX module manages security functions such as access control, MKTME and Secure EPT, as well as the communication interface with the host, to achieve isolation and protection of sensitive workloads.

[0050] In some embodiments, Intel TDX module managed access control leverages MKTME and Secure EPT to provide isolation and resource management for applications. By combining MKTME and Secure EPT, Intel TDX module managed access control can provide highly secure isolation and resource management for applications, ensuring that each application runs in its own isolated virtual machine with limited access to memory and other resources.

[0051] In some embodiments, the host hypervisor hosts access control, enhanced with MKTME, to provide secure and reliable isolation and resource management for virtual machines, ensuring that each virtual machine runs in its own isolated virtual environment and restricting its access to memory and other resources.

[0052] Figure 3 A flow chart of a virtual machine creation method provided in an embodiment of the present application. Figure 3 As shown, the virtual machine creation method provided in this application can be implemented through the above-mentioned OpenStack cloud platform, and specifically includes the following steps:

[0053] S301: The OpenStack cloud platform receives a creation request.

[0054] The create request is used to request the creation of a virtual machine on a host machine.

[0055] In some embodiments, the OpenStack cloud platform may receive a creation request for requesting to create a virtual machine on a host machine, and may thereby create the virtual machine on the host machine based on the creation request.

[0056] Exemplarily, the Nova-API component of the OpenStack cloud platform receives a creation request sent by a user through the client's Restful API interface, and establishes communication with the Nova-Scheduler component based on the creation request, thereby forwarding the creation request to the Nova-Scheduler component. Among them, the Nova-API component is part of Nova, the core component of the OpenStack cloud platform. It is an intermediate layer between the client and the Nova component on the OpenStack cloud platform, and is used to receive and respond to the client user's application programming interface (API) requests, such as: virtual machine creation, deletion, start, stop and other operations. The Nova-Scheduler component is one of the core components of Nova, the core component of the OpenStack cloud platform, and is also the scheduler component in Nova. It is used to schedule and manage the creation and operation of virtual machine instances to ensure the efficient use of resources and the stability of the system.

[0057] It should be understood that before the OpenStack cloud platform receives a creation request, the hardware and software configurations on the host machine need to be adjusted to support Intel TDX technology. Specifically, the host machine's hardware is configured to enable Intel's TDX and SGX security features, and the host machine's software, including QEMU, Kernel, and Libvirt, are configured to target versions, which indicate the versions that support TDX. The host machine's hardware configuration includes: enabling full memory encryption, automatically setting the memory encryption bypass mode, enabling multi-tenant memory encryption, disabling memory integrity checks, enabling TDX, ensuring the Intel TDX key splitting value is non-zero, enabling SGX, automatically setting the SGX registration server, and disabling delayed authentication mode.

[0058] S302: When the available resources of the host machine meet preset conditions, the OpenStack cloud platform applies to the host machine for target resources required for running the virtual machine based on the creation request.

[0059] The preset conditions include: the available resources of the host machine meet the target resources required for running the virtual machine, and the rated virtual machine usage of the host machine is lower than a preset threshold.

[0060] In some embodiments, after receiving the creation request, the OpenStack cloud platform may also apply to the host machine for target resources required for running the virtual machine based on the creation request if the available resources of the host machine meet preset conditions.

[0061] Exemplarily, after the Nova-Scheduler component receives the creation request sent by the Nova-API component, it can call the resource statistics module placement to query the target resources required to run the virtual machine in the flavor of the creation request, and query the available resources of the host machine and the rated virtual machine usage of the host machine (i.e., MEM_ENCRYPTION_CONTEXT). Thus, when the available resources of the host machine meet the target resources required to run the virtual machine and the preset threshold of the host machine's rated virtual machine usage, the Nova-Scheduler component applies to the host machine for the target resources required to run the virtual machine based on the creation request. In other cases, the Nova-Scheduler component returns a message that the creation failed. After applying to the host machine for the target resources required to run the virtual machine, the Nova-Scheduler component can also call the remote procedure call protocol (RPC) to trigger the process of creating a virtual machine. The placement resource statistics module is a component separated from the Nova component. It is used to collect the available resources of each node, write node resource statistics to the database, maintain the resource list of the OpenStack cloud platform computing nodes, including virtual central processing units (CPUs), memory, disk space, etc., and allocate virtual machine instances to appropriate computing nodes. Flavor represents the specification or configuration of the virtual machine, defining the number and size of the virtual machine's CPU, memory, disk, and other resources. The preset threshold is set by the administrator based on actual conditions and is not limited in the embodiments of this application.

[0062] S303: When the creation request indicates that the type of the virtual machine is an encryption type, the OpenStack cloud platform obtains an XML file.

[0063] The XML file is used to represent the configuration required to create a virtual machine.

[0064] In some embodiments, after the OpenStack cloud platform applies to the host machine for target resources required for running the virtual machine based on the creation request, the OpenStack cloud platform may also obtain the XML file when the creation request indicates that the type of the virtual machine is an encryption type.

[0065] Exemplarily, after the Nova-Scheduler component calls the RPC protocol to trigger the process of creating a virtual machine, the Nova-compute component responds to the call and verifies the flavor and image metadata in the creation request during the Spawn phase (i.e., the virtual machine creation phase), including: whether the hw:tdx_encryption=True parameter exists in the creation request, and whether the specifications of the virtual machine in the flavor and image metadata are consistent. When the hw:tdx_encryption=True parameter exists in the creation request and the specifications of the virtual machine in the flavor and image metadata are consistent, the Nova-compute component obtains the configuration XML file required to characterize the creation of the virtual machine. Among them, the XML file is used to indicate that the boot loader file path of the virtual machine is the location of the file of the UEFI firmware, the controller configuration of the virtual machine enables the IOMMU function, the network interface configuration of the virtual machine enables the IOMMU function, and disables the ROM function. The Nova-compute component is a daemon process and a core component of the OpenStack cloud platform. It is used to create and manage virtual machines and manage the life cycle of virtual machine instances, including operations such as starting, stopping, suspending, and deleting. The Spawn phase represents the creation of a VM instance, including resource allocation, VM network configuration, and OS installation and configuration. hw:tdx_encryption = True indicates that the VM is encrypted. The VM specifications in the flavor and image metadata are set by the user when the VM is created.

[0066] S304. The OpenStack cloud platform configures startup security configuration parameters in the XML file, and configures the startup security configuration parameter type to TDX.

[0067] In some embodiments, after obtaining the XML file, the OpenStack cloud platform may further configure startup security configuration parameters in the XML file, and configure the type of the startup security configuration parameters to be TDX.

[0068] For example, the Nova-compute component determines that the type of the created virtual machine is an encryption type based on hw:tdx_encryption=True in the flavor, thereby adding a new startup security configuration parameter to the XML file and configuring the type of the startup security configuration parameter to be TDX. TDX startup security is configured to protect the data in the virtual machine, ensuring that the data in the virtual machine is encrypted and protected during startup and operation.

[0069] Specifically, the XML file fragment of the virtual machine startup security configuration is as follows:

[0070] <launchSecurity type='tdx'>

[0071] <policy> 0x10000000< / policy>

[0072]

[0073] launchSecurity type = 'tdx' is used to define the launch security configuration parameters of type "tdx" to enhance the isolation and security of the virtual machine. <policy> 0x10000000< / policy> Used to define a policy expressed in hexadecimal notation (0x10000000) that represents a specific encryption configuration or setting.

[0074] S305. The OpenStack cloud platform creates a virtual machine on the host machine based on the XML file and the target resources.

[0075] In some embodiments, after the OpenStack cloud platform configures the startup security configuration parameters in the XML file, it can create a virtual machine on the host machine based on the XML file and the target resources.

[0076] For example, after the Nova-compute component determines the XML configuration file of the virtual machine, it can execute the XML file, read and parse the configuration information of the virtual machine in the XML file, and thereby allocate the target resources obtained from the host machine based on the configuration information of the virtual machine, and configure the hardware configuration, virtual disk configuration and virtual network interface configuration of the virtual machine on the host machine, create a virtual machine instance, and realize the creation of a virtual machine on the host machine.

[0077] It should be understood that the Nova-compute component can not only create virtual machines on the host machine, but also manage and operate virtual machines, such as creating, modifying, and deleting virtual machine instances, as well as performing other management operations, such as starting a virtual machine, shutting down a virtual machine, pausing a virtual machine, and resuming a virtual machine.

[0078] The technical solutions provided by the above embodiments bring at least the following beneficial effects: the virtual machine creation method provided by the embodiments of the present application, wherein the OpenStack cloud platform can receive a creation request for creating a virtual machine on a host machine, and when the available resources of the host machine meet the preset conditions, the platform applies to the host machine for the target resources required for the operation of the virtual machine based on the creation request, and when the creation request indicates that the type of the virtual machine is an encrypted type, obtains an XML file, configures the startup security configuration parameters in the XML file, and configures the startup security configuration parameters to be of the type TDX, thereby creating a virtual machine on the host machine based on the XML file and the target resources. The virtual machine creation method of the present application combines the OpenStack cloud platform with TDX technology, thereby supporting the memory encryption configuration of the virtual machine based on TDX technology, building a trusted environment within the virtual machine, and realizing the creation of a memory-encrypted virtual machine, thereby avoiding security risks caused by the leakage of virtual machine data and ensuring the confidentiality and integrity of the virtual machine data during operation.

[0079] In one possible implementation, the OpenStack cloud platform can also adjust the hardware and software configurations of the host machine. The basic input / output system (BIOS) of the host machine hardware is configured as follows:

[0080] Total Memory Encryption=Enable;

[0081] Total Memory Encryption Bypass=Auto;

[0082] Total Memory Encryption Multi-Tenant=Enable;

[0083] Memory Integrity = Disable;

[0084] TDX=Enable;

[0085] Intel TDX Key Split=None-zero Value;

[0086] SGX=Enable;

[0087] SGX registration server=Auto;

[0088] Delayed Authentication Mode=Disable;

[0089] Total Memory Encryption = Enable enables the host's full memory encryption function, encrypting the contents of all physical memory on the host to enhance data security. Total Memory Encryption Bypass = Auto automatically determines whether to bypass memory encryption. Total Memory Encryption Multi-Tenant = Enable enables multi-tenant memory encryption, allowing different users or applications to have independent encryption keys to increase isolation. Memory Integrity = Disable disables memory integrity protection. TDX = Enable enables TDX technology. Intel TDX Key Split = None-zero Value ensures that the Intel TDX technology key is not zero. SGX = Enable enables SGX technology, which protects applications from interference and attacks by other software. SGX registration server = Auto automatically selects an SGX registration server. Delayed Authentication Mode = Disable disables delayed authentication mode to increase the difficulty of certain types of attacks.

[0090] Furthermore, because host support for TDX technology requires specific QEMU-KVM versions and kernels, you also need to compile the host OS QEMU and kernel to determine the target versions. Run the following commands on the host to install and configure the target software packages: . / pkg-builder build-repo.sh; dnf install https: / / dl.fedoraproject.org / pub / epel / epel-release-latest-8.noarch.rpm; dnf install kernel qemu-kvm ovmf libvirt tdx-module-production; . / pkg-builder build-repo.sh runs the script named build-repo.sh to build or update the software repository. The command dnf install https: / / dl.fedoraproject.org / pub / epel / epel-release-latest-8.noarch.rpm downloads and installs the epel-release RPM package from the specified uniform resource locator (URL). This package provides the software repository configuration. The command dnf install kernel qemu-kvmovmf libvirt tdx-module-production uses the dnf command to install the kernel, QEMU-KVM, open virtual machine firmware (OVMF), Libvirt, and TDX-module-production packages. The kernel is the core component of the operating system, providing basic functionality required for system operation. QEMU-KVM is an open-source virtualization software package that allows multiple virtual machines to run on a single physical machine. OVMF is an open-source tool for creating and running virtual machine images. Libvirt is an open-source tool for managing virtual machines, providing functionality for creating, running, and managing virtual machines. TDX-module-production is a TDX-specific production module that supports memory encryption.

[0091] The host machine also needs to modify the boot loader (GRUB) and kernel information and create the appropriate version of the guest OS. Modify the GRUB and kernel information by executing the following commands: numa_balancing = disable; grub2 -mkconfig -o / boot / efi / EFI / redhat / grub.cfg; Grubby -set-default = / boot / vmlinuz-<kernel version> ; Among them, numa_balancing = disable means disabling non-uniform memory access (NUMA) balancing. NUMA is a memory management strategy that manages process memory access based on the topology of physical memory. grub2-mkconfig -o / boot / efi / EFI / redhat / grub.cfg means generating a GRUB 2 configuration file. grub2-mkconfig is used to generate a GRUB 2 configuration file based on the kernel and modules in the system. -o specifies the output file path, that is, / boot / efi / EFI / redhat / grub.cfg. Grubby-set-default = / boot / vmlinuz-<kernel version> Indicates setting the default kernel version based on Grubby. -set-default is used to set the default kernel image path, i.e. / boot / vmlinuz-<kernel version> . Create a guest OS of the appropriate version by executing the following command: . / create-redhat-image.sh -l$GUEST_ISO -r$GUEST_REPO -o$GUEST_NAME; where . / create-redhat-image.sh is the script file to be executed. -l$GUEST_ISO is the specified ISO file path, which stores the ISO image used to create the guest OS. -r$GUEST_REPO is the URL of the specified repository, which is used to install additional software packages or updates. -o$GUEST_NAME is the name of the newly created guest OS.

[0092] In another possible implementation, the XML file obtained by the OpenStack cloud platform includes the virtual machine's operating system type configuration, controller configuration, and network interface configuration. A fragment of the XML file for the virtual machine's operating system type configuration is as follows:

[0093] <os>

[0094] <type arch='x86_64'machine='pc-q35-3.0'> hvm

[0095] <loader> / path / to / OVMF.fd< / loader>

[0096] < / os>

[0097] os indicates that this XML code defines the virtual machine's operating system type and related configurations. type specifies the virtual machine's type and architecture. arch = 'x86_64' specifies that the virtual machine's architecture is the 64-bit x86 architecture, and machine = 'pc-q35-3.0' specifies that the virtual machine's hardware configuration type is pc-q35-3.0. <loader> / path / to / OVMF.fd< / loader> Used to specify the file path of the virtual machine's boot loader, i.e. / path / to / OVMF.fd.

[0098] The following is a fragment of the XML file for the virtual machine's controller configuration:

[0099] <controller type='virtio-serial'index='0'>

[0100] <driver iommu='on' / >

[0101]

[0102] <controller type='scsi'index='0'model='virtio-scsi'>

[0103] <driver iommu='on' / >

[0104]

[0105] Controller indicates that this XML code defines controller-related configuration for the virtual machine. "type="virtio-serial" index="0" indicates that the controller type is virtio-serial, with index 0, to provide efficient I / O performance. "driver" iommu="on" indicates that the IOMMU function is enabled. The IOMMU is a hardware mechanism used to isolate and protect device I / O memory access, improving security and reducing potential hardware issues. "type="scsi" index="0" model="virtio-scsi" indicates that the controller type is small computer system interface (SCSI), with index 0 and model virtio-scsi. Virtio-scsi is a SCSI controller based on the Virtio standard that provides efficient storage I / O performance.

[0106] The XML file snippet for the virtual machine's network interface configuration is as follows:

[0107] <interface type='network'>

[0108] <mac address='52:54:00:cc:56:90' / >

[0109] <source network＝'default'>

[0110] <model type='virtio' / >

[0111] <driver iommu='on' / >

[0112] <rom enabled='no' / >

[0113]

[0114] Among them, interface type = 'network' means defining an interface of type "network". macaddress = '52:54:00:cc:56:90' indicates that a media access control address (MAC) is assigned to the interface. The MAC address is used to uniquely identify the address of a network interface. source network = 'default' is used to specify that the network source of the interface is "default", indicating that the interface is connected to the default network. modeltype = 'virtio' is used to specify that the interface uses the virtio model. Virtio is a standard used to improve I / O performance between virtual machines and hosts. driver iommu = 'on' indicates that the IOMMU function is enabled. rom enabled = 'no' disables the ROM function. ROM is used to store firmware or boot code.

[0115] In another possible implementation, before receiving the creation request, the OpenStack cloud platform can also modify the properties of the image on the cloud platform to configure the startup security configuration parameters of the virtual machine, install EDK2 and configure the OVMF_CODE.fd file so that TDX encryption is used when the virtual machine is started. Figure 4 As shown, before the OpenStack cloud platform receives the creation request in step S301, the virtual machine creation method of the present application further includes the following steps S401-S402:

[0116] S401. The OpenStack cloud platform modifies properties of the image to configure startup security configuration parameters of the virtual machine.

[0117] Among them, the image attributes include: the image firmware type is UEFI, the image is Q35, and the image enables TDX encryption.

[0118] In some embodiments, the OpenStack cloud platform may modify properties of the image to configure startup security configuration parameters of the virtual machine.

[0119] For example, the OpenStack cloud platform can add the firmware type hw_firmware_type, machine type hw_tdx_encryption, and hw_machine_type attribute parameters to the image metadata of the virtual machine based on the following command:

[0120] openstack image set--property hw_firmware_type=uefi--property hw_machine_type=q35--property--hw_tdx_encryption=True;

[0121] openstack image set is a command-line tool for modifying image properties on the OpenStack cloud platform. hw_firmware_type=uefi sets the image's hw_firmware_type attribute to uefi, indicating that the image supports UEFI boot mode. hw_machine_type=q35 sets the image's hw_machine_type attribute to q35. hw_tdx_encryption=True sets the image's hw_tdx_encryption attribute to True. Additionally, the OpenStack cloud platform can add the hw:tdx_encryption attribute parameter to indicate the virtual machine type. hw:tdx_encryption=True indicates that the virtual machine is encrypted.

[0122] S402. Install EDK2 on the OpenStack cloud platform and configure the OVMF_CODE.fd file to use TDX encryption when starting the virtual machine.

[0123] In some embodiments, the OpenStack cloud platform may further install EDK2 and configure the OVMF_CODE.fd file so as to adopt TDX encryption when the virtual machine is started.

[0124] For example, the OpenStack cloud platform can configure the machine type parameter for virtual machine startup to the default generated / usr / share / edk2 / ovmf / OVMF_CODE.fd. Among them, / usr / share / edk2 / ovmf / OVMF_CODE.fd is a file path, which usually points to a virtual machine firmware image file, which is usually used for UEFI firmware. / usr / share / edk2 / ovmf / is part of the file path, indicating that the file is located in the ovmf directory of the edk2 software package. edk2 is an open source project for developing UEFI firmware. OVMF_CODE.fd is the file name, indicating that this is a UEFI firmware image file named "OVMF_CODE", and .fd is the extension of the firmware image file.

[0125] In another possible implementation, the OpenStack cloud platform may also determine the rated virtual machine usage on the host before receiving the creation request, so as to determine whether the available resources on the host meet the preset conditions. Figure 4 In step S301, before the OpenStack cloud platform receives the creation request, the virtual machine creation method of the present application further includes the following step S403:

[0126] S403: The OpenStack cloud platform determines the rated virtual machine usage on the host machine.

[0127] In some embodiments, since the number of virtual machines supported for creation on the OpenStack cloud platform based on TDX technology is limited, the OpenStack cloud platform may determine the rated virtual machine usage on the host before receiving a creation request to determine whether the rated virtual machine usage is overloaded.

[0128] For example, the OpenStack cloud platform can add a parameter MEM_ENCRYPTION_CONTEXT for rated virtual machine usage in the resource management module placement, and call the resource management module placement to detect the number of virtual machines currently existing on the host machine, that is, the rated virtual machine usage. In addition, the OpenStack cloud platform can modify the rated virtual machine usage in the following two situations. The first situation is that the OpenStack cloud platform completes the creation of the virtual machine, and the resource management module placement can apply to update the value of MEM_ENCRYPTION_CONTEXT by adding one. The second situation is that the OpenStack cloud platform deletes the virtual machine, and the resource management module placement can apply to update the value of MEM_ENCRYPTION_CONTEXT by subtracting one. Among them, under normal circumstances, TDX supports the creation of 128 virtual machines on the Intel EMR version CPU, that is, the preset threshold size is 128 virtual machines.

[0129] In another possible implementation, after creating a virtual machine, the OpenStack cloud platform can also update the rated virtual machine usage in the host machine, so that when creating a virtual machine on the host machine next time, it can determine whether the available resources of the host machine meet the preset conditions based on the updated rated virtual machine usage. Figure 4 As shown, after the OpenStack cloud platform creates a virtual machine on the host machine based on the XML file and the target resources in step S305, the virtual machine creation method of the present application further includes the following step S404:

[0130] S404: The OpenStack cloud platform updates the rated virtual machine usage in the host machine.

[0131] In some embodiments, after completing the creation of the virtual machine, the OpenStack cloud platform may update the rated virtual machine usage in the host machine.

[0132] For example, after the OpenStack cloud platform creates a memory-encrypted virtual machine, the Nova-compute component can call the placement interface to increase the value of MEM_ENCRYPTION_CONTEXT by one, indicating that the rated virtual machine usage on the host machine has increased by one.

[0133] The technical solutions provided by the above embodiments bring at least the following beneficial effects: the virtual machine creation method provided by the embodiments of the present application, wherein the OpenStack cloud platform can receive a creation request for creating a virtual machine on a host machine, and when the available resources of the host machine meet the preset conditions, the platform applies to the host machine for the target resources required for the operation of the virtual machine based on the creation request, and when the creation request indicates that the type of the virtual machine is an encrypted type, obtains an XML file, configures the startup security configuration parameters in the XML file, and configures the startup security configuration parameters to be of the type TDX, thereby creating a virtual machine on the host machine based on the XML file and the target resources. The virtual machine creation method of the present application combines the OpenStack cloud platform with TDX technology, thereby supporting the memory encryption configuration of the virtual machine based on TDX technology, building a trusted environment within the virtual machine, and realizing the creation of a memory-encrypted virtual machine, thereby avoiding security risks caused by the leakage of virtual machine data and ensuring the confidentiality and integrity of the virtual machine data during operation.

[0134] Furthermore, the controller configuration and network interface configuration of the virtual machine in the XML file both enable the IOMMU function to isolate and protect device I / O memory access to improve security and reduce potential hardware problems. After completing the creation of the virtual machine, the OpenStack cloud platform can also update the rated virtual machine usage in the host so that the next time a virtual machine is created, the available resources of the host are detected based on the rated virtual machine usage in the host, avoiding the creation of virtual machines when the available resources of the host do not meet the preset conditions. In addition, the OpenStack cloud platform can also configure the host's hardware to enable Intel's TDX and SGX security features, and configure QEMU, Kernel, and Libvirt in the host's software to the target version so that the host supports TDX technology, thereby protecting the virtual machine from threats from the host and avoiding threats from other virtual machines.

[0135] The following is an introduction to the virtual machine creation method of the embodiment of the present application based on a specific embodiment. The specific implementation process of this method is as follows: Figure 5 shown.

[0136] The OpenStack cloud platform receives a creation request from a user requesting the creation of an encrypted virtual machine (equivalent to the OpenStack cloud platform receiving the creation request), performs a resource check on the available resources of the host machine based on the creation request, and if the resource check succeeds, requests resources from the host machine, namely, the target resources required to run the virtual machine (equivalent to the OpenStack cloud platform requesting the target resources required to run the virtual machine from the host machine based on the creation request, when the available resources of the host machine meet the preset conditions). If the type of the virtual machine in the creation request is encrypted, the OpenStack cloud platform obtains an XML configuration file (Define XML) for the virtual machine and creates a virtualization layer creation (Spawn) instance based on the target resources and the XML configuration file, wherein the XML configuration file includes configurations for the CPU, RAM, and launch security of the virtual machine (equivalent to the OpenStack cloud platform obtaining an XML file, configuring launch security configuration parameters in the XML file, and configuring the launch security configuration parameters to be of type TDX, when the creation request indicates that the type of the virtual machine is encrypted, thereby creating the virtual machine on the host machine based on the XML file and the target resources). The OpenStack cloud platform updates MEM_ENCRYPTION_CONTEXT (equivalent to the OpenStack cloud platform updating the rated virtual machine usage in the host), and the virtual machine creation process ends. If the parameter verification fails, the virtual machine creation process ends and an error message is returned.

[0137] In an exemplary embodiment, the present application further provides a virtual machine creation device, which may include one or more functional modules for implementing the virtual machine creation method of the above method embodiment.

[0138] For example, Figure 6 A schematic diagram of the composition of a virtual machine creation device provided in an embodiment of the present application. Figure 6 As shown, the virtual machine creation device includes: a receiving module 601 , an application module 602 , an acquisition module 603 , a configuration module 604 and a creation module 605 .

[0139] The receiving module 601 is used to receive a creation request for creating a virtual machine on a host machine. The application module 602 is used to apply to the host machine for the target resources required to run the virtual machine based on the creation request, if the available resources of the host machine meet preset conditions. The acquisition module 603 is used to obtain an XML file representing the configuration required to create the virtual machine when the creation request indicates that the virtual machine type is encrypted. The configuration module 604 is used to configure the startup security configuration parameters in the XML file and configure the startup security configuration parameters to be of TDX type. The creation module 605 is used to create the virtual machine on the host machine based on the XML file and the target resources.

[0140] In some embodiments, the XML file is used to indicate that the boot loader file path of the virtual machine is the location of the UEFI firmware file, the controller configuration of the virtual machine enables the IOMMU function, the network interface configuration of the virtual machine enables the IOMMU function, and disables the ROM function.

[0141] In other embodiments, the preset conditions include: available resources of the host machine satisfying target resources required for running the virtual machine, and rated virtual machine usage of the host machine being lower than a preset threshold.

[0142] In some further embodiments, the host machine's hardware is configured to enable Intel's TDX and SGX security features, and QEMU, Kernel, and Libvirt in the host machine's software are configured as target versions; the target version is used to indicate a version that supports TDX.

[0143] In some further embodiments, the hardware configuration of the host machine includes: the full encryption function of memory is configured to be enabled, the bypass mode of memory encryption is configured to be automatic, the multi-tenant function of memory encryption is configured to be enabled, the memory integrity check is configured to be disabled, TDX is configured to be enabled, the value of Intel TDX key splitting is configured to be non-zero, SGX is configured to be enabled, the SGX registration server is configured to be automatic, and the delayed authentication mode is configured to be disabled.

[0144] In yet other embodiments, the apparatus further includes a modification module 606 and an installation module 607. The modification module 606 is configured to configure startup security configuration parameters for the virtual machine, wherein the image attributes include: the image firmware type is UEFI, the image machine type is Q35, and the image has TDX encryption enabled. The installation module 607 is configured to install EDK2 and configure the OVMF_CODE.fd file to enable TDX encryption when the virtual machine boots.

[0145] In some further embodiments, the apparatus further includes a determination module 608 and an update module 609. The determination module 608 is configured to determine the rated virtual machine usage on the host machine, and the update module 609 is configured to update the rated virtual machine usage on the host machine.

[0146] In an exemplary embodiment, the present application also provides an electronic device, which may be the virtual machine creation device in the above method embodiment. Figure 7 This is a schematic diagram of the composition of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device may include: a processor 701 and a memory 702; the memory 702 stores instructions executable by the processor 701; when the processor 701 is configured to execute the instructions, the electronic device or network device or manager implements the method described in the aforementioned method embodiment.

[0147] In an exemplary embodiment, the present application also provides a computer-readable storage medium having computer program instructions stored thereon; when the computer program instructions are executed by a computer, the computer implements the method described in the aforementioned embodiment. The computer-readable storage medium can be a non-transitory computer-readable storage medium, for example, a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0148] In an exemplary embodiment, the embodiment of the present application further provides a computer program product, which, when executed on a computer, enables the computer to execute the above-mentioned related method steps to implement the virtual machine creation method in the above-mentioned embodiment.

[0149] The above are only specific embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for creating a virtual machine, characterized in that: Applied to the OpenStack cloud platform; the method includes: Receive a creation request; the creation request is used to request to create a virtual machine on a host machine; Applying for target resources required for running the virtual machine from the host machine based on the creation request when available resources of the host machine meet preset conditions; When the creation request indicates that the type of the virtual machine is an encryption type, obtaining an XML file; the XML file is used to represent the configuration required to create the virtual machine; Configure the startup security configuration parameters in the XML file, and configure the type of the startup security configuration parameters to TDX; The virtual machine is created on the host machine based on the XML file and the target resource.

2. The method according to claim 1, characterized in that The XML file is used to indicate that the boot loader file path of the virtual machine is the location of the UEFI firmware file, the controller configuration of the virtual machine enables the IOMMU function, the network interface configuration of the virtual machine enables the IOMMU function, and disables the ROM function.

3. The method according to claim 1, characterized in that The preset conditions include: available resources of the host machine meet the target resources required for running the virtual machine, and a rated virtual machine usage of the host machine is lower than a preset threshold.

4. The method according to claim 1, wherein The hardware of the host machine is configured to enable Intel's TDX and SGX security functions; QEMU, Kernel, and Libvirt in the software of the host machine are configured as target versions; the target version is used to indicate a version that supports the TDX.

5. The method according to claim 4, characterized in that The hardware configuration of the host machine includes: the full encryption function of memory is configured to be enabled, the bypass mode of memory encryption is configured to be automatic, the multi-tenant function of memory encryption is configured to be enabled, the memory integrity check is configured to be disabled, the TDX is configured to be enabled, the value of Intel TDX key splitting is configured to be non-zero, the SGX is configured to be enabled, the SGX registration server is configured to be automatic, and the delayed authentication mode is configured to be disabled.

6. The method according to claim 2, characterized in that Before receiving the creation request, the method further includes: Modifying the properties of the image to configure the startup security configuration parameters of the virtual machine; the properties of the image include: the firmware type of the image is UEFI, the machine type of the image is Q35, and the image enables TDX encryption; Install EDK2 and configure the OVMF_CODE.fd file to use TDX encryption when the virtual machine is started.

7. The method according to claim 3, characterized in that Before receiving the creation request, the method further includes: Determining the rated virtual machine usage on the host machine; After creating the virtual machine, the method further includes: The rated virtual machine usage in the host machine is updated.

8. A virtual machine creation device, characterized in that: The device includes: a receiving module, an application module, an acquisition module, a configuration module and a creation module; The receiving module is used to receive a creation request; the creation request is used to request to create a virtual machine on the host machine; The application module is configured to apply to the host machine for target resources required for running the virtual machine based on the creation request when the available resources of the host machine meet preset conditions; The acquisition module is used to obtain an XML file when the creation request indicates that the type of the virtual machine is an encryption type; the XML file is used to represent the configuration required to create the virtual machine; The configuration module is used to configure the startup security configuration parameters in the XML file, and configure the type of the startup security configuration parameters to be TDX; The creation module is used to create the virtual machine on the host machine based on the XML file and the target resource.

9. An electronic device, characterized in that: The electronic device includes: a processor and a memory; The memory stores instructions executable by the processor; When the processor is configured to execute the instructions, the electronic device implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium includes: computer software instructions; When the computer software instructions are executed in an electronic device, the electronic device is enabled to implement the method according to any one of claims 1 to 7.

Images