Authentication interaction method, coding network card and virtual machine
By verifying digital certificates and negotiating session keys between the virtual machine and the coded network interface card, the problem of data transmission security in the virtual machine is solved, and full-process security protection for data transmission is achieved.
Patent Information
- Application Number
- CN202511068761.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-31
- Publication Date
- 2025-11-18
AI Technical Summary
In existing technologies, there is a lack of necessary security control measures between virtual machines and encoding network cards, which cannot ensure the security of virtual machine data transmission. In particular, when sending video data outward, the trustworthiness and security of the receiver are not effectively guaranteed.
By implementing digital certificate verification and session key negotiation between the virtual machine and the coded network interface card, the security of data transmission is ensured, including certificate issuer public key verification, temporary session key negotiation, and periodic heartbeat message transmission, so as to achieve normal bidirectional communication link and encrypted protection of data.
It implements secure authentication between the virtual machine and the encoding network card, ensuring the security of data transmission throughout the entire process, preventing data from being illegally received, and providing more comprehensive security protection.
Smart Images
Figure CN120979670A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present disclosure relates to the technical field of authentication interaction, in particular to an authentication interaction method, an encoding network card and a virtual machine. BACKGROUND
[0002] The existing encoding network card (VPU, also known as video processing unit) is inserted on the host in the PCIe mode, has an independent network interface, and is irrelevant to the host itself, thereby realizing network isolation with the host. The virtual machine (VM) runs on the host and communicates with the encoding network card (VPU) through PCIe. This working mode can realize relatively safe transmission effect, but for the communication path between the virtual machine (VM) and the encoding network card (VPU), there is still a lack of necessary security control mode, because: the security requirement of the virtual machine (VM) is higher, and when sending video data outward, how to ensure that the receiving end of the data is trusted and safe is not involved and covered in the prior art. The existing security authentication process only involves S (VPU) and R image receiving end, and does not involve the security interaction authentication between S (VPU) and VM. SUMMARY
[0003] The purpose of the present disclosure is to overcome the deficiencies of the prior art, provide an authentication interaction method, an encoding network card and a virtual machine, and the authentication interaction method can realize security authentication of the virtual machine to the encoding network card, so as to ensure the security of the data transmission of the virtual machine outward, and further realize data full-process security protection.
[0004] According to a first aspect of an embodiment of the present disclosure, an authentication interaction method is provided, applied to an encoding network card, and includes the following steps:
[0005] Obtaining a handshake request sent by a target virtual machine and responding to the handshake request;
[0006] Sending a digital certificate to the target virtual machine, wherein the digital certificate includes at least one of a public key, a certificate issuer and a validity period;
[0007] Indicating the target virtual machine to verify the signature of the digital certificate according to the public key of the certificate issuer;
[0008] Negotiating a temporary session key with the target virtual machine, and sending a handshake packet to the target virtual machine through the session key, so as to establish a connection with the target virtual machine through the handshake packet.
[0009] In one embodiment, the method further includes:
[0010] Heartbeat messages encrypted with the session key are periodically sent to the target virtual machine to ensure normal bidirectional communication between the coded network card and the target virtual machine.
[0011] In one embodiment, the method further includes:
[0012] If the heartbeat message encrypted with the session key is not sent to the target virtual machine periodically, the target virtual machine is instructed to interrupt its connection with the coded network card so that the target virtual machine will no longer send data.
[0013] In one embodiment, the method further includes:
[0014] Record local logs based on the connection information between the encoded network card and the target virtual machine.
[0015] According to a second aspect of the present disclosure, an authentication interaction method is provided, applied to a virtual machine, the method comprising:
[0016] Send a handshake request to the coded network interface card (NIC) and obtain the NIC's response to the handshake request;
[0017] Receive a digital certificate sent by the coded network card, wherein the digital certificate includes at least one of the following: public key, certificate issuer, and validity period;
[0018] Verify the signature of the digital certificate using the public key of the certificate issuer;
[0019] Negotiate a temporary session key with the coded network interface card (NIC), and send a handshake message to the coded NIC using the session key to establish a connection with the coded NIC through the handshake message.
[0020] In one embodiment, the method further includes:
[0021] The heartbeat messages sent by the coded network card are periodically acquired to ensure that the bidirectional communication link between the coded network cards is normal; wherein the heartbeat messages are messages encrypted with the session key.
[0022] In one embodiment, the method further includes:
[0023] If the heartbeat message sent by the coded network card is not received periodically, the connection between the virtual machine and the coded network card will be interrupted and no more data will be sent.
[0024] In one embodiment, the method further includes:
[0025] Record local logs based on the connection information between the virtual machine and the coded network card.
[0026] According to a third aspect of the present disclosure, an coded network interface card (NIC) is provided, the NIC comprising: an acquisition module, a first transmission module, an indication module, and a first negotiation module; wherein...
[0027] The acquisition module is used to acquire the handshake request sent by the target virtual machine and respond to the handshake request;
[0028] The first sending module is used to send a digital certificate to the target virtual machine, wherein the digital certificate includes at least one of a public key, a certificate issuer, and a validity period;
[0029] The instruction module is used to instruct the target virtual machine to verify the signature of the digital certificate based on the public key of the certificate issuer;
[0030] The first negotiation module is used to negotiate a temporary session key with the target virtual machine and send a handshake message to the target virtual machine through the session key to establish a connection with the target virtual machine through the handshake message.
[0031] According to a fourth aspect of the present disclosure, a virtual machine is provided, the virtual machine comprising: a second sending module, a receiving module, a verification module, and a second negotiation module; wherein...
[0032] The second sending module is used to send a handshake request to the coded network interface card (NIC) and obtain the response of the coded network interface card to the handshake request;
[0033] The receiving module is used to receive a digital certificate sent by the coded network card, wherein the digital certificate includes at least one of the following: public key, certificate issuer, and validity period.
[0034] The verification module is used to verify the signature of the digital certificate based on the public key of the certificate issuer;
[0035] The second negotiation module is used to negotiate a temporary session key with the coded network interface card (NIC) and send a handshake message to the coded NIC through the session key to establish a connection with the coded NIC through the handshake message.
[0036] The authentication interaction method provided in this disclosure, based on the existing network isolation mechanism between the virtual machine processor (VPU) and the virtual machine (VM), implements secure authentication based on other data interaction methods, so that the original data is also protected when it is output from the source. This provides more comprehensive security protection for the virtual machine (VM) and the virtual machine processor (VPU), thereby ensuring the security of the external transmission of virtual machine data and achieving full-process data security protection. Attached Figure Description
[0037] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.
[0038] Figure 1 This is a schematic diagram of the structure of an coded network interface card (NIC).
[0039] Figure 2 This is a schematic diagram illustrating the interaction between an coded network interface card (NIC) and a virtual machine in existing technologies.
[0040] Figure 3 This is a schematic diagram illustrating the interaction between the coded network interface card and the virtual machine in this disclosure.
[0041] Figure 4 This is a flowchart of an authentication interaction method provided in an embodiment of the present disclosure.
[0042] Figure 5 This is a flowchart of an authentication interaction method provided in an embodiment of the present disclosure.
[0043] Figure 6 This is an architecture diagram of an coded network interface card provided in an embodiment of this disclosure.
[0044] Figure 7 This is an architecture diagram of a virtual machine provided in an embodiment of this disclosure. Detailed Implementation
[0045] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.
[0046] Figure 1 This is a schematic diagram of the structure of a network interface card (NIC). Figure 1 As shown, the system interface of the coded network interface card (VPU) communicates with the virtual machine (VM) running on the host machine via the system bus, which includes PCIe, ISA, etc. Data is obtained from the VM, encoded by the encoding device in the VPU, and then sent to the receiving end through the network interface on the VPU. Since the network on the VPU is independent of and unrelated to the host machine's network, network isolation is achieved.
[0047] Figure 2 This is a schematic diagram illustrating the interaction between a network interface card (NIC) and a virtual machine in existing technology. For example... Figure 2As shown, the way the coded network interface card (VPU) obtains data from the virtual machine (VM) through the system interface does not have a clear interaction and security authentication method.
[0048] Figure 3 This is a schematic diagram illustrating the interaction between the network interface card (NIC) and the virtual machine in this disclosure. For example... Figure 3 As shown, this disclosure further improves the process by which the coded network interface card (VPU) interacts with the virtual machine (VM) through the system interface, making the scope of security protection more comprehensive.
[0049] It's important to note that during the security authentication process, the virtual machine (VM) primarily needs to verify that the virtual private network interface card (VPU), as the data receiver, is secure and trustworthy. Therefore, the VM acts as the client initiating the authentication, while the VPU acts as the server. The VM's network environment has a certificate authentication server. The certificate used by the VPU can be generated by the VM user, and naturally, the VM user can verify the VPU's certificate.
[0050] Figure 4 This is a flowchart illustrating an authentication interaction method provided in an embodiment of this disclosure. Figure 4 As shown, this method is applied to an coded network interface card (NIC), and includes:
[0051] Step 401: Obtain the handshake request sent by the target virtual machine and respond to the handshake request;
[0052] In this step, the target virtual machine initiates a handshake request, the encoding network card receives the handshake request initiated by the target virtual machine, and responds.
[0053] Step 402: Send the digital certificate to the target virtual machine. The digital certificate includes at least one of the following: public key, certificate issuer, and validity period.
[0054] Step 403: Instruct the target virtual machine to verify the signature of the digital certificate based on the public key of the certificate issuer;
[0055] In this step, the target virtual machine uses the public key issued by the certificate issuer to verify the signature of the certificate sent by the coded network card to ensure the certificate is trustworthy.
[0056] Step 404: Negotiate a temporary session key with the target virtual machine, and send a handshake message to the target virtual machine through the session key to establish a connection with the target virtual machine through the handshake message.
[0057] In this step, the target virtual machine and the coded network interface card negotiate a temporary session key. This session key can be generated by the virtual machine. Both parties use the temporary session key to send a handshake message, such as the string "OK", to ensure that the key is correct. Once the connection handshake is complete, the connection is successfully established. In subsequent operations, all data sent by the target virtual machine to the coded network interface card needs to be encrypted using the session key to prevent the data from being received by a third party.
[0058] It should be noted that there are many algorithms in the prior art that can implement this embodiment, such as the common elliptic curve algorithms ECC / ECDSA / ECDH / Curve25519 / Curve448, etc. Therefore, this embodiment will not be described in detail.
[0059] Optionally, the method further includes:
[0060] Heartbeat messages encrypted with the session key are periodically sent to the target virtual machine to ensure normal bidirectional communication between the coded network card and the target virtual machine.
[0061] In this embodiment, since the main direction of data is from the target virtual machine to the encoding network card, in order to ensure that the bidirectional communication link between the virtual machine and the encoding network card is normal, the encoding network card needs to send heartbeat messages to the target virtual machine periodically, such as once every 5 seconds. Of course, the messages need to be encrypted with the session key.
[0062] Optionally, the method further includes:
[0063] If the heartbeat message encrypted with the session key is not sent to the target virtual machine periodically, the target virtual machine is instructed to interrupt its connection with the coded network card so that the target virtual machine will no longer send data.
[0064] In this embodiment, if the target virtual machine does not receive a valid timed heartbeat message from the coded network card, a timeout will be triggered. At this time, the target virtual machine can terminate the connection at any time to ensure that the data in the coded network card will no longer be sent out, thereby achieving the purpose of data protection.
[0065] Optionally, the method further includes:
[0066] Record local logs based on the connection information between the encoded network card and the target virtual machine.
[0067] In this embodiment, both the target virtual machine and the encoding network card can record local logs for all current connections for subsequent security auditing.
[0068] Figure 5 This is a flowchart illustrating an authentication interaction method provided in an embodiment of this disclosure. Figure 5As shown, this method is applied to a virtual machine and includes:
[0069] Step 501: Send a handshake request to the coded network interface card (NIC) and obtain the NIC's response to the handshake request;
[0070] In this step, the target virtual machine initiates a handshake request, the encoding network card receives the handshake request initiated by the target virtual machine, and responds.
[0071] Step 502: Receive the digital certificate sent by the coded network card, wherein the digital certificate includes at least one of the following: public key, certificate issuer, and validity period;
[0072] Step 503: Verify the signature of the digital certificate using the public key of the certificate issuer;
[0073] In this step, the virtual machine uses the public key issued by the certificate issuer to verify the signature of the certificate sent by the coded network card to ensure the certificate is trustworthy.
[0074] Step 504: Negotiate a temporary session key with the coded network interface card (NIC), and send a handshake message to the coded NIC using the session key to establish a connection with the coded NIC through the handshake message.
[0075] In this step, the virtual machine and the coded network interface card negotiate a temporary session key. This session key can be generated by the virtual machine. Both parties use the temporary session key to send a handshake message, such as the string "OK", to ensure that the key is correct. Once the connection handshake is complete, the connection is successfully established. In subsequent operations, all data sent by the virtual machine to the coded network interface card needs to be encrypted using the session key to prevent the data from being received by a third party.
[0076] It should be noted that there are many algorithms in the prior art that can implement this embodiment, such as the common elliptic curve algorithms ECC / ECDSA / ECDH / Curve25519 / Curve448, etc. Therefore, this embodiment will not be described in detail.
[0077] Optionally, the method further includes:
[0078] The heartbeat messages sent by the coded network card are periodically acquired to ensure that the bidirectional communication link between the coded network cards is normal; wherein the heartbeat messages are messages encrypted with the session key.
[0079] In this embodiment, since the main direction of data is from the target virtual machine to the encoding network card, in order to ensure that the bidirectional communication link between the virtual machine and the encoding network card is normal, the encoding network card needs to send heartbeat messages to the virtual machine periodically, such as once every 5 seconds. Of course, the messages need to be encrypted with the session key.
[0080] Optionally, the method further includes:
[0081] If the heartbeat message sent by the coded network card is not received periodically, the connection between the virtual machine and the coded network card will be interrupted and no more data will be sent.
[0082] In this embodiment, if the virtual machine does not receive a valid timed heartbeat message from the coded network card, a timeout will be triggered. At this time, the virtual machine can terminate the connection at any time to ensure that the data in the coded network card will no longer be sent out, thereby achieving the purpose of data protection.
[0083] Optionally, the method further includes:
[0084] If the heartbeat message sent by the coded network card is not received periodically, the connection between the virtual machine and the coded network card will be interrupted and no more data will be sent.
[0085] In this embodiment, both the virtual machine and the coded network card can record local logs for all current connections for subsequent security auditing.
[0086] The authentication interaction method provided in this disclosure, based on the existing network isolation mechanism between the virtual machine processor (VPU) and the virtual machine (VM), implements secure authentication based on other data interaction methods, so that the original data is also protected when it is output from the source. This provides more comprehensive security protection for the virtual machine (VM) and the virtual machine processor (VPU), thereby ensuring the security of the external transmission of virtual machine data and achieving full-process data security protection.
[0087] Figure 6 This is an architecture diagram of an coded network interface card (NIC) provided in an embodiment of this disclosure. Figure 6 As shown, the coded network interface card includes: an acquisition module 601, a first sending module 602, an instruction module 603, and a first negotiation module 604; wherein, the acquisition module 601 is used to acquire a handshake request sent by the target virtual machine and respond to the handshake request; the first sending module 602 is used to send a digital certificate to the target virtual machine, the digital certificate including at least one of a public key, a certificate issuer, and a validity period; the instruction module 603 is used to instruct the target virtual machine to verify the signature of the digital certificate according to the public key of the certificate issuer; the first negotiation module 604 is used to negotiate a temporary session key with the target virtual machine and send a handshake message to the target virtual machine through the session key to establish a connection with the target virtual machine through the handshake message.
[0088] Figure 7 This is an architecture diagram of a virtual machine provided as an embodiment of this disclosure. (For example...) Figure 7As shown, the virtual machine includes a second sending module 701, a receiving module 702, an authentication module 703, and a second negotiation module 704: the second sending module 701 is used to send a handshake request to the coded network interface card (NIC) and obtain the response of the coded NIC to the handshake request; the receiving module 702 is used to receive a digital certificate sent by the coded NIC, the digital certificate including at least one of a public key, a certificate issuer, and a validity period; the authentication module 703 is used to verify the signature of the digital certificate according to the public key of the certificate issuer; the second negotiation module 704 is used to negotiate a temporary session key with the coded NIC and send a handshake message to the coded NIC through the session key to establish a connection with the coded NIC through the handshake message.
[0089] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0090] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0091] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0092] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0093] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.
[0094] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.
Claims
1. An authentication interaction method, characterized in that, Applied to an coded network interface card, the method includes: Obtain the handshake request sent by the target virtual machine and respond to the handshake request; A digital certificate is sent to the target virtual machine, the digital certificate including at least one of the following: public key, certificate issuer, and validity period; The target virtual machine is instructed to verify the signature of the digital certificate based on the public key of the certificate issuer; Negotiate a temporary session key with the target virtual machine, and send a handshake message to the target virtual machine using the session key to establish a connection with the target virtual machine through the handshake message.
2. The method according to claim 1, characterized in that, The method further includes: Heartbeat messages encrypted with the session key are periodically sent to the target virtual machine to ensure normal bidirectional communication between the coded network card and the target virtual machine.
3. The method according to claim 2, characterized in that, The method further includes: If the heartbeat message encrypted with the session key is not sent to the target virtual machine periodically, the target virtual machine is instructed to interrupt its connection with the coded network card so that the target virtual machine will no longer send data.
4. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Record local logs based on the connection information between the encoded network card and the target virtual machine.
5. An authentication interaction method, characterized in that, Applied to a virtual machine, the method includes: Send a handshake request to the coded network interface card (NIC) and obtain the NIC's response to the handshake request; Receive a digital certificate sent by the coded network card, wherein the digital certificate includes at least one of the following: public key, certificate issuer, and validity period; Verify the signature of the digital certificate using the public key of the certificate issuer; Negotiate a temporary session key with the coded network interface card (NIC), and send a handshake message to the coded NIC using the session key to establish a connection with the coded NIC through the handshake message.
6. The method according to claim 5, characterized in that, The method further includes: The heartbeat messages sent by the coded network card are periodically acquired to ensure that the bidirectional communication link between the coded network cards is normal; wherein the heartbeat messages are messages encrypted with the session key.
7. The method according to claim 5, characterized in that, The method further includes: If the heartbeat message sent by the coded network card is not received periodically, the connection between the virtual machine and the coded network card will be interrupted and no more data will be sent.
8. The method according to any one of claims 5 to 7, characterized in that, The method further includes: Record local logs based on the connection information between the virtual machine and the coded network card.
9. A type of coded network interface card, characterized in that, The coded network interface card includes: an acquisition module, a first transmission module, an indication module, and a first negotiation module; wherein... The acquisition module is used to acquire the handshake request sent by the target virtual machine and respond to the handshake request; The first sending module is used to send a digital certificate to the target virtual machine, wherein the digital certificate includes at least one of a public key, a certificate issuer, and a validity period; The instruction module is used to instruct the target virtual machine to verify the signature of the digital certificate based on the public key of the certificate issuer; The first negotiation module is used to negotiate a temporary session key with the target virtual machine and send a handshake message to the target virtual machine through the session key to establish a connection with the target virtual machine through the handshake message.
10. A virtual machine, characterized in that, The virtual machine includes a second sending module, a receiving module, a verification module, and a second negotiation module; wherein, The second sending module is used to send a handshake request to the coded network interface card (NIC) and obtain the response of the coded network interface card to the handshake request; The receiving module is used to receive a digital certificate sent by the coded network card, wherein the digital certificate includes at least one of the following: public key, certificate issuer, and validity period. The verification module is used to verify the signature of the digital certificate based on the public key of the certificate issuer; The second negotiation module is used to negotiate a temporary session key with the coded network interface card (NIC) and send a handshake message to the coded NIC through the session key to establish a connection with the coded NIC through the handshake message.