Method and system for secure control of virtual machine cloning in a cloud server cryptomachine environment

Abstract

The present application relates to the technical field of virtualization security, in particular to a virtual machine cloning security control method and system in a cloud server cryptomachine environment, comprising the following steps: a physical cryptomachine generates a hardware root key pair, a management platform generates an authorization certificate by signing with a root key pair public key, extracts a source marker to construct a unique identifier in combination with a time stamp, calls a private key to encrypt a data block to generate a signature and construct a credential, the cryptomachine decrypts and compares a hash digest by using a public key, divides an independent storage area when consistent, establishes a mapping relationship and returns a resource access handle to a cloned virtual machine. In the present application, a trusted authorization system is established through a hardware root key, a unique identity credential containing a source marker is dynamically constructed, the identity authenticity is ensured through digital signature and hardware level verification, after verification, an independent storage area is forcibly divided, hardware resource physical isolation of cloning and source instance is realized, the risk of unauthorized access is blocked, and the security of cryptographic operation is ensured.

Description

Technical Field

[0001] This invention relates to the field of virtualization security technology, and in particular to a method and system for secure control of virtual machine cloning in a cloud server cryptographic machine environment. Background Technology

[0002] Virtualization security technology involves using software or hardware mechanisms to isolate and protect computing resources, data transmission, and execution processes in a virtualized environment to prevent unauthorized access, data leakage, or malicious tampering, ensuring the integrity and confidentiality of virtual machines. In traditional cloud server cryptographic machine environments, virtual machine cloning security control methods involve the virtualization management platform directly copying the source virtual machine's disk image file and configuration files to the target storage path using snapshot technology or file system copy commands, and assigning a new MAC address to create a cloned virtual machine. During this process, the cloned virtual machine typically directly inherits the source virtual machine's operating system registry configuration, application programming interface handles, and driver settings bound to the physical cryptographic machine board. It continues to use the source virtual machine's key container and encrypted session channel through PCI passthrough or virtual function interfaces without independent identity reset or renegotiation of hardware security module access permissions.

[0003] Traditional virtual machine cloning methods, when involving physical cryptographic machine environments, directly adopt the system configuration and driver state of the source virtual machine. This results in the generated cloned instance completely inheriting the source instance's access permissions to hardware security modules. This full-copy operation mode causes multiple virtual machine instances to share the same key container and encrypted session handle, making it impossible for the physical cryptographic machine to effectively distinguish the source of instructions from different instances. It is difficult to implement fine-grained operation auditing and permission isolation. Once any instance is attacked, attackers can obtain sensitive key information through the shared channel, causing identity confusion and serious data security risks. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a secure control method and system for virtual machine cloning in a cloud server cryptographic machine environment.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a virtual machine cloning security control method in a cloud server cryptographic machine environment, comprising the following steps:

[0006] S1: The physical cryptographic machine generates a hardware root key pair, the virtualization management platform generates a management public key and a management private key and transmits the management public key to the physical cryptographic machine, and uses the hardware root key pair to sign the management public key to generate a platform authorization certificate;

[0007] S2: The virtualization management platform extracts the source mark, combines it with the timestamp to construct a target unique identifier, combines the source mark and the target unique identifier to generate a data block to be signed, calls the management private key to encrypt the data block to be signed to generate digital signature data, and constructs an identity credential containing the data block to be signed and the digital signature data;

[0008] S3: Start the cloned virtual machine and transmit the identity credentials to the physical cryptographic machine. The physical cryptographic machine parses the platform authorization certificate to extract the management public key, uses the management public key to decrypt the digital signature data, hashes the data block to be signed to generate a computation digest, and compares the decrypted data with the computation digest.

[0009] S4: When the comparison is consistent, the physical cryptographic machine divides the independent storage area, establishes a mapping relationship between the target unique identifier and the independent storage area, generates a resource access handle pointing to the independent storage area and returns it to the cloned virtual machine.

[0010] As a further aspect of the present invention, step S1 specifically comprises:

[0011] S11: The physical cryptographic machine calls the internally integrated true random number generator to generate the hardware root key pair containing the hardware root public key and the hardware root private key, stores the hardware root private key in a hardware-protected secure storage area, and broadcasts the hardware root public key to the outside for verification purposes.

[0012] S12: The virtualization management platform generates a key pair containing a management public key and a management private key according to a preset asymmetric encryption algorithm standard, sends the management public key to the physical cryptographic machine through an encrypted communication channel, and stores the management private key in a local secure container.

[0013] S13: The physical cryptographic machine receives the management public key, obtains the hardware serial number and firmware version information of the current device, concatenates the management public key with the hardware serial number, calls the hardware root private key to perform a digital signature operation on the combined data, and generates a platform authorization certificate containing the signature result and public key attribute information.

[0014] As a further aspect of the present invention, step S2 specifically comprises:

[0015] S21: The virtualization management platform obtains the configuration feature hash value of the source virtual machine through the system log interface as the source mark, and reads the high-precision clock cycle number of the current system as the timestamp. The source mark and the timestamp are concatenated at the character level to generate a globally unique target identifier.

[0016] S22: The virtualization management platform uses the source tag as header data and the target unique identifier as payload data, and assembles them according to a predefined binary data packet format to generate a data block to be signed for authentication.

[0017] S23: The virtualization management platform calls the management private key, uses an asymmetric encryption algorithm to perform overall encryption operation on the data block to be signed, generates irreversible digital signature data, and appends the digital signature data to the end of the data block to be signed to encapsulate and obtain an identity credential.

[0018] As a further aspect of the present invention, step S3 specifically comprises:

[0019] S31: During the boot process of the cloned virtual machine, a direct I / O channel is established with the physical cryptographic machine. The identity credentials are injected into the channel and sent to the physical cryptographic machine. The physical cryptographic machine uses the known hardware root public key to verify the platform authorization certificate. After the verification is successful, the management public key is parsed and restored from the platform authorization certificate.

[0020] S32: The physical cryptographic machine uses the parsed management public key to decrypt and restore the digital signature data in the identity credential, obtaining the original plaintext data sequence. At the same time, it uses the same hash algorithm as the encryption end to perform digest calculation on the data block to be signed in the identity credential, generating a computed digest.

[0021] S33: The physical cryptographic machine compares the decrypted plaintext data sequence with the generated computation digest bit by bit, counts the difference in the number of bits between the two, and determines that the comparison result is consistent only when the difference in the number of bits is zero; otherwise, it determines that the verification has failed and triggers a security alarm interruption process.

[0022] As a further aspect of the present invention, step S4 specifically comprises:

[0023] S41: When the comparison results match, the physical cryptographic machine scans the idle state of the internal storage resource pool, locks a continuous physical address space according to the preset security policy, and marks it as an independent storage area that can only be accessed by a specific ID.

[0024] S42: The physical cryptographic machine creates a new entry in the internal security access control table, using the target unique identifier as the index key and the physical starting address and length of the independent storage area as the index value, and establishes a one-to-one mapping relationship between the two.

[0025] S43: The physical cryptographic machine generates a resource access handle containing an encrypted access token and an address offset based on the mapping relationship, and sends the resource access handle back to the operating system kernel of the cloned virtual machine through a secure channel to complete the mounting authorization of the storage resources.

[0026] As a further aspect of the present invention, the process of generating the platform authorization certificate in S13 specifically includes:

[0027] Obtain the binary data stream of the management public key, and use a secure hash algorithm to calculate the integrity check value of the data stream;

[0028] Obtain the hardware serial number of the physical cryptographic machine and the validity period window parameter of the current issuance operation;

[0029] The integrity verification value, the hardware serial number, and the validity period window parameter are concatenated in a predetermined order to form the content to be issued.

[0030] The hardware root private key is used to perform encryption operations on the content to be signed, generating a signature ciphertext. The signature ciphertext and the content to be signed are then encapsulated together to generate a platform authorization certificate.

[0031] As a further aspect of the present invention, the process of constructing the target unique identifier in S21 specifically includes:

[0032] Read the universally unique identifier of the source virtual machine and the task sequence number of the current cloning task;

[0033] Obtain the nanosecond-level timestamp of the current moment of the virtualization management platform and a randomly generated dynamic salt value;

[0034] The universally unique identifier, task serial number, nanosecond-level timestamp, and dynamic salt value are mixed and arranged in order from high byte to low byte.

[0035] An irreversible compression mapping transformation is performed on the mixed data, and the transformed fixed-length string is truncated to generate a unique identifier for the target.

[0036] As a further aspect of the present invention, the specific process of comparing and decrypting the data obtained in S33 and calculating the digest includes:

[0037] The plaintext data sequence obtained from decryption is temporarily stored in the first secure register, and the computation digest generated by hash calculation is temporarily stored in the second secure register.

[0038] The hardware comparator circuit is activated, and data bits in the first and second security registers are read synchronously under the drive of the clock signal;

[0039] Perform bitwise XOR logical operations and accumulate the number of times the XOR operation result is not zero in real time;

[0040] When all data bits have been read and the cumulative count is strictly equal to zero, a matching level signal is output; otherwise, a matching failure level signal is output and a data destruction command is triggered.

[0041] As a further aspect of the present invention, the process of dividing the independent storage area in S41 specifically includes:

[0042] Retrieve a list of unallocated physical blocks in the physical storage medium, and filter out candidate physical blocks that meet the capacity requirements based on the resource request specifications of the cloned virtual machine;

[0043] The hardware-level data erasure logic is activated to write all-zero data or meaningless random noise data into all address units of the selected candidate physical block to cover the historical residual information in that area.

[0044] After the data erasure operation is completed, modify the partition configuration register of the storage controller, set the read and write permission bits of the candidate physical block, and update its status to an allocated and protected independent storage area.

[0045] A virtual machine cloning security control system for a cloud server cryptographic machine environment, the system being used to implement the aforementioned virtual machine cloning security control method for a cloud server cryptographic machine environment, the system comprising:

[0046] The authorization certificate management module is used to control the physical cryptographic machine to generate a hardware root key pair, control the virtualization management platform to generate a management public key and a management private key, coordinate the transmission process of the management public key, and drive the physical cryptographic machine to sign the management public key using the hardware root key pair to generate a platform authorization certificate.

[0047] The identity credential construction module is used to instruct the virtualization management platform to extract the source marker and combine it with the timestamp to construct the target unique identifier, generate a data block to be signed, call the management private key to encrypt and generate digital signature data, and assemble an identity credential containing the data block to be signed and the digital signature data.

[0048] The security verification and analysis module is used to transmit identity credentials when starting the cloned virtual machine, drive the physical cryptographic machine to parse the platform authorization certificate to extract the management public key, perform decryption operations and hash calculations to generate a computation digest, and is responsible for comparing the consistency between the decrypted data and the computation digest.

[0049] The resource isolation mapping module is used to control the physical cryptographic machine to divide an independent storage area in the storage resource pool when the comparison results are consistent, establish a mapping relationship between the target unique identifier and the area, and generate a resource access handle pointing to the area and return it to the cloned virtual machine.

[0050] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0051] In this invention, a trusted authorization system is established through the physical cryptographic machine's hardware root key. During the cloning process, a unique identity credential containing a source marker and timestamp is dynamically constructed. Digital signatures and hardware-level integrity verification ensure the authenticity and uniqueness of the cloned instance's identity. After successful verification, the physical cryptographic machine is forced to allocate an independent storage area and establish a dedicated mapping relationship, thereby achieving physical isolation between the cloned instance and the source instance at the hardware resource level. This prevents the risk of unauthorized access from the shared key container and ensures the security and auditability of cryptographic operations in a virtualized environment. Attached Figure Description

[0052] Figure 1 This is a flowchart of the virtual machine cloning security control method in a cloud server cryptographic machine environment according to the present invention;

[0053] Figure 2 This is a flowchart of the authorization certificate issuance process for the platform of this invention;

[0054] Figure 3 This is a flowchart illustrating the identity credential construction and generation process of the present invention.

[0055] Figure 4 This is a flowchart of the identity credential verification and digest comparison process of the present invention;

[0056] Figure 5 This is a flowchart illustrating the independent storage area partitioning and authorization process of this invention. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this invention clearer, the software-based technical solution is described in detail below with reference to system architecture diagrams and embodiments. It should be understood that the specific embodiments described herein are only for explaining the technical solutions of this invention and do not constitute a limitation on the scope of protection.

[0058] In the description of this invention, the system architecture relationships or data processing flows indicated by terms such as "layer," "module," "interface," "data flow," "client," and "server" are all defined based on the architecture diagram or flowchart corresponding to the embodiments. This way of describing is only used to clearly illustrate the logical relationships between the elements in the technical solution, and not to limit the physical deployment form. The term "multiple" includes two or more technical units, including but not limited to multiple data nodes, processing threads, service instances, or functional components and other scalable elements. The specific number is determined according to the actual business scenario and needs to be specifically specified.

[0059] Please see Figure 1 and Figure 2 This invention provides a technical solution: a virtual machine cloning security control method in a cloud server cryptographic machine environment, comprising the following steps:

[0060] S1: The physical cryptographic machine generates a hardware root key pair, the virtualization management platform generates a management public key and a management private key and transmits the management public key to the physical cryptographic machine, and uses the hardware root key pair to sign the management public key to generate a platform authorization certificate;

[0061] The specific steps of S1 are as follows:

[0062] S11: The physical cryptographic machine calls the internally integrated true random number generator to generate a hardware root key pair containing the hardware root public key and the hardware root private key. The hardware root private key is stored in a hardware-protected secure storage area, and the hardware root public key is broadcast to the outside for verification purposes.

[0063] S12: The virtualization management platform generates a key pair containing a management public key and a management private key according to the preset asymmetric encryption algorithm standard, sends the management public key to the physical cryptographic machine through an encrypted communication channel, and stores the management private key in a local secure container.

[0064] S13: The physical cryptographic machine receives the management public key, obtains the hardware serial number and firmware version information of the current device, concatenates and combines the management public key and the hardware serial number, calls the hardware root private key to perform digital signature operation on the combined data, and generates a platform authorization certificate containing the signature result and public key attribute information.

[0065] The process of generating the S13 platform license certificate specifically includes:

[0066] Obtain the binary data stream of the management public key, and use a secure hash algorithm to calculate the integrity check value of the data stream;

[0067] Obtain the hardware serial number of the physical cryptographic machine and the validity period window parameters of the current issuance operation;

[0068] The integrity check value, hardware serial number, and validity period window parameters are concatenated into the content to be issued in a predetermined order.

[0069] The hardware root private key is used to perform encryption operations on the content to be signed, generating a signature ciphertext. The signature ciphertext and the content to be signed are then encapsulated together to generate a platform authorization certificate.

[0070] In this step, the physical cryptographic machine system first activates its internally integrated true random number generator module, which operates based on the physical entropy source of a thermal noise diode. The system control circuit applies a reverse breakdown voltage to the thermal noise diode, causing it to operate in an avalanche breakdown state. At this time, an analog noise signal with true random characteristics is generated across the diode. The sampling circuit samples this analog noise signal at a high speed of 50 MHz, converting continuous analog voltage fluctuations into the original binary bit stream. Subsequently, the system calls the von Neumann debiasing logic to post-process the original bit stream. For every two bits of data read, if it is 01, it outputs 0; if it is 10, it outputs 1; if it is 00 or 11, it discards them, thereby eliminating bias and generating a high-entropy random seed. Using this random seed, the physical cryptographic machine initializes the elliptic curve parameters according to the national standard SM2 elliptic curve public key cryptography algorithm and performs dot multiplication operations on a finite field to generate a 256-bit hardware root private key and a corresponding hardware root public key. The system immediately writes the generated hardware root private key into a hardware-protected secure storage area with anti-tamper self-destruct capability via a dedicated internal high-speed bus. The physical address mapping of this area is locked by a hardware firewall, preventing direct access by external commands. Simultaneously, the system broadcasts the hardware root public key externally through the management interface for subsequent verification.

[0071] Upon receiving the initialization command, the virtualization management platform allocates a protected encrypted workspace in memory. Based on the RSA asymmetric encryption algorithm standard, with a modulus length of 2048 bits, the platform generates a key pair containing a management public key and a management private key. The system then builds a secure container based on lightweight virtualization locally, writing the generated management private key into the container's isolated storage area using memory encryption technology, ensuring that even if the storage medium is physically read, the plaintext private key cannot be recovered. Next, the virtualization management platform establishes an encrypted communication channel with the physical cryptographic machine via the TLS 1.3 protocol. The platform encapsulates the management public key in an X.509 format certificate request and sends it to the physical cryptographic machine through this channel.

[0072] After receiving the data packet containing the public key through the encrypted communication channel, the physical cryptographic machine first parses the format to extract the binary data stream of the public key. The system then accesses the read-only memory (ROM) of the device's firmware area to read the unique hardware serial number burned at the factory, such as "HSM-CN-2025-9981," and the current firmware version information "V3.5.2." The system reads the current clock information and sets the validity period window parameter for the signing operation, for example, setting the validity period to 31,536,000 seconds (one year). Subsequently, the system performs a concatenation operation, linking the binary data stream of the public key, the ASCII code stream of the hardware serial number, and the numerical stream of the validity period window parameter in the memory buffer, with the public key first, the serial number in the middle, and the time parameter last, forming a continuous block of data to be signed.

[0073] The system invokes a secure hash algorithm (such as the SM3 algorithm) to calculate the digest of the data block to be signed. Specifically, the system groups the data block into 512-bit groups, performs iterative calculations using a compression function, and outputs a 256-bit integrity check value. The system then invokes the hardware root private key stored in a secure storage area to perform a digital signature operation on the integrity check value. During the operation, the system uses an elliptic curve digital signature algorithm, combined with a temporary random number, to encrypt the check value, generating a signature ciphertext containing R and S values. Finally, the system encapsulates the management public key plaintext, hardware serial number, validity period window parameters, integrity check value, and signature ciphertext according to a predefined data structure, adds a header identifier and a tail check bit, and generates the final platform authorization certificate. For example, if the management public key hash value is E1F2... (in hexadecimal), the hardware serial number is 9981, and the signature ciphertext encrypted with the root private key is AABB..., then the certificate payload will contain an ordered set of these data. Table 1 shows an example of the data structure of the generated platform authorization certificate.

[0074] Table 1. Example of Platform Authorization Certificate Data Structure

[0075]

[0076] Please see Figure 1 and Figure 3 S2: The virtualization management platform extracts the source mark, combines it with the timestamp to construct the target unique identifier, combines the source mark and the target unique identifier to generate a data block to be signed, calls the management private key to encrypt the data block to be signed to generate digital signature data, and constructs an identity credential containing the data block to be signed and the digital signature data.

[0077] The specific steps of S2 are as follows:

[0078] S21: The virtualization management platform obtains the configuration feature hash value of the source virtual machine through the system log interface as the source mark, and reads the high-precision clock cycle number of the current system as the timestamp. The source mark and the timestamp are concatenated at the character level to generate a globally unique target identifier.

[0079] The process of constructing the target unique identifier for S21 specifically includes:

[0080] Read the universally unique identifier of the source virtual machine and the task sequence number of the current clone task;

[0081] Obtain the current nanosecond-level timestamp of the virtualization management platform and a randomly generated dynamic salt value;

[0082] The universally unique identifier, task serial number, nanosecond-level timestamp, and dynamic salt value are mixed and arranged in order from high byte to low byte.

[0083] Perform an irreversible compression mapping transformation on the mixed data, extract the transformed fixed-length string, and generate a unique identifier for the target.

[0084] S22: The virtualization management platform uses the source tag as header data and the target unique identifier as payload data, and assembles them according to a predefined binary data packet format to generate a data block to be signed for authentication.

[0085] S23: The virtualization management platform calls the management private key, uses an asymmetric encryption algorithm to perform overall encryption operation on the data block to be signed, generates irreversible digital signature data, appends the digital signature data to the end of the data block to be signed, and encapsulates it to obtain the identity credential.

[0086] The virtualization management platform first accesses the source virtual machine's configuration database through a standard system log interface to read the source virtual machine's CPU architecture, memory allocation, and disk volume label information. The system converts this configuration data into a string format and inputs it into the SHA-256 hashing module to calculate a 64-character hexadecimal hash value, which is defined as the source identifier. For example, if the source virtual machine is configured as "4 cores and 8GB of memory," the first 8 bits of the hashed source identifier would be "a1b2c3d4". Simultaneously, the system accesses the high-precision event timer on the motherboard to read the current nanosecond-level timestamp. Assuming the current time is December 11, 2025, at 10:30:00, the converted nanosecond-level timestamp value is 1765410600000000000. After converting the source identifier and timestamp value into a string, the system performs character-level concatenation, directly appending the timestamp string to the end of the source identifier string to generate a globally unique basic identifier string.

[0087] During the construction of the target unique identifier, the system further reads the Universally Unique Identifier (UUID) of the source virtual machine, such as "550e8400-e29b-41d4-a716-446655440000", and the current cloned task's serial number in the task queue, such as "Task-8848". The system then obtains the current nanosecond-level timestamp and calls a pseudo-random number generator to generate a 32-bit dynamic salt value, such as "9527". The system performs a mixed permutation operation, specifically: dividing the UUID into four equal segments, truncating the nanosecond-level timestamp into high and low bits, and using the task serial number as a separator. The system reassembles the UUID in the following order: "UUID first segment + timestamp high bit + Task serial number + UUID second segment + dynamic salt value + UUID third segment + timestamp low bit + UUID fourth segment". Subsequently, the system performs an irreversible compression mapping transformation on this long string. The transformation logic is as follows: for every four characters read from the string, their ASCII code values ​​are accumulated, and then the accumulated result is modulo 62. Based on the modulo value, a corresponding character is selected from the character set "0-9, az, AZ". After processing the entire string, the first 32 characters after transformation are extracted to generate the final unique identifier.

[0088] The virtualization management platform then uses the previously generated 64-character source tag as the header data and the 32-character target unique identifier as the payload data. The system assembles the data according to a predefined binary packet format, first writing a 4-byte header identifier, then the source tag data, followed by a 4-byte delimiter, and finally the target unique identifier data. This assembly process constructs a contiguous block of data to be signed in memory. For example, if the header data is "a1b2..." and the payload data is "Xy9Z...", the assembled data block appears as a continuous binary stream in memory.

[0089] After assembling the data block, the virtualization management platform invokes the management private key stored in the secure container. The system employs the RSA-2048 asymmetric encryption algorithm, using the aforementioned data block to be signed in memory as input for overall encryption. During the operation, the system first pads the data block to be signed to meet the block length requirements of the encryption algorithm. Then, it performs modular exponentiation using the private key to generate an irreversible digital signature of 256 bytes. The system appends this digital signature directly to the end of the data block to be signed using binary appending. Finally, the system adds a checksum and a tail identifier to the entire data, encapsulating it to obtain a complete identity credential. This identity credential contains not only plaintext identification information but also an unforgeable encrypted signature for subsequent authentication.

[0090] Please see Figure 1 and Figure 4 S3: Start the cloned virtual machine and transfer the identity credentials to the physical cryptographic machine. The physical cryptographic machine parses the platform authorization certificate to extract the management public key, uses the management public key to decrypt the digital signature data, hashes the data block to be signed to generate a computation digest, and compares the decrypted data with the computation digest.

[0091] The specific steps for S3 are as follows:

[0092] S31: During the boot process of the cloned virtual machine, a direct I / O channel is established with the physical cryptographic machine. The identity credentials are injected into this channel and sent to the physical cryptographic machine. The physical cryptographic machine uses the known hardware root public key to verify the platform authorization certificate. After the verification is successful, the management public key is parsed and restored from the platform authorization certificate.

[0093] S32: The physical cryptographic machine uses the management public key obtained from the parsing to decrypt and restore the digital signature data in the identity credential, obtaining the original plaintext data sequence. At the same time, it uses the same hash algorithm as the encryption end to perform digest calculation on the data block to be signed in the identity credential, generating a computed digest.

[0094] S33: The physical cryptographic machine compares the decrypted plaintext data sequence with the generated computation digest bit by bit, counts the number of differences between the two, and determines that the comparison result is consistent only when the number of differences is zero; otherwise, it determines that the verification has failed and triggers a security alarm interruption process.

[0095] The specific process of comparing and decrypting the data obtained from S33 and calculating the digest includes:

[0096] The plaintext data sequence obtained from decryption is temporarily stored in the first secure register, and the computation digest generated by hash calculation is temporarily stored in the second secure register.

[0097] The hardware comparator circuit is activated, and data bits in the first and second security registers are read synchronously under the drive of the clock signal;

[0098] Perform bitwise XOR logical operations and accumulate the number of times the XOR operation result is not zero in real time;

[0099] When all data bits have been read and the cumulative count is strictly equal to zero, a matching level signal is output; otherwise, a matching failure level signal is output and a data destruction command is triggered.

[0100] When the cloned virtual machine completes the basic kernel loading and enters the boot phase, the hypervisor intercepts its I / O requests and establishes a direct I / O channel connecting the virtual machine's memory space and the physical cryptographic machine interface via PCI passthrough technology. The cloned virtual machine writes the identity credential data packet generated in step S2 into the transmit buffer of this channel. The physical cryptographic machine reads this data packet through direct memory access (DMA) mechanism. The physical cryptographic machine first uses the known, previously broadcast hardware root public key to verify the platform authorization certificate submitted or pre-stored along with the credentials. The verification process involves using the hardware root public key to decrypt the digital signature ciphertext in the certificate, obtaining the decrypted verification value, and comparing it with the hash value of the certificate content calculated on-site. If the verification is successful, it indicates that the certificate was indeed issued by a legitimate physical cryptographic machine and has not been tampered with. The physical cryptographic machine then parses and restores the binary data of the management public key from the certificate according to the data structure shown in Table 1.

[0101] The physical cryptographic machine uses the parsed management public key to decrypt and restore the digital signature data at the end of the identity credential. The system reads the 256 bytes of digital signature data into the decryption engine, performs RSA decryption using the management public key, removes padding bits, and restores the original plaintext data sequence. Theoretically, this sequence should be completely identical to the data block to be signed in the credential. Simultaneously, the physical cryptographic machine extracts the data block to be signed from the plaintext portion of the identity credential (containing the source marker and target unique identifier) ​​and sends it to a hardware hash accelerator. The accelerator uses the SHA-256 algorithm, identical to that used in the encryption process, to perform high-speed digest calculation on the data block, generating a 256-bit computed digest.

[0102] Subsequently, the physical cryptographic machine enters the crucial comparison phase. The system temporarily stores the decrypted plaintext data sequence (i.e., the restored value of the original digest) in the first secure register (RegisterA) and the computed digest generated by the hardware hash accelerator in the second secure register (RegisterB). Both registers are 256 bits wide. The system activates the hardware comparator circuit, which mainly consists of 256 parallel XOR gates and subsequent accumulators. Driven by the clock signal, the system synchronously reads the data bits at corresponding positions in registers A and B. Bit 0 is entered into the first XOR gate, bit 1 into the second XOR gate, and so on. If the two input bits are the same (both 0 or both 1), the XOR gate outputs logic 0; if they are different, it outputs logic 1.

[0103] The system collects the outputs of all 256 XOR gates in real time and feeds them into an adder counter for accumulation. This accumulation operation is completed within one clock cycle. All XOR gates output 0, and the accumulator's final result is 0, only if every bit in register A and register B is identical. After all data bits are compared, the system checks the accumulator's value. If the accumulation count is strictly zero, the hardware comparator outputs a high-level signal, indicating a successful comparison. If the accumulation count is greater than zero, it indicates that the data has been tampered with or the signature forged during transmission; the hardware comparator outputs a low-level signal, indicating a failed verification. In this case, the system immediately triggers a security interrupt, sends an alarm code to the management console, sends a forced shutdown command to the cloned virtual machine, and executes a data destruction command to clear sensitive data in the relevant registers. Table 2 shows the register states and logic outputs of the hardware comparator under different comparison conditions.

[0104] Table 2 Hardware Comparator Logic State Snapshot Table

[0105]

[0106] Please see Figure 1 and Figure 5 S4: When the comparison is consistent, the physical cryptographic machine divides the independent storage area, establishes the mapping relationship between the target unique identifier and the independent storage area, generates a resource access handle pointing to the independent storage area and returns it to the clone virtual machine;

[0107] The specific steps for S4 are as follows:

[0108] S41: When the comparison results match, the physical cryptographic machine scans the idle status of the internal storage resource pool, locks a continuous physical address space according to the preset security policy, and marks it as an independent storage area that can only be accessed by a specific ID.

[0109] The process of S41 dividing the storage area into independent regions specifically includes:

[0110] Retrieve a list of unallocated physical blocks in the physical storage medium and filter candidate physical blocks that meet the capacity requirements based on the resource request specifications of the cloned virtual machine;

[0111] The hardware-level data erasure logic is activated to write all-zero data or meaningless random noise data into all address units of the selected candidate physical block to cover the historical residual information in that area.

[0112] After the data erasure operation is completed, modify the partition configuration register of the storage controller, set the read and write permission bits of the candidate physical block, and update its status to an allocated and protected independent storage area.

[0113] S42: The physical cryptographic machine creates a new entry in the internal security access control table, using the target unique identifier as the index key and the physical starting address and length of the independent storage area as the index value, to establish a one-to-one mapping relationship between the two.

[0114] S43: The physical cryptographic machine generates a resource access handle containing an encrypted access token and an address offset based on the mapping relationship, and sends the resource access handle back to the operating system kernel of the cloned virtual machine through a secure channel to complete the mounting authorization of the storage resource.

[0115] Once the hardware comparator outputs a high-level signal indicating a match, the physical cryptographic machine initiates the storage resource allocation process. The system first scans the status bitmap of the internal storage resource pool, where each bit corresponds to a 4KB physical block in the physical storage medium. The system searches for regions with a bit value of 0 (representing free space) and, based on the resource request specifications pre-declared by the cloned virtual machine (e.g., requesting 1GB of dedicated secure storage space), selects a contiguous list of physical blocks. Assume the system selects the address space range with physical page numbers from 0x1000 to 0x10FF as candidate physical blocks.

[0116] The system immediately initiates hardware-level data erasure logic, which bypasses the operating system's file system and operates directly on the physical media. The erasure process consists of three phases: the first phase writes all zeros (0x00) to all address units of the selected candidate physical blocks; the second phase writes all ones (0xFF); and the third phase writes meaningless random noise data generated by a true random number generator. This process aims to completely cover any historical residual information that may exist in the area, preventing data leakage caused by residual magnetism. After completing the three rounds of data erasure operations, the system sends an instruction to the partition configuration register of the storage controller to lock the address range of physical page numbers 0x1000 to 0x10FF, sets its read / write permission bit to "authorized access only," and updates its status bit to "allocated and protected," thereby defining an independent storage area at the hardware physical level.

[0117] Subsequently, the physical cryptographic machine creates a new entry in the security access control table maintained in its internally protected static random access memory (SRAM). The system uses the target unique identifier (e.g., "Xy9Z...") generated in step S2 as the index key and the physical starting address (0x1000) and length (256 pages) of the independent storage area as the index value. The system uses a hash mapping algorithm to map the index key to a specific row in the storage table and writes the index value, thus establishing a one-to-one mapping between the target unique identifier and the independent storage area. Table 3 illustrates the mapping structure in the security access control table.

[0118] Table 3 Mapping Relationship of Independent Storage Areas

[0119]

[0120] Finally, the physical cryptographic machine generates a resource access handle based on the above mapping relationship. The system obtains the current session key, combines the target unique identifier with the physical starting address, and calculates an encrypted access token using the HMAC-SHA256 algorithm. Simultaneously, the system calculates the address offset of this independent storage area relative to the storage base address. The system encapsulates the encrypted access token, address offset, and allowed access opcodes into a 128-bit resource access handle. The physical cryptographic machine sends this resource access handle back to the operating system kernel of the cloned virtual machine through the previously established secure channel. After receiving the handle, the virtual machine kernel registers it to the file system mount point, completing the mounting authorization of the storage resource. Thereafter, any read / write request from the cloned virtual machine to this area must include this handle in the instruction. The physical cryptographic machine hardware will verify the validity of the handle in real time, ensuring that only the virtual machine possessing the handle can access the corresponding independent storage area.

[0121] A virtual machine cloning security control system for a cloud server cryptographic machine environment, the system being used to execute the aforementioned virtual machine cloning security control method for a cloud server cryptographic machine environment, the system comprising:

[0122] The authorization certificate management module is used to control the physical cryptographic machine to generate hardware root key pairs, control the virtualization management platform to generate management public keys and management private keys, coordinate the transmission process of management public keys, and drive the physical cryptographic machine to sign the management public keys using hardware root key pairs to generate platform authorization certificates.

[0123] The identity credential construction module is used to instruct the virtualization management platform to extract the source mark and combine it with the timestamp to construct the target unique identifier, combine them to generate a data block to be signed, call the management private key to encrypt and generate digital signature data, and assemble an identity credential containing the data block to be signed and the digital signature data.

[0124] The security verification and analysis module is used to transmit identity credentials when starting the cloned virtual machine, drive the physical cryptographic machine to parse the platform's authorization certificate to extract the management public key, perform decryption operations and hash calculations to generate a computation digest, and is responsible for comparing the consistency between the decrypted data and the computation digest.

[0125] The resource isolation mapping module is used to control the physical cryptographic machine to divide an independent storage area in the storage resource pool when the comparison results are consistent, establish a mapping relationship between the target unique identifier and the area, and generate a resource access handle pointing to the area and return it to the cloned virtual machine.

[0126] The above embodiments illustrate preferred embodiments of the present invention. Any equivalent adjustments to the technical solution based on software engineering methods are within the scope of protection, including but not limited to: implementing algorithm logic using different programming languages, refactoring functional modules into services, adjusting data interaction protocols, and optimizing resource scheduling strategies. Any implementation scheme derived from reasonable modifications to the data processing flow, service call chain, or system architecture layer without departing from the core technology of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A method for secure control of virtual machine cloning in a cloud server cryptographic machine environment, characterized in that, Includes the following steps: S1: The physical cryptographic machine generates a hardware root key pair, the virtualization management platform generates a management public key and a management private key and transmits the management public key to the physical cryptographic machine, and uses the hardware root key pair to sign the management public key to generate a platform authorization certificate; S2: The virtualization management platform extracts the source mark, combines it with the timestamp to construct a target unique identifier, combines the source mark and the target unique identifier to generate a data block to be signed, calls the management private key to encrypt the data block to be signed to generate digital signature data, and constructs an identity credential containing the data block to be signed and the digital signature data; S3: Start the cloned virtual machine and transmit the identity credentials to the physical cryptographic machine. The physical cryptographic machine parses the platform authorization certificate to extract the management public key, uses the management public key to decrypt the digital signature data, hashes the data block to be signed to generate a computation digest, and compares the decrypted data with the computation digest. S4: When the comparison is consistent, the physical cryptographic machine divides the independent storage area, establishes a mapping relationship between the target unique identifier and the independent storage area, generates a resource access handle pointing to the independent storage area and returns it to the cloned virtual machine.

2. The virtual machine cloning security control method in a cloud server cryptographic machine environment according to claim 1, characterized in that, The specific steps of S1 are as follows: S11: The physical cryptographic machine calls the internally integrated true random number generator to generate the hardware root key pair containing the hardware root public key and the hardware root private key, stores the hardware root private key in a hardware-protected secure storage area, and broadcasts the hardware root public key to the outside for verification purposes. S12: The virtualization management platform generates a key pair containing a management public key and a management private key according to a preset asymmetric encryption algorithm standard, sends the management public key to the physical cryptographic machine through an encrypted communication channel, and stores the management private key in a local secure container. S13: The physical cryptographic machine receives the management public key, obtains the hardware serial number and firmware version information of the current device, concatenates the management public key with the hardware serial number, calls the hardware root private key to perform a digital signature operation on the combined data, and generates a platform authorization certificate containing the signature result and public key attribute information.

3. The virtual machine cloning security control method in a cloud server cryptographic machine environment according to claim 1, characterized in that, The specific steps of S2 are as follows: S21: The virtualization management platform obtains the configuration feature hash value of the source virtual machine through the system log interface as the source mark, and reads the high-precision clock cycle number of the current system as the timestamp. The source mark and the timestamp are concatenated at the character level to generate a globally unique target identifier. S22: The virtualization management platform uses the source tag as header data and the target unique identifier as payload data, and assembles them according to a predefined binary data packet format to generate a data block to be signed for authentication. S23: The virtualization management platform calls the management private key, uses an asymmetric encryption algorithm to perform overall encryption operation on the data block to be signed, generates irreversible digital signature data, and appends the digital signature data to the end of the data block to be signed to encapsulate and obtain an identity credential.

4. The virtual machine cloning security control method in a cloud server cryptographic machine environment according to claim 1, characterized in that, The specific steps in S3 are as follows: S31: During the boot process of the cloned virtual machine, a direct I / O channel is established with the physical cryptographic machine. The identity credentials are injected into the channel and sent to the physical cryptographic machine. The physical cryptographic machine uses the known hardware root public key to verify the platform authorization certificate. After the verification is successful, the management public key is parsed and restored from the platform authorization certificate. S32: The physical cryptographic machine uses the parsed management public key to decrypt and restore the digital signature data in the identity credential, obtaining the original plaintext data sequence. At the same time, it uses the same hash algorithm as the encryption end to perform digest calculation on the data block to be signed in the identity credential, generating a computed digest. S33: The physical cryptographic machine compares the decrypted plaintext data sequence with the generated computation digest bit by bit, counts the difference in the number of bits between the two, and determines that the comparison result is consistent only when the difference in the number of bits is zero; otherwise, it determines that the verification has failed and triggers a security alarm interruption process.

5. The virtual machine cloning security control method in a cloud server cryptographic machine environment according to claim 1, characterized in that, The specific steps of S4 are as follows: S41: When the comparison results match, the physical cryptographic machine scans the idle state of the internal storage resource pool, locks a continuous physical address space according to the preset security policy, and marks it as an independent storage area that can only be accessed by a specific ID. S42: The physical cryptographic machine creates a new entry in the internal security access control table, using the target unique identifier as the index key and the physical starting address and length of the independent storage area as the index value, and establishes a one-to-one mapping relationship between the two. S43: The physical cryptographic machine generates a resource access handle containing an encrypted access token and an address offset based on the mapping relationship, and sends the resource access handle back to the operating system kernel of the cloned virtual machine through a secure channel to complete the mounting authorization of the storage resources.

6. The virtual machine cloning security control method in a cloud server cryptographic machine environment according to claim 2, characterized in that, The process of generating the platform authorization certificate in S13 specifically includes: Obtain the binary data stream of the management public key, and use a secure hash algorithm to calculate the integrity check value of the data stream; Obtain the hardware serial number of the physical cryptographic machine and the validity period window parameter of the current issuance operation; The integrity verification value, the hardware serial number, and the validity period window parameter are concatenated in a predetermined order to form the content to be issued. The hardware root private key is used to perform encryption operations on the content to be signed, generating a signature ciphertext. The signature ciphertext and the content to be signed are then encapsulated together to generate a platform authorization certificate.

7. The virtual machine cloning security control method in a cloud server cryptographic machine environment according to claim 3, characterized in that, The process of constructing the target unique identifier in S21 specifically includes: Read the universally unique identifier of the source virtual machine and the task sequence number of the current cloning task; Obtain the nanosecond-level timestamp of the current moment of the virtualization management platform and a randomly generated dynamic salt value; The universally unique identifier, task serial number, nanosecond-level timestamp, and dynamic salt value are mixed and arranged in order from high byte to low byte. An irreversible compression mapping transformation is performed on the mixed data, and the transformed fixed-length string is truncated to generate a unique identifier for the target.

8. The virtual machine cloning security control method in a cloud server cryptographic machine environment according to claim 4, characterized in that, The specific process of S33 includes: The plaintext data sequence obtained from decryption is temporarily stored in the first secure register, and the computation digest generated by hash calculation is temporarily stored in the second secure register. The hardware comparator circuit is activated, and data bits in the first and second security registers are read synchronously under the drive of the clock signal; Perform bitwise XOR logical operations and accumulate the number of times the XOR operation result is not zero in real time; When all data bits have been read and the cumulative count is strictly equal to zero, a matching level signal is output; otherwise, a matching failure level signal is output and a data destruction command is triggered.

9. The virtual machine cloning security control method in a cloud server cryptographic machine environment according to claim 5, characterized in that, The process of dividing the independent storage area in S41 specifically includes: Retrieve a list of unallocated physical blocks in the physical storage medium, and filter out candidate physical blocks that meet the capacity requirements based on the resource request specifications of the cloned virtual machine; The hardware-level data erasure logic is activated to write all-zero data or meaningless random noise data into all address units of the selected candidate physical block to cover the historical residual information in that area. After the data erasure operation is completed, modify the partition configuration register of the storage controller, set the read and write permission bits of the candidate physical block, and update its status to an allocated and protected independent storage area.

10. A virtual machine cloning security control system in a cloud server cryptographic machine environment, characterized in that, The system is used to implement the virtual machine cloning security control method in a cloud server cryptographic machine environment as described in any one of claims 1-9, and the system includes: The authorization certificate management module is used to control the physical cryptographic machine to generate a hardware root key pair, control the virtualization management platform to generate a management public key and a management private key, coordinate the transmission process of the management public key, and drive the physical cryptographic machine to sign the management public key using the hardware root key pair to generate a platform authorization certificate. The identity credential construction module is used to instruct the virtualization management platform to extract the source marker and combine it with the timestamp to construct the target unique identifier, generate a data block to be signed, call the management private key to encrypt and generate digital signature data, and assemble an identity credential containing the data block to be signed and the digital signature data. The security verification and analysis module is used to transmit identity credentials when starting the cloned virtual machine, drive the physical cryptographic machine to parse the platform authorization certificate to extract the management public key, perform decryption operations and hash calculations to generate a computation digest, and is responsible for comparing the consistency between the decrypted data and the computation digest. The resource isolation mapping module is used to control the physical cryptographic machine to divide an independent storage area in the storage resource pool when the comparison results are consistent, establish a mapping relationship between the target unique identifier and the area, and generate a resource access handle pointing to the area and return it to the cloned virtual machine.

Images