Access method and apparatus for virtual machines

Abstract

The present disclosure relates to a method and device for accessing a virtual machine, the method comprising: receiving an access request for a target virtual machine sent by a user terminal; configuring a first dynamic password for the target virtual machine in response to the access request; generating and sending a uniform resource locator (URL) to the user terminal based on the first dynamic password and configuration information of the target virtual machine; receiving a second dynamic password sent by the user terminal, wherein the second dynamic password is obtained by the user terminal based on the URL; comparing the second dynamic password with the first dynamic password; and allowing the user terminal to access the target virtual machine if the second dynamic password is consistent with the first dynamic password.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to methods and apparatus for accessing virtual machines. Background Technology

[0002] As a mainstream open-source cloud computing management platform, OpenStack provides users with services for creating and managing virtual machines. Users can remotely connect to the virtual machine console through a web-based dashboard (Horizon) and using a noVNC client based on the Virtual Network Console (VNC) protocol or a client based on the Simple Protocol for Independent Computing Environment (SPICE) protocol, thereby performing operating system-level management and operation of virtual machines.

[0003] Nova is the Compute Service of the OpenStack project, primarily responsible for the lifecycle management of virtual machine instances and other computing resources. Furthermore, Nova itself does not provide virtualization capabilities; instead, it acts as an orchestration layer that calls the underlying hypervisor to complete the computing services.

[0004] In related technologies, to ensure the security of remote connections, separate Web VNC proxy services (nova-novncproxy), console token authentication services (nova-consoleauth), and Web SPICE proxy services (nova-spicehtml5proxy) have been developed to enable remote console access provided by Nova. These three services work together to achieve secure Web VNC and Web SPICE access. For example, the nova-novncproxy and nova-consoleauth components can be used to restrict remote access permissions using a "proxy + token" model. However, this solution cannot prevent users from accessing the virtual machine's nova / spice console via "physical IP + nova / spice port," thus bypassing the "proxy + token" model provided by nova-novncproxy and nova-consoleauth. This would expose the virtual machine completely without any security protection, resulting in poor security. Summary of the Invention

[0005] This disclosure provides a method and apparatus for accessing virtual machines, in order to at least solve the problem in the aforementioned related technologies where virtual machines are fully exposed without any security protection, resulting in poor security.

[0006] According to a first aspect of the present disclosure, a method for accessing a virtual machine is provided, applied to a server, comprising: receiving an access request for a target virtual machine sent by a user terminal; in response to the access request, configuring a first dynamic password for the target virtual machine; generating and sending a Uniform Resource Locator (URL) to the user terminal based on the first dynamic password and configuration information of the target virtual machine; receiving a second dynamic password sent by the user terminal, wherein the second dynamic password is obtained by the user terminal based on the URL; comparing the second dynamic password with the first dynamic password; and allowing the user terminal to access the target virtual machine if the second dynamic password matches the first dynamic password.

[0007] Optionally, the control node of the server is equipped with an encryption control module, the compute node of the server is equipped with an encryption proxy module, and the network node of the server is equipped with an authentication proxy module; the step of configuring a first dynamic password for the target virtual machine in response to the access request includes: generating the first dynamic password through the encryption control module in the control node and sending the generated first dynamic password to the encryption proxy module in the compute node; configuring the first dynamic password for the target virtual machine through the encryption proxy module in the compute node; the step of generating and sending a Uniform Resource Locator (URL) to the user terminal based on the first dynamic password and the configuration information of the target virtual machine includes: sending the generated first dynamic password to the network node through the encryption control module in the control node; and generating and sending the URL to the user terminal through the authentication proxy module in the network node based on the first dynamic password and the configuration information of the target virtual machine.

[0008] Optionally, comparing the second dynamic password with the first dynamic password includes: reading the first dynamic password from the control node through the authentication proxy module set in the network node, and comparing the first dynamic password read from the control node with the second dynamic password; if the comparison is consistent, reading the first dynamic password from the target virtual machine through the authentication proxy module set in the network node, and comparing the first dynamic password read from the target virtual machine with the second dynamic password.

[0009] Optionally, the method further includes: configuring a dynamic key for the target virtual machine through an encryption proxy module in the computing node, and sending the configuration information of the target virtual machine containing the dynamic key to the control node; sending the configuration information of the target virtual machine containing the dynamic key to the network node through an encryption control module in the control node; before reading the first dynamic password from the target virtual machine through the authentication proxy module set in the network node, the method further includes: reading the dynamic key from the target virtual machine through the authentication proxy module set in the network node, and comparing the read dynamic key with the dynamic key contained in the configuration information of the target virtual machine; if the comparison is consistent, performing the step of reading the first dynamic password from the target virtual machine through the authentication proxy module set in the network node.

[0010] Optionally, it further includes: generating a session token through the network node; generating and sending the URL to the user terminal based on the first dynamic password and the configuration information of the target virtual machine through the authentication proxy module in the network node, including: generating and sending the URL to the user terminal based on the first dynamic password, the configuration information of the target virtual machine, and the session token through the authentication proxy module in the network node; receiving the second dynamic password sent by the user terminal, including: receiving the second dynamic password and the session token sent by the user terminal; reading the first dynamic password from the control node through the authentication proxy module set in the network node, including: reading the first dynamic password from the control node through the authentication proxy module set in the network node if the session token sent by the user terminal has not expired.

[0011] Optionally, after allowing the user terminal to access the target virtual machine, the method further includes: generating an update password; and using the update password to overwrite the first dynamic password.

[0012] Optionally, before receiving the access request for the target virtual machine sent by the user terminal, the method further includes: receiving the startup request for the target virtual machine sent by the user terminal; configuring an initialization password for the target virtual machine in response to the startup request; the configuration of a first dynamic password for the target virtual machine in response to the access request includes: generating and using the first dynamic password to overwrite the initialization password in response to the access request.

[0013] Optionally, the startup request includes the identifier of the target virtual machine and the identifier of the target protocol, wherein the target virtual machine is a virtual machine selected by the user terminal from a plurality of virtual machines included in the server in response to the user's operation, and the target protocol is a protocol selected by the user terminal from a plurality of protocols supported by the virtual machine in response to the user's operation, each of the plurality of protocols corresponding to its own port; the step of generating and sending a Uniform Resource Locator (URL) to the user terminal based on the first dynamic password and the configuration information of the target virtual machine includes: generating and sending the URL to the user terminal based on the first dynamic password, the IP address of the target protocol, and the port number corresponding to the target protocol.

[0014] According to a second aspect of the present disclosure, a virtual machine access device is provided, applied to a server, comprising: an access request receiving module configured to receive an access request for a target virtual machine sent by a user terminal; a dynamic password configuration module configured to configure a first dynamic password for the target virtual machine in response to the access request; a Uniform Resource Locator (URL) generation module configured to generate and send a URL to the user terminal based on the first dynamic password and configuration information of the target virtual machine; a dynamic password receiving module configured to receive a second dynamic password sent by the user terminal, wherein the second dynamic password is obtained by the user terminal based on the URL; a password comparison module configured to compare the second dynamic password with the first dynamic password; and an access permission module configured to allow the user terminal to access the target virtual machine if the second dynamic password matches the first dynamic password.

[0015] Optionally, the control node of the server is equipped with an encryption control module, the compute node of the server is equipped with an encryption proxy module, and the network node of the server is equipped with an authentication proxy module; the dynamic password configuration module is configured to: generate the first dynamic password through the encryption control module in the control node, and send the generated first dynamic password to the encryption proxy module in the compute node; configure the first dynamic password for the target virtual machine through the encryption proxy module in the compute node; the Uniform Resource Locator (URL) generation module is configured to: send the generated first dynamic password to the network node through the encryption control module in the control node; and generate and send the URL to the user terminal based on the first dynamic password and the configuration information of the target virtual machine through the authentication proxy module in the network node.

[0016] Optionally, the password comparison module is configured to: read a first dynamic password from the control node through the authentication proxy module set in the network node, and compare the first dynamic password read from the control node with the second dynamic password; if the comparison is consistent, read the first dynamic password from the target virtual machine through the authentication proxy module set in the network node, and compare the first dynamic password read from the target virtual machine with the second dynamic password.

[0017] Optionally, the access device further includes: a dynamic key configuration module configured to configure a dynamic key for the target virtual machine through an encryption proxy module in the compute node, and send the configuration information of the target virtual machine containing the dynamic key to the control node; a configuration information sending module configured to send the configuration information of the target virtual machine containing the dynamic key to the network node through an encryption control module in the control node; a comparison module configured to read the dynamic key from the target virtual machine through an authentication proxy module set in the network node, and compare the read dynamic key with the dynamic key contained in the configuration information of the target virtual machine; and an execution module configured to, if the comparison is consistent, execute the step of reading the first dynamic password from the target virtual machine through the authentication proxy module set in the network node.

[0018] Optionally, the access device further includes: a session token generation module configured to generate a session token through the network node; a Uniform Resource Locator (URL) generation module configured to generate and send the URL to the user terminal based on the first dynamic password, the configuration information of the target virtual machine, and the session token through an authentication proxy module in the network node; a dynamic password receiving module configured to receive a second dynamic password and a session token sent by the user terminal; and a password comparison module configured to read the first dynamic password from the control node through the authentication proxy module in the network node if the session token sent by the user terminal has not expired.

[0019] Optionally, the access device further includes: an update password generation module configured to generate an update password; and a password overriding module configured to overwrite the first dynamic password with the update password.

[0020] Optionally, the access device further includes: a startup request receiving module configured to receive a startup request for the target virtual machine sent by the user terminal; an initialization password configuration module configured to configure an initialization password for the target virtual machine in response to the startup request; and a dynamic password configuration module configured to generate and overwrite the initialization password using the first dynamic password in response to the access request.

[0021] Optionally, the startup request includes the identifier of the target virtual machine and the identifier of the target protocol, wherein the target virtual machine is the virtual machine selected by the user terminal from a plurality of virtual machines contained in the server in response to the user's operation, and the target protocol is the protocol selected by the user terminal from a plurality of protocols supported by the virtual machine in response to the user's operation, each of the plurality of protocols corresponding to its own port; the Uniform Resource Locator (URL) generation module is configured to generate and send the URL to the user terminal based on the first dynamic password, the IP address of the target protocol, and the port number corresponding to the target protocol.

[0022] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement a virtual machine access method according to the present disclosure.

[0023] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided that, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform an access method for a virtual machine according to the present disclosure.

[0024] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements a virtual machine access method according to the present disclosure.

[0025] The technical solutions provided by the embodiments of this disclosure bring at least the following beneficial effects:

[0026] This disclosure introduces an end-to-end dynamic password authentication and encryption mechanism, adding a security barrier to remote console connections at the protocol level. This ensures that even if an attacker obtains the virtual machine instance's IP address and port number, they cannot establish a console connection without providing the dynamic password. This effectively prevents unauthorized direct access bypassing nova-spicehtml5proxy, nova-novncproxy, and nova-consoleauth. In other words, by introducing dynamic password authentication, this disclosure increases the difficulty for attackers to eavesdrop on or hijack console sessions, thereby effectively reducing the security risks of unauthorized access exposed to the console service.

[0027] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0028] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0029] Figure 1 This is a structural block diagram illustrating an encryption system for a remote console of an OpenStack virtualization instance according to an exemplary embodiment of the present disclosure;

[0030] Figure 2 This is a flowchart illustrating a method for accessing a virtual machine according to an exemplary embodiment of the present disclosure;

[0031] Figure 3 This is a block diagram illustrating an access device for a virtual machine according to an exemplary embodiment of the present disclosure;

[0032] Figure 4 This is a block diagram illustrating an electronic device according to exemplary embodiments of the present disclosure. Detailed Implementation

[0033] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0034] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following examples do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0035] It should be noted that the phrase "at least one of several items" in this disclosure refers to three parallel cases: "any one of the several items", "a combination of any number of the several items", and "all of the several items". For example, "including at least one of A and B" includes the following three parallel cases: (1) including A; (2) including B; (3) including A and B. Another example is "performing at least one of step one and step two", which means the following three parallel cases: (1) performing step one; (2) performing step two; (3) performing both step one and step two.

[0036] Figure 1 This is a structural block diagram illustrating an encryption system for a remote console of an OpenStack virtualization instance according to an exemplary embodiment of this disclosure. (Refer to...) Figure 1 The encryption system provided in this disclosure mainly includes three nodes: a control node, a computing node, and a network node. These three nodes can work together to achieve end-to-end link security. Furthermore, these three nodes refer to a logical division; that is, these three nodes can be located within the same device or on different devices. This disclosure does not impose any specific restrictions on this.

[0037] The following section will explain the structure and function of each node, as well as the data interaction process between the user terminal and each node, and between the nodes themselves.

[0038] Reference Figure 1 First, the access request can be initiated by the user terminal; that is, the device accessing the encrypted system can be a user terminal. For example, a user can initiate an access request to the control node through a browser or client tool within the terminal, which can invoke the virtual machine web console in the control node.

[0039] Next, a dynamic password can be generated through the control node. This control node may include, but is not limited to, a web-based management platform, the nova-api application programming interface, and an encryption control service (also known as an encryption control module). For example, an access request initiated by a user terminal can be routed to the encryption control service via the nova-api to create the current session. The encryption control service can function as a standalone microservice, responsible for managing console session tokens, generating dynamic passwords, coordinating password updates, and can be integrated with existing Nova services.

[0040] It's important to note that the OpenStack Nova component can contain multiple sub-components. For example, it may include, but is not limited to, nova-api, nova-compute, etc. nova-api is an interactive interface that administrators can use to manage internal infrastructure and provide services to users. Furthermore, web-based management also uses this interface to send messages to the message queue, achieving resource scheduling functionality. nova-compute is the virtualization execution engine, providing virtual machine lifecycle management, including but not limited to: creation, startup, stopping, pausing, migration, and destruction. Nova-compute primarily receives requests and performs operations through the message queue and is typically deployed on compute nodes.

[0041] Then, the dynamic password mentioned above can be configured for the target virtual machine through the compute node. This compute node may include, but is not limited to, nova-compute, the encryption proxy module, and the target virtual machine. The encryption proxy module is primarily responsible for interacting with the hypervisor, performing dynamic VNC / SPICE password settings and updates, and exchanging data with the encryption control service. For example, as described earlier, when a user terminal initiates an access request, the encryption control service can generate a dynamic password. Then, the encryption proxy module can be notified via the RPC command nova-compute to configure the dynamic password for the target virtual machine.

[0042] It should be noted that the virtual machine provided in this disclosure supports, but is not limited to, the following protocols: VNC and SPICE. When the user selects the VNC protocol, a kernel-based Virtual Machine (KVM) can be used to execute the virtualization driver; when the user selects the SPICE protocol, the process can be started through the encryption proxy module in the compute node (Quick Emulator, QEMU), and the SPICE password can be dynamically set via command-line parameters. QEMU is open-source processor emulation software, primarily used for operating system and hardware platform simulation.

[0043] Next, the network node can perform verification based on the dynamic password, and the verification result can determine whether to allow service to the user terminal. This network node can contain two types of console agents (also called authentication agent modules): nova-novncproxy and nova-spicehtml5proxy. Nova-novncproxy primarily corresponds to the VNC protocol, while nova-spicehtml5proxy primarily corresponds to the SPICE protocol. The console agent is mainly used to obtain the dynamic password from the encryption control service and automatically complete the VNC / SPICE protocol layer authentication. For example, after obtaining the dynamic password from the encryption control service, the console agent can use this dynamic password and the target virtual machine's configuration information to generate and send a Uniform Resource Locator (URL) to the user terminal. Then, the console agent can also receive the dynamic password sent by the user terminal based on the URL and compare it with the dynamic password previously configured for the target virtual machine. Only if the comparison matches will the user terminal be allowed to access the target virtual machine, i.e., only then will the target virtual machine be allowed to provide service to the user terminal.

[0044] It should be noted that the core components of the encryption system provided in this disclosure can be an encryption control service and an encryption proxy module. By introducing these two core components into the OpenStack architecture and deeply integrating them with the existing console authentication process, dynamic password protection and data encryption for remote connections can be achieved.

[0045] Figure 2 This is a flowchart illustrating a method for accessing a virtual machine according to an exemplary embodiment of the present disclosure, applied to a server.

[0046] Reference Figure 2 In step 201, an access request for the target virtual machine sent by a user terminal can be received.

[0047] In step 202, in response to the access request, a first dynamic password can be configured for the target virtual machine.

[0048] According to an exemplary embodiment of this disclosure, before receiving an access request for the target virtual machine sent by a user terminal, a startup request for the target virtual machine sent by the user terminal may also be received. Then, in response to the startup request, an initialization password can be configured for the target virtual machine. Next, in response to the access request, a first dynamic password can be generated and used to override the aforementioned initialization password.

[0049] It should be noted that the server, in response to a startup request sent by a user terminal for a target virtual machine, can control the virtual machine's startup. Furthermore, refer to... Figure 1 When a virtual machine instance starts, the nova-compute service in the compute node can configure traditional VNC / SPICE parameters, and can also set a strong, random initial password for the virtual machine's VNC / SPICE server by calling Hypervisor instructions (e.g., for configuration of libvirt's Extensible Markup Language, XML). This random initial password, along with the virtual machine's configuration information, can then be sent to the encryption control service for registration and storage.

[0050] It should be noted that since users may not use the virtual machine immediately after starting it, but may wait for a period of time, such as 10 minutes, before using it. Therefore, an initial random password can be configured for the virtual machine when it is started. This initial random password can then be used to provide security protection during the period between the start-up and the use of the virtual machine, thus ensuring the security of the virtual machine during this idle period.

[0051] In step 203, a Uniform Resource Locator (URL) can be generated and sent to the user terminal based on the first dynamic password and the configuration information of the target virtual machine. That is, a URL containing the dynamic password and the configuration information of the target virtual machine can be generated and sent to the user's browser.

[0052] For example, the URL can be, but is not limited to, the following format: https: / / <proxy_host> : <port> / spice_auto.html?token=<encrypted_token> `?password=<......>`. The target virtual machine's configuration information can include `proxy_host` and `port`. `proxy_host` is the IP address of the protocol selected by the user, and `port` is the port corresponding to the selected protocol among multiple ports on the target virtual machine. `token` is the session token generated by the console agent, and `password` is the dynamic password.

[0053] According to an exemplary embodiment of this disclosure, the aforementioned startup request may include an identifier of a target virtual machine and an identifier of a target protocol. The target virtual machine may be a virtual machine selected by the user terminal from a plurality of virtual machines contained in the server in response to a user's operation. The target protocol may be a protocol selected by the user terminal from a plurality of protocols supported by the virtual machine in response to a user's operation, and each of the plurality of protocols may correspond to its own port. For example, in this disclosure, the plurality of protocols may include, but are not limited to, the VNC protocol and the SPICE protocol.

[0054] A URL can be generated and sent to the user terminal based on the first dynamic password, the IP address of the target protocol, and the port number corresponding to the target protocol. As mentioned above, the URL can be, but is not limited to, the following format: https: / / <proxy_host> : <port> / spice_auto.html?token=<encrypted_token> ?password=<......>, where proxy_host is the IP address of the target protocol and port is the port number corresponding to the target protocol.

[0055] In step 204, a second dynamic password sent by the user terminal can be received, wherein the second dynamic password may be obtained by the user terminal based on a URL.

[0056] For example, a user's browser can connect to the console agent via a URL (Web Socket Secure, WSS) and send a dynamic password contained in the URL to the console agent. Additionally, see [link to other documentation]. Figure 1 If the user selects the VNC protocol when starting the virtual machine, the console proxy can be nova-novncproxy; if the user selects the SPICE protocol when starting the virtual machine, the console proxy can be nova-spicehtml5proxy.

[0057] In step 205, the second dynamic password can be compared with the first dynamic password. That is, when the console agent establishes a connection to the VNC / SPICE port of the compute node, it can automatically use a dynamic password for authentication, and this process is completely transparent and imperceptible to the user.

[0058] According to exemplary embodiments of this disclosure, as described above, the server may include a control node, a compute node, and a network node, wherein the compute node may contain a target virtual machine. Furthermore, the control node may contain an encryption control module (also referred to as an encryption control service); the compute node may contain an encryption proxy module; and the network node may contain an authentication proxy module (e.g., but not limited to: nova-novncproxy, nova-spicehtml5proxy).

[0059] A first dynamic password can be generated through the encryption control module configured in the control node, and this generated first dynamic password can be sent to the encryption proxy module configured in the compute node. Then, the encryption proxy module configured in the compute node can configure the first dynamic password for the target virtual machine. For example, when a user requests the console through the HorizonDashboard service, the access request can be routed to the encryption control service. The encryption control service can then generate a dynamic session password, which can be used to replace the target virtual machine's current VNC / SPICE password, i.e., the aforementioned initial random password. For example, refer to... Figure 1 The encryption control service can update the VNC / SPICE password of the target virtual machine to the dynamic password for this session via the encryption agent module on the compute node through a Remote Procedure Call (RPC) instruction.

[0060] The generated first dynamic password can also be sent to the network node via the encryption control module configured in the control node. Next, the authentication proxy module in the network node can generate and send a URL to the user terminal based on the first dynamic password and the target virtual machine's configuration information.

[0061] According to an exemplary embodiment of this disclosure, when the user terminal subsequently accesses the target virtual machine, it can read the first dynamic password from the control node through the authentication proxy module set in the network node, and compare the first dynamic password read from the control node with the second dynamic password. If the comparison matches, the first dynamic password can be read from the target virtual machine through the authentication proxy module set in the network node, and compare the first dynamic password read from the target virtual machine with the second dynamic password.

[0062] It should be noted that by comparing the first dynamic password read from the control node with the second dynamic password sent by the user terminal, it can be verified whether the dynamic password sent by the user terminal was indeed generated by the encryption control service. Subsequent data processing will only proceed after confirming that the dynamic password sent by the user terminal was indeed generated by the encryption control service. This further enhances the security of remote virtual machine connections and reduces the risk of virtual machine exposure.

[0063] According to exemplary embodiments of this disclosure, referring to Figure 1 When a user terminal initiates a boot request for the target virtual machine, a dynamic key can be configured for the target virtual machine through the encryption proxy module in the compute node, and the configuration information of the target virtual machine containing the dynamic key can be sent to the control node. Then, the configuration information of the target virtual machine containing the dynamic key can be sent to the network node through the encryption control module in the control node. When the user terminal actually accesses the target virtual machine subsequently, refer to... Figure 1 The authentication proxy module configured in the network node can read the dynamic key from the target virtual machine and compare it with the dynamic key contained in the target virtual machine's configuration information to obtain the comparison result. If the comparison results match, the step of reading the first dynamic password from the target virtual machine through the authentication proxy module configured in the network node can be executed.

[0064] It's important to note that by comparing the dynamic key read from the target virtual machine with the dynamic key contained in the target virtual machine's configuration information, it's possible to verify whether the currently accessed virtual machine is indeed the one previously started by the user. Subsequent data processing will only proceed once it's confirmed that the currently accessed virtual machine is indeed the one previously started by the user. Thus, by setting dynamic passwords and dynamic keys—that is, by combining dynamic passwords with Transport Layer Security (TLS) / Secure Sockets Layer (SSL) encryption—a double layer of security can be established, further enhancing the security of remote virtual machine connections and reducing the risk of virtual machine exposure.

[0065] According to exemplary embodiments of this disclosure, referring to Figure 1 When the user terminal actually accesses the target virtual machine, a session token can be generated through the network node. Then, the authentication proxy module in the network node can generate and send a URL to the user terminal based on the first dynamic password, the target virtual machine's configuration information, and the session token. Next, it can receive the second dynamic password and session token sent by the user terminal. If the session token sent by the user terminal has not expired, the first dynamic password can be read from the control node through the authentication proxy module configured in the network node. In this way, by setting a session token and only executing the subsequent dynamic password verification process if the session token has not expired, the validity and continuity of the current session can be guaranteed.

[0066] In step 206, if the second dynamic password is consistent with the first dynamic password, that is, if the dynamic password sent by the user terminal is consistent with the dynamic password previously configured for the target virtual machine, the user terminal can be allowed to access the target virtual machine.

[0067] According to an exemplary embodiment of this disclosure, after allowing a user terminal to access the target virtual machine, that is, after providing the target service to the user terminal through the target virtual machine, that is, after the current session ends, or after the current session token expires, an update password can be generated and can be used to overwrite the first dynamic password of the current session.

[0068] For example, after the current console session ends, or after the current session token expires, or at preset intervals, the encryption control service can again instruct the encryption agent module to update the virtual machine's VNC / SPICE password to a new random value.

[0069] It's important to note that if the dynamic password isn't updated after the session ends, the virtual machine could be completely exposed if the original dynamic password is intercepted by a hacker. Therefore, a new dynamic password can be generated and overwritten after the session ends, after the session token expires, or at preset intervals. This ensures the old session dynamic password becomes invalid and guarantees forward security of the dynamic password.

[0070] As mentioned earlier, the protocols supported by the virtual machine in this disclosure may include, but are not limited to, VNC and SPICE protocols. The implementation process of remote virtual machine connections will be described separately for each protocol below.

[0071] 1. VNC encryption implementation based on Libvirt driver:

[0072] Implementation environment preparation: Standard OpenStack Stein version deployment, which can use Libvirt / Kernel-based Virtual Machine (KVM) virtualization driver.

[0073] S1. Virtual Machine Startup Configuration

[0074] When generating Libvirt domain XML, nova-compute adds VNC password configuration:

[0075] xml

[0076] <domain type="kvm">

[0077] # Specify the virtual machine creation type as kvm

[0078] <devices>

[0079] <graphics type="vnc" port="5900" listen="0.0.0.0" passwd="{{dynamic_password}}" / >

[0080] < / devices>

[0081] < / domain>

[0082] Here, {{ dynamic_password}} is a variable generated by the encryption control service and injected through the encryption proxy module.

[0083] S2, Encryption Proxy Module Operation

[0084] The encryption proxy module receives instructions from the encryption control service and dynamically updates the VNC password of the running virtual machine through the Libvirt Python Application Programming Interface (API):

[0085] import libvirt

[0086] def update_vnc_password(instance_name, new_password):

[0087] #Update VNC default password entry

[0088] conn = libvirt.open()

[0089] #Open the libvirt library

[0090] domain = conn.lookupByName(instance_name)

[0091] # Update VNC password via Libvirt API

[0092] domain.updateDeviceFlags(

[0093] " <graphics type="vnc" passwd="%s" / > "% new_password,

[0094] flags=libvirt.VIR_DOMAIN_AFFECT_LIVE )

[0096] #Update the corresponding XML file for the virtual machine

[0097] S3, noVNC agent integration

[0098] Modify nova-novncproxy to obtain and automatically use dynamic passwords from the encryption control service when establishing VNC connections with compute nodes:

[0099] def connect_to_vnc_server(self, host, port, token):

[0100] # 1. Verify the token with the encryption control service and obtain a dynamic password.

[0101] connect_info = encryption_control_service.validate_token(token)

[0102] vnc_password = connect_info['vnc_password']

[0103] # 2. Establish a Transmission Control Protocol (TCP) connection to the VNC server.

[0104] sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

[0105] sock.connect((host, port))

[0106] # 3. Automatically perform VNC password authentication

[0107] # Send VNC protocol handshake and password authentication process

[0108] auth_message = build_vnc_auth_message(vnc_password)

[0109] sock.send(auth_message)

[0110] 2. SPICE Encryption Implementation Based on QEMU Process

[0111] S1, SPICE Server Dynamic Parameter Configuration

[0112] When starting the QEMU process, the encrypted proxy module can dynamically set the SPICE password via command-line parameters or Unix Socket:

[0113] / usr / bin / qemu-system-x86_64 \

[0114] ... \

[0115] -spice port=5900,password-secret=dynamic_spice_password \

[0116] -object secret,id=dynamic_spice_password,data=MySuperSecretPass123!

[0117] S2, Dynamic Password Update

[0118] The encrypted proxy module can update the SPICE password at runtime via the QEMU Monitor Protocol (QMP).

[0119] def update_spice_password(vm_id, new_password):

[0120] qmp_cmd = {

[0121] "execute":"set_password",

[0122] "arguments": {

[0123] "protocol":"spice",

[0124] "password": new_password

[0125] }

[0126] }

[0127] # Update the SPICE protocol password. vm_id is the virtual machine ID, new_password is the new password, and qmp_cmd is the parameter to be filled in for updating the SPICE protocol password. The parameters are in JSON format.

[0128] send_qmp_command(vm_id, qmp_cmd)

[0129] # Send command to KVM to update SPICE password

[0130] S3, Web Integration

[0131] In the web, when the console page loads, a temporary session token can be obtained from the cryptographic control service via JavaScript and embedded into the connection URL of the noVNC / SPICE client, thereby triggering the entire cryptographic authentication process.

[0132] In this disclosure, by dynamically generating, distributing, and updating authentication passwords for the VNC / SPICE server throughout the virtual machine's lifecycle, the difficulty for attackers to eavesdrop on or hijack console sessions is increased, thereby effectively reducing the risk of unauthorized access caused by the VNC / SPICE server being directly exposed to the network. Furthermore, the dynamic password management and authentication processes provided in this disclosure are automatically completed by the system backend, requiring no user to remember or enter any additional passwords. Therefore, it is transparent to the user, resulting in a seamless user experience and reducing operational burden. Additionally, this disclosure is compatible with existing architectures; it can serve as an enhancement plugin for existing OpenStack console architectures without large-scale code refactoring. It can be implemented by adding services and modifying a small amount of agent code, effectively reducing deployment costs and demonstrating good compatibility.

[0133] Figure 3 This is a block diagram illustrating a virtual machine access device 300 according to an exemplary embodiment of the present disclosure, applied to a server.

[0134] Reference Figure 3 The virtual machine access device 300 may include an access request receiving module 301, a dynamic password configuration module 302, a Uniform Resource Locator (URL) generation module 303, a dynamic password receiving module 304, a password comparison module 305, and an access permission module 306.

[0135] The access request receiving module 301 can receive access requests for the target virtual machine sent by the user terminal.

[0136] In response to an access request, the dynamic password configuration module 302 can configure a first dynamic password for the target virtual machine.

[0137] According to an exemplary embodiment of this disclosure, the access device 300 may further include a startup request receiving module and an initialization password configuration module.

[0138] The startup request receiving module can receive a startup request for the target virtual machine sent by the user terminal. Then, in response to the startup request, the initialization password configuration module can configure an initialization password for the target virtual machine. Next, in response to an access request, the dynamic password configuration module 302 can generate and use a first dynamic password to override the aforementioned initialization password.

[0139] The Uniform Resource Locator (URL) generation module 303 can generate and send a URL containing the dynamic password and the configuration information of the target virtual machine to the user terminal based on the first dynamic password and the configuration information of the target virtual machine.

[0140] According to an exemplary embodiment of this disclosure, the aforementioned startup request may include an identifier of a target virtual machine and an identifier of a target protocol. The target virtual machine may be a virtual machine selected by the user terminal from a plurality of virtual machines contained in the server in response to a user's operation. The target protocol may be a protocol selected by the user terminal from a plurality of protocols supported by the virtual machine in response to a user's operation, and each of the plurality of protocols may correspond to its own port. For example, in this disclosure, the plurality of protocols may include, but are not limited to, the VNC protocol and the SPICE protocol.

[0141] The Uniform Resource Locator (URL) generation module 303 can generate and send a URL to the user terminal based on the first dynamic password, the IP address of the target protocol, and the port number corresponding to the target protocol.

[0142] The dynamic password receiving module 304 can receive a second dynamic password sent by the user terminal, wherein the second dynamic password can be obtained by the user terminal based on a URL.

[0143] The password comparison module 305 can compare the second dynamic password with the first dynamic password. That is, when the console agent establishes a connection to the VNC / SPICE port of the compute node, it can automatically use the dynamic password for authentication, and this process is completely transparent and imperceptible to the user.

[0144] According to exemplary embodiments of this disclosure, as described above, the server may include a control node, a compute node, and a network node, wherein the compute node may contain a target virtual machine. Furthermore, the control node may contain an encryption control module (also referred to as an encryption control service); the compute node may contain an encryption proxy module; and the network node may contain an authentication proxy module (e.g., but not limited to: nova-novncproxy, nova-spicehtml5proxy).

[0145] The dynamic password configuration module 302 can generate a first dynamic password through the encryption control module set in the control node, and can send the generated first dynamic password to the encryption proxy module set in the compute node. Then, the dynamic password configuration module 302 can configure the first dynamic password for the target virtual machine through the encryption proxy module set in the compute node.

[0146] The Uniform Resource Locator (URL) generation module 303 can also send the generated first dynamic password to the network node through the encryption control module set in the control node. Next, the URL generated by the URL generated by the URL generated by the authentication proxy module in the network node based on the first dynamic password and the configuration information of the target virtual machine can be sent to the user terminal.

[0147] According to an exemplary embodiment of this disclosure, when the user terminal subsequently accesses the target virtual machine, the password comparison module 305 can read the first dynamic password from the control node through the authentication proxy module set in the network node, and can compare the first dynamic password read from the control node with the second dynamic password. If the comparison matches, the password comparison module 305 can read the first dynamic password from the target virtual machine through the authentication proxy module set in the network node, and can compare the first dynamic password read from the target virtual machine with the second dynamic password.

[0148] According to an exemplary embodiment of this disclosure, the access device 300 may further include a dynamic key configuration module, a configuration information sending module, a comparison module, and an execution module.

[0149] When a user terminal initiates a boot request for the target virtual machine, the dynamic key configuration module can configure a dynamic key for the target virtual machine through the encryption proxy module in the compute node, and can send the configuration information of the target virtual machine containing the dynamic key to the control node. Then, the configuration information sending module can send the configuration information of the target virtual machine containing the dynamic key to the network node through the encryption control module in the control node. When the user terminal actually accesses the target virtual machine later, the comparison module can read the dynamic key from the target virtual machine through the authentication proxy module set in the network node, and compare the read dynamic key with the dynamic key contained in the target virtual machine's configuration information to obtain the comparison result. If the comparison result indicates a match, the execution module can perform the step of reading the first dynamic password from the target virtual machine through the authentication proxy module set in the network node.

[0150] According to an exemplary embodiment of this disclosure, the access device 300 may further include a session token generation module.

[0151] When the user terminal actually accesses the target virtual machine, the session token generation module can also generate a session token through the network node. Then, the Uniform Resource Locator (URL) generation module 303 can generate and send a URL to the user terminal based on the first dynamic password, the target virtual machine's configuration information, and the session token through the authentication proxy module in the network node. Next, the dynamic password receiving module 304 can receive the second dynamic password and the session token sent by the user terminal. If the session token sent by the user terminal has not expired, the password comparison module 305 can read the first dynamic password from the control node through the authentication proxy module set in the network node.

[0152] When the second dynamic password is consistent with the first dynamic password, that is, when the dynamic password sent by the user terminal is consistent with the dynamic password previously configured for the target virtual machine, the access module 306 can allow the user terminal to access the target virtual machine, that is, the target service can be provided to the user terminal through the target virtual machine.

[0153] According to an exemplary embodiment of this disclosure, the access device 300 may further include an update password generation module and a password overwrite module.

[0154] After allowing the user terminal to access the target virtual machine, that is, after providing the target service to the user terminal through the target virtual machine, that is, after the current session ends, or after the current session token expires, the password generation module can generate an update password. Then, the password overriding module can use the update password to overwrite the first dynamic password for this session.

[0155] Figure 4 This is a block diagram illustrating an electronic device 400 according to an exemplary embodiment of the present disclosure.

[0156] Reference Figure 4 The electronic device 400 includes at least one memory 401 and at least one processor 402. The at least one memory 401 stores a set of computer-executable instructions that, when executed by the at least one processor 402, execute a virtual machine access method according to an exemplary embodiment of the present disclosure.

[0157] As an example, electronic device 400 may be a PC, tablet, personal digital assistant, smartphone, or other device capable of executing the aforementioned set of instructions. Here, electronic device 400 is not necessarily a single electronic device, but may be any collection of devices or circuits capable of executing the aforementioned instructions (or instruction sets) individually or in combination. Electronic device 400 may also be part of an integrated control system or system manager, or may be configured to interconnect with a portable electronic device locally or remotely (e.g., via wireless transmission) through an interface.

[0158] In electronic device 400, processor 402 may include a central processing unit (CPU), a graphics processing unit (GPU), a programmable logic device, a dedicated processor system, a microcontroller, or a microprocessor. By way of example and not limitation, processor may also include analog processors, digital processors, microprocessors, multi-core processors, processor arrays, network processors, etc.

[0159] The processor 402 can execute instructions or code stored in the memory 401, which can also store data. Instructions and data can also be sent and received over a network via a network interface device, which can employ any known transmission protocol.

[0160] The memory 401 may be integrated with the processor 402, for example, by placing RAM or flash memory within an integrated circuit microprocessor. Alternatively, the memory 401 may include a separate device, such as an external disk drive, a storage array, or other storage device that can be used by any database system. The memory 401 and the processor 402 may be operatively coupled, or may communicate with each other, for example, via I / O ports, network connections, etc., enabling the processor 402 to read files stored in the memory.

[0161] In addition, the electronic device 400 may also include a video display (such as a liquid crystal display) and a user interaction interface (such as a keyboard, mouse, touch input device, etc.). All components of the electronic device 400 can be interconnected via a bus and / or network.

[0162] According to exemplary embodiments of the present disclosure, a computer-readable storage medium storing instructions may also be provided, wherein when the instructions are executed by at least one processor, they cause at least one processor to perform an access method of a virtual machine according to the present disclosure. Examples of computer-readable storage media herein include: read-only memory (ROM), random access programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), flash memory, non-volatile memory, CD-ROM, CD-R, CD+R, CD-RW, CD+RW, DVD-ROM, DVD-R, DVD+R, DVD-RW, DVD+RW, DVD-RAM, BD-ROM, BD-R, BD-R LTH, BD-RE, Blu-ray or optical disc storage, hard disk drive (HDD), solid-state drive (SSD), card storage (such as multimedia cards, secure digital (SD) cards, or ultra-fast digital (XD) cards), magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid-state drive, and any other device configured to store a computer program and any associated data, data files, and data structures in a non-transitory manner and to provide the computer program and any associated data, data files, and data structures to a processor or computer so that the processor or computer can execute the computer program. The computer program in the aforementioned computer-readable storage medium can run in an environment deployed in computer devices such as clients, hosts, agent devices, servers, etc. Furthermore, in one example, the computer program and any associated data, data files, and data structures are distributed across a networked computer system, such that the computer program and any associated data, data files, and data structures are stored, accessed, and executed in a distributed manner through one or more processors or computers.

[0163] According to exemplary embodiments of the present disclosure, a computer program product may also be provided, wherein the instructions in the computer program product are executable by a processor of a computer device to perform a virtual machine access method according to exemplary embodiments of the present disclosure.

[0164] According to the virtual machine access method and apparatus disclosed herein, by introducing an end-to-end dynamic password authentication and encryption mechanism, a security barrier can be added to remote console connections at the protocol level. This ensures that even if an attacker obtains the IP address and port number of the virtual machine instance, they will still be unable to establish a console connection without providing a dynamic password. This effectively prevents unauthorized direct access bypassing nova-spicehtml5proxy, nova-novncproxy, and nova-consoleauth. In other words, by introducing dynamic password authentication, this disclosure increases the difficulty for attackers to eavesdrop on or hijack console sessions, thereby effectively reducing the security risks of unauthorized access exposed by the console service.

[0165] According to an exemplary embodiment of this disclosure, an initialization random password can be configured for the virtual machine at the same time as it is started. This initialization random password can then be used to provide security protection for the period between the start of the virtual machine and its use, thereby ensuring the security of the virtual machine during its idle period.

[0166] According to an exemplary embodiment of this disclosure, by comparing the dynamic password read from the control node with the dynamic password sent by the user terminal, it can be verified whether the dynamic password sent by the user terminal is indeed a dynamic password generated by the encryption control service. Subsequent data processing will only be executed after it is determined that the dynamic password sent by the user terminal is indeed a dynamic password generated by the encryption control service. This further improves the security of remote virtual machine connections and reduces the risk of virtual machine exposure.

[0167] According to an exemplary embodiment of this disclosure, by setting a session token and only performing the subsequent dynamic password verification process if the session token has not expired, the validity and continuity of the current session can be guaranteed.

[0168] According to an exemplary embodiment of this disclosure, if the dynamic password is not updated after the current session ends, the virtual machine will be completely exposed if the original dynamic password is intercepted by a hacker. Therefore, a new dynamic password can be regenerated and used to overwrite the original dynamic password after the current session ends, after the current session token expires, or at preset intervals, to ensure that the old session dynamic password becomes invalid, thereby ensuring forward security of the dynamic password.

[0169] According to exemplary embodiments of this disclosure, dynamic password management and authentication processes are automatically completed by the system backend, eliminating the need for users to remember or enter any additional passwords. Therefore, this is transparent to users, resulting in a seamless user experience and reducing operational burden. Furthermore, this disclosure is compatible with existing architectures; it can serve as an enhancement plugin for existing OpenStack console architectures without requiring large-scale code refactoring. Instead, it can be implemented by adding services and modifying a small amount of agent code, effectively reducing deployment costs and demonstrating good compatibility.

[0170] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0171] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.< / port> < / port>

Claims

1. A method for accessing a virtual machine, applied to a server, characterized in that, include: Receive access requests for the target virtual machine sent by the user terminal; In response to the access request, a first dynamic password is configured for the target virtual machine; Generate and send a Uniform Resource Locator (URL) to the user terminal based on the first dynamic password and the configuration information of the target virtual machine; The system receives a second dynamic password sent by the user terminal, wherein the second dynamic password is obtained by the user terminal based on the URL. Compare the second dynamic password with the first dynamic password; If the second dynamic password is consistent with the first dynamic password, the user terminal is allowed to access the target virtual machine; The server's control node is equipped with an encryption control module, the server's computing node is equipped with an encryption proxy module, and the server's network node is equipped with an authentication proxy module. The step of configuring a first dynamic password for the target virtual machine in response to the access request includes: The first dynamic password is generated by the encryption control module set in the control node, and the generated first dynamic password is sent to the encryption proxy module set in the computing node; The first dynamic password is configured for the target virtual machine through the encryption proxy module set in the computing node; The step of generating and sending a Uniform Resource Locator (URL) to the user terminal based on the first dynamic password and the configuration information of the target virtual machine includes: The generated first dynamic password is sent to the network node through the encryption control module set in the control node; The authentication proxy module in the network node generates and sends the URL to the user terminal based on the first dynamic password and the configuration information of the target virtual machine.

2. The access method as described in claim 1, characterized in that, The step of comparing the second dynamic password with the first dynamic password includes: The authentication proxy module set in the network node reads the first dynamic password from the control node and compares the first dynamic password read from the control node with the second dynamic password. If the comparison is consistent, the first dynamic password is read from the target virtual machine through the authentication proxy module set in the network node, and the first dynamic password read from the target virtual machine is compared with the second dynamic password.

3. The access method as described in claim 2, characterized in that, Also includes: The encryption proxy module in the computing node configures a dynamic key for the target virtual machine and sends the configuration information of the target virtual machine containing the dynamic key to the control node. The encryption control module in the control node sends the configuration information of the target virtual machine, containing the dynamic key, to the network node; Before reading the first dynamic password from the target virtual machine through the authentication proxy module set in the network node, the method further includes: The authentication proxy module set in the network node reads the dynamic key from the target virtual machine and compares the read dynamic key with the dynamic key contained in the configuration information of the target virtual machine. If the comparison is consistent, the step of reading the first dynamic password from the target virtual machine through the authentication proxy module set in the network node is performed.

4. The access method as described in claim 2, characterized in that, Also includes: A session token is generated through the network node; The step of generating and sending the URL to the user terminal based on the first dynamic password and the configuration information of the target virtual machine through the authentication proxy module in the network node includes: The authentication proxy module in the network node generates and sends the URL to the user terminal based on the first dynamic password, the configuration information of the target virtual machine, and the session token. The step of receiving the second dynamic password sent by the user terminal includes: Receive the second dynamic password and session token sent by the user terminal; The step of reading the first dynamic password from the control node through the authentication proxy module set in the network node includes: If the session token sent by the user terminal has not expired, the first dynamic password is read from the control node through the authentication proxy module set in the network node.

5. The access method as described in claim 1, characterized in that, After allowing the user terminal to access the target virtual machine, the process also includes: Generate an updated password; The updated password is used to overwrite the first dynamic password.

6. The access method as described in claim 1, characterized in that, Before receiving the access request for the target virtual machine sent by the user terminal, it also includes: Receive the startup request for the target virtual machine sent by the user terminal; In response to the startup request, configure an initialization password for the target virtual machine; The step of configuring a first dynamic password for the target virtual machine in response to the access request includes: In response to the access request, the first dynamic password is generated and overridden the initialization password.

7. The access method as described in claim 6, characterized in that, The startup request includes the identifier of the target virtual machine and the identifier of the target protocol, wherein the target virtual machine is the virtual machine selected by the user terminal from a plurality of virtual machines contained in the server in response to the user's operation, and the target protocol is the protocol selected by the user terminal from a plurality of protocols supported by the virtual machine in response to the user's operation, and each of the plurality of protocols corresponds to its own port; The step of generating and sending a Uniform Resource Locator (URL) to the user terminal based on the first dynamic password and the configuration information of the target virtual machine includes: Based on the first dynamic password, the IP address of the target protocol, and the port number corresponding to the target protocol, the URL is generated and sent to the user terminal.

8. A virtual machine access device, applied to a server, characterized in that, include: The access request receiving module is configured to receive access requests for the target virtual machine sent by the user terminal. A dynamic password configuration module is configured to configure a first dynamic password for the target virtual machine in response to the access request. The Uniform Resource Locator (URL) generation module is configured to generate and send a URL to the user terminal based on the first dynamic password and the configuration information of the target virtual machine. A dynamic password receiving module is configured to receive a second dynamic password sent by the user terminal, wherein the second dynamic password is obtained by the user terminal based on the URL; The password comparison module is configured to compare the second dynamic password with the first dynamic password; The access permission module is configured to allow the user terminal to access the target virtual machine if the second dynamic password matches the first dynamic password; The server's control node is equipped with an encryption control module, the server's computing node is equipped with an encryption proxy module, and the server's network node is equipped with an authentication proxy module. The dynamic password configuration module is configured as follows: The first dynamic password is generated by the encryption control module set in the control node, and the generated first dynamic password is sent to the encryption proxy module set in the computing node; The first dynamic password is configured for the target virtual machine through the encryption proxy module set in the computing node; The Uniform Resource Locator (URL) generation module is configured as follows: The generated first dynamic password is sent to the network node through the encryption control module set in the control node; The authentication proxy module in the network node generates and sends the URL to the user terminal based on the first dynamic password and the configuration information of the target virtual machine.

9. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the virtual machine access method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the virtual machine access method as described in any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the virtual machine access method as described in any one of claims 1 to 7.

Images