Virtual machine key management method and device, equipment, storage medium and program product

Abstract

The invention provides a virtual machine key management method and device, equipment, a storage medium and a program product, and relates to the technical field of information security, the method comprises the following steps: constructing a security state vector of a virtual machine based on state information of the virtual machine; key derivation is carried out based on a root key of a host machine where the virtual machine is located, the identity label of the virtual machine, the security state vector and the system time, and a master key of the virtual machine is generated; and performing key derivation based on the master key, the context information of the virtual machine, the random number and the system time, and generating a session key of the virtual machine. According to the method, multilevel dynamic key derivation is realized by constructing the security state vector of the virtual machine, so that the binding of the key with the identity, the real-time running state and the physical environment of the virtual machine is completed, the rigidity and lag risks caused by long-term fixed use of a static key are overcome, the self-adaption to the dynamic life cycle of the virtual machine is realized, and the dynamic life cycle of the virtual machine is improved. And finally, key isolation management is realized.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a virtual machine key management method, apparatus, device, storage medium, and program product. Background Technology

[0002] In cloud computing environments, multiple isolated virtual machines (VMs) are typically run on a single physical server using a hypervisor. To ensure the confidentiality of data within each VM, encryption and effective key isolation are usually required.

[0003] Currently, virtual machine key isolation methods mainly include: static key isolation, which generates a long-term unchanging key based on a fixed virtual machine identifier (such as a Universally Unique Identifier, UUID), but cannot adapt to dynamic scenarios such as virtual machine configuration changes or migrations; hardware-level isolation, which relies on a specific CPU (Central Processing Unit) to extend hardware-level encrypted memory, but suffers from strong hardware dependency and limited protection scope; and access control-based isolation, which controls key access through hypervisor permission policies, but its security depends entirely on the integrity of the hypervisor.

[0004] The methods described above are insufficient for adaptive management of keys in dynamic virtual machine environments, and are prone to causing key update delays or residual risks. Therefore, there is an urgent need for an isolation method that can adapt to the dynamic characteristics of virtualization environments and achieve intelligent key management. Summary of the Invention

[0005] This application provides a virtual machine key management method, apparatus, device, storage medium, and program product to address the shortcomings of existing technologies in dynamic virtualization environments, where key management is static and rigid and cannot adapt to changes in the virtual machine's operating environment, thereby achieving adaptive virtualization environment dynamic characteristics and key isolation management.

[0006] This application provides a virtual machine key management method, including the following steps: Based on the virtual machine's state information, construct the virtual machine's security state vector; The master key of the virtual machine is generated by key derivation based on the root key of the source host machine where the virtual machine is located, the identity identifier of the virtual machine, the security state vector, and the system time; Based on the master key, the virtual machine's context information, a random number, and the system time, a key derivation is performed to generate the virtual machine's session key.

[0007] According to the virtual machine key management method provided in this application, the step of generating the master key of the virtual machine by key derivation based on the root key of the source host machine where the virtual machine is located, the identity identifier of the virtual machine, the security state vector, and the system time includes: The identity identifier, the security state vector, and the system time are combined to obtain the first combined data; The master key of the virtual machine is generated based on the root key of the source host machine and the first combined data.

[0008] According to the virtual machine key management method provided in this application, the step of generating a session key for the virtual machine based on the master key, the context information of the virtual machine, a random number, and the system time includes: The context information, the random number, and the system time are combined to form the second combined data; The session key is generated based on the master key and the second combined data.

[0009] According to the virtual machine key management method provided in this application, the status information includes at least one of hardware status information, software status information, and runtime status information; the step of constructing a security state vector of the virtual machine based on the virtual machine's status information includes: Collect the status information of the virtual machine; The collected state information is concatenated and combined, and a hash operation is performed on the concatenated and combined data to generate the security state vector.

[0010] According to the virtual machine key management method provided in this application, the security state vector is updated based on at least one of the following methods: The security state vector is updated based on the periodically collected state information; If a configuration change event or security policy event is detected in the virtual machine, the security state vector is updated based on the re-collected state information.

[0011] According to the virtual machine key management method provided in this application, the virtual machine key management method further includes: Calculate the similarity between the security state vector of the virtual machine and the security state baseline of the virtual machine; If the similarity is less than the security state threshold of the virtual machine, the security state vector is updated to the new security state baseline of the virtual machine, and the master key and the session key are re-derived; The security status threshold is obtained by adjusting based on the historical security events of the virtual machine.

[0012] This application provides a virtual machine key management method, including the following steps: A migration temporary key is generated based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine resides, and the identification information of the source host machine; the virtual machine's master key is derived from the root key of the source host machine, the virtual machine's identity and security state vector, and the system time. During the virtual machine migration process, the transmission encryption key is updated based on the migration temporary key, the security state vector of the virtual machine, and real-time information representing the migration progress. After the virtual machine migration is completed, a new master key for the virtual machine on the target host is generated based on the root key of the target host, the baseline state information of the target host, and the migration completion time.

[0013] According to the virtual machine key management method provided in this application, the baseline state information of the source host machine includes at least one of the hardware characteristics of the source host machine, the running snapshot of the virtual machine, and the migration startup time; The process of generating a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine resides, and the identification information of the source host machine includes: The baseline state information of the source host machine and the identification information are combined to obtain source-end combined data; The migration temporary key is generated based on the master key and the source-end combined data.

[0014] According to the virtual machine key management method provided in this application, the real-time information representing the migration progress includes the amount of data successfully transferred and the time elapsed since the migration started; The step of updating the transmission encryption key based on the migration temporary key, the virtual machine's security state vector, and real-time information representing the migration progress includes: The security state vector of the virtual machine is combined with the real-time information representing the migration progress to obtain combined migration process data; A new transmission encryption key is generated based on the migration temporary key and the migration process combination data.

[0015] According to the virtual machine key management method provided in this application, the baseline state information of the target host machine includes the hardware characteristics of the target host machine and the running state information of the virtual machine after migration; The process of generating a new master key for the virtual machine on the target host based on the root key of the target host, the baseline state information of the target host, and the migration completion time includes: The baseline state information of the target host machine is combined with the migration completion time to obtain the target end combined data; The new master key is generated based on the root key of the target host machine and the combined data of the target end.

[0016] This application also provides a virtual machine key management device, including the following modules: A security state vector construction module is used to construct the security state vector of the virtual machine based on the virtual machine's state information; The first key derivation module is used to derive the master key of the virtual machine based on the root key of the source host machine where the virtual machine is located, the identity identifier of the virtual machine, the security state vector, and the system time. The second key derivation module is used to derive a key based on the master key, the context information of the virtual machine, a random number, and the system time, and generate a session key for the virtual machine.

[0017] This application also provides a virtual machine key management device, including the following modules: The migration temporary key generation module is used to generate a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine resides, and the identification information of the source host machine; the virtual machine's master key is derived from the root key of the source host machine, the virtual machine's identity identifier and security state vector, and the system time. The transmission encryption key update module is used to update the transmission encryption key based on the migration temporary key, the security state vector of the virtual machine, and real-time information representing the migration progress during the virtual machine migration process. The master key update module is used to generate a new master key for the virtual machine on the target host machine after the virtual machine migration is completed, based on the root key of the target host machine where the virtual machine is located, the baseline state information of the target host machine, and the migration completion time.

[0018] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the virtual machine key management methods described above.

[0019] This application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the virtual machine key management method as described above.

[0020] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the virtual machine key management methods described above.

[0021] The virtual machine key management method, apparatus, device, storage medium, and program product provided in this application construct a security state vector for the virtual machine based on its state information; generate a master key for the virtual machine by derivation based on the root key of the host machine, the identity identifier of the virtual machine, the security state vector, and the system time; and generate a session key for the virtual machine by derivation based on the master key, the context information of the virtual machine, a random number, and the system time. This application achieves multi-level dynamic key derivation by constructing a multi-dimensional security state vector for the virtual machine, thereby completing a deep dynamic binding between the key and the virtual machine's identity, real-time operating status, and physical environment. This overcomes the rigidity and lag risks caused by static keys due to long-term fixed use, achieves adaptation to the dynamic lifecycle of the virtual machine, and ultimately realizes key isolation management. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is one of the flowcharts illustrating the virtual machine key management method provided in this application.

[0024] Figure 2 This is the second flowchart of the virtual machine key management method provided in this application.

[0025] Figure 3 This is a schematic diagram of the key security mechanism for virtual machine migration provided in this application.

[0026] Figure 4 This is a schematic diagram of the architecture of the virtual machine key management system provided in this application.

[0027] Figure 5 This is one of the structural schematic diagrams of the virtual machine key management device provided in this application.

[0028] Figure 6 This is the second schematic diagram of the virtual machine key management device provided in this application.

[0029] Figure 7 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] The following is combined Figures 1-7 This application describes a virtual machine key management method, apparatus, device, storage medium, and program product.

[0032] Figure 1 This is one of the flowcharts illustrating the virtual machine key management method provided in this application, such as... Figure 1 As shown, the method includes: Step 101: Construct the security state vector of the virtual machine based on the virtual machine's state information.

[0033] It should be understood that status information includes at least one of hardware status information, software status information, and runtime status information. Hardware status information characterizes the computing, storage, or network resource configuration of the virtual machine; hardware status information may include CPU model, memory configuration, storage device UUID, etc. Software status information characterizes the integrity of the operating system or applications running within the virtual machine; software status information may include operating system version, security patches, a list of installed software, etc. Runtime environment information characterizes the physical host environment in which the virtual machine resides and its relationships with surrounding virtual machines; runtime environment information may include a list of active processes, network connections, resource usage, etc.

[0034] Collect virtual machine status information, concatenate and combine the collected status information, and perform hash operation on the concatenated and combined data to generate a security status vector.

[0035] Step 102: Based on the root key of the source host machine where the virtual machine is located, the identity identifier of the virtual machine, the security state vector, and the system time, key derivation is performed to generate the master key of the virtual machine.

[0036] The root key of the source host machine refers to a high-level, long-term valid master key generated, stored, and protected by the Hardware Security Module (HSM) of the source physical host machine. The virtual machine's identity is a universally unique identifier for the virtual machine, or a globally unique identifier assigned by the virtualization management platform at creation. The system time is the current system timestamp. The virtual machine's master key is a core encryption key generated for a specific virtual machine and valid for a period of time.

[0037] The root key of the source host machine, the identity of the virtual machine, the security state vector, and the system time are used to generate the master key of the virtual machine through a key derivation function.

[0038] Step 103: Based on the master key, the context information of the virtual machine, the random number, and the system time, perform key derivation to generate the session key of the virtual machine.

[0039] Context information is used to uniquely identify the target and type of the current encryption operation, and includes at least one of the following: an operation type identifier, indicating whether the operation is data reading, data writing, or network communication; and a resource target identifier, indicating the logical address of the data block accessed, the file path, or the five-tuple information of the network session. The random number is a random value generated on-the-fly by a cryptographically secure pseudo-random number generator before key derivation. The session key is a symmetric encryption key that is discarded after use and is used only to encrypt or decrypt a single data unit associated with the context information.

[0040] The master key, the context information of the current virtual machine operation, the random number, and the system time are used to generate the session key for the virtual machine to use for this encryption operation through the key derivation function.

[0041] The virtual machine key management method provided in this application constructs a security state vector for the virtual machine based on its state information; it then performs key derivation based on the root key of the host machine, the virtual machine's identity identifier, the security state vector, and the system time to generate the virtual machine's master key; finally, it performs key derivation based on the master key, the virtual machine's context information, a random number, and the system time to generate the virtual machine's session key. This application achieves multi-level dynamic key derivation by constructing a multi-dimensional security state vector for the virtual machine, thereby completing a deep dynamic binding between the key and the virtual machine's identity, real-time operating status, and physical environment. This overcomes the rigidity and lag risks caused by static keys due to long-term fixed use, achieves adaptation to the dynamic lifecycle of the virtual machine, and ultimately realizes key isolation management.

[0042] Based on the above embodiments, the step of generating the master key of the virtual machine by key derivation based on the root key of the source host machine where the virtual machine resides, the identity identifier of the virtual machine, the security state vector, and the system time includes: The identity identifier, the security state vector, and the system time are combined to obtain the first combined data; The master key of the virtual machine is generated based on the root key of the source host machine and the first combined data.

[0043] Key derivation functions can be hash-based message authentication code key derivation functions, cryptographic key derivation functions, etc.

[0044] Following a preset first field order, the virtual machine's identity identifier, security state vector, and system time are concatenated to form a first raw string. A cryptographic hash operation is then performed on this first raw string, and the resulting hash value is used as the first combined data. The preset first field order can be the concatenation of identity identifier, security state vector, and system time sequentially.

[0045] The root key is used as the key material input for the key derivation function, and the first combination of data is used as the other parameters input for the key derivation function. The key derivation function is executed, and the virtual machine's master key is output.

[0046] In one embodiment, the master key is calculated as follows: ; in, This serves as the identity identifier for the virtual machine. For the security state vector of the virtual machine, For system time, Accurate to the second, ensuring that the same virtual machine can be derived at different times of the second. Unlike other methods, even if the security state vector remains unchanged, the key can be automatically updated over time, improving forward security. For string concatenation; This is a key derivation function that takes dp as input, derivation parameters as input, and outputs the derived key key. This is a hash function. The input parameter is data, which is the data to be hashed. The output is the hash value of the data data.

[0047] This application embodiment cryptographically binds the identity, state, and time of a virtual machine and combines them with a hardware root of trust to derive a key. The above binding and derivation mechanism achieves deep coupling between the master key and the real-time running environment of the virtual machine, ensuring cryptographic identity isolation between different virtual machines, while also being able to respond in real time to changes in the virtual machine's own state.

[0048] Based on the above embodiments, the step of generating a session key for the virtual machine by key derivation based on the master key, the virtual machine's context information, a random number, and the system time includes: The context information, the random number, and the system time are combined to form the second combined data; The session key is generated based on the master key and the second combined data.

[0049] Following a preset second field order, the virtual machine's context information, random number, and system time are concatenated to form a second raw string. A cryptographic hash operation is then performed on this second raw string, and the resulting hash value is used as the second combined data. The preset second field order can be context information, random number, and system time concatenated sequentially.

[0050] The master key is used as the key material input for the key derivation function, and the second combination data is used as the application context information input for the key derivation function. The key derivation function is then executed, and the session key is output.

[0051] In one embodiment, the session key is calculated as follows: ; in, For session key, This includes virtual machine context information, such as operation type (read / write), resource identifier, etc. Use a random number to ensure the uniqueness of the session key for each session.

[0052] This application embodiment binds specific operation context, cryptographic random numbers, and time to form a derived input, and then combines it with the virtual machine's master key to generate a session key, thereby achieving operation-level encrypted isolation within the virtual machine. This effectively resists data penetration and replay attacks between different tasks within the same virtual machine, providing fine-grained forward security protection for data flow within the virtual machine.

[0053] Based on the above embodiments, constructing the security state vector of the virtual machine based on the virtual machine's state information includes: Collect the status information of the virtual machine; The collected state information is concatenated and combined, and a hash operation is performed on the concatenated and combined data to generate the security state vector.

[0054] Collect virtual machine status information. For example, through a collection module deployed on the host machine or virtual machine monitor, hardware status information, software status information, and runtime status information of the virtual machine can be obtained from the virtualization management interface and the virtual machine itself. The collection module can obtain status information through at least one of the following methods: calling the application programming interface provided by the virtualization management platform; reading information reported by the guest agent program installed within the virtual machine; or parsing the performance monitoring counters and event logs provided by the virtual machine monitor.

[0055] The collection of virtual machine status information can be performed based on at least one of the following triggering conditions: periodic timed collection; event-driven collection in response to changes in virtual machine configuration; event-driven collection in response to receiving security alarms or key update instructions.

[0056] Before concatenation, the collected state information from each dimension undergoes standardized preprocessing. For example, all non-text information (such as numerical values ​​and enumeration values) is converted to UTF-8 encoded strings; list-type data (such as disk UUID lists and patch lists) is sorted (e.g., alphabetically) and then connected using predefined delimiters (such as semicolons); if the collected information contains timestamps, they are converted to a standard format (such as ISO 8601). The standardized preprocessed state information is then concatenated and combined, and a cryptographic hash function is applied to the resulting string to generate a fixed-length, irreversible secure state vector.

[0057] In one embodiment, the security state vector of a virtual machine is derived from multiple dimensions, including the virtual machine's hardware state, software state, and runtime state. Calculation composition: ; in, For the security state vector of the virtual machine, For hardware status information, This is software status information. This is the running status information.

[0058] This application embodiment collects multi-dimensional state information of the virtual machine and performs standardized concatenation and cryptographic hashing to transform dynamic and heterogeneous runtime data into a secure state vector. This vector serves as the input for key derivation, ensuring a deep dynamic binding between the key and the real-time state of the virtual machine, thus overcoming the lag of static keys.

[0059] Based on the above embodiments, the security state vector is updated in at least one of the following ways: The security state vector is updated based on the periodically collected state information; If a configuration change event or security policy event is detected in the virtual machine, the security state vector is updated based on the re-collected state information.

[0060] It should be understood that configuration change events are authorized operations initiated by administrators or automated operation and maintenance platforms that alter the static resource specifications or system composition of virtual machines. Configuration change events include adjustments to compute resources, changes to storage resources, network configuration updates, and software version upgrades.

[0061] Security policy events are anomalies or alerts detected by security monitoring systems that indicate a potential deviation from the security baseline or a threat to the virtual machine's operational status. These events include abnormal process startups and unusual behavior.

[0062] The system presets a fixed time interval (e.g., T=5 minutes) as the update cycle for the security state vector. This cycle can be configured in the management interface, and different cycles can be set for virtual machines with different security levels. In the security state vector management module, an independent timer is maintained for each virtual machine, starting from the completion of the last vector generation or update. When the timer reaches the preset cycle T, a new round of state information collection is triggered, and the security state vector is updated based on the newly collected state information.

[0063] Upon detecting a configuration change event or security policy event in a virtual machine, the security state vector is updated based on the re-collected state information. For example, in response to detecting a triggering event, the periodic update process of the virtual machine is interrupted; the virtual machine's state information is immediately re-collected, and a new security state vector is calculated and generated based on the re-collected state information to replace the old vector.

[0064] In one embodiment, the system establishes a two-layer event monitoring system to capture triggering conditions in real time. The configuration change event monitoring layer is directly hooked into the event bus of the virtualization management platform, monitoring specific types of virtual machine configuration change events. The security policy event monitoring layer interfaces with the alarm output of the security information and event management system, intrusion detection system, or host security agent, receiving security alarms of preset levels. Once an event is captured and verified, the system immediately interrupts the current task and executes the following process: confirming the authenticity of the event and obtaining the event context, temporarily freezing the use of the virtual machine's current security state vector (to prevent key inconsistencies during the update process). Simultaneously, a high-priority state information collection task is triggered to immediately and completely re-collect the virtual machine's state. For configuration change events, the collection focuses on verifying whether the change has taken effect; for security events, the collection will additionally include in-depth information such as alarm-related processes and network connections. Using the latest collected state information, a new security state vector is quickly generated through an optimized hash calculation module. The old vector is replaced with the new vector using atomic operations. After the vector update is successful, a vector update event is immediately sent to the key management module, which will automatically trigger a master key re-derivation process. After the update is complete, reset the virtual machine's periodic update timer. Simultaneously, record the complete process of this event-triggered update (event type, old vector, new vector, timestamp) in the security audit log.

[0065] In one embodiment, the security state vector of the virtual machine is updated using a dual mechanism of "periodic + event-triggered": it is sampled periodically every 5 minutes by default; if a configuration change (such as memory expansion, system patch update) or security event (such as abnormal process startup) occurs, the update is triggered immediately to ensure that the security state vector reflects the current security state of the virtual machine in real time.

[0066] This application's embodiments introduce a dual-modal update mechanism to achieve intelligent dynamic management of the security state vector, enabling precise adaptation of the key to the virtual machine's real-time state and overcoming the lag of static updates.

[0067] Based on the above embodiments, the virtual machine key management method further includes: Calculate the similarity between the security state vector of the virtual machine and the security state baseline of the virtual machine; If the similarity is less than the security state threshold of the virtual machine, the security state vector is updated to the new security state baseline of the virtual machine, and the master key and the session key are re-derived; wherein, the security state threshold is obtained by adjusting based on the historical security events of the virtual machine.

[0068] The security state baseline refers to the historical security state vector recorded by the system and used as a comparison benchmark. The security state threshold is a dynamically adjusted value based on the frequency or severity of historical security events occurring in the virtual machine, used to determine whether the current security state vector has changed compared to the security state baseline, requiring a key update. Dynamically adjusting the security state threshold includes: lowering the security state threshold in response to a security event detected within a preset historical time period; and raising the security state threshold in response to no security events detected within the preset historical time period.

[0069] The current safety state vector and the safety state baseline are obtained. A scalar value representing the degree of consistency between the two is calculated and output as the similarity score using a predetermined vector similarity measurement algorithm. The predetermined vector similarity measurement algorithm can be a cosine similarity algorithm, where the similarity score is the cosine angle between the current safety state vector and the safety state baseline.

[0070] When the similarity is less than the virtual machine's security state threshold, it indicates that the current virtual machine's operating state has undergone a significant abnormal change beyond the system's tolerance range compared to its accepted normal baseline. When the judgment condition is met, the current security state vector is written to the storage location corresponding to the security state baseline, completing the baseline replacement; the virtual machine's master key re-derivation process is triggered; all session keys derived from the old master key are discarded, and the session key re-derivation process is triggered. After completing the security state baseline update and key re-derivation, the timer used to trigger the periodic update of the security state vector is reset.

[0071] In one embodiment, the master key of the virtual machine is determined based on the virtual machine's state transitions. The method for performing dynamic updates is as follows: The host machine maintains the security state baseline of the virtual machine. (A fixed value for the first time); Threshold for the host machine to maintain the security state of virtual machines. (A default value, such as 0.7), the security status threshold can be dynamically adjusted based on historical security events. For example, if the virtual machine has experienced more than two security events (such as abnormal processes or unauthorized access) in the past 30 days, the security status threshold will be automatically reduced by 20%; if there are no security events for a long period of time, the security status threshold will be increased by 10%.

[0072] The host machine monitors the virtual machine and collects the virtual machine's current security state vector in real time. The host machine performs differential calculations. ,in, This is a similarity calculation function. When... At this time, the host machine performs the following operations on the virtual machine: generates a new virtual machine security principal baseline. ; Regenerate the virtual machine's master key Update all based on virtual machine session key .

[0073] This application embodiment compares the virtual machine status with the security baseline in real time. When a significant anomaly is detected, it automatically triggers a security baseline reset and a key system synchronization and rotation, thereby achieving millisecond-level adaptation of security policies and operating environment. It transforms status monitoring into proactive cryptographic defense and constructs an intelligent key management system that can dynamically isolate.

[0074] Figure 2 This is the second flowchart illustrating the virtual machine key management method provided in this application, as shown below. Figure 2 As shown, the method includes: Step 201: Generate a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine is located, and the identification information of the source host machine.

[0075] It should be understood that the virtual machine's master key is derived from the root key of the source host, the virtual machine's identity and security state vector, and the system time.

[0076] The baseline state information of the source host machine refers to the set of states collected and solidified at the moment the migration event is triggered, which is used to uniquely represent the startup context of the migration. It may include at least one of the following: hardware characteristics of the source host machine (such as CPU model and memory configuration), current running snapshot of the virtual machine (such as active processes and network connections), and migration startup time.

[0077] A virtual machine's identity is a logical identifier used to uniquely identify the source host machine at the network or management level.

[0078] A migration temporary key is a short-term, valid encryption key generated specifically for a single virtual machine migration session.

[0079] The migration temporary key is generated by using a key derivation function, taking the virtual machine's master key, the baseline state information of the source host machine where the virtual machine resides, and the identification information of the source host machine.

[0080] Step 202: During the virtual machine migration process, the transmission encryption key is updated based on the migration temporary key, the security state vector of the virtual machine, and real-time information representing the migration progress.

[0081] Real-time information characterizing migration progress refers to a set of dynamic parameters continuously collected during the virtual machine migration data transfer phase to quantify the current execution status of the migration operation. This may include the amount of data successfully transferred (the total amount of data successfully transferred so far (e.g., bytes), or the number of memory pages / disk blocks transferred) and the time elapsed since the migration started. In one embodiment, the real-time information characterizing migration progress may also include load status metrics, i.e., real-time performance indicators of the virtual machine during the migration process, such as dirty page rate, CPU utilization, and network throughput; and checkpoint identifiers, i.e., the logical stage or checkpoint number to which the current transfer belongs.

[0082] A migration temporary key is a session key used to encrypt the migration data stream in real time during the migration data transmission phase.

[0083] The migration temporary key, the virtual machine's security state vector, and real-time information representing the migration progress are used to generate a new transmission encryption key through a key derivation function.

[0084] Step 203: After the virtual machine migration is completed, a new master key for the virtual machine on the target host is generated based on the root key of the target host where the virtual machine is located, the baseline state information of the target host, and the migration completion time.

[0085] The baseline state information of the target host machine refers to the set of states collected and solidified at the moment when the virtual machine resumes operation on the target host machine and the migration is declared complete. These states are used to characterize the new operating environment of the target end and may include the hardware characteristics of the target host machine and the operating state information of the virtual machine after migration.

[0086] Using the root key of the target host machine, the baseline state information of the target host machine, and the migration completion time, a new master key for the virtual machine on the target host machine is generated through a key derivation function.

[0087] The virtual machine key management method provided in this application generates a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine, and the identification information of the source host machine. The virtual machine's master key is derived from the root key of the source host machine, the virtual machine's identity identifier, security state vector, and system time. During the virtual machine migration process, the transmission encryption key is updated based on the migration temporary key, the virtual machine's security state vector, and real-time information representing the migration progress. After the virtual machine migration is completed, a new master key for the virtual machine on the target host machine is generated based on the root key of the target host machine, the baseline state information of the target host machine, and the migration completion time. This application constructs a complete key security lifecycle management for virtual machine migration through state binding and dynamic key chain mechanisms. During the migration process, by deeply binding the transmission encryption key with the virtual machine's real-time state and migration progress to form a dynamic key chain, an encrypted channel resistant to eavesdropping and replay protection is constructed, ensuring end-to-end confidentiality of the migration data stream. After the migration is completed, by generating a new master key based on the target hardware environment, cryptographic isolation between the key system and the source environment is achieved, eliminating the risk of residual keys after cross-environment migration. Ultimately, in dynamic migration scenarios, the dual security goals of process confidentiality and environmental adaptation were achieved simultaneously.

[0088] Based on the above embodiments, generating a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine resides, and the identification information of the source host machine includes: The baseline state information of the source host machine and the identification information are combined to obtain source-end combined data; The migration temporary key is generated based on the master key and the source-end combined data.

[0089] Following a preset first combination order, various information elements and identification information from the baseline state information are concatenated to form a first raw data string. A cryptographic hash operation is then performed on the first raw data string, and the resulting hash value is used as the source-end combined data. The preset first combination order is as follows: hardware feature information, runtime snapshot, migration start timestamp, and source host machine identification information are concatenated sequentially.

[0090] The master key is used as the input key material for the key derivation function, and the source-end combined data is used as the input for other derived parameters of the key derivation function. The key derivation function is executed, and the migration temporary key is output.

[0091] It should be understood that the validity period of the migration temporary key is strictly limited to the entire migration session from the start of the migration to the completion of the key switch on the target host. The migration temporary key is actively and irreversibly deleted from all relevant systems after the migration session ends.

[0092] In one embodiment, the temporary key is migrated. The calculation method is as follows: ; in, This is the master key of the virtual machine before the migration. This provides the baseline state information of the source host machine. This is the identification information of the source host machine.

[0093] This application embodiment integrates the complete context at the start of the migration with the host identifier, and then derives a temporary key from the master key. This mechanism ensures that the key is triple-bound to the specific source host, the instantaneous state of the virtual machine, and the migration event, thereby creating a globally unique temporary root of trust for the entire migration process and eliminating the risk of the key being predicted, reused, or forged.

[0094] Based on the above embodiments, updating the transmission encryption key based on the migration temporary key, the security state vector of the virtual machine, and real-time information representing the migration progress includes: The security state vector of the virtual machine is combined with the real-time information representing the migration progress to obtain combined migration process data; A new transmission encryption key is generated based on the migration temporary key and the migration process combination data.

[0095] Following a preset second combination order, the security state vector is concatenated with various data from the real-time information to form a second original data string. A cryptographic hash operation is then performed on the second original data string, and the resulting hash value is used as the combined data for the migration process. The preset second combination order involves concatenating the security state vector, the amount of data transmitted, and the migration process timestamp sequentially.

[0096] The temporary migration key is used as the input key material for the key derivation function, and the combined data of the migration process is used as the application context information input for the key derivation function. The key derivation function is executed and outputs a new transmission encryption key.

[0097] In one embodiment, the encryption key is transmitted. The calculation method is as follows: .

[0098] in, For the security state vector of the virtual machine, This represents the amount of data already transmitted. This refers to the time elapsed since the migration started.

[0099] This application embodiment derives the transmission key by dynamically binding the real-time status of the virtual machine with the migration progress, so that the key can automatically evolve synchronously with the migration process, thereby ensuring that a stolen single key can only decrypt a small amount of data, thus building a forward security barrier against eavesdropping and replay in the migration link.

[0100] Based on the above embodiments, generating a new master key for the virtual machine on the target host based on the root key of the target host, the baseline state information of the target host, and the migration completion time includes: The baseline state information of the target host machine is combined with the migration completion time to obtain the target end combined data; The new master key is generated based on the root key of the target host machine and the combined data of the target end.

[0101] Following a preset third combination order, various information elements from the target host's baseline state information are concatenated with the migration completion time to form a third raw data string. A cryptographic hash operation is then performed on this third raw data string, and the resulting hash value is used as the target-side combined data. The preset third combination order consists of concatenating the target host's hardware characteristics, the virtual machine's post-migration running status information, and the migration completion timestamp in sequence.

[0102] The root key of the target host machine is used as the input key material for the key derivation function, and the target end combined data is used as the input other derived parameters of the key derivation function. The key derivation function is executed and outputs the new master key of the virtual machine on the target host machine.

[0103] In one embodiment, after the new master key is generated, the process further includes a key switching and cleanup step: using the new master key to derive a session key for the virtual machine on the target machine for subsequent operations; marking the master key of the virtual machine on the source host and all keys derived from it as historical keys, and initiating a security cleanup process. The security cleanup process includes: after confirming that the new master key and its derived session keys have been successfully put into use, securely erasing temporary key materials and historical key materials related to this migration session on the source host and all intermediate systems.

[0104] In one embodiment, the virtual machine's new master key The calculation formula is: ; in, This provides the baseline state information for the target host machine. For migration completion time, This is the root key of the target host machine.

[0105] This application embodiment binds the new host hardware fingerprint, virtual machine landing status and completion time on the target end, and then derives a brand new master key by combining the new environment trust root, thereby ensuring that the new key is deeply bound to the target end physical environment and the initial state of the virtual machine, realizing the environment switching and security reconstruction of the key system, and eliminating the risk of key cross-environment residual.

[0106] In one embodiment, during the migration of a virtual machine across hosts, it is necessary to simultaneously ensure that the key is not leaked during transmission and that the key is adapted to the new environment after migration. This embodiment of the application achieves end-to-end key security during virtual machine migration through "state binding + dynamic key chain," as described in the reference. Figure 3 The specific method is as follows: Before migration, the source host locks the temporary key to the state: When the source host triggers the migration, the source host's migration baseline state of the virtual machine is collected, including the source host's hardware characteristics (CPU model, memory configuration), the virtual machine's current running snapshot (active processes, network connection), migration start time, etc.

[0107] Generate migration temporary key : .

[0108] During migration, real-time status-linked key updates are implemented: The source and target host machines synchronously monitor real-time changes in the virtual machine's status. When the similarity of virtual machine security status changes exceeds a threshold (e.g., a sudden increase in memory update frequency leading to excessively large differences in state vectors), the transmission encryption key is automatically updated. : .

[0109] After migration, key reconstruction for target-side state adaptation: After migration is complete, the target host collects the target-side baseline state (such as target hardware information and virtual machine recovery running state) and regenerates the new master key for the virtual machine. : ; Interruption self-healing mechanism: If an interruption occurs, the system saves a snapshot of the interruption state (including the current state and used key parameters); upon recovery, it continues to use the data based on the snapshot. Alternatively, it can be re-derived to avoid data becoming disconnected from the key.

[0110] This application's embodiments, through state binding and dynamic key chain mechanisms, construct a complete key security lifecycle management system for virtual machine migration, achieving the dual security goals of process confidentiality and environment adaptation.

[0111] In one embodiment, the root key of the host machine The master key of the virtual machine Virtual machine session key The key is managed as follows: 1. Key Generation: Root Key Generated and permanently stored by the host machine's cryptographic hardware (HSM) to ensure the security of the underlying key; the virtual machine's master key. Automatically during virtual machine creation Function based on Virtual machine unique identifier Initial security state vector And time factor derivation, to achieve binding with the initial state of the virtual machine.

[0112] Virtual machine session key Before each virtual machine operation, based on Context information (such as operation type), random numbers, and time are dynamically generated to ensure the immediacy and uniqueness of session-level keys.

[0113] It should be understood that in existing technologies, static key generation relies solely on a fixed identifier within a virtual machine, which is strongly bound to the lifecycle and cannot adapt to state changes. The master key in this application's embodiment... Generate not only the associated root key and virtual machine identifier It also integrates real-time security status. and time factor Session key By further overlaying context and random numbers, the key is deeply bound to the dynamic state of the virtual machine from the very beginning of its generation, thus solving the leakage risk of static keys that are "used for life" and demonstrating the innovation of the generation logic.

[0114] 2. Key Update: Employs a dual-trigger mechanism of "periodic + event": automatically updates every 24 hours by default. and When the virtual machine's security status changes beyond a threshold (such as hardware configuration changes or software patch updates) or a security event is detected (such as an abnormal process), it is immediately triggered. Update, and simultaneously update all dependencies. of In the event of an emergency security threat (such as the risk of key leakage), the system will automatically perform a full-link key update.

[0115] It should be understood that in existing technologies, key updates are mostly manually triggered or occur at fixed intervals, failing to respond to dynamic scenarios such as virtual machine configuration changes and security events. This solution designs a dual-trigger update mechanism of "periodic + event": a default periodic update ensures basic security, while updates are triggered immediately when state changes exceed thresholds (such as hardware expansion or abnormal processes) or security events occur, and the master key update is linked to a chain-like update of all session keys. This "passive periodic + active response" mechanism achieves precise adaptation between the key and the real-time state of the virtual machine, overcoming the lag of static updates and demonstrating the creativity of the update logic.

[0116] 3. Key Destruction: When a virtual machine is destroyed, the system automatically revokes its corresponding key. and associated derived keys; after the session ends, It is immediately destroyed without leaving any storage trace; if a key leak or unauthorized access is detected, the key revocation process is automatically triggered, blocking all subsequent operations based on the key and forcibly generating a new keychain.

[0117] It should be understood that in existing technologies, key revocation relies on manual operation by the hypervisor or delayed cleanup after virtual machine destruction, which can easily lead to the residue of "zombie keys". The embodiments of this application strongly bind revocation to the virtual machine lifecycle (automatic revocation of the master key upon destruction), the session lifecycle (destruction of the session key upon termination), and security risks (emergency revocation and blocking of operations upon leakage), achieving "key disappearing with the scenario", avoiding the risk of unauthorized access, and demonstrating the innovation of the revocation logic.

[0118] 4. Key backup and recovery: Regular automatic backups are performed, and backup files are accessed via... Encrypted storage, and the backup content is associated with the state parameters at the time of its creation (e.g., , ), ensuring accurate reconstruction during recovery; root key A multi-replica mechanism is adopted, and the keys are automatically synchronized and stored in HSMs in different physical locations to avoid key loss due to single point of failure. During recovery, the keys are activated through a distributed verification mechanism.

[0119] It should be understood that in existing technologies, key backups are mostly simple copies, and during restoration, the consistency between the key and the generation scenario cannot be verified. The embodiments of this application associate the state parameters during the generation of the master key backup ( , The root key is distributed and stored in multiple copies in the HSM. During recovery, it is activated through status parameter verification and distributed verification to ensure that the recovered key can accurately adapt to the original scenario. This solves the problem of "recovery is invalid" in traditional backup and reflects the creativity of backup and recovery logic.

[0120] To further explain the virtual machine key management method provided in this application, please refer to the following embodiments.

[0121] This application addresses the issues of dynamism, security, and management efficiency in virtual machine key isolation within a virtualized environment. It proposes a virtual machine key isolation method based on dynamic key derivation. This method constructs a multi-dimensional security state vector to achieve deep binding between keys and virtual machine states, employs a multi-level key derivation mechanism to ensure key dynamism, designs a state-aware key update strategy and a full-process migration security mechanism, and automates key lifecycle management, thereby achieving fine-grained and highly adaptable virtual machine key isolation. The specific technical solution can be implemented through the following steps: Step 1: Construct a multi-dimensional security state vector: Collect virtual machine hardware, software and running status, generate a security state vector through hashing, and update it at a 5-minute cycle + event trigger (configuration change or security event) to ensure real-time performance.

[0122] Step 2: Implement multi-level dynamic key derivation: Based on the root key, virtual machine identifier, security state vector, and second-level time, derive the master key through the key derivation function; derive the session key based on the master key, context, random number, and time to ensure uniqueness.

[0123] Step 3: Dynamic key update based on state changes: The host maintains a security state baseline and a dynamic threshold, calculates the similarity between the current security state vector and the baseline, updates the baseline if the threshold is exceeded, and re-derives the master key and its associated session key.

[0124] Step 4: Design a key security mechanism for virtual machine migration: generate a temporary key on the source end before migration; update the transmission encryption key in real time during migration; generate a new master key on the target end after migration; save a snapshot when interrupted, and restore to continue using or regenerate the transmission encryption key.

[0125] Step 5: Automated management of key lifecycle: The root key is generated into multiple copies by the HSM; the master key of the virtual machine is automatically derived when it is created, and the session key of the virtual machine is dynamically generated before operation; dual-triggered updates, reversal upon destruction / end, and forced updates in case of leakage; backup of the virtual machine's master key associated state, and distributed recovery of the root key.

[0126] Through the above steps, this application embodiment realizes the dynamic binding of keys with virtual machine state, time, and environment, solves the limitations of static keys, and improves the security and adaptability of virtual machine key isolation.

[0127] In one embodiment, the dynamic key update of the government cloud virtual machine is used as an example for analysis and explanation: A provincial government cloud platform has deployed multiple virtual machines carrying social security data. These virtual machines need to meet high security requirements and handle dynamic scenarios such as hardware upgrades and system patch updates. The specific implementation method is as follows: When a virtual machine is deployed, the system collects its hardware status (such as Intel Xeon CPU, 64GB memory, storage UUID, etc.), software status (such as CentOS 8.5, installed security patch KB202305, office software list), and running status (such as initial process list, intranet connection, etc.), and generates an initial security state vector through a hash algorithm: .

[0128] Root key The master key is generated and solidified by the platform's HSM. The calculation method is as follows: ; in, The creation time is accurate to the second.

[0129] Session key The calculation method is as follows: ; Among them, session key Used for the first social security data query session.

[0130] Three days later, the system automatically installed patches for the high-risk vulnerabilities, triggering the event update mechanism and re-collecting the software state to generate a security state vector. Calculate similarity : ; if If the value falls below the threshold of 0.7, a key update is triggered, and a new master key is generated. ; At the same time, all session keys are updated accordingly: .

[0131] This application's embodiments solve the problem that traditional static keys cannot adapt to dynamic scenarios such as system patch updates and hardware configuration changes by dynamically associating keys with state vectors. After patch installation, the key chain is updated quickly, and the session key changes in real time with the operation context, thus resisting the risk of side-channel attacks.

[0132] In one embodiment, the migration of a financial cloud virtual machine across data centers is used as an example for analysis and explanation: A bank's core transaction system virtual machine needs to be migrated from data center A to data center B (disaster recovery scenario). The migration process requires complete key confidentiality, and the keys must be compatible with the new hardware environment after migration. The specific implementation method is as follows: Prior to migration, a temporary key is generated at the source: The source host (Data Center A) collects the "Source Migration Baseline Status": Intel Xeon CPU E5, 128GB memory, active virtual machine processes (transaction engine, database connection), and migration start time. Generate a temporary key: ; in, This is the master key before migration.

[0133] During migration, the encryption key is dynamically updated: During the migration process, the virtual machine status is synchronized in real time between the source and target ends (e.g., the memory page update frequency suddenly increases by 200%, exceeding the preset threshold). Automatically update the transmission encryption key: ; in, This represents the amount of data already transmitted. (At the current time), triggered once every 100MB of data. renew.

[0134] After migration, the target key is reconstructed: After the migration is completed ( Record completion time), collect "target baseline status" on the target host machine (Data Center B): AMD EPYC CPU, 256GB memory, virtual machine recovery running status; generate a new master key: ; in, (for the target root key), and based on the new Derive session keys to adapt to new hardware environments.

[0135] Interruption self-healing: If migration is interrupted (e.g., due to network failure), the system saves the data at the time of the interruption. , Parameter snapshot; Resume based on snapshot Or re-derive This ensures that the data and keys are synchronized.

[0136] In this application embodiment, the key is not stored locally throughout the migration process. The encryption key is dynamically changed during transmission to resist man-in-the-middle attacks. After migration, the key automatically adapts to the target environment, which reduces the risk of key leakage and shortens the interruption recovery time compared with traditional migration schemes.

[0137] In one embodiment, this application specifically proposes a virtual machine key management system, referring to... Figure 4 The system includes the following modules: (1) Status Acquisition and Processing Module: Its function is to collect the hardware status (CPU model, memory configuration, storage UUID, etc.), software status (operating system version, security patches, installed software list, etc.), and running status (active processes, network connection, resource utilization, etc.) of the virtual machine. Its processing logic is to fuse the multi-dimensional status into a security status vector through a hash algorithm. It updates in real time according to a "periodic (default 5 minutes) + event trigger (configuration change or security event)" mechanism. .

[0138] (2) Hardware Security Module (HSM): Its function is to serve as the underlying security foundation, generating and permanently storing the root key. ),make sure It provides physical isolation and immutability. Its key feature is support for distributed storage of multiple root keys, achieved through a distributed verification mechanism. Safe recovery, avoiding single points of failure.

[0139] (3) Key Derivation Module: Its function is to generate keys at each level based on a multi-level dynamic key derivation algorithm, specifically including: Master key ( ): Through key derivation functions, combined with Virtual machine unique identifier It generates time factors down to the second level to ensure timeliness and forward security.

[0140] Session key ( ):based on Context information (operation type, resource identifier), random number and time factor derivation ensure the uniqueness of each session.

[0141] (4) Monitoring and Triggering Module: Its function is to monitor the virtual machine's security status and operating scenario in real time and trigger corresponding mechanisms: Status monitoring: Compare with current status Calculate the similarity with the safety status baseline.

[0142] Triggering logic: When the similarity exceeds the threshold, a key update is triggered; when a migration request or security event (such as an abnormal process) is detected, a migration security mechanism or emergency key update is triggered.

[0143] (5) Key update and management module: Its function is to perform key updates based on the trigger signal from the monitoring module: when the state change exceeds the threshold, the security state baseline is updated and a new key is derived. And update all dependencies accordingly. It supports a dual-trigger update mechanism of "period (default 24 hours) + event" to perform full-link key updates in emergency situations.

[0144] (6) Migration Security Module: Its function is to ensure the security of keys throughout the entire process of virtual machine migration across hosts. Before migration: Generate a temporary key ( ), bind the source host base state and the source host ID.

[0145] During migration: Real-time synchronization of virtual machine state; when state changes exceed a threshold, based on... ,real time The amount of data transmitted and the time-updated encryption key ( ).

[0146] After migration: Reconstruct a new master key based on the target host root key, the target baseline state, and the migration completion time.

[0147] Interruption self-healing: Saves a snapshot of the interrupted state, which can be reused or re-derived upon recovery. This ensures that the data and keys are synchronized.

[0148] (7) Encryption Engine: Its function is to receive the transmission encryption key generated by the migration security module. This encrypts memory and disk data during the virtual machine migration process to ensure confidentiality during transmission.

[0149] (8) Key Lifecycle Management Module: Its function is to automatically manage the entire lifecycle of keys. generate: Generated by HSM Automatically derived when the virtual machine is created. Dynamically generated before each operation.

[0150] Destroy: Undo when the virtual machine is destroyed. Destroyed immediately after the session ends When a leak is detected, the keychain is forcibly revoked and a new keychain is derived.

[0151] Backup and restore: Regular backup (associated) and time parameters, through Encrypted storage) Recovery is achieved through distributed recovery with multiple replicas.

[0152] The interaction logic between the modules includes: the status acquisition module will... Synchronization is performed to the key derivation module and the monitoring module; the monitoring module triggers the key update module or the migration security module based on state changes; the migration security module calls the encryption engine to achieve encrypted data transmission, relying on the key derivation module to generate temporary keys and transmit encryption keys; the lifecycle management module runs through the entire process of key generation, update, and destruction, ensuring that the keys are dynamically adapted to the virtual machine lifecycle and security status.

[0153] This application's embodiments construct a multi-dimensional security state vector that integrates virtual machine hardware, software, and operational status, and update it using a "periodic + event-triggered" approach; through multi-level dynamic key derivation, a master key is derived from the root key combined with identifier, status, and time, and then a session key is derived based on the master key, context, random number, and time; key updates are triggered based on the similarity between the status and the baseline; a full-process key security mechanism is designed for migration scenarios; and automated management of the entire lifecycle of key generation, update, revocation, backup, and recovery is achieved.

[0154] The virtual machine key management device provided in this application is described below. The virtual machine key management device described below can be referred to in correspondence with the virtual machine key management method described above.

[0155] refer to Figure 5 The virtual machine key management device provided in this application includes: The security state vector construction module 501 is used to construct the security state vector of the virtual machine based on the virtual machine's state information; The first key derivation module 502 is used to derive the master key of the virtual machine based on the root key of the source host machine where the virtual machine is located, the identity identifier of the virtual machine, the security state vector and the system time. The second key derivation module 503 is used to perform key derivation based on the master key, the context information of the virtual machine, a random number, and the system time to generate a session key for the virtual machine.

[0156] The virtual machine key management device provided in this application constructs a security state vector for the virtual machine based on its state information; it then performs key derivation based on the root key of the host machine where the virtual machine resides, the virtual machine's identity identifier, the security state vector, and the system time to generate the virtual machine's master key; finally, it performs key derivation based on the master key, the virtual machine's context information, a random number, and the system time to generate the virtual machine's session key. This application achieves multi-level dynamic key derivation by constructing a multi-dimensional security state vector for the virtual machine, thereby completing a deep dynamic binding between the key and the virtual machine's identity, real-time operating status, and physical environment. This overcomes the rigidity and lag risks caused by static keys due to long-term fixed use, achieves adaptation to the dynamic lifecycle of the virtual machine, and ultimately realizes key isolation management.

[0157] In one embodiment, the first key derivation module 502 is further configured to: The identity identifier, the security state vector, and the system time are combined to obtain the first combined data; The master key of the virtual machine is generated based on the root key of the source host machine and the first combined data.

[0158] In one embodiment, the second key derivation module 503 is further configured to: The context information, the random number, and the system time are combined to form the second combined data; The session key is generated based on the master key and the second combined data.

[0159] In one embodiment, the state information includes at least one of hardware state information, software state information, and runtime state information; the security state vector construction module 501 is further configured to: Collect the status information of the virtual machine; The collected state information is concatenated and combined, and a hash operation is performed on the concatenated and combined data to generate the security state vector.

[0160] In one embodiment, the security state vector is updated based on at least one of the following methods: The security state vector is updated based on the periodically collected state information; If a configuration change event or security policy event is detected in the virtual machine, the security state vector is updated based on the re-collected state information.

[0161] In one embodiment, the virtual machine key management device further includes a key update module, used for: Calculate the similarity between the security state vector of the virtual machine and the security state baseline of the virtual machine; If the similarity is less than the security state threshold of the virtual machine, the security state vector is updated to the new security state baseline of the virtual machine, and the master key and the session key are re-derived; The security status threshold is obtained by adjusting based on the historical security events of the virtual machine.

[0162] refer to Figure 6 The virtual machine key management device provided in this application includes: The migration temporary key generation module 601 is used to generate a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine is located, and the identification information of the source host machine; the virtual machine's master key is derived from the root key of the source host machine, the virtual machine's identity identifier and security state vector, and the system time. The transmission encryption key update module 602 is used to update the transmission encryption key based on the migration temporary key, the security state vector of the virtual machine, and real-time information representing the migration progress during the virtual machine migration process. The master key update module 603 is used to generate a new master key for the virtual machine on the target host machine after the virtual machine migration is completed, based on the root key of the target host machine where the virtual machine is located, the baseline status information of the target host machine, and the migration completion time.

[0163] The virtual machine key management device provided in this application generates a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine resides, and the identification information of the source host machine. The virtual machine's master key is derived from the root key of the source host machine, the virtual machine's identity identifier, security state vector, and system time. During the virtual machine migration process, the transmission encryption key is updated based on the migration temporary key, the virtual machine's security state vector, and real-time information representing the migration progress. After the virtual machine migration is completed, a new master key for the virtual machine on the target host machine is generated based on the root key of the target host machine, the baseline state information of the target host machine, and the migration completion time. This application constructs a complete key security lifecycle management for virtual machine migration through state binding and dynamic key chain mechanisms. During the migration process, by deeply binding the transmission encryption key with the virtual machine's real-time state and migration progress to form a dynamic key chain, an encrypted channel resistant to eavesdropping and replay protection is constructed, ensuring end-to-end confidentiality of the migration data stream. After the migration is completed, by generating a new master key based on the target hardware environment, cryptographic isolation between the key system and the source environment is achieved, eliminating the risk of residual keys after cross-environment migration. Ultimately, in dynamic migration scenarios, the dual security goals of process confidentiality and environmental adaptation were achieved simultaneously.

[0164] In one embodiment, the baseline state information of the source host machine includes at least one of the hardware characteristics of the source host machine, the runtime snapshot of the virtual machine, and the migration start time; the migration temporary key generation module 601 is further configured to: The baseline state information of the source host machine and the identification information are combined to obtain source-end combined data; The migration temporary key is generated based on the master key and the source-end combined data.

[0165] In one embodiment, the real-time information characterizing the migration progress includes the amount of data successfully transmitted and the time elapsed since the migration started; the transmission encryption key update module 602 is further configured to: The security state vector of the virtual machine is combined with the real-time information representing the migration progress to obtain combined migration process data; A new transmission encryption key is generated based on the migration temporary key and the migration process combination data.

[0166] In one embodiment, the baseline state information of the target host machine includes the hardware characteristics of the target host machine and the running state information of the virtual machine after migration; the master key update module 603 is further configured to: The baseline state information of the target host machine is combined with the migration completion time to obtain the target end combined data; The new master key is generated based on the root key of the target host machine and the combined data of the target end.

[0167] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7 As shown, the electronic device may include a processor 710, a communications interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communications interface 720, and the memory 730 communicate with each other through the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute a virtual machine key management method, which includes: constructing a security state vector of the virtual machine based on the virtual machine's state information; performing key derivation based on the root key of the source host machine where the virtual machine resides, the identity identifier of the virtual machine, the security state vector, and the system time to generate a master key for the virtual machine; and performing key derivation based on the master key, the context information of the virtual machine, a random number, and the system time to generate a session key for the virtual machine.

[0168] The processor 710 can call logical instructions in the memory 730 to execute a virtual machine key management method, which includes: generating a migration temporary key based on the virtual machine's master key, the baseline state information of the source host where the virtual machine resides, and the identification information of the source host; the virtual machine's master key is derived from the root key of the source host, the virtual machine's identity identifier and security state vector, and the system time; during the virtual machine migration process, updating the transmission encryption key based on the migration temporary key, the virtual machine's security state vector, and real-time information representing the migration progress; and after the virtual machine migration is completed, generating a new master key for the virtual machine on the target host based on the root key of the target host where the virtual machine resides, the baseline state information of the target host, and the migration completion time.

[0169] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0170] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the virtual machine key management method provided by the above methods. The method includes: constructing a security state vector of the virtual machine based on the virtual machine's state information; performing key derivation based on the root key of the source host machine where the virtual machine is located, the identity identifier of the virtual machine, the security state vector, and the system time to generate a master key for the virtual machine; and performing key derivation based on the master key, the context information of the virtual machine, a random number, and the system time to generate a session key for the virtual machine.

[0171] When the computer program is executed by the processor, the computer can execute the virtual machine key management method provided by the above methods. The method includes: generating a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine is located, and the identification information of the source host machine; the virtual machine's master key is derived from the root key of the source host machine, the identity identifier and security state vector of the virtual machine, and the system time; during the virtual machine migration process, updating the transmission encryption key based on the migration temporary key, the security state vector of the virtual machine, and real-time information representing the migration progress; and after the virtual machine migration is completed, generating a new master key for the virtual machine on the target host machine based on the root key of the target host machine where the virtual machine is located, the baseline state information of the target host machine, and the migration completion time.

[0172] In another aspect, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the virtual machine key management method provided by the above methods. The method includes: constructing a security state vector of the virtual machine based on the virtual machine's state information; performing key derivation based on the root key of the source host machine where the virtual machine resides, the identity identifier of the virtual machine, the security state vector, and the system time to generate a master key for the virtual machine; and performing key derivation based on the master key, the context information of the virtual machine, a random number, and the system time to generate a session key for the virtual machine.

[0173] When executed by a processor, this computer program implements the virtual machine key management method provided by the above methods. This method includes: generating a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine resides, and the identification information of the source host machine; the virtual machine's master key is derived from the root key of the source host machine, the virtual machine's identity identifier and security state vector, and the system time; during the virtual machine migration process, updating the transmission encryption key based on the migration temporary key, the virtual machine's security state vector, and real-time information representing the migration progress; and after the virtual machine migration is completed, generating a new master key for the virtual machine on the target host machine based on the root key of the target host machine where the virtual machine resides, the baseline state information of the target host machine, and the migration completion time.

[0174] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0175] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0176] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A virtual machine key management method, characterized in that, include: Based on the virtual machine's state information, construct the virtual machine's security state vector; The master key of the virtual machine is generated by key derivation based on the root key of the source host machine where the virtual machine is located, the identity identifier of the virtual machine, the security state vector, and the system time; Based on the master key, the virtual machine's context information, a random number, and the system time, a key derivation is performed to generate the virtual machine's session key.

2. The virtual machine key management method according to claim 1, characterized in that, The process of generating the master key for the virtual machine based on the root key of the source host machine, the identity identifier of the virtual machine, the security state vector, and the system time includes: The identity identifier, the security state vector, and the system time are combined to obtain the first combined data; The master key of the virtual machine is generated based on the root key of the source host machine and the first combined data.

3. The virtual machine key management method according to claim 1, characterized in that, The step of generating a session key for the virtual machine based on the master key, the virtual machine's context information, a random number, and the system time includes: The context information, the random number, and the system time are combined to form the second combined data; The session key is generated based on the master key and the second combined data.

4. The virtual machine key management method according to claim 1, characterized in that, The status information includes at least one of hardware status information, software status information, and runtime status information; the construction of the virtual machine's security state vector based on the virtual machine's status information includes: Collect the status information of the virtual machine; The collected state information is concatenated and combined, and a hash operation is performed on the concatenated and combined data to generate the security state vector.

5. The virtual machine key management method according to claim 1, characterized in that, The security state vector is updated based on at least one of the following methods: The security state vector is updated based on the periodically collected state information; If a configuration change event or security policy event is detected in the virtual machine, the security state vector is updated based on the re-collected state information.

6. The virtual machine key management method according to any one of claims 1 to 5, characterized in that, The virtual machine key management method further includes: Calculate the similarity between the security state vector of the virtual machine and the security state baseline of the virtual machine; If the similarity is less than the security state threshold of the virtual machine, the security state vector is updated to the new security state baseline of the virtual machine, and the master key and the session key are re-derived; The security status threshold is obtained by adjusting based on the historical security events of the virtual machine.

7. A virtual machine key management method, characterized in that, include: A migration temporary key is generated based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine resides, and the identification information of the source host machine; The master key of the virtual machine is derived from the root key of the source host machine, the identity identifier and security state vector of the virtual machine, and the system time. During the virtual machine migration process, the transmission encryption key is updated based on the migration temporary key, the security state vector of the virtual machine, and real-time information representing the migration progress. After the virtual machine migration is completed, a new master key for the virtual machine on the target host is generated based on the root key of the target host, the baseline state information of the target host, and the migration completion time.

8. The virtual machine key management method according to claim 7, characterized in that, The baseline state information of the source host machine includes at least one of the hardware characteristics of the source host machine, the running snapshot of the virtual machine, and the migration startup time; The process of generating a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine resides, and the identification information of the source host machine includes: The baseline state information of the source host machine and the identification information are combined to obtain source-end combined data; The migration temporary key is generated based on the master key and the source-end combined data.

9. The virtual machine key management method according to claim 7, characterized in that, The real-time information representing the migration progress includes the amount of data that has been successfully transmitted and the time elapsed since the migration started. The step of updating the transmission encryption key based on the migration temporary key, the virtual machine's security state vector, and real-time information representing the migration progress includes: The security state vector of the virtual machine is combined with the real-time information representing the migration progress to obtain combined migration process data; A new transmission encryption key is generated based on the migration temporary key and the migration process combination data.

10. The virtual machine key management method according to claim 7, characterized in that, The baseline state information of the target host machine includes the hardware characteristics of the target host machine and the running state information of the virtual machine after migration; The process of generating a new master key for the virtual machine on the target host based on the root key of the target host, the baseline state information of the target host, and the migration completion time includes: The baseline state information of the target host machine is combined with the migration completion time to obtain the target end combined data; The new master key is generated based on the root key of the target host machine and the combined data of the target end.

11. A virtual machine key management device, characterized in that, include: A security state vector construction module is used to construct the security state vector of the virtual machine based on the virtual machine's state information; The first key derivation module is used to derive the master key of the virtual machine based on the root key of the source host machine where the virtual machine is located, the identity identifier of the virtual machine, the security state vector, and the system time. The second key derivation module is used to derive a key based on the master key, the context information of the virtual machine, a random number, and the system time, and generate a session key for the virtual machine.

12. A virtual machine key management device, characterized in that, include: The migration temporary key generation module is used to generate a migration temporary key based on the virtual machine's master key, the baseline state information of the source host machine where the virtual machine resides, and the identification information of the source host machine; the virtual machine's master key is derived from the root key of the source host machine, the virtual machine's identity identifier and security state vector, and the system time. The transmission encryption key update module is used to update the transmission encryption key based on the migration temporary key, the security state vector of the virtual machine, and real-time information representing the migration progress during the virtual machine migration process. The master key update module is used to generate a new master key for the virtual machine on the target host machine after the virtual machine migration is completed, based on the root key of the target host machine where the virtual machine is located, the baseline state information of the target host machine, and the migration completion time.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the virtual machine key management method as described in any one of claims 1 to 10.

14. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the virtual machine key management method as described in any one of claims 1 to 10.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the virtual machine key management method as described in any one of claims 1 to 10.

Images