Increment simulation method and system for mirror image data in cloud environment, and related device
Through the cloud environment mirror data incremental simulation method, file-level comparison markers and memory initialization backup are used, and file-level incremental merger of virtual machine, the problem of mirror system downtime and update in the existing technology is solved, and efficient cloud electronic data forensic analysis is realized.
Patent Information
- Application Number
- PCT/CN2024/089281
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2024-02-05
- Filing Date
- 2024-04-23
- Publication Date
- 2025-08-14
AI Technical Summary
The simulation analysis and forensics operation of mirror data of existing cloud environment systems requires the cloud environment to shut down, interrupting the running current mirror system, resulting in overall inefficiency.
The cloud environment mirror data incremental simulation method is adopted to identify and track the differences between the basic version and the target version through file-level comparison and running memory initialization backup, virtual machine file-level incremental merging and memory update, and update the cloud mirror system without shutting down.
It realizes the update of the cloud electronic data forensic analysis object system without restarting the cloud simulation or sandbox environment, and improves overall work efficiency.
Smart Images

Figure CN2024089281_14082025_PF_FP_ABST
Abstract
Description
A cloud environment mirror data incremental simulation method, system and related equipment Technical Field
[0001] The present invention relates to data simulation forensics technology, and in particular to simulation technology for cloud environment system mirror data. Background Art
[0002] Currently commonly used mirroring technologies mainly include full mirroring technology, differential mirroring technology, and simulation and sandbox technology.
[0003] Among them, full image technology needs to be based on a complete system image, including the operating system, applications and system configuration, allowing users to quickly deploy and replicate specific system environments; differential image technology, when creating a virtual machine instance based on the original image, allows the same base image plus a differential image, and can save any modifications to the instance in the differential image, saving storage space in the cloud environment; simulation and sandbox technology runs the system image in an isolated environment, which can provide a safe testing environment and allow testing and verification of applications and system configurations without affecting the host system or other images.
[0004] When performing simulation analysis and forensic operations on existing cloud environment system image data, the cloud environment often needs to be shut down to load the complete target cloud environment image, or the base image plus the differential image. However, both require restarting the cloud simulation or sandbox environment, which interrupts the running current image system and suspends the cloud electronic data forensic analysis workflow, reducing overall work efficiency.
[0005] Summary of the Invention
[0006] In view of the problem that the simulation analysis and forensic operation scheme of the existing cloud environment system mirror data requires the cloud environment to be shut down, interrupting the current running mirror system and reducing the overall work efficiency, the purpose of the present invention is to provide a cloud environment mirror data incremental simulation scheme, which can complete the update of the cloud electronic data forensic analysis object system without interrupting the current running mirror system.
[0007] To achieve the above-mentioned object, the present invention provides a cloud environment image data incremental simulation method, the simulation method comprising: cloud image system file-level comparison marking, identifying and tracking file-level differences between a base version cloud image system and a target version cloud image system, and marking and recording them;
[0008] Cloud image running memory initialization data backup, backing up the data in the target cloud image system running memory, and performing initialization operations on the running memory of the target virtual system running in the cloud environment;
[0009] Virtual machine file-level incremental merging and memory updates: Based on the detected incremental data, the main file system is updated one by one, and the file system is incrementally merged. At the same time, the running memory status is checked, and when the running memory status is updated, the backed-up running memory data is reloaded to perform memory updates.
[0010] In some embodiments of the present invention, the simulation method performs differential comparative analysis on the target image and the system files contained in the currently running virtual machine during the file-level comparison and marking stage of the cloud image system. After file-level scanning and analysis, fingerprint marks are generated for the incremental files to form a file-level difference record table.
[0011] In some embodiments of the present invention, the file-level difference record table includes three types of information: file name, file address, and file fingerprint.
[0012] In some embodiments of the present invention, the method opens up a temporary virtual space in the cloud environment during the cloud image running memory initialization data backup stage, loads the target image, runs the temporary virtual machine, and operates the temporary space virtual machine to enter a sleep state to temporarily solidify the running memory.
[0013] In some embodiments of the present invention, the method is based on a sleep mechanism of a temporary space virtual machine operating system to obtain a running memory backup with continuous logical addresses.
[0014] In some embodiments of the present invention, when the simulation method performs virtual machine file-level incremental merging in the virtual machine file-level incremental merging and memory update stages, based on the files and difference record table generated in the cloud image comparison and marking stage, the disk system of the target virtual machine is operated to load the difference files recorded in the table in an overwrite write manner to implement incremental merging.
[0015] In some embodiments of the present invention, the simulation method switches running memory data by updating the basic pointer when performing memory update in the virtual machine file-level incremental merging and memory update phase.
[0016] In order to achieve the above-mentioned object, the present invention provides a cloud environment image data incremental simulation system, which is composed of a cloud image system file-level comparison and marking unit, a cloud image running memory initialization data backup unit, and a virtual machine file-level incremental merging and memory update unit;
[0017] The cloud mirror system file-level comparison and marking unit is configured to identify and track file-level differences between the base version cloud mirror system and the target version cloud mirror system, and mark and record them;
[0018] The cloud image running memory initialization data backup unit is configured to perform data interaction with the cloud image system file level comparison and marking unit, complete the backup of the data in the cloud image system running memory, and initialize the running memory of the running virtual machine;
[0019] The virtual machine file-level incremental merging and memory update unit is configured to interact with the cloud image system file-level comparison and marking unit and the cloud image running memory initialization data backup unit to perform data, and update the main file system one by one according to the detected incremental data to perform incremental merging of the file system; at the same time, check the running memory status, and if the running memory status is updated, reload the backed up running memory data to perform memory update.
[0020] In order to achieve the above-mentioned purpose, the present invention provides a terminal device, which includes a processor, a memory, and a program stored in the memory and can be run on the processor, characterized in that the program code is loaded by the processor and executes the implementation steps of the above-mentioned virtual machine image data incremental simulation method.
[0021] In order to achieve the above-mentioned object, the present invention provides a computer program product, which, when executed on a data processing device, is characterized in that it is suitable for executing the implementation steps of the above-mentioned virtual machine image data incremental simulation method.
[0022] The cloud environment mirror data incremental simulation solution provided by the present invention can realize electronic data simulation analysis operations for the cloud environment. It can update the running cloud mirror without stopping the system. There is no need to restart the cloud simulation or sandbox environment, and there is no need to interrupt the current running mirror system. It can complete the update of the cloud electronic data forensic analysis object system and improve overall work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] The present invention is further described below with reference to the accompanying drawings and specific embodiments.
[0024] FIG1 is a schematic diagram of incremental simulation of cloud environment mirror data provided in an example of the present invention;
[0025] FIG2 is a system block diagram of a cloud environment mirror data incremental simulation system provided in an example of the present invention. DETAILED DESCRIPTION
[0026] In order to make the technical means, creative features, objectives and effects achieved by the present invention easier to understand, the present invention is further described below with reference to specific illustrations.
[0027] The simulation analysis and forensic operation plan for the existing cloud environment system image data requires the cloud environment to be shut down to load the complete target cloud environment image, or the base image plus the differential image. Both require restarting the cloud simulation or sandbox environment, interrupting the current running image system, thereby pausing the cloud electronic data forensic analysis workflow.
[0028] To this end, the present invention provides a cloud environment mirror data incremental simulation solution, which innovatively utilizes the incremental update of the cloud system's file data and the initialization update of the running memory to achieve non-stop update of the cloud mirror system simulation.
[0029] This cloud environment image data incremental simulation solution specifically builds a temporary virtual machine in the cloud environment resource pool, obtains the corresponding running memory backup, combines the built-in sleep mechanism of the operating system, compares and calculates the running memory and system file increments, and updates the system files and running environment accordingly to complete the simulation of the target image.
[0030] Among them, the cached virtual machine obtains statically processed memory data through hibernation, imports it into the running memory of the target virtual machine, and then refreshes the target virtual machine through the running memory address offset method based on the hibernation and wake-up mechanism of the operating system.
[0031] The cloud environment mirror data incremental simulation solution implemented in this way is based on the existing system image and only simulates the changes in it, rather than re-simulating the entire system. This can greatly improve efficiency and save resources, especially for forensic analysis of electronic data in large and complex cloud systems, which involves multiple modifications and updates to the cloud environment, and can greatly improve work efficiency.
[0032] Specifically, as shown in Figure 1, this cloud environment image data incremental simulation solution mainly consists of three parts: cloud image system file-level comparison marking, cloud image running memory initialization data backup, and virtual machine file-level incremental merging and memory update.
[0033] First, in the cloud image system file-level comparison and marking stage, it is used to identify and track the file-level differences between the base version cloud image system and the target version cloud image system, and mark and record them.
[0034] As a further explanation, in this stage, the basic cloud image system file-level comparison and marking is carried out. Specifically, it is implemented by the following processing steps: image file comparison, file-level scanning of the cloud image system, file fingerprint generation, and difference recording. The specific process is as follows:
[0035] (S1.1) First, perform differential comparative analysis on the target image and the system files contained in the currently running virtual machine;
[0036] (S1.2) Based on step (S1.1), perform file-level scanning and parsing on the target image file, and perform traversal analysis on each file and directory;
[0037] (S1.3) determining the incremental file through step (S1.1) and step (S1.2), and generating a fingerprint mark for the incremental file;
[0038] (S1.4) Based on the results determined in steps (S1.1) to (S1.3), a file-level difference record table is formed.
[0039] To further illustrate, in step (S1.1), the image files to be compared are the base version cloud image file and the target version cloud image file, wherein the image currently running on the target virtual machine is the base version, and the system needs to complete the simulation of the target version cloud image.
[0040] This step effectively determines the different information between the base version cloud image file and the target version cloud image file through differential comparison and analysis.
[0041] Furthermore, the differences between the image files determined in this step specifically involve the comparison results of the same fingerprint files that have not been changed, different fingerprint files that have been modified, and files that have been added or deleted. All analysis results of changes, additions or deletions are marked and recorded.
[0042] It is further explained that in step (S1.2), the file-level scan of the cloud image is preferably performed without actually running the cloud image. The traversal scanning tool of the file system is used to perform traversal analysis of each file and directory of the cloud image, and the file fingerprint is generated in step (S1.3) to obtain a file-level difference record table.
[0043] It is further explained that when the file fingerprint is generated in step (S1.3), a unique fingerprint can be generated for the system files involved in the cloud image, thereby realizing the location and differentiation of the files.
[0044] As an example, the method for generating the file fingerprint here may use a hash function, such as MD5, SHA-1, or SHA-256, but is not limited thereto.
[0045] Further explanation: Step (S1.4) specifically compares the differences between the image files, including the same fingerprint files that have not been changed, different fingerprint files that have been modified, and files that have been added or deleted. All analysis results of changes, additions, or deletions are marked and recorded.
[0046] The file-level difference record table formed contains three types of information: file name, file address, and file fingerprint. The file fingerprint is obtained by calculating the basic attributes of the file such as name, size, time, etc. without parsing the file content, so as to ensure the efficiency and accuracy of text comparison marking and updating.
[0047] Then, based on the completion of the cloud image system file-level comparison marking, the cloud image running memory initialization data backup phase is entered. In this phase, the backup of the data in the cloud image system running memory is completed, and the running memory of the running virtual machine is initialized.
[0048] The cloud image system's runtime memory, which contains all currently executing programs and data, is targeted here. To facilitate fault recovery, analysis, or other purposes, this phase packages and backs up runtime data and initializes the virtual cloud system's runtime memory.
[0049] As a further explanation, in this stage, the cloud image running memory initialization data backup is performed, which is specifically achieved by the following processing steps: cloud resource configuration, temporary space virtual machine sleep operation, memory data initialization backup, etc. The specific process is as follows:
[0050] (S2.1) This step first configures cloud resources, creates a temporary virtual space in the cloud environment, loads the target image file, and runs the temporary virtual machine;
[0051] (S2.2) Based on the configuration in step (S2.1), this step operates the temporary virtual machine to enter a sleep state, thereby temporarily solidifying the running memory;
[0052] (S2.3) After the temporary virtual machine enters the sleep state, a running memory backup with a continuous logical address is obtained based on the sleep mechanism of the temporary virtual machine operating system.
[0053] Furthermore, this stage dynamically configures the storage and computing resources in the cloud environment through step (2.1), so as to allocate appropriate computing, storage and network resources to the applications or services requested by users, and ensure that the cloud platform resources are used in the most efficient way.
[0054] Furthermore, this stage performs memory data initialization backup through step (2.3), which can effectively load and update the runtime memory data of virtual machines or containers in cloud environments or virtualized environments, ensuring that any changes made in persistent storage (such as changes to images or snapshots) can be correctly initialized to the memory of the image system instance to be analyzed.
[0055] Finally, after completing the initial data backup of the cloud image's running memory, the virtual machine enters the file-level incremental merge and memory update phase. This phase involves file system changes and changes to the running system's memory status. Based on the detected incremental data, the primary file system is updated one by one, performing an incremental merge of the file system. Simultaneously, the running memory status is checked. If the running memory status has been updated, the backed-up running memory data is reloaded and the memory update is performed.
[0056] Specifically, during the incremental merge of the file system in this stage, based on the files and difference record table generated in the cloud image comparison and marking stage, the disk system of the target virtual machine is operated to load the difference files recorded in the table in an overwrite manner to implement the incremental merge.
[0057] To further illustrate, when performing an incremental file system merge, the system first performs a file system incremental calculation. By comparing the incremental data between the target image file and the currently running system file, the global identifier of the data resource is calculated and an incremental index table is generated. Next, based on this, the file read and write permissions of the running simulation system are configured, and the incremental data in the target image is imported according to the incremental index table. This allows for processing data changes between one import and another, focusing on importing only modified data rather than repeatedly importing all data. This is highly efficient and resource-saving for large cloud image systems or those that require frequent updates.
[0058] In this phase, after the incremental merge of the file system is completed, the memory update is performed. First, the memory status is checked, and then the memory status is updated based on the search results.
[0059] First, when running a memory status check, the system applications or services whose memory status is affected by the file change are specifically detected, including checking cached data, configurations, or other data structures in memory.
[0060] Next, when the running memory status is updated, the memory data base pointer is updated first, that is, the backed-up running memory data is reloaded, and an independent logical address area is opened in the running memory of the target virtual machine. After the memory backup generated in the cloud image running memory initialization backup phase is imported into the area, the running memory base pointer offset operation is performed; then, based on the completion of the memory base pointer offset operation, the target virtual machine is woken up, that is, the sleep wake-up mechanism of the target virtual machine system is used to realize non-stop incremental simulation of the target virtual machine.
[0061] The cloud environment mirror data incremental simulation solution thus formed can perform electronic data simulation and analysis operations for the cloud environment. It can update the running cloud image without stopping the system, without restarting the cloud simulation or sandbox environment, and without interrupting the current running mirror system, thereby improving overall work efficiency.
[0062] The cloud environment image data incremental simulation solution provided in this example solution can be implemented as a corresponding software program, forming a corresponding cloud environment image data incremental simulation system. When running, this software program will execute the aforementioned cloud environment image data incremental simulation method and store the data in a corresponding storage medium for processor access and execution.
[0063] Referring to Figure 2, the cloud environment image data incremental simulation system 100 thus formed is functionally composed of three functional units: a cloud image system file-level comparison and marking unit 110, a cloud image running memory initialization data backup unit 120, and a virtual machine file-level incremental merging and memory update unit 130.
[0064] The cloud image system file-level comparison and marking unit 110 is specifically configured to identify and track file-level differences between the base version cloud image system and the target version cloud image system, and to mark and record them.
[0065] The cloud image running memory initialization data backup unit 120 is specifically configured to interact with the cloud image system file-level comparison and marking unit 110 for data, complete the backup of the data in the cloud image system running memory, and initialize the running memory of the running virtual machine.
[0066] The virtual machine file-level incremental merging and memory update unit 130 is specifically configured to interact with the cloud image system file-level comparison and marking unit 110 and the cloud image running memory initialization data backup unit 120 for data, and update the main file system one by one according to the detected incremental data to perform incremental merging of the file system; at the same time, check the running memory status, and if the running memory status is updated, reload the backed-up running memory data to perform memory update.
[0067] The following describes in detail the configuration of the cloud environment mirror data incremental simulation system 100.
[0068] In some embodiments, the cloud image system file-level comparison and marking unit 110 in the simulation system 100 is specifically composed of an image file comparison module 111 , a target image file scanning module 112 , a file fingerprint generation module 113 and a file-level difference recording module 114 .
[0069] The image file comparison module 111 is configured to perform differential comparison analysis on the target image and the system files included in the currently running virtual machine.
[0070] Image file comparison module 111 specifically compares the base version cloud image file with the target version cloud image file. The target virtual machine currently runs the base version image, and the system needs to complete the simulation of the target version cloud image. Image file comparison module 111 effectively determines the differences between the base version cloud image file and the target version cloud image file by performing a differential comparison analysis of the two versions.
[0071] Furthermore, the image file comparison module 111 determines the differences between the image files, specifically the comparison results of the same fingerprint files that have not been changed, different fingerprint files that have been modified, and files that have been added or deleted. All analysis results of changes, additions or deletions are marked and recorded.
[0072] The target image file scanning module 112 cooperates with the image file comparison module 111 to perform data interaction, and performs file-level scanning and analysis on the target image file, and performs traversal analysis on each file and directory.
[0073] When performing a file-level scan of the cloud image, the target image file scanning module 112 preferably performs the scan without actually running the cloud image. The target image file scanning module 112 utilizes the file system's traversal scanning tool to perform a traversal analysis of each file and directory of the cloud image, and cooperates with the file fingerprint generation module 113 to generate file fingerprints to obtain a file-level difference record table.
[0074] Furthermore, the target image file scanning module 112 can specifically process the image data of the virtual machine or container to parse the system image file and obtain the disk file directory structure and attributes in the target image.
[0075] The file fingerprint generation module 113 cooperates with the image file comparison module 111 and the target image file scanning module 112 to perform data interaction, determine incremental files, and generate fingerprint tags for the incremental files.
[0076] When the file fingerprint generation module 113 generates a file fingerprint for an incremental file, it can generate a unique fingerprint for the system files involved in the cloud image, thereby locating and distinguishing the files.
[0077] Furthermore, the file fingerprint generation module 113 preferably uses a hash function to generate the file fingerprint, such as MD5, SHA-1 or SHA-256, but is not limited thereto.
[0078] The file-level difference recording module 114 cooperates with the image file comparison module 111 , the target image file scanning module 112 and the file fingerprint generation module 113 to perform data interaction and form a file-level difference recording table.
[0079] The file-level difference recording module 114 can mark and record the differences between the mirror files, including the comparison results of the same fingerprint files that have not been changed, different fingerprint files that have been modified, and files that have been added or deleted, and the analysis results of all changes, additions or deletions, and form a corresponding file-level difference record table accordingly.
[0080] The file-level difference record table formed contains three types of information: file name, file address, and file fingerprint. The file fingerprint is obtained by calculating the basic attributes of the file such as name, size, and time without parsing the file content, so as to ensure the efficiency and accuracy of text comparison marking and updating.
[0081] In some embodiments, the cloud image running memory initialization data backup unit 120 in the simulation system 100 is specifically composed of a cloud resource configuration module 121, a temporary space virtual machine sleep operation module 122 and a memory data initialization backup module 123.
[0082] The cloud resource configuration module 121 is configured to open a temporary virtual space in the cloud environment, load the target image file, and run the temporary virtual machine.
[0083] The cloud resource configuration module 121 can specifically dynamically configure storage and computing resources in the cloud environment to allocate appropriate computing, storage and network resources to applications or services requested by users, ensuring that cloud platform resources are used in the most efficient manner.
[0084] The temporary space virtual machine sleep operation module 122 is configured to interact with the cloud resource configuration module 121 for data, and can operate the temporary virtual machine configured and run by the cloud resource configuration module 121 to enter a sleep state based on the built-in sleep mechanism of the operating system.
[0085] The memory data initialization backup module 123 is configured to interact with the temporary space virtual machine sleep operation module 122 for data, and after the temporary space virtual machine sleep operation module 122 operates the temporary virtual machine to enter the sleep state, based on the sleep mechanism of the temporary virtual machine operating system, to obtain a running memory backup with a continuous logical address.
[0086] Furthermore, the memory data initialization backup module 123 can effectively load and update the runtime memory data for a virtual machine or container in a cloud environment or a virtualized environment, ensuring that any changes made in persistent storage (such as changes to an image or snapshot) can be correctly initialized into the memory of the image system instance to be analyzed.
[0087] In some implementations, the virtual machine file-level incremental merging and memory update unit 130 in the simulation system 100 is specifically composed of a file system incremental merging module 131 and a memory update module 132 .
[0088] The file system incremental merge module 131 is configured to interact with the cloud image system file-level comparison and marking unit 110 to perform data, update the main file system one by one according to the detected incremental data, and perform an incremental merge operation on the file system.
[0089] Specifically, the file system incremental merge module 131 operates the disk system of the target virtual machine based on the file and difference record table generated by the cloud image system file-level comparison marking unit 110, loads the difference files recorded in the table in an overwrite write manner, and implements incremental merge.
[0090] As a further explanation, when the file system incremental merge module 131 performs a file system incremental merge, it first performs a file system incremental calculation. By comparing the incremental data between the target image file and the currently running system file, it calculates the data resource global identifier and generates an incremental index table (corresponding to the file-level difference record table). Then, based on this, by configuring the file read and write permissions of the currently running virtual machine system, it imports the incremental data in the target image according to the incremental index table. This can process data changes that occur between one import and another, focusing on importing only the modified data rather than repeatedly importing all data. This is efficient and resource-saving for large cloud image systems or cloud image systems that require frequent updates.
[0091] The memory update module 132 is configured to interact with the file system incremental merge module 131 and the cloud image running memory initialization data backup unit 120 to perform data. After the file system incremental merge module 131 completes the virtual machine file level incremental merge, it can check the running memory status at the same time. If the running memory status is updated, it reloads the backed up running memory data to perform memory update.
[0092] When running the memory status check, the memory update module 132 specifically detects system applications or services whose memory status is affected by file changes, including checking cached data, configurations, or other data structures in the memory.
[0093] When the memory update module 132 performs an update of the running memory state, it specifically does so by updating the memory data base pointer and waking up the target virtual machine. When the memory update module 132 performs an update of the memory data base pointer, i.e., reloading the backed-up running memory data, creating an independent logical address area in the running memory of the target virtual machine, importing the memory backup generated during the initialization and backup phase of the cloud image running memory into this area, and then performing an offset operation on the running memory base pointer. Then, upon completing the memory base pointer offset operation, the target virtual machine is woken up, i.e., utilizing the sleep-wake-up mechanism of the target virtual machine system to achieve non-stop incremental simulation of the target virtual machine.
[0094] The cloud environment image data incremental simulation system thus formed uses a cloud image comparison and marking unit to identify and track file-level differences between the base version cloud image system and the target version cloud image system during operation, and records these differences. The cloud image running memory initialization backup unit backs up the data in the cloud image system's running memory and initializes the running memory of the virtual system running in the cloud environment. On this basis, the virtual machine system's file-level incremental merging and memory update unit updates the main file system one by one based on the detected incremental data, while switching the running memory data by updating the base pointer. This ultimately achieves incremental simulation of cloud environment image data. This allows the running cloud image to be updated without shutting down, without restarting the cloud simulation or sandbox environment, and without interrupting the current running image system, thereby improving overall work efficiency.
[0095] Finally, it should be noted that an embodiment of the present invention further provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps of the implementation method of the above-mentioned cloud environment mirror data incremental simulation solution.
[0096] An embodiment of the present invention further provides a processor, which is used to run a program, wherein when the program is run, the steps of the implementation method of the above-mentioned cloud environment mirror data incremental simulation solution are executed.
[0097] An embodiment of the present invention also provides a terminal device, which includes a processor, a memory, and a program stored in the memory and runnable on the processor. The program code is loaded and executed by the processor to implement the steps of the implementation method of the above-mentioned cloud environment mirror data incremental simulation solution.
[0098] The present invention also provides a computer program product which, when executed on a data processing device, is suitable for executing the steps of the implementation method of the above-mentioned cloud environment mirror data incremental simulation solution.
[0099] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.
[0100] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.
[0101] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0102] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products of the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.
[0103] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.
[0104] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.
[0105] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.
[0106] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.
[0107] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.
[0108] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.
[0109] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0110] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the foregoing embodiments. The foregoing embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.
Claims
1. A cloud environment mirror data incremental simulation method, characterized in that: The simulation method comprises: Cloud image system file-level comparison marking, identifying and tracking file-level differences between the base version cloud image system and the target version cloud image system, and marking and recording them; The cloud image running memory initialization data backup backs up the data in the target cloud image system running memory and performs initialization operations on the running memory of the target virtual system running in the cloud environment; Virtual machine file-level incremental merging and memory updates: Based on the detected incremental data, the main file system is updated one by one, and the file system is incrementally merged. At the same time, the running memory status is checked, and when the running memory status is updated, the backed-up running memory data is reloaded to perform memory updates.
2. The cloud environment mirror data incremental simulation method according to claim 1, characterized in that: In the cloud image system file-level comparison and marking stage, the simulation method implements differential comparative analysis on the target image and the system files contained in the currently running virtual machine. After file-level scanning and analysis, fingerprint marks are generated for incremental files to form a file-level difference record table.
3. The cloud environment mirror data incremental simulation method according to claim 2, characterized in that: The file-level difference record table includes three types of information: file name, file address, and file fingerprint.
4. The cloud environment mirror data incremental simulation method according to claim 1, characterized in that: The method opens a temporary virtual space in the cloud environment during the data backup phase of cloud image running memory initialization, loads the target image, runs the temporary virtual machine, and operates the temporary space virtual machine to enter a sleep state to temporarily solidify the running memory.
5. The cloud environment mirror data incremental simulation method according to claim 4, characterized in that: The method is based on the sleep mechanism of the temporary space virtual machine operating system to obtain a running memory backup with continuous logical addresses.
6. The virtual machine image data incremental simulation method according to claim 1, characterized in that: When performing virtual machine file-level incremental merging in the virtual machine file-level incremental merging and memory update stages, the simulation method operates the disk system of the target virtual machine based on the files and difference record table generated in the cloud image comparison and marking stage, loads the difference files recorded in the table in an overwrite write manner, and implements incremental merging.
7. The virtual machine image data incremental simulation method according to claim 1, characterized in that: The simulation method switches running memory data by updating the basic pointer when performing memory update in the virtual machine file level incremental merging and memory update phase.
8. A cloud environment mirror data incremental simulation system, characterized in that: The simulation system is composed of a cloud image system file-level comparison and marking unit, a cloud image running memory initialization data backup unit, and a virtual machine file-level incremental merging and memory update unit. The cloud mirror system file-level comparison and marking unit is configured to identify and track file-level differences between the base version cloud mirror system and the target version cloud mirror system, and mark and record them; The cloud image running memory initialization data backup unit is configured to perform data interaction with the cloud image system file level comparison and marking unit, complete the backup of the data in the cloud image system running memory, and initialize the running memory of the running virtual machine; The virtual machine file-level incremental merging and memory update unit is configured to interact with the cloud image system file-level comparison and marking unit and the cloud image running memory initialization data backup unit to perform data, and update the main file system one by one according to the detected incremental data to perform incremental merging of the file system; at the same time, check the running memory status, and if the running memory status is updated, reload the backed up running memory data to perform memory update.
9. A terminal device comprising a processor, a memory, and a program stored in the memory and executable on the processor, characterized in that: The program code is loaded by the processor and executes the implementation steps of the virtual machine image data incremental simulation method according to any one of claims 1 to 7.
10. A computer program product, when executed on a data processing device, characterized in that The method is suitable for executing the implementation steps of the method for incremental simulation of virtual machine image data as described in any one of claims 1 to 7.
Citation Information
Patent Citations
Virtual machine mirror image updating method, server and desktop cloud system
CN103218248A
Method for running tabletop virtual system on client side and client side
CN103593227A
System mirror image file updating method of virtual machine, cloud data center and system
CN105094948A
Android application cloud data forensics analysis system and method based on application data simulation
CN109614203A
Computer evidence obtaining method and device
CN114417330A