CN103530572A - Method for protecting virtual machine files and user terminal - Google Patents

Abstract

The present invention provides a virtual machine file protection method and a user terminal, wherein the method includes: the user terminal obtains a key during the process of running the operating system kernel file of the virtual machine, wherein the key is for the virtual machine The operating system main file and the user file stored in the virtual machine are encrypted using the key; verify whether the decryption key sent by the user is legal according to the key, and if so, the operating system main file and The user files are decrypted. Through the virtual machine file protection method and the user terminal provided by the present invention, the operating system files and user files in the virtual machine are bound and protected, preventing malicious users from deciphering and attacking the virtual machine from other controllable operating systems. User files, improving the security of user files.

Description

Virtual machine file protection method and user terminal

technical field

The embodiment of the present invention relates to the field of computer technology, and in particular to a virtual machine file protection method and a user terminal.

Background technique

With the advent of the era of cloud computing, more and more enterprises move their employees' computers to the cloud through virtual machines, and employees access the desktops of remote virtual machines through a very cheap client computer, which can greatly reduce the cost of Maintenance costs for employee computers.

The virtual hard disk of the virtual machine exists in the cloud in the form of files, especially for the virtual machines of employees who store sensitive data, which poses a great threat to information security. Malicious users can easily access the virtual machine from the client and obtain information stored in the virtual machine. The files in the hard disk or arbitrarily modify the files in it. And the existing solution is that the user only encrypts the user files in the virtual machine, which cannot prevent malicious users from entering the virtual machine from other operating systems to decipher and attack the user files in the virtual machine.

Contents of the invention

In view of the above-mentioned defects in the prior art, embodiments of the present invention provide a virtual machine file protection method and a user terminal.

One aspect of the present invention provides a virtual machine file protection method, including:

The user terminal obtains the key during the process of running the operating system kernel file of the virtual machine, wherein the key is used for encrypting the main operating system file of the virtual machine and user files stored in the virtual machine the key;

The user terminal verifies whether the decryption key sent by the user is legal according to the key, and if so, decrypts the operating system main file and the user file.

Another aspect of the present invention provides a user terminal, including:

An acquisition module, configured to acquire a key during the process of running the operating system kernel file of the virtual machine, wherein the key is to perform a key operation on the main operating system file of the virtual machine and user files stored in the virtual machine keys used for encryption processing;

A processing module, configured to verify whether the decryption key sent by the user is legal according to the key, and if so, decrypt the operating system main file and the user file.

The virtual machine file protection method and the user terminal provided by the embodiment of the present invention obtain and encrypt the main file of the operating system of the virtual machine and the user files stored in the virtual machine through the user terminal in the process of running the operating system kernel file of the virtual machine The key used for processing, if the decryption key sent by the user is verified according to the key, the main file of the operating system and the user file will be decrypted. Provides certain protection to prevent malicious users from deciphering and attacking user files in the virtual machine from other controllable operating systems, improving the security of user files.

Description of drawings

Fig. 1 is a flowchart of a virtual machine file protection method provided by an embodiment of the present invention;

FIG. 2 is a flow chart of another virtual machine file protection method provided by an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a user terminal provided by an embodiment of the present invention.

Detailed ways

Fig. 1 is a flowchart of a virtual machine file protection method provided by the embodiment of the present invention, as shown in Fig. 1, the method includes:

Step 100, the user terminal obtains the key during the process of running the operating system kernel file of the virtual machine, wherein the key is the key of the main file of the operating system of the virtual machine and the user file stored in the virtual machine keys used for encryption processing;

The virtual machine stored in the cloud stores the main file of the operating system and user files. In order to prevent malicious users from easily accessing the virtual machine from other controllable operating systems, obtaining files stored in the virtual machine or arbitrarily modifying the files inside, It is necessary to encrypt the main operating system files and user files stored in the virtual machine as a whole, and embed the encryption key in the operating system kernel file, and modify the entry address of the operating system of the virtual machine to the kernel of the operating system document. Wherein, it should be noted that the key used for encrypting the operating system main file of the virtual machine and the user files stored in the virtual machine can be embedded in the operating system kernel file in various ways according to actual application needs , such as through a user terminal or a virtual machine management platform, the user terminal is used as an example to illustrate the following: when a legitimate user accesses the corresponding virtual machine through the user terminal to complete the user file processing work, an encryption operation including a key is sent to the user terminal, and when the user terminal After receiving the encryption operation including the key sent by the user, call the preset disk encryption program, apply the key to encrypt the main file of the operating system of the virtual machine and the user file, and embed the key in the operating system of the virtual machine In the kernel file, the processed operating system main file, user file and operating system kernel file are stored in the cloud.

The process for the user to access the above-mentioned encrypted virtual machine through the client computer is as follows. The user terminal loads the operating system kernel file of the virtual machine into the memory according to the entry address of the virtual machine operating system, and then runs the operating system kernel file to obtain the encrypted password. key, which is used to encrypt the main file of the operating system in the virtual machine and the user files stored in the virtual machine in advance.

Step 101, the user terminal verifies whether the decryption key sent by the user is legal according to the key, and if so, decrypts the operating system main file and the user file.

After the user terminal finishes running the operating system kernel file, the user will be prompted to enter the decryption key through the interface, and the user will input the decryption key through the user terminal according to the prompt information, so that the user terminal receives the decryption key sent by the user through the user terminal, including the decryption key. instruction, the decryption instruction is used to decrypt the pre-encrypted operating system main file and user file. The user terminal compares the key obtained by running the operating system kernel file with the decryption key in the decryption command sent by the user to verify whether the decryption key is legal. If the comparison results are consistent, it means that the decryption key is legal. The main file of the system and the user file are decrypted, so that the user terminal loads the main file of the operating system of the virtual machine into the memory, and then runs the main file of the operating system to start the operating system of the virtual machine. After the operating system is started, the user can normally access the virtual machine according to Obtain user files according to your own needs.

In the virtual machine file protection method provided in this embodiment, the user terminal obtains the encryption key used for encrypting the main file of the operating system of the virtual machine and the user files stored in the virtual machine during the process of running the operating system kernel file of the virtual machine. key, if it is verified that the decryption key sent by the user is legal according to the key, the main file of the operating system and the user file will be decrypted, realizing the binding protection of the operating system file and user file in the virtual machine, avoiding Malicious users decipher and attack user files in virtual machines from other controllable operating systems, improving the security of user files.

Based on the above embodiments, those skilled in the art can understand that, according to different operating system programming, the key used for encrypting the operating system main file of the virtual machine and the user files stored in the virtual machine is embedded in the The specific form of expression in the operating system kernel file is not limited to one, such as: layered call, shell program call, etc., the following uses the way of shell program call as an example, and uses the embodiment shown in Figure 2 to illustrate in detail, Figure 2 is The flow chart of another virtual machine file protection method provided by the embodiment of the present invention is shown in FIG. The key used for encrypting user files is embedded in the kernel file of the operating system, and the method includes:

Step 200, the user terminal sends an encryption operation including virtual machine identification information to the virtual machine management platform, so that the virtual machine management platform can obtain a key corresponding to the virtual machine identification information according to the locally pre-stored user registration information, and apply The key encrypts the operating system master file of the virtual machine corresponding to the virtual machine identification information in the cloud storage and the user files stored in the virtual machine, and embeds the key in the virtual machine. In the kernel file of the operating system of the machine;

After the legal user accesses the corresponding virtual machine through the user terminal and completes the user file processing work, it sends an encryption operation including the identification information of the virtual machine to the virtual machine management platform, and the virtual machine management platform parses the obtained encryption operation to obtain the identification information of the virtual machine. Then obtain the key corresponding to the virtual machine identification information sent by the user terminal according to the user registration information stored in advance locally, apply the key to host the operating system of the virtual machine corresponding to the virtual machine identification information in the cloud storage by adding a shell program Files and user files stored in the virtual machine are encrypted, and the shell program is embedded in the kernel file of the operating system, and the information of the first sector of the operating system is modified to the entry address of the shell program, wherein the shell program Including the subroutine for obtaining the key, the subroutine for decrypting and the subroutine for encrypting, wherein the subroutine for obtaining the key is used to obtain the key used for encrypting the main file of the operating system and the user file; the subroutine for decrypting is used for operating Decryption subroutine for decrypting system main files and user files; encryption subroutine for encrypting user files to be stored in the virtual machine using the key used to encrypt operating system main files and user files .

Step 201, the user terminal jumps to the preset entry point of the shell program during running the operating system kernel file, and calls the key acquisition subroutine to acquire the key;

The user terminal loads the operating system kernel file in the virtual machine into the memory, then runs the operating system kernel file, jumps to the preset entry point of the shell program during the running of the operating system kernel file, and runs the shell program The subroutine for obtaining the key in the key obtains the key, and the obtained key is the key used by the virtual machine management platform to encrypt the operating system main file and user file in the virtual machine in advance.

Step 202, the user terminal verifies whether the decryption key sent by the user is legal according to the key, and if so, runs a decryption subroutine for decrypting the operating system main file and the user file;

After the user terminal finishes running the operating system kernel file, the user will be prompted to input the decryption key through the interface, and the user will input the decryption key through the user terminal according to the prompt information, so that the user terminal receives the decryption instruction including the decryption key sent by the user terminal, The user terminal compares the key obtained by running the key acquisition subroutine with the decryption key in the decryption command to verify whether the decryption key is legal. If the comparison results are consistent, it means that the decryption key is legal. The decryption subroutine for decrypting the main file of the operating system and the user file, so that the user terminal loads the main file of the operating system into the memory, and then runs the main file of the operating system to start the operating system. After the operating system is started, the user can normally access the virtual machine according to its own Requires access to user files.

Step 203, after the operating system is started, the user terminal invokes the encryption subroutine and applies the key to encrypt the user file to be stored in the virtual machine according to the storage instruction sent by the user through the user terminal.

After the user terminal loads the main file of the operating system and starts the operating system, the user can process the file through the user terminal. When the user terminal receives the storage command sent by the user, it runs the encryption subroutine in the shell program, so as to apply the previous encryption of the operating system. The user file to be stored in the virtual machine is encrypted with a key used for encryption of the main file and the user file before being stored in the virtual machine.

In the virtual machine file protection method provided in this embodiment, by adding a shell program to the operating system main file and user files in the virtual machine in advance for encryption, and embedding the shell program in the operating system kernel file, the user terminal runs the operating system The shell program in the kernel file obtains the key. If the decryption key sent by the user through the user terminal is verified according to the key, it can be decrypted by running the decryption subroutine in the shell program, and can be decrypted by running the encryption subroutine in the shell program. Encrypt the files to be stored in the virtual machine. The binding protection of operating system files and user files in the virtual machine is realized, preventing malicious users from deciphering and attacking user files in the virtual machine from other controllable operating systems, and improving the security of user files.

Those of ordinary skill in the art can understand that all or part of the steps to realize the above method embodiments can be completed by program instructions related hardware, the aforementioned program can be stored in a user terminal readable storage medium, and when the program is executed, Execution includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

FIG. 3 is a schematic structural diagram of a user terminal provided by an embodiment of the present invention. As shown in FIG. 3 , the user terminal includes: an acquisition module 11 and a processing module 12, wherein the acquisition module 11 is used to run the operating system kernel of the virtual machine In the process of obtaining the key, the key is the key used to encrypt the operating system master file of the virtual machine and the user file stored in the virtual machine; the processing module 12 is used to The key verifies whether the decryption key sent by the user is legal, and if so, decrypts the operating system main file and the user file.

For the functions and processing flow of each module in the user terminal provided in this embodiment, refer to the method embodiment shown in FIG. 1 above. The implementation principles and technical effects are similar, and will not be repeated here.

It should be noted that the key used for encrypting the main file of the operating system of the virtual machine and the user files stored in the virtual machine can be embedded in the kernel file of the operating system in various ways according to actual application needs. described as follows:

Situation 1: When the execution subject is a virtual machine management platform, after the legal user accesses the corresponding virtual machine through the user terminal and completes the user file processing work, the processing module 12 is also used to: send the encrypted file including the identification information of the virtual machine to the virtual machine management platform. Operation, so that the virtual machine management platform obtains the key corresponding to the virtual machine identification information according to the local pre-stored user registration information, and applies the key to the virtual machine corresponding to the virtual machine identification information in the cloud storage. The main file of the operating system of the computer and the user file stored in the virtual machine are encrypted, and the key is embedded in the kernel file of the operating system of the virtual machine.

Situation 2: When the execution subject is the user terminal, after the legitimate user accesses the corresponding virtual machine through the user terminal to complete the user file processing work, the processing module 12 is also used to: receive the encryption operation including the key sent by the user; call the preset A disk encryption program that applies the key to encrypt the operating system main file and the user file, and embeds the key in the operating system kernel file of the virtual machine, and encrypts all processed files The operating system main file, the user file and the operating system kernel file are stored in the cloud.

Based on the above embodiments, those skilled in the art can understand that, according to different operating system programming, the key used for encrypting the operating system main file of the virtual machine and the user files stored in the virtual machine is embedded in the The specific form of expression in the operating system kernel file is not limited to one, such as: layered call, shell program call, etc., the following uses the way of shell program call as an example to illustrate: that is, the operating system kernel file includes shell programs, so Include in the shell program: key acquisition subroutine and decryption subroutine, then acquisition module 11 is specifically used for:

Jumping to the preset entry point of the shell program during the process of running the operating system kernel file;

calling the key acquisition subroutine to acquire the key;

The processing module 12 is specifically used for:

If it is verified according to the key that the decryption key is legal, the decryption subroutine is invoked to decrypt the operating system main file and the user file.

Further, the shell program also includes: an encryption subroutine;

After the decryption processing of the operating system main file and the user file, the processing module 12 is further configured to: call the encryption subroutine according to the storage instruction sent by the user, apply the key to the file to be stored The user files are encrypted and stored in the virtual machine.

For the functions and processing flow of each module in the user terminal provided in this embodiment, refer to the method embodiment shown in FIG. 2 above. The implementation principles and technical effects are similar, and will not be repeated here.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (10)

1. A virtual machine file protection method, characterized in that, comprising: The user terminal obtains the key during the process of running the operating system kernel file of the virtual machine, wherein the key is used for encrypting the main operating system file of the virtual machine and user files stored in the virtual machine the key; The user terminal verifies whether the decryption key sent by the user is legal according to the key, and if so, decrypts the operating system main file and the user file. 2. The virtual machine file protection method according to claim 1, wherein, before the obtaining the key, the method further comprises: The user terminal sends an encryption operation including virtual machine identification information to the virtual machine management platform, so that the virtual machine management platform obtains a key corresponding to the virtual machine identification information according to the locally pre-stored user registration information, and applies the The key encrypts the operating system master file of the virtual machine corresponding to the virtual machine identification information in the cloud storage and the user file stored in the virtual machine, and embeds the key in the virtual machine in the kernel file of the operating system. 3. The virtual machine file protection method according to claim 1, wherein, before the obtaining the key, the method further comprises: The user terminal receives the encryption operation including the key sent by the user; The user terminal invokes a preset disk encryption program, applies the key to encrypt the operating system main file and the user file, and embeds the key in the operating system kernel file of the virtual machine , and perform cloud storage on the processed operating system main file, the user file and the operating system kernel file. 4. The virtual machine file protection method according to any one of claims 1-3, wherein the operating system kernel file includes a shell program, and the shell program includes: a key acquisition subroutine and a decryption subroutine ; The user terminal obtaining the key during the process of running the operating system kernel file of the virtual machine specifically includes: The user terminal jumps to the preset entry point of the shell program during the process of running the operating system kernel file; The user terminal calls the key acquisition subroutine to acquire the key; The decryption process includes: If the user terminal verifies that the decryption key is legal according to the key, it calls the decryption subroutine to decrypt the operating system main file and the user file. 5. The virtual machine file protection method according to claim 4, wherein the shell program further comprises: an encryption subroutine; After the decryption processing of the operating system main file and the user file, the method further includes: The user terminal invokes the encryption subroutine according to the storage instruction sent by the user, applies the key to encrypt the user file to be stored, and stores it in the virtual machine. 6. A user terminal, characterized in that, comprising: An acquisition module, configured to acquire a key during the process of running the operating system kernel file of the virtual machine, wherein the key is to perform a key operation on the main operating system file of the virtual machine and user files stored in the virtual machine keys used for encryption processing; A processing module, configured to verify whether the decryption key sent by the user is legal according to the key, and if so, decrypt the operating system main file and the user file. 7. The user terminal according to claim 6, wherein, before said obtaining the key, said processing module is further configured to: sending an encryption operation including the virtual machine identification information to the virtual machine management platform, so that the virtual machine management platform obtains a key corresponding to the virtual machine identification information according to the local pre-stored user registration information, and applies the key pair The operating system master file of the virtual machine corresponding to the virtual machine identification information in the cloud storage and the user file stored in the virtual machine are encrypted, and the key is embedded in the operating system kernel of the virtual machine in the file. 8. The user terminal according to claim 6, wherein, before said acquiring the key, said processing module is further configured to: Receive the encryption operation including the key sent by the user; Invoke a preset disk encryption program, apply the key to encrypt the operating system main file and the user file, and embed the key in the operating system kernel file of the virtual machine, and The processed operating system main file, the user file and the operating system kernel file are stored in the cloud. 9. The user terminal according to any one of claims 6-8, wherein the operating system kernel file includes a shell program, and the shell program includes: a key acquisition subroutine and a decryption subroutine, the Get modules specifically for: Jumping to the preset entry point of the shell program during the process of running the operating system kernel file; calling the key acquisition subroutine to acquire the key; The processing module is specifically used for: If it is verified according to the key that the decryption key is legal, the decryption subroutine is invoked to decrypt the operating system main file and the user file. 10. The user terminal according to claim 9, wherein the shell program further comprises: an encryption subroutine; After decrypting the operating system main file and the user file, the processing module is further configured to: The encryption subroutine is invoked according to the storage instruction sent by the user, and the user file to be stored is encrypted by applying the key and stored in the virtual machine.

Images