CN104954137A - Method of virtual machine security certification based on domestic password technique - Google Patents

Abstract

The invention discloses a method of virtual machine security certification based on a domestic password technique, which belongs to the field of technical security of computers. According to the method, on the basis of cloud computing, a security certification resource pool is set, a trusted root certificate is issued by a national electronic certification system, a digital certificate is issued to each virtual machine by the security certification resource pool, and the binding with the digital certificate is realized through a driver in a virtual machine operating system, so that encryption transmission and integrity verification of interactive data information between virtual machines as well as the virtual machine and a terminal user are realized, security applications to identity authentication, access control and data encryption transmission are satisfied, identity cheat, illegal resource access and transmission data leakage are prevented, and the identity reality is distinguished. The method is a most effective scheme for solving cloud computing security and has the advantages of convenience and easiness in use.

Description

A method of virtual machine security authentication based on domestic encryption technology

technical field

The invention discloses a virtual machine security authentication method, which belongs to the field of computer technology security, and specifically relates to a virtual machine security authentication method based on domestic encryption technology.

Background technique

The widespread use of cloud computing and virtual technology can effectively save the investment in physical hardware equipment and make full use of the hardware resources of physical hardware equipment, so as to achieve the purpose of energy saving, emission reduction and efficiency improvement. In a cloud computing environment, application services are provided to users by generating and managing virtual machines one by one. Cloud computing provides services by deploying a large number of virtual machines, and the information exchange between the virtual machines is exchanged in clear text, but at the same time, it cannot confirm that each virtual machine is authentic, and currently lacks the necessary security Authentication management measures cannot establish an effective access control mechanism when end users use services or resources in virtual machines, which directly leads to a series of security problems in cloud computing services, such as the identity cannot be confirmed, and data transmission in plain text has security risks. . In order to ensure the trusted interaction between the inside and outside of cloud computing, improve cloud computing security management capabilities, and prevent illegal theft of cloud computing resources, the present invention provides a virtual machine security authentication method based on domestic cryptography technology. Combining electronic authentication and trusted computing technology, a security authentication resource pool suitable for cloud computing application requirements is established to meet the security applications of identity authentication, access control and data encryption transmission, and to solve the identity authentication and access of each virtual machine in the cloud computing environment. It is the most effective solution to cloud computing security to solve the problem of control and data encryption transmission, prevent identity counterfeiting, illegal resource access and leak of transmitted data, and identify the authenticity of identity, and it is convenient and easy to use.

Contents of the invention

The present invention aims at a series of security problems such as the inability to establish an effective access control mechanism when terminal users use resources in services or virtual machines, the identity of cloud computing services cannot be confirmed, and potential safety hazards when data is transmitted in plain text. The virtual machine security authentication method based on domestic cryptography technology, based on domestic cryptography technology, combined with electronic authentication and trusted computing technology, establishes a security authentication resource pool suitable for cloud computing application requirements to meet the requirements of identity authentication, access control and data encryption transmission. The security application solves the problems of identity authentication, access control and data encryption transmission of each virtual machine in the cloud computing environment.

The concrete scheme that the present invention proposes is:

A virtual machine security authentication method based on domestic cryptographic technology, by establishing a security authentication resource pool based on cloud computing, to perform security authentication on virtual machines; the security authentication resource pool consists of a physical device layer and a middleware layer, and the physical device layer passes The device implements basic functions, the middleware layer realizes the authentication of digital certificates, and the functions of key encryption and decryption, and the physical device layer communicates with the virtual machine through the middleware layer;

The national electronic certification system issues trusted root certificates to the security certification resource pool, and the security certification resource pool distributes digital certificates to virtual machines for identity authentication and encrypted communication with other virtual machines or terminal users. When users exchange information, digital certificates are used to identify the identities of both parties, and those who fail to pass the verification cannot access; when information is exchanged, the security authentication resource pool provides virtual machines with identity authentication, access control, and data encryption transmission services.

The process of issuing a data certificate for the virtual machine is as follows: the virtual machine establishes communication with the security authentication resource pool, provides the name of the virtual machine to the security authentication resource pool, and the security authentication resource pool allocates the digital certificate of the virtual machine, and installs the digital certificate in the virtual machine to operate The driver in the system is used to realize automatic loading and importing.

The virtual machine performs identity authentication with other virtual machines, first exchanges digital certificates, and then verifies whether the digital certificates of the exchanged virtual machines are consistent with those assigned by trusted root certificates through the trusted root certificates in the security authentication resource pool.

The virtual machine communicates encrypted with other virtual machines or end users, and all interactive data information adopts digital envelope technology and digital signature technology to realize encrypted transmission and integrity verification of information.

The process of encrypted communication between the virtual machine and other virtual machines is as follows: both communicating virtual machines generate private keys and symmetric keys, and the first virtual machine receives plaintext data to generate a first message digest, which is encrypted with its own private key After that, the first data signature is generated, and the plaintext data is encrypted with a symmetric key to generate ciphertext data, and the digital certificate of the second virtual machine is used to encrypt the symmetric key to generate a digital envelope; the digital envelope uses the private key of the second virtual machine The key is decrypted into a symmetric key, and then the second virtual machine decrypts the received ciphertext data into plaintext data using the symmetric key, and then generates the second message digest, and the first digital signature uses the digital certificate of the first virtual machine Decrypt the first message digest and compare it with the second message digest, and pass if they agree.

The trusted root certificate of the security authentication resource pool includes the name and domain name information of the cloud computing where it is located; the digital certificate of the virtual machine includes the name information of the virtual machine.

The security authentication resource pool supports domestic cryptographic algorithms, including SM1, SM2, SM3, and SM4.

The benefits of the present invention are: the present invention is based on cloud computing, and a security authentication resource pool is set. The national electronic certification system issues a trusted root certificate, and the security authentication resource pool issues a digital certificate for each virtual machine. The driver realizes the binding with the digital certificate, so that all interactive data information between virtual machines and between virtual machines and end users adopts digital envelope technology and digital signature technology to realize encrypted transmission of information and Integrity verification ensures that the transmitted information cannot be seen by a third party, and at the same time ensures that the transmitted information is not lost, to meet the security application of identity authentication, access control and data encryption transmission, and to solve the identity authentication of each virtual machine in the cloud computing environment , access control and data encryption transmission issues, to prevent identity counterfeiting, and illegal resource access and transmission data leakage, and to identify the authenticity of identity is the most effective solution to cloud computing security, and it is convenient and easy to use.

Description of drawings

Fig. 1 is a schematic diagram of the composition framework of the security authentication resource pool of the present invention;

Fig. 2 is a schematic diagram of a virtual machine digital certificate issuance process of the present invention;

Fig. 3 is a schematic diagram of identity authentication between virtual machines of the present invention;

Fig. 4 is a schematic diagram of encrypted data transmission and signature verification between virtual machines in the security authentication resource pool of the present invention.

Detailed ways

The present invention will be further described in conjunction with the accompanying drawings.

A method for virtual machine security authentication based on domestic cryptographic technology, by establishing a security authentication resource pool based on cloud computing, wherein the security authentication resource pool supports domestic cryptographic algorithms, including SM1, SM2, SM3, and SM4, to perform security authentication on virtual machines ;Security authentication resource pool is composed of physical device layer and middleware layer. The physical device layer realizes basic functions through devices, and the middleware layer realizes the functions of digital certificate authentication and key encryption and decryption. The physical device layer and virtual machine pass through the middleware layer. communicate;

The national electronic certification system issues trusted root certificates to the security certification resource pool, and the security certification resource pool distributes digital certificates to virtual machines for identity authentication and encrypted communication with other virtual machines or terminal users. When users exchange information, digital certificates are used to identify the identities of both parties, and those who fail to pass the verification cannot access; when information is exchanged, the security authentication resource pool provides virtual machines with identity authentication, access control, and data encryption transmission services. The trusted root certificate of the security authentication resource pool contains the name and domain name information of the cloud computing where it is located; the digital certificate of the virtual machine contains the name information of the virtual machine.

The process of assigning a data certificate to a virtual machine is as follows: the virtual machine establishes communication with the security authentication resource pool, provides the name of the virtual machine to the security authentication resource pool, and the security authentication resource pool allocates the digital certificate of the virtual machine, and installs it in the virtual machine operating system. The driver in to achieve automatic loading and importing;

The virtual machine and other virtual machines perform identity authentication, first exchange digital certificates, and then verify whether the digital certificates of the virtual machines obtained by the exchange are consistent with those assigned by the trusted root certificates through the trusted root certificates in the security authentication resource pool.

The virtual machine communicates encrypted with other virtual machines or end users. All interactive data information adopts digital envelope technology and digital signature technology to realize encrypted transmission and integrity verification of information.

Specifically, referring to virtual machine V1 and virtual machine 2 in Figure 4, the process of encrypted communication is as follows: both communicating virtual machines generate a private key and a symmetric key, that is, virtual machine V1 generates a private key kv1, that is, virtual machine V2 generates a private key key kv2, and generate a symmetric key E1, where the digital certificates of virtual machine V1 and virtual machine V2 are Cv1 and Cv2. Virtual machine V1 generates message digest H1 from the received plaintext data, encrypts it with private key kv1 to generate data signature S1, and at the same time encrypts the plaintext data with symmetric key E1 to generate ciphertext data, uses the digital certificate Cv2 of virtual machine V2 to encrypt the symmetric key The key E1 is encrypted to generate a digital envelope; the digital envelope is decrypted into a symmetric key E1 with the private key kv2 of the virtual machine V2, and then the virtual machine V2 decrypts the received ciphertext data into plaintext data with the symmetric key E1, and then generates a message digest H2, The digital signature S1 uses the digital certificate kv1 of the virtual machine V1 to decrypt the message digest H1 and compare it with the message digest H2, and if they agree, it is passed. Ensure that the transmitted information cannot be seen by third parties, and at the same time ensure that the transmitted information will not be lost.

Claims (7)

1. A method for virtual machine security authentication based on domestic cryptographic technology is characterized in that: by setting up a security authentication resource pool based on cloud computing, the virtual machine is safely authenticated; the security authentication resource pool consists of a physical device layer and a middleware layer Composition, the physical device layer implements basic functions through the device, the middleware layer realizes the functions of digital certificate authentication and key encryption and decryption, and the physical device layer communicates with the virtual machine through the middleware layer; The national electronic certification system issues trusted root certificates to the security certification resource pool, and the security certification resource pool distributes digital certificates to virtual machines for identity authentication and encrypted communication with other virtual machines or terminal users. When users exchange information, digital certificates are used to identify the identities of both parties, and those who fail to pass the verification cannot access; when information is exchanged, the security authentication resource pool provides virtual machines with identity authentication, access control, and data encryption transmission services. 2. The method of a virtual machine security authentication based on domestic encryption technology according to claim 1, wherein the process of issuing a data certificate for the virtual machine is: the virtual machine establishes communication with the security authentication resource pool, and the virtual machine The name of the security authentication resource pool is provided to the security authentication resource pool, and the digital certificate of the virtual machine is allocated to the security authentication resource pool, which is automatically loaded and imported through the driver installed in the virtual machine operating system. 3. A method for virtual machine security authentication based on domestic cryptographic technology according to claim 1 or 2, characterized in that the virtual machine performs identity authentication with other virtual machines, first exchanges digital certificates, and then passes through each The trusted root certificate in the security authentication resource pool verifies whether the exchanged digital certificate of the virtual machine is consistent with that assigned by the trusted root certificate. 4. A method for virtual machine security authentication based on domestic cryptographic technology according to claim 1 or 2, characterized in that said virtual machine communicates encrypted with other virtual machines or end users, and all interactive data information uses Digital envelope technology and digital signature technology realize encrypted transmission and integrity verification of information. 5. A method for virtual machine security authentication based on domestic encryption technology according to claim 4, characterized in that the process of encrypted communication between the virtual machine and other virtual machines is: the two sides of the communicating virtual machine generate a private key and Symmetric key, the first virtual machine will receive the plaintext data to generate the first message digest, encrypt it with its own private key to generate the first data signature, and at the same time encrypt the plaintext data with the symmetric key to generate ciphertext data, use the second The digital certificates of the two virtual machines encrypt the symmetric key to generate a digital envelope; the digital envelope is decrypted into a symmetric key with the private key of the second virtual machine, and then the second virtual machine decrypts the received ciphertext data with the symmetric key For plaintext data, generate the second message digest. The first digital signature uses the digital certificate of the first virtual machine to decrypt the first message digest and compare it with the second message digest. If they agree, it is passed. 6. A method for virtual machine security authentication based on domestic cryptographic technology according to claim 5, characterized in that the trusted root certificate of the security authentication resource pool includes information on the name and domain name of the cloud computing where it is located; The digital certificate of the virtual machine contains the name information of the virtual machine. 7. A method for virtual machine security authentication based on domestic cryptographic technology according to claim 6, characterized in that said security authentication resource pool supports domestic cryptographic algorithms, including SM1, SM2, SM3, and SM4.