IP Library › Granted Patent US 49,601
Granted Patent E1
US 49,601 · App. 17/206,072 · Granted Aug 8, 2023

Cloud system data management method and apparatus

Inventor: Sihai Ye (Shenzhen, CN)
Assignee: HUAWEI CLOUD COMPUTING TECHNOLOGIES CO., LTD.
G06F9/45558G06F2009/45562G06F2009/45579
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 49,601
App. No.
17/206,072
Granted
Aug 8, 2023
Kind
E1
Abstract

A cloud system data management method for alleviate a data leakage problem occurring when a user accessed by another user when a virtual data volume of the user is mounted to a virtual machine of another user includes creating a first virtual machine for a user and allocating a virtual data volume to the first virtual machine, setting an identifier of the virtual data volume as an identifier corresponding to a home identifier of the first virtual machine, determining, according to the identifier of the virtual data volume and a home identifier of a second virtual machine, whether the virtual data volume and the second virtual machine belong to a same user when the virtual data volume needs to be mounted to the second virtual machine, forbidding the virtual data volume to be mounted to the second virtual machine when they do not belong to the same user.

Claims (44)

1. A cloud system data management method, comprising:

creating a first virtual machine for a user, the first virtual machine having a first home identifier that identifies the user, and the first virtual machine comprising dynamic data having a dynamic data identifier that corresponds to the first home identifier,

allocating a virtual data volume to the first virtual machine, the virtual data volume having a virtual data volume identifier corresponding to the first home identifier;

determining, according to the virtual data volume identifier and a second home identifier of a second virtual machine, whether the virtual data volume and the second virtual machine belong to the user when the virtual data volume needs to be moved to the second virtual machine;

forbidding the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine do not belong to the user;

determining whether the second home identifier corresponds to the dynamic data identifier when the dynamic data needs to be transferred to the second virtual machine;

allowing the dynamic data to be transferred to the second virtual machine when the second home identifier corresponds to the dynamic data identifier; and

forbidding the dynamic data to be transferred to the second virtual machine when the second home identifier does not correspond to the dynamic data identifier.

2. The method of claim 1 , further comprising allowing the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine belong to the user.

3. The method of claim 2 , wherein determining, according to the virtual data volume identifier and the second home identifier, whether the virtual data volume and the second virtual machine belong to the user comprises determining whether the second home identifier and the virtual data volume identifier are identical, the virtual data volume and the second virtual machine belong to the user when the second home identifier and the virtual data volume identifier are identical, and the virtual data volume and the second virtual machine do not belong to the user when the second home identifier and the virtual data volume identifier are not identical.

4. The method of claim 1 , wherein the dynamic data is data in a memory of the first virtual machine.

5. The method of claim 1 , further comprising setting the virtual data volume identifier as a public identifier to indicate that the virtual data volume may be moved to any virtual machine before the virtual data volume is allocated to the first virtual machine.

6. An apparatus, comprising:

a processor; and

a memory coupled to the processor, the memory having a plurality of instructions stored thereon that, when executed by the processor, cause the processor to:

create a first virtual machine for a user, the first virtual machine having a first home identifier that identifies the user;

allocate a virtual data volume to the first virtual machine, the virtual data volume having a virtual data volume identifier corresponding to the first home identifier;

determine whether the virtual data volume identifier and a second home identifier of a second virtual machine are identical corresponding when the virtual data volume needs to be moved to the second virtual machine, the virtual data volume and the second virtual machine belonging to the user when the second home identifier and the virtual data volume identifier are identical corresponding, and the virtual data volume and the second virtual machine not belonging to the user when the second home identifier and the virtual data volume identifier are not identical corresponding;

forbid the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine are not identical corresponding; and

allow the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine are identical corresponding.

7. The apparatus of claim 6 , wherein the instructions further cause the processor to:

set a dynamic data identifier of dynamic data in the first virtual machine as corresponding to the first home identifier;

determine whether the second home identifier corresponds to the dynamic data identifier when the dynamic data needs to be transferred to the second virtual machine;

allow the dynamic data to be transferred to the second virtual machine when the second home identifier corresponds to the dynamic data identifier; and

forbid the dynamic data to be transferred to the second virtual machine when the second home identifier does not correspond to the dynamic data identifier.

8. The apparatus of claim 7 , wherein the dynamic data is data in a memory of the first virtual machine.

9. The apparatus of claim 6 , wherein the instructions further cause the processor to set the virtual data volume identifier as a public identifier to indicate that the virtual data volume may be moved to any virtual machine before the virtual data volume is allocated to the first virtual machine.

10. The apparatus of claim 6 , wherein the instructions further cause the processor to acquire a correspondence between the second virtual machine and the user.

11. A computer program product, comprising:

a non-transitory computer-readable medium configured to store computer executable instructions that, when executed by a processor, instruct the processor to:

create a first virtual machine for a user, the first virtual machine having a first home identifier that identifies the user;

set a virtual data volume identifier of a virtual data volume as a public identifier to indicate that the virtual data volume may be moved to any virtual machine, the virtual data volume identifier corresponding to the first home identifier;

allocate the virtual data volume to the first virtual machine;

determine, according to the virtual data volume identifier and a second home identifier of a second virtual machine, whether the virtual data volume and the second virtual machine belong to the user when the virtual data volume needs to be moved to the second virtual machine; and

forbid the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine do not belong to the user.

12. The computer program product of claim 11 , wherein the computer executable instructions further cause the processor to allow the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine belong to the user.

13. The computer program product of claim 12 , wherein the computer executable instructions further cause the processor to determine whether the second home identifier and the virtual data volume identifier are identical, the virtual data volume and the second virtual machine belong to the user when the second home identifier and the virtual data volume identifier are identical, and the virtual data volume and the second virtual machine do not belong to the user when the second home identifier and the virtual data volume identifier are not identical.

14. The computer program product of claim 11 , wherein the computer executable instructions further cause the processor to:

set a dynamic data identifier of dynamic data in the first virtual machine as an identifier corresponding to the first home identifier;

determine whether the second home identifier corresponds to the dynamic data identifier when the dynamic data needs to be transferred to the second virtual machine;

allow the dynamic data to be transferred to the second virtual machine when the second home identifier corresponds to the dynamic data identifier; and

forbid the dynamic data to be transferred to the second virtual machine when the second home identifier does not correspond to the dynamic data identifier.

15. The computer program product of claim 14 , wherein the dynamic data is data in a memory of the first virtual machine.

16. The computer program product of claim 11 , wherein the computer executable instructions further cause the processor to acquire a correspondence between the second virtual machine and the user.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 1, 2022
From: HUAWEI TECHNOLOGIES CO., LTD.
To: HUAWEI CLOUD COMPUTING TECHNOLOGIES CO., LTD.
Reel/Frame 059267/0088 →