Cloud system data management method and apparatus

Abstract

A cloud system data management method for alleviate a data leakage problem occurring when a user accessed by another user when a virtual data volume of the user is mounted to a virtual machine of another user includes creating a first virtual machine for a user and allocating a virtual data volume to the first virtual machine, setting an identifier of the virtual data volume as an identifier corresponding to a home identifier of the first virtual machine, determining, according to the identifier of the virtual data volume and a home identifier of a second virtual machine, whether the virtual data volume and the second virtual machine belong to a same user when the virtual data volume needs to be mounted to the second virtual machine, forbidding the virtual data volume to be mounted to the second virtual machine when they do not belong to the same user.

What is claimed is: 
     
       1. A cloud system data management method, comprising:
 creating a first virtual machine for a user, the first virtual machine having a first home identifier that identifies the user, and the first virtual machine comprising dynamic data having a dynamic data identifier that corresponds to the first home identifier, 
 allocating a virtual data volume to the first virtual machine, the virtual data volume having a virtual data volume identifier corresponding to the first home identifier; 
 determining, according to the virtual data volume identifier and a second home identifier of a second virtual machine, whether the virtual data volume and the second virtual machine belong to the user when the virtual data volume needs to be moved to the second virtual machine; 
 forbidding the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine do not belong to the user; 
 determining whether the second home identifier corresponds to the dynamic data identifier when the dynamic data needs to be transferred to the second virtual machine; 
 allowing the dynamic data to be transferred to the second virtual machine when the second home identifier corresponds to the dynamic data identifier; and 
 forbidding the dynamic data to be transferred to the second virtual machine when the second home identifier does not correspond to the dynamic data identifier. 
 
     
     
       2. The method of  claim 1 , further comprising allowing the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine belong to the user. 
     
     
       3. The method of  claim 2 , wherein determining, according to the virtual data volume identifier and the second home identifier, whether the virtual data volume and the second virtual machine belong to the user comprises determining whether the second home identifier and the virtual data volume identifier are identical, the virtual data volume and the second virtual machine belong to the user when the second home identifier and the virtual data volume identifier are identical, and the virtual data volume and the second virtual machine do not belong to the user when the second home identifier and the virtual data volume identifier are not identical. 
     
     
       4. The method of  claim 1 , wherein the dynamic data is data in a memory of the first virtual machine. 
     
     
       5. The method of  claim 1 , further comprising setting the virtual data volume identifier as a public identifier to indicate that the virtual data volume may be moved to any virtual machine before the virtual data volume is allocated to the first virtual machine. 
     
     
       6. An apparatus, comprising:
 a processor; and 
 a memory coupled to the processor, the memory having a plurality of instructions stored thereon that, when executed by the processor, cause the processor to:
 create a first virtual machine for a user, the first virtual machine having a first home identifier that identifies the user; 
 allocate a virtual data volume to the first virtual machine, the virtual data volume having a virtual data volume identifier corresponding to the first home identifier; 
 determine whether the virtual data volume identifier and a second home identifier of a second virtual machine are identical corresponding when the virtual data volume needs to be moved to the second virtual machine, the virtual data volume and the second virtual machine belonging to the user when the second home identifier and the virtual data volume identifier are identical corresponding, and the virtual data volume and the second virtual machine not belonging to the user when the second home identifier and the virtual data volume identifier are not identical corresponding; 
 forbid the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine are not identical corresponding; and 
 allow the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine are identical corresponding. 
 
 
     
     
       7. The apparatus of  claim 6 , wherein the instructions further cause the processor to:
 set a dynamic data identifier of dynamic data in the first virtual machine as corresponding to the first home identifier; 
 determine whether the second home identifier corresponds to the dynamic data identifier when the dynamic data needs to be transferred to the second virtual machine; 
 allow the dynamic data to be transferred to the second virtual machine when the second home identifier corresponds to the dynamic data identifier; and 
 forbid the dynamic data to be transferred to the second virtual machine when the second home identifier does not correspond to the dynamic data identifier. 
 
     
     
       8. The apparatus of  claim 7 , wherein the dynamic data is data in a memory of the first virtual machine. 
     
     
       9. The apparatus of  claim 6 , wherein the instructions further cause the processor to set the virtual data volume identifier as a public identifier to indicate that the virtual data volume may be moved to any virtual machine before the virtual data volume is allocated to the first virtual machine. 
     
     
       10. The apparatus of  claim 6 , wherein the instructions further cause the processor to acquire a correspondence between the second virtual machine and the user. 
     
     
       11. A computer program product, comprising:
 a non-transitory computer-readable medium configured to store computer executable instructions that, when executed by a processor, instruct the processor to:
 create a first virtual machine for a user, the first virtual machine having a first home identifier that identifies the user; 
 set a virtual data volume identifier of a virtual data volume as a public identifier to indicate that the virtual data volume may be moved to any virtual machine, the virtual data volume identifier corresponding to the first home identifier; 
 allocate the virtual data volume to the first virtual machine; 
 determine, according to the virtual data volume identifier and a second home identifier of a second virtual machine, whether the virtual data volume and the second virtual machine belong to the user when the virtual data volume needs to be moved to the second virtual machine; and 
 forbid the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine do not belong to the user. 
 
 
     
     
       12. The computer program product of  claim 11 , wherein the computer executable instructions further cause the processor to allow the virtual data volume to be moved to the second virtual machine when the virtual data volume and the second virtual machine belong to the user. 
     
     
       13. The computer program product of  claim 12 , wherein the computer executable instructions further cause the processor to determine whether the second home identifier and the virtual data volume identifier are identical, the virtual data volume and the second virtual machine belong to the user when the second home identifier and the virtual data volume identifier are identical, and the virtual data volume and the second virtual machine do not belong to the user when the second home identifier and the virtual data volume identifier are not identical. 
     
     
       14. The computer program product of  claim 11 , wherein the computer executable instructions further cause the processor to:
 set a dynamic data identifier of dynamic data in the first virtual machine as an identifier corresponding to the first home identifier; 
 determine whether the second home identifier corresponds to the dynamic data identifier when the dynamic data needs to be transferred to the second virtual machine; 
 allow the dynamic data to be transferred to the second virtual machine when the second home identifier corresponds to the dynamic data identifier; and 
 forbid the dynamic data to be transferred to the second virtual machine when the second home identifier does not correspond to the dynamic data identifier. 
 
     
     
       15. The computer program product of  claim 14 , wherein the dynamic data is data in a memory of the first virtual machine. 
     
     
       16. The computer program product of  claim 11 , wherein the computer executable instructions further cause the processor to acquire a correspondence between the second virtual machine and the user.