An encryption and decryption method in a virtualization system, where the virtualization system includes a virtual machine monitor (VMM) and an encryption and decryption virtual machine. The VMM includes a control module, the encryption and decryption virtual machine records a first association relationship between a hard disk image identifier and a key, the key includes an encryption key, and the virtualization system records a second association relationship between the hard disk image identifier and a hard disk image attribute. The control module in the VMM is configured to determine whether to-be-written data needs to be encrypted and forward the to-be-written data, which reduces system complexity of the VMM. In addition, encryption or decryption is processed without occupying a resource in the VMM.