CN106685999A - A virtual machine security protection method, system and security device - Google Patents

Abstract

The invention discloses a safety protection method for a virtual machine, a system and a safety device. The method comprises the following steps: intercepting a data flow of a target virtual machine, thereby acquiring a corresponding intercepted data; sending the intercepted data to the safety device; selecting a safety proxy corresponding to the target virtual machine from a plurality of safety proxies contained in the safety device, thereby acquiring a target safety proxy; utilizing the target safety proxy to detect virus for the intercepted data, thereby confirming if the intercepted data is a safety data; and if yes, performing the subsequent data routing treatment on the intercepted data by the safety device. According to the method disclosed by the invention, the purpose of saving computer resources is achieved, the centralized management for the plurality of safety proxies corresponding to multiple virtual machines becomes convenient and the management cost of the safety proxies is reduced.

Description

A virtual machine security protection method, system and security device

technical field

The present invention relates to the field of security technology, in particular to a virtual machine security protection method, system and security equipment.

Background technique

Currently, security protection in virtualized environments has become a hot focus in the IT industry. In the early stages of virtualization technology, security solutions did not have a protection model adapted to the virtualization environment, and people could only follow the traditional security protection strategy, that is, deploy a security protection product suite on each virtual machine, the so-called "security Agent", this security protection mode is called "Agent-based". However, with the large-scale application of cloud computing and virtualization technology, this mode has shown a variety of disadvantages, mainly reflected in: each virtual machine needs to install the corresponding security agent, so that the physical host The storage resource and the memory resource occupy a large amount, and make the management process of the security agent quite complicated, and the management cost of the security agent is relatively high.

From the above, it can be seen that how to save computer resources and reduce the management cost of the security agent in the process of security protection of the virtualization platform is a problem to be further solved.

Contents of the invention

In view of this, the object of the present invention is to provide a virtual machine security protection method, system and security equipment, which can realize the purpose of saving computer resources and reducing the management cost of security agents in the process of security protection of virtualization platforms. The specific plan is as follows:

A virtual machine security protection method, comprising:

Intercept the data flow of the target virtual machine to obtain the corresponding intercepted data;

sending said intercepted data to a security device;

Selecting a security agent corresponding to the target virtual machine from multiple security agents included in the security device to obtain a target security agent;

using the target security agent to perform virus detection on the intercepted data to determine whether the intercepted data is safe data;

If the intercepted data is security data, subsequent corresponding data routing processing is carried out on the intercepted data by the security device.

Optionally, the process of intercepting the data flow of the target virtual machine includes:

The data flow of the target virtual machine is intercepted by using the network driver on the virtualization platform to obtain the intercepted data.

Optionally, the network driver is a network driver including a firewall.

Optionally, the device type of the security device is a virtual machine.

Optionally, the virtual machine security protection method also includes:

When the upgrade patch for the security agent is acquired, the upgrade patch is used to upgrade all the security agents in the security device.

The invention also discloses a virtual machine security protection system, including:

The data interception module is used to intercept the data flow of the target virtual machine to obtain corresponding interception data;

A data sending module, configured to send the intercepted data to a security device;

An agent screening module, configured to filter out a security agent corresponding to the target virtual machine from a plurality of security agents included in the security device to obtain a target security agent;

A data detection module, configured to use the target security agent to perform virus detection on the intercepted data, so as to determine whether the intercepted data is safe data;

The data routing module is configured to perform subsequent corresponding data routing processing on the intercepted data through the security device when the intercepted data is secure data.

Optionally, the data interception module is specifically configured to use a network driver on a virtualization platform to intercept the data flow of the target virtual machine to obtain the intercepted data.

Optionally, the virtual machine security protection system also includes:

The agent upgrade module is configured to use the upgrade patch to upgrade all the security agents in the security device when the upgrade patch for the security agent is obtained.

The present invention further discloses a security device, which includes a plurality of security agents, and also includes:

A data acquisition module, configured to acquire interception data obtained after intercepting the data flow of the target virtual machine;

An agent screening module, configured to screen out a security agent corresponding to the target virtual machine from the plurality of security agents to obtain a target security agent;

A data detection module, configured to use the target security agent to perform virus detection on the intercepted data, so as to determine whether the intercepted data is safe data;

The data routing module is configured to perform subsequent corresponding data routing processing on the intercepted data when the intercepted data is safe data.

Optionally, the device type of the security device is a virtual machine.

In the present invention, the virtual machine security protection method includes: intercepting the data flow of the target virtual machine to obtain corresponding intercepted data; sending the intercepted data to the security device; The security agent corresponding to the virtual machine obtains the target security agent; uses the target security agent to perform virus detection on the intercepted data to determine whether the intercepted data is safe data; data routing processing.

It can be seen that the present invention places the security agent corresponding to the virtual machine in the security device. When it is necessary to carry out security protection on the target virtual machine, the present invention first intercepts the data of the target virtual machine, and then sends the intercepted data to the above-mentioned security device. Then select the security agent corresponding to the target virtual machine from multiple security agents in the security device, and use the selected security agent to perform security analysis on the intercepted data. When it is determined that the intercepted data is safe data, the The security device performs subsequent corresponding routing processing on the intercepted data. It can be seen that the present invention places the security agents corresponding to multiple virtual machines in the security device. When it is necessary to protect a certain virtual machine, it can use The corresponding security agent stored in the security device is used for security protection operations, so that there is no need to install the corresponding security agent in each virtual machine, thereby avoiding the situation that the computer resources of the host computer are occupied, that is, saving The purpose of computer resources, and because the present invention centrally places the security agents corresponding to multiple virtual machines in the security device, it can facilitate the centralized management of multiple security agents corresponding to multiple virtual machines, that is, the present invention also Reduced management costs for security agents.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

FIG. 1 is a flowchart of a virtual machine security protection method disclosed in an embodiment of the present invention;

FIG. 2 is a flowchart of a specific virtual machine security protection method disclosed in an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a virtual machine security protection system disclosed in an embodiment of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The embodiment of the present invention discloses a virtual machine security protection method, as shown in Fig. 1, the method includes:

Step S11: Intercept the data flow of the target virtual machine to obtain corresponding intercepted data.

Wherein, the aforementioned target virtual machine is any virtual machine on the virtualization platform.

Step S12: Send the intercepted data to the security device.

Step S13: Screen out the security agent corresponding to the target virtual machine from the multiple security agents included in the security device to obtain the target security agent.

In this embodiment, the security device includes multiple security agents, where different security agents correspond to different virtual machines. After the interception data corresponding to the target virtual machine is sent to the security device, a security agent corresponding to the target virtual machine will be screened out from the security device, and then the security agent can be used to perform security analysis on the interception data.

Step S14: Utilize the target security agent to perform virus detection on the intercepted data to determine whether the intercepted data is safe data.

Step S15: If the intercepted data is secure data, carry out subsequent corresponding data routing processing on the intercepted data through the security device.

That is, when it is determined that the intercepted data corresponding to the target virtual machine is security data, the security device will be used to route the intercepted data to a corresponding data receiver. It can be understood that, in the case that the intercepted data is not secure data, data routing processing on the above-mentioned intercepted data will be prohibited.

It can be seen that in the embodiment of the present invention, the security agent corresponding to the virtual machine is placed in the security device. When the target virtual machine needs to be protected, the embodiment of the present invention first intercepts the data of the target virtual machine, and then sends the intercepted data to The above-mentioned security device then screens out the security agent corresponding to the target virtual machine from multiple security agents in the security device, thereby using the screened security agent to perform security analysis on the intercepted data, and when it is determined that the intercepted data is secure data Next, the subsequent corresponding routing processing will be carried out on the intercepted data through the security device. It can be seen that the embodiment of the present invention places the security agents corresponding to multiple virtual machines in the security device. When protecting, you can use the corresponding security agent stored in the security device to perform security protection operations, so that you don’t need to install the corresponding security agent in each virtual machine, so as to avoid the situation that the computer resources of the host computer are occupied. That is to say, the purpose of saving computer resources is achieved, and since the embodiment of the present invention centrally places the security agents corresponding to multiple virtual machines in the security device, it is convenient to centralize the multiple security agents corresponding to multiple virtual machines Management, that is, the embodiments of the present invention also reduce the management cost of the security agent.

Referring to Fig. 2, the embodiment of the present invention also discloses a specific virtual machine security protection method, including the following steps:

Step S21: using the network driver on the virtualization platform to intercept the data flow of the target virtual machine to obtain intercepted data.

Preferably, in this embodiment, the above-mentioned network driver program may specifically be a network driver program including a firewall. Further, the network driver program in this embodiment may specifically include a fast-path driver unit for performing fast-path processing and a slow-path driver unit for performing slow-path processing.

Step S22: Send the intercepted data to the security virtual machine.

That is, the device type of the security device in the previous embodiment may specifically be a virtual machine. It should be pointed out that, in this embodiment, the above-mentioned secure virtual machine can be obtained by installing multiple security agents corresponding to multiple virtual machines on an ordinary virtual machine. In addition, in this embodiment, the physical hosts corresponding to the security virtual machine may be the same as or different from the physical hosts corresponding to other common virtual machines.

Step S23: Screen out the security agent corresponding to the target virtual machine from the multiple security agents included in the security virtual machine to obtain the target security agent.

Step S24: Utilize the target security agent to perform virus detection on the intercepted data to determine whether the intercepted data is safe data.

Step S25: If the intercepted data is secure data, carry out subsequent corresponding data routing processing on the intercepted data through the secure virtual machine.

It can be understood that, when the intercepted data is not safe data, data routing processing on the above intercepted data will be prohibited.

Further, the virtual machine security protection method in the embodiment of the present invention may further include: when an upgrade patch for the security agent is obtained, using the upgrade patch to upgrade all security agents in the security device.

Correspondingly, the embodiment of the present invention also discloses a virtual machine security protection system, as shown in Figure 3, the system includes:

The data interception module 11 is used for intercepting the data flow of the target virtual machine to obtain corresponding interception data;

A data sending module 12, configured to send intercepted data to a security device;

An agent screening module 13, configured to screen out a security agent corresponding to the target virtual machine from a plurality of security agents included in the security device to obtain the target security agent;

The data detection module 14 is used to utilize the target security agent to carry out virus detection to the intercepted data, to determine whether the intercepted data is safe data;

The data routing module 15 is configured to perform subsequent corresponding data routing processing on the intercepted data through the security device when the intercepted data is secure data.

Wherein, the above-mentioned data interception module can specifically be used to intercept the data flow of the target virtual machine by using the network driver program on the virtualization platform to obtain the intercepted data.

In this embodiment, the foregoing network driver program may specifically be a network driver program including a firewall.

In addition, the device type of the foregoing security device may specifically be a virtual machine.

Further, the virtual machine security protection system in this embodiment may also include:

The agent upgrade module is configured to use the upgrade patch to upgrade all the security agents in the security device when the upgrade patch for the security agent is obtained.

It can be seen that in the embodiment of the present invention, by placing the security agents corresponding to multiple virtual machines in the security device, when it is necessary to perform security protection on a certain virtual machine, the corresponding security agents stored in the security device can be used for security protection. In this way, there is no need to install a corresponding security agent in each virtual machine, thereby avoiding the occurrence of a large computer resource occupation of the host computer, that is, the purpose of saving computer resources is realized, and, because the embodiment of the present invention Centrally placing security agents corresponding to multiple virtual machines in a security device facilitates centralized management of multiple security agents corresponding to multiple virtual machines, that is, the embodiments of the present invention also reduce management costs of security agents.

Further, the embodiment of the present invention also discloses a security device, including multiple security agents, and also includes:

A data acquisition module, configured to acquire interception data obtained after intercepting the data flow of the target virtual machine;

An agent screening module, configured to screen out a security agent corresponding to the target virtual machine from multiple security agents to obtain the target security agent;

The data detection module is used to utilize the target security agent to perform virus detection on the intercepted data, so as to determine whether the intercepted data is safe data;

The data routing module is used to carry out subsequent corresponding data routing processing on the intercepted data when the intercepted data is safe data.

Wherein, the device type of the foregoing security device may specifically be a virtual machine.

In the embodiment of the present invention, by placing the security agents corresponding to multiple virtual machines in the security device, when it is necessary to perform security protection on a certain virtual machine, the corresponding security agents stored in the security device can be used to perform security protection operations , so that there is no need to install a corresponding security agent in each virtual machine, thereby avoiding the occurrence of a large computer resource occupation of the host computer, that is, the purpose of saving computer resources is achieved, and, because the embodiment of the present invention will be more The security agent corresponding to each virtual machine is centrally placed in the security device, which facilitates centralized management of multiple security agents corresponding to multiple virtual machines, that is, the embodiment of the present invention also reduces the management cost of the security agent.

Finally, it should also be noted that in this text, relational terms such as first and second etc. are only used to distinguish one entity or operation from another, and do not necessarily require or imply that these entities or operations, any such actual relationship or order exists. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

A virtual machine security protection method, system, and security device provided by the present invention have been introduced in detail above. In this paper, specific examples are used to illustrate the principle and implementation of the present invention. The descriptions of the above embodiments are only used to help Understand the method of the present invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and scope of application. In summary, the content of this specification is not It should be understood as a limitation of the present invention.

Claims (10)

1. a kind of secure virtual machine means of defence, it is characterised in that include：

The data flow of target virtual machine is intercepted, corresponding data interception is obtained；

The data interception is sent to safety equipment；

TSM Security Agent corresponding with the target virtual machine is filtered out in the multiple TSM Security Agent included from the safety equipment, is obtained To targeted security agency；

Acted on behalf of using the targeted security, Viral diagnosis are carried out to the data interception, to determine that whether the data interception be Secure data；

If the data interception is secure data, by the safety equipment follow-up corresponding number is launched to the data interception According to route processing.

2. secure virtual machine means of defence according to claim 1, it is characterised in that the data to target virtual machine The process that stream is intercepted, including：

Using the network driver on virtual platform, the data flow of the target virtual machine is intercepted, obtain described Data interception.

3. secure virtual machine means of defence according to claim 2, it is characterised in that

The network driver is the network driver comprising fire wall.

4. secure virtual machine means of defence according to claim 1, it is characterised in that the device type of the safety equipment For virtual machine.

5. the secure virtual machine means of defence according to any one of Claims 1-4, it is characterised in that also include：

When the upgrade patch for TSM Security Agent is got, then using the upgrade patch, to the safety equipment in it is all TSM Security Agent carries out upgrading processing.

6. a kind of secure virtual machine guard system, it is characterised in that include：

Data interception module, for intercepting to the data flow of target virtual machine, obtains corresponding data interception；

Data transmission blocks, for the data interception to be sent to safety equipment；

Screening module is acted on behalf of, for filtering out and the target virtual machine in multiple TSM Security Agent for including from the safety equipment Corresponding TSM Security Agent, obtains targeted security agency；

Data detection module, for acting on behalf of using the targeted security, carries out Viral diagnosis, to determine to the data interception State whether data interception is secure data；

Data routing module, for being secure data when the data interception, then by the safety equipment to the interception number According to the follow-up corresponding data route processing of expansion.

7. secure virtual machine guard system according to claim 6, it is characterised in that

The data interception module, specifically for using the network driver on virtual platform, to the target virtual machine Data flow intercepted, obtain the data interception.

8. the secure virtual machine guard system according to claim 6 or 7, it is characterised in that also include：

Upgraded module is acted on behalf of, for when the upgrade patch for TSM Security Agent is got, then using the upgrade patch, to described All TSM Security Agent in safety equipment carry out upgrading processing.

9. a kind of safety equipment, it is characterised in that including multiple TSM Security Agent, also include：

Data acquisition module, for obtaining the data interception obtained after the data flow to target virtual machine is intercepted；

Screening module is acted on behalf of, for filtering out safe generation corresponding with the target virtual machine from the plurality of TSM Security Agent Reason, obtains targeted security agency；

Data detection module, for acting on behalf of using the targeted security, carries out Viral diagnosis, to determine to the data interception State whether data interception is secure data；

Data routing module, for being secure data when the data interception, then launches follow-up corresponding to the data interception Data route processing.

10. safety equipment according to claim 9, it is characterised in that the device type of the safety equipment is virtual machine.