CN107547480A - A kind of method, apparatus and virtual desktop management system of virtual desktop security control - Google Patents

Abstract

The present invention provides a method for virtual desktop security control. A security control policy is preset in a management node. The security control policy includes at least one typical scenario and a security strategy corresponding to each typical scenario. Each typical scenario is a user type, A combination of access device type and remote desktop type, each security policy includes at least one security control item; the method includes: receiving a connection request sent by the access device, the connection request is used for the access device to request to establish a connection with the server; The user type, access device type, and remote desktop type carried in the connection request are compared with the typical scenarios in the security control policy to determine the typical scenario matching the connection request and the security policy corresponding to the matching typical scenario; according to the determined The security policy sends instruction information to the access device, and the instruction information is used to instruct the access device to establish a connection with the server, thereby improving the information security of the enterprise business.

Description

Method, device and virtual desktop management system for virtual desktop security control

technical field

The invention relates to the security field, in particular to a virtual desktop security control method, device and virtual desktop management system.

Background technique

With the development of remote desktop and virtualization technologies, more and more enterprises choose to use virtual desktops for daily office work, so as to improve the management efficiency of enterprise office resources.

In the prior art, a virtual desktop infrastructure (Virtual Desktop Infrastructure, VDI) mainly includes a virtual desktop management system, a server, and an access device. The virtual desktop management system is used to realize the management and control functions of virtual desktop remote access. The virtualization software is deployed in the server to form at least one virtual machine. The administrator can pre-allocate the server or virtual machine to the user in the virtual desktop management system. Users can configure different permissions. The management system can form multiple assigned servers or virtual machines into a desktop group, and control the remote access operation permissions of servers or virtual machines in the desktop group through the desktop group, such as whether to allow remote access during the remote connection process. Servers or virtual machines use external devices such as Universal Serial Bus (Universal Serial Bus) flash memory registers. Therefore, when a user remotely accesses a server or a virtual machine, the implementation of the security control policy depends on the user's operation authority and the operation authority of the server or virtual machine to allow remote access. However, for the continuous expansion of virtual desktop application scenarios, only through the authority control relationship between the user and the server or virtual machine assigned to the user can no longer meet the needs of differentiated control of access security in differentiated access scenarios. The information security of enterprise business cannot be effectively guaranteed.

Contents of the invention

Embodiments of the present invention provide a virtual desktop security control method, device, and virtual desktop management system, which can preset a security control policy in a management node, and the management node can use the user type and access device type carried in each connection request Compare with the remote desktop type and security control strategy, determine the typical scenario matching this connection request and the security strategy corresponding to the matching typical scenario, so as to implement differentiated control for different connection requests and improve the information security of enterprise business .

In order to achieve the above object, the present invention adopts following technical scheme:

In the first aspect, a method for virtual desktop security control is provided, wherein a security control policy is preset in the management node, and the security control policy includes at least one typical scenario and each of the at least one typical scenario corresponds to security policy, each of the at least one typical scenario is a combination of user type, access device type, and remote desktop type, and each of the security policies includes at least one security control item; the method includes:

The management node receives a connection request sent by the access device, and the connection request is used for the access device to request to establish a connection with the server;

The management node acquires the user type, access device type, and remote desktop type carried in the connection request;

The management node compares the user type, access device type, and remote desktop type carried in the connection request with the at least one typical scenario in the security control policy, and determines a typical scenario that matches the connection request and a security policy corresponding to the typical matching scenario;

The management node sends indication information to the access device according to the determined security policy, where the indication information is used to instruct the access device to establish a connection with the server.

Specifically, the administrator can also preset security control policies in the virtual desktop management system through the management node. Specifically, security control policies can be preset according to user types, access device types, and remote desktop types, where the security control policies include credit levels, security policies, and typical scenarios. Administrators can determine typical scenarios according to the requirements of business scenarios in the specific implementation process, according to user types, access device types, and remote desktop types. Each typical scenario corresponds to a security policy, and each security policy corresponds to a credit level.

Optionally, security control policies can also be preset according to user type, access device type, remote desktop type, and access network environment type.

It is worth noting that the security control policy preset by the administrator can be stored in a file or database table that is preset and defined in the management node, or can be stored in other storage forms, which is not limited by the present invention.

Optionally, after the administrator presets security control policies on the management node, he can add or update credit levels, security policies, and typical scenarios according to business needs, so as to adapt to changes in information security requirements of enterprises. It should be noted that the updated security control policy only takes effect for the updated new connection request.

Optionally, if there is no matching typical scenario after comparing the user type, access device type, access network environment type, and remote desktop type carried in the connection request with the preset security control policy, the preset default security control policy can be implemented. Strategy.

Those skilled in the art should understand that virtual desktops are a type of remote desktops. After the allocation relationship between users and virtual machines is established in the virtual desktop management system, users can use any type of access device to access The network environment sends a request to connect to the virtual machine to the virtual desktop management system, and the credit level is only valid for this connection request.

From the above description, it can be seen that the administrator presets security control policies in the management node, that is, at least one typical scenario is formed according to the combination of user type, access device type, and remote desktop type. Each typical scenario corresponds to a security policy. When When a user requests to establish a connection with a remote desktop through an access device, compare the user type, access device type, and remote desktop type carried in the connection request with the typical scenarios in the security control policy to determine whether the connection request is related to the current connection request. Matching typical scenarios and security policies corresponding to the matching typical scenarios, implement different security control items on access devices and servers according to the requirements of the determined security policies, which is different from the existing technology that relies on user operation rights and server or The security control of the operating authority of the virtual machine that allows remote access can perform differentiated security control on connection requests in different scenarios, and improve the information security of the virtual desktop infrastructure.

With reference to the possible implementation manner of the first aspect, in the first possible manner of the first aspect, the method further includes:

The management node sends the determined security policy to the server, and the determined security policy includes collecting at least one of global positioning system data, camera data, and microphone data of the access device;

The management node receives the access device data sent by the server, and the access device data is obtained by the server notifying the access device according to the determined security policy;

The management node saves the access device data.

With reference to the first possible implementation manner of the first aspect, in the second possible implementation manner of the first aspect, the obtaining of the access device data by the access device according to the determined security policy is specifically:

The access device receives the determined security policy sent by the server;

The access device collects the access device data according to the requirements of the determined security policy;

The access device sends the access device data to the server.

With reference to the possible implementation of the first aspect, in a third possible implementation of the first aspect, the method further includes:

The management node sends the determined security policy to the server, the determined security policy includes at least one of file system redirection, clipboard redirection, and digital watermark, so that the server based on the Determined security policy:

mapping the file system of the server to the access device; or

passing the content of the server's clipboard to the access device; or

Adding a watermark to the image sent by the server to the access device.

With reference to the third possible implementation manner of the first aspect, in a fourth possible implementation manner of the first aspect, the method further includes:

The server sends the determined security policy to the access device, so that the access device: based on the determined security policy:

mapping the file system of the access device to the server; or

passing the clipboard content of the access device to the server; or

Adding a watermark to the image of the access device.

Through the description of the above content, according to the requirements of the security policy matching this connection request, collect the Global Positioning System (Global Positioning System, GPS) data, camera data, and microphone data of the access device, and save them in the management node. Compared with the existing technology, collecting and saving access device data can periodically conduct security audits on connection requests in the virtual desktop management system, thereby improving enterprise information security. On the other hand, for each connection request, different security control items are implemented on the access device and the server, thereby solving the problem in the prior art that differentiated control cannot be achieved in different access scenarios, thereby improving The information security of enterprise business.

Optionally, in another possible embodiment of the present invention, in the preset security control policy, a preset score segment is set for each credit level, and for the user type, access Mark points for each type of access device type, access network environment type, and remote desktop type. For example, if the access device is a mobile device, mark 5 points; if the access device is a personal computer or thin client, mark 10 points; ordinary users mark 5 points, 10 points for special users; 10 points for intranet access; 5 points for external network access; 5 points for ordinary virtual machines; 10 points for special virtual machines. Score the user type, access device type, access network environment type and remote desktop type carried in the request, compare the total score of this connection request with the preset score segment, and determine the score segment that matches this connection request And the security policy corresponding to the score segment, implement the security policy on the access device and server, using the above method, can also solve the problem in the prior art that different connection requests cannot be differentiated for differentiated security control, and improve the information security of the enterprise. Safety.

It should be understood that in various embodiments of the present invention, the sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of each process should be determined by its functions and internal logic, rather than by the embodiment of the present invention. The implementation process constitutes any limitation.

To sum up, the security control method provided by the embodiment of the present invention presets the security control strategy in the management node, according to the user type, access device type, remote desktop type and preset Compared with the security control strategy of the current connection request, determine the typical scenario that matches this connection request and the security strategy corresponding to the typical scenario, and implement different security strategies for the access device and server in this connection request, which is comparable to the existing technology. Compared with this method, it solves the problem that the security of connection requests cannot be controlled differently in different access scenarios, and improves the information security of enterprises. In addition, according to the requirements of the security policy, access device data such as GPS data, camera data, and microphone data are collected in the access device, and security audits can be performed on connection requests with lower credit levels in the virtual desktop infrastructure. Strengthen the protection of enterprise business information security.

In a second aspect, an embodiment of the present invention provides a method for virtual desktop security control, the method comprising:

The access device sends a connection request to the management node, the connection request is used for the access device to request to establish a connection with the server, so that the management node determines the security policy of the connection request, and uses the determined security policy sent to said server;

The access device receives the determined security policy sent by the server, and the determined security policy includes collecting at least one of global positioning system data, camera data, and microphone data;

The access device collects access device data according to the requirements of the security policy of the connection request;

The access device sends the access device data to the server.

It is worth noting that the camera data or microphone data collected by the access device can be real-time data or data stored in the access device; on the other hand, the camera data or microphone data collected by the access device can be a complete The data may also be a part of the complete data, which is not limited in the present invention.

Optionally, when the security policy received by the access device requires the data of the access device to be returned, the interface of the access device can give corresponding prompts and judgment information. If the user chooses to allow the collection of access device data, the return Access the device data, and allow the user to continue to complete the operation of logging in to the virtual machine; if the user chooses not to allow the collection of access device data, the connection request is interrupted.

With reference to the possible implementation of the second aspect, in the first possible implementation of the second aspect, the determined security policy further includes at least one of file system redirection, clipboard redirection, and digital watermarking, but

The access device is based on the security policy of the connection request:

mapping the file system of the access device to the server; or

passing the clipboard content of the access device to the server; or

Adding a watermark to the image of the access device.

Through the above description, the access device can collect GPS data, camera data, microphone data and other access device data in the access device based on the requirements of the security policy determined by the management node. Perform security audits on low connection requests to improve the information security of enterprise business.

In a third aspect, an embodiment of the present invention provides a method for virtual desktop security control, the method comprising:

The server receives the security policy sent by the management node, and the security policy includes at least one of global positioning system data, camera data, and microphone data;

The server sends the security policy to the access device, so that the access device collects access device data according to the requirements of the security policy;

The server receives the access device data sent by the access device;

The server sends the access device to the management node, so that the management node saves the access device data.

With reference to the possible implementation of the third aspect, in the first possible implementation of the third aspect, the security policy further includes: at least one of file system redirection, clipboard redirection, and digital watermarking, then

The server based on the security policy:

mapping the file system of the server to the access device; or

passing the content of the server's clipboard to the access device; or

Adding a watermark to the image sent by the server to the access device.

Through the description of the above content, the server can implement different security control items based on the security policy determined by the management node, and send the security policy to the access device, and send the access device data returned by the access device to the management node. The management node saves the access device data. Compared with the prior art, the virtual desktop management system can implement different security policies according to the access information of the access device, and store the access device data returned by the access device to facilitate Subsequent security audits are performed on connection requests with lower credit levels to improve the information security of enterprise business.

In a fourth aspect, the present invention provides a virtual desktop management system. The virtual desktop management system includes: a server, a management node, and an access device:

The management node is used to preset a security control strategy, the security control strategy includes at least one typical scenario and a security strategy corresponding to each of the at least one typical scenario, and each of the at least one typical scenario is a user type . A combination of access device type and remote desktop type, each of the security policies includes at least one security control item;

The management node is further configured to: obtain the user type, access device type, and remote desktop type carried in the connection request sent by the access device; Comparing the remote desktop type with the at least one typical scenario in the security control policy, determining a typical scenario matching the connection request and a security policy corresponding to the matching typical scenario; according to the determined security policy sending indication information to the access device, where the indication information is used to instruct the access device to establish a connection with the server;

The access device is configured to send a connection request to the management node, where the connection request is used for the access device to request to establish a connection with a server; and is also configured to: receive the indication information sent by the management node, The indication information is used to instruct the access device to establish a connection with the server.

The server is configured to establish a connection with the access device according to the indication information.

With reference to the possible implementation manner of the fourth aspect, in the first possible implementation manner of the fourth aspect, the method further includes:

The management node is further configured to send the determined security policy to the server, the security policy of the connection request includes collecting at least one of global positioning system data, camera data, and microphone data; The access device data, the access device data is obtained by the server notifying the access device according to the requirements of the determined security policy; saving the access device data;

The server is further configured to receive the determined security policy sent by the management node; send the determined security policy to the virtual machine; send the access device data to the management node;

The access device is further configured to receive the determined security policy sent by the server; collect the data of the access device according to the requirements of the determined security policy; send the data of the access device to the server.

By presetting the security control policy in the management node, when the user requests to establish a connection with the server through different access devices, the management node can compare the typical scenarios in the security control policy according to the user type, access device type and remote desktop type , determine the typical scenario matching this connection request and the security policy corresponding to the matching typical scenario, compared with the prior art that only controls the security of the connection request through user or virtual machine operation authority, realizes the connection request for different scenarios Carry out differentiated control to enhance the information security protection of the enterprise; on the other hand, according to the requirements of the security policy, collect GPS data, camera data, microphone data and other access device data in the access device, which can be used in the virtual desktop infrastructure. Security audits are performed on connection requests with lower credit levels to improve the information security of enterprise business.

In a fifth aspect, the present invention provides a management node, the management node includes a processor, a memory, a communication interface, and a system bus, and the processor, memory, and communication interface are connected through the system bus and complete mutual communication, The memory is used to store computer-executable instructions, and when the virtual desktop management system is running, the processor executes the computer-executable instructions in the memory to utilize hardware resources in the virtual desktop management system to perform the first aspect, The method described in any one of the first possible implementation manner of the first aspect and the third possible implementation manner of the first aspect.

By presetting the security control policy in the management node, when the user requests to establish a connection with the server through different access devices, the management node can according to the user type, access device type, access network environment type and remote The desktop type is matched with the preset security control strategy to determine the security strategy for this connection request. Compared with the existing technology, it realizes differential control of connection requests in different scenarios and enhances the information security protection of the enterprise; On the one hand, according to the requirements of the security policy, access device data such as GPS data, camera data, and microphone data are collected in the access device, and security audits can be performed on connection requests with lower credit levels in the virtual desktop infrastructure. In this way, Improve the information security of enterprise business.

In a sixth aspect, the present invention provides an access device, the access device includes a processor, a memory, a communication interface, and a system bus, and the processor, memory, and communication interface are connected through the system bus and complete mutual communication. Communication, the memory is used to store computer-executable instructions, and when the virtual desktop management system is running, the processor executes the computer-executable instructions in the memory to utilize hardware resources in the virtual desktop management system to execute the second aspect and the method described in the first possible implementation manner of the second aspect.

Through the above description, the access device can collect GPS data, camera data, microphone data and other access device data in the access device based on the requirements of the security policy determined by the management node, and send it back to the management node for storage, which is different from the existing technology In contrast, by saving the access device data in the management node, the security audit of the connection request in the virtual desktop infrastructure can be periodically performed, thereby improving the information security of the enterprise business.

In a seventh aspect, the present invention provides a server, the server includes a processor, a memory, a communication interface, and a system bus, and the processor, the memory, and the communication interface are connected through the system bus and complete mutual communication, and the The memory is used to store computer-executable instructions. When the virtual desktop management system is running, the processor executes the computer-executable instructions in the memory to utilize hardware resources in the virtual desktop management system to perform the third aspect and the third aspect. The method described in the first possible implementation manner of the aspect.

The server can implement different security control items based on the security policy determined by the management node, and send the security policy to the access device, and send the access device data returned by the access device to the management node, and the management node saves the access device Compared with the existing technology, the virtual desktop management system can implement different security policies according to the access information of the access device, and store the access device data returned by the access device, which is convenient for subsequent verification of the lower credit level. Perform security audits on connection requests to improve the information security of enterprise services.

In an eighth aspect, there is provided a computer-readable medium for storing a computer program, where the computer program includes instructions for executing the method in the first aspect or any possible implementation manner of the first aspect.

To sum up, by presetting the security control strategy in the management node, when a user requests to establish a connection with the server through different access devices, the management node can The network environment type and remote desktop type are matched with the preset security control strategy to determine the security strategy for this connection request. Compared with the existing technology, it realizes differential control of connection requests in different scenarios and enhances the information of the enterprise. Security protection; on the other hand, according to the requirements of the security policy, access device data such as GPS data, camera data, microphone data, etc. are collected in the access device, so that connection requests with lower credit levels in the virtual desktop infrastructure can be secured. Audit, in order to improve the information security of enterprise business.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the accompanying drawings required in the embodiments of the present invention. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without making creative efforts.

FIG. 1 is a schematic diagram of a virtual desktop infrastructure in the prior art;

FIG. 2 is a schematic flowchart of a method for virtual desktop security control provided by an embodiment of the present invention;

FIG. 3 is a schematic flow chart of another virtual desktop security control method provided by an embodiment of the present invention;

FIG. 4 is a schematic diagram of a virtual desktop management system provided by an embodiment of the present invention;

FIG. 5 is a schematic diagram of a management node provided by an embodiment of the present invention;

FIG. 6 is a schematic diagram of an access device provided by an embodiment of the present invention;

FIG. 7 is a schematic diagram of a virtual machine provided by an embodiment of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts shall fall within the protection scope of the present invention.

Figure 1 is a schematic diagram of a virtual desktop infrastructure (Virtual Desktop Infrastructure, VDI). As shown in the figure, the virtual desktop infrastructure includes a virtual desktop management system, an access gateway, an access device and a server, wherein the access device includes a personal computer (Personal Computer, PC), thin client (Thin Client, TC), mobile device.

The virtual desktop management system is used to implement the management and control functions of remote desktop access. The virtual desktop management system may include management nodes, domain servers, log servers, network access servers, license authentication servers, and other types of management components. Each management component in the management system can be deployed by a server or by a virtual machine, which is not limited in the present invention.

Users can access the remote desktop through the virtual desktop management system. The remote desktop can be the operating system installed on the server, or the operating system of the virtual machine formed by deploying virtualization software on the server. Specifically, remote desktops can be divided into multiple types according to their attributes. For example, according to the functions of remote desktops, they can be divided into office-type remote desktops and conference-type remote desktops for connecting meetings; Network planning is divided into common remote desktop and special remote desktop; it can also be divided into secure remote desktop and common remote desktop according to whether the operating system is encrypted.

Administrators can pre-allocate servers or virtual machines to users in the virtual desktop management system, and record the assignment relationship. The interface displays information about all servers or virtual machines that have been assigned to the user. Users can choose any server or virtual machine to access. Users can be divided into ordinary users and special users according to different permissions.

For example, the virtual desktop management system allocates a common virtual machine and a special virtual machine to common user A, and a special virtual machine to special user B, then user A uses the account and password to access the When logging in to the web interface, all 2 virtual machines assigned to user A are displayed on the web interface, and the user can select any virtual machine to access. The management system will send the security policy to the access device and the virtual machine that the user needs to access. After the control items of the security policy are implemented on the access device and the virtual machine that the user needs to access, the user can log in to the virtual machine for office operations.

A virtual desktop agent is deployed in each remote desktop and access device, where the virtual desktop agent in the remote desktop is the server, and the virtual desktop agent in the access device is the client; the management system can be connected through the desktop agent The access device and the remote desktop can be managed and monitored, and the virtual desktop protocol can also be processed through the desktop proxy between the remote desktop and the access device.

Thus, the user can use the access device to communicate with the virtual desktop management system and the remote desktop through the access gateway through the Ethernet, so as to realize the remote access function of the virtual desktop. In the specific implementation process, different access network environment types can be distinguished according to different access gateways, for example, the network type of the virtual desktop is divided into intranet and extranet according to the security of the local area network.

In addition, administrators can also preset security control policies in the management node. Specifically, security control policies can be preset according to user types, access device types, and remote desktop types, where the security control policies include credit levels, security policies, and typical scenarios. Administrators can determine typical scenarios according to the requirements of business scenarios in the specific implementation process, according to user types, access device types, and remote desktop types. Each typical scenario corresponds to a security policy, and each security policy corresponds to a credit level.

Optionally, security control policies can also be preset according to user type, access device type, remote desktop type, and access network environment type.

Exemplarily, Table 1 is the specific content of an embodiment of the security control policy.

Table 1 Security Control Strategy

As shown in Table 1, the administrator presets security control policies in the management node according to the user type, access network environment type, access device type, and remote desktop type. If it is assumed that the user types include ordinary users and special users; The environment includes intranet and extranet; access devices include mobile devices, personal computers, and thin clients; remote desktops are virtual machines, and the types of remote desktops include ordinary virtual machines and special virtual machines; examples of typical scenarios are shown in Table 1 Show:

Typical scenario 1: A special user uses a mobile device to access a special virtual machine on the external network. The limiting conditions for the typical scenario include user type, access network environment, access device, and remote desktop type. The connection request for this typical scenario is implemented The corresponding security policy does not allow users to access the remote desktop, and its authorization level is the lowest.

Typical Scenario 2: A special user uses a mobile device to access a common virtual machine on the external network. The limiting conditions for the typical scenario include user type, access network environment, access device, and remote desktop type. The connection request for this typical scenario is implemented The corresponding security policy has an extremely low credit level.

Typical scenario three: use a mobile device to access a virtual machine from the external network, and the user type and remote desktop type are not limited. The typical scenario specifically includes: ordinary users use mobile devices to access ordinary Network access to special virtual machines, special users use mobile devices to access ordinary virtual machines on the external network, and special users use mobile devices to access special virtual machines on the external network. Among them, special users use mobile devices to access special virtual machines on the external network is the credit level is the lowest typical scenario, and a special user uses a mobile device to access a normal virtual machine on the external network is a typical scenario with an extremely low credit level. 1. The connection request of ordinary users using mobile devices to access special virtual machines on the external network. The security policies corresponding to the typical scenarios are implemented, and the credit level is low.

Typical scenario 4: Use a thin client to access a special virtual machine on the external network, and the user type is not limited. The typical scenario includes: ordinary users use a thin client to access a special virtual machine on the external If the virtual machine is connected to a special virtual machine and does not overlap with other typical scenarios in the security control policy, the corresponding security policy is implemented for the connection request in the above typical scenario, and its credit level is medium.

Typical scenario five: use a personal computer to access a virtual machine on the intranet, and the user type and virtual machine type are not limited. The typical scenario specifically includes: ordinary users use personal computers to access ordinary virtual machines on the intranet, Access to special virtual machines on the intranet, special users use personal computers to access ordinary virtual machines on the intranet, and special users use personal computers to access special virtual machines on the intranet, and the above typical scenarios are not the same as those typical in other security control strategies. If the scenarios overlap, the corresponding security policies are implemented for the connection requests in the above typical scenarios, and the credit level is high.

Typical scenario 6: Use a thin client to access a virtual machine on the intranet, and the user type and virtual machine type are not limited. The typical scenario specifically includes: ordinary users use a thin client to access ordinary Thin clients access special virtual machines on the intranet, special users use thin clients to access ordinary virtual machines on the intranet, special users use thin clients to access special virtual machines on the intranet, and the above typical scenarios are not related to security control If other typical scenarios in the policy are repeated, the corresponding security policy will be implemented for the connection requests in the above typical scenarios, and its credit level will be extremely high.

It is worth noting that the typical scenarios in Table 1 can be a combination of user type, access device type, access network environment type, and remote desktop type. Each typical scenario corresponds to a security policy, and each security policy includes at least one security policy. control item.

In addition, the typical scenarios listed in Table 1 are only examples, and corresponding typical scenarios can be established according to the information security requirements of specific business scenarios during the specific implementation process, which is not limited by the present invention. In the following specific description of the present invention, the security control strategy shown in Table 1 will be taken as an example for detailed description.

Further, there are six pre-defined credit levels of minimum, very low, low, medium, high, and very high. The lower the credit level, the more security control items are implemented on the access device and server of the connection request. If the security control item flag in this security policy is on, it means that the access device or server of this connection request needs to perform the function of the corresponding security control item; if the security control item flag is off, it means that the access device of this connection request Or the server does not need to execute the function corresponding to the security control item.

Specifically, the following security control items can be included in the security policy:

Returning Global Positioning System (Global Positioning System, GPS) data: the access device sends back its GPS positioning data to the management node.

Returning camera data: The access device collects camera data and sends it back to the management node.

Return microphone data: the access device collects microphone data and sends it back to the management node.

Digital Watermark: Add a digital watermark to the image.

Clipboard redirection: It is used to transfer the data of the clipboard in the access device to the server or transfer the data of the clipboard in the server to the access device, so that data can be exchanged between the access device and the server copy.

File redirection: used to map the file system of the access device to the server or map the file system of the server to the access device, so that the access device and the server can use the mapped file system for read and write operations.

It should be noted that the security control strategy shown in Table 1 is only an example, and does not constitute a limitation of the present invention. In addition, clipboard redirection and file redirection functions can be controlled by one-way policies, and different control methods can be adopted, that is, between the access device and the server, one direction is enabled and the other direction is disabled. For example, the server transmits the content of the clipboard to the access device, but the content of the access device is not transmitted to the server. In addition, other possible security control items or other security policy combinations can be added. For example, if a mobile device using the IOS operating system or a mobile device whose operating system is Android connects to the server, different credit levels and security policies can be adopted according to whether the user storage read and write permissions in the IOS operating system have been cracked or the administrator permissions have been unlocked. During specific implementation, different policies may be set according to specific information security requirements, which are not limited by the present invention.

It is also worth noting that the security control policy preset by the administrator can be stored in a file or database table that is preset and defined in the management node, or can be stored in other storage forms, which is not limited by the present invention.

Optionally, after the administrator presets security control policies on the management node, he can add or update credit levels, security policies, and typical scenarios according to business needs, so as to adapt to changes in information security requirements of enterprises. It should be noted that the updated security control policy only takes effect for the updated new connection request.

Next, in combination with the above description, FIG. 2 introduces in detail the virtual machine desktop security control method provided by the present invention, and the method includes:

S201. Preset a security control policy in the management node, the security control policy includes at least one typical scenario and a security policy corresponding to each of the at least one typical scenario, and each of the at least one typical scenario is a user type . A combination of an access device type and a remote desktop type, each of the security policies includes at least one security control item, wherein each of the security policies includes at least one security control item.

Optionally, the security control policy may also include a credit level.

Specifically, the credit level is used to identify the security control level of this connection request, and each of the at least one typical scenario corresponds to one of the credit levels.

Optionally, the management node may also preset a security control policy according to an access network environment type and preset a security policy.

For example, the administrator can preset typical scenarios, security policies and credit levels in the security control policies shown in Table 1 on the management node.

S202. The management node receives the connection request sent by the access device.

Specifically, the connection request is used for the access device to request to establish a connection with the server.

S203. The management node acquires the user type, access device type, and remote desktop type carried in the connection request.

Optionally, the management node may also acquire the access network environment type carried in the connection request.

For example, if a special user uses a mobile device to send a request message for accessing a normal virtual machine to the virtual desktop management system on the external network, the virtual desktop management system obtains a connection request message including the special user, the mobile device, the external network and the normal virtual machine. virtual machine.

S204. Compare the user type, access device type, and remote desktop type carried in the connection request with the at least one typical scenario in the security control policy, and determine the typical scenario that matches the connection request and the The security policy corresponding to the matching typical scenario.

Specifically, the management node compares the user type, access device type, and remote desktop type carried in the connection request obtained in step S202 with typical scenarios in the security control policy. match, it is determined that the security policy to be implemented for this connection request is the security policy corresponding to the matching typical scenario, and its credit level is the corresponding credit level of the matching typical scenario.

For example, with the security control policy shown in Table 1, if a special user uses a mobile device to send a connection request to access a common virtual machine on the external network, compared with the typical scenarios of each credit level in Table 1, it is the same as the one with an extremely low credit level. If it matches the typical scenario, that is, it matches the typical scenario of "a special user uses a mobile device to access a common virtual machine on the external network", then it is determined that the security policy corresponding to the matching typical scenario is the security policy of this connection request, and its credit level is extremely low. If an ordinary user uses a mobile device to send a connection request to access an ordinary virtual machine on the external network, compared with the typical scenario in the security control policy in Table 1, and matches "using a mobile device to access a virtual machine on the external network", then determine the match The security policy corresponding to the typical scenario is the security policy of this connection request, and its credit level is low.

Optionally, if there is no matching typical scenario after comparing the user type, access device type, access network environment type, and remote desktop type carried in the connection request with the preset security control policy, the preset default security control policy can be implemented. Strategy.

For example, the management node can preset the default security policy as the security policy corresponding to the typical scenario "using a thin client to access a special virtual machine on the external network", and the default credit level is medium. network to send a connection request to access a common virtual machine, the management node compares the user type, access device type, access network environment type, and remote desktop type carried in this connection request with the typical scenarios listed in Table 1 to determine that no If they match, the predefined default security policy will be implemented on the access device and server of this connection request, that is, the security policy corresponding to the typical scenario "using a thin client to access a special virtual machine on the external network" will be implemented. for middle.

Those skilled in the art should understand that virtual desktops are a type of remote desktops. After the allocation relationship between users and virtual machines is established in the virtual desktop management system, users can use any type of access device to access The network environment sends a request to connect to the virtual machine to the virtual desktop management system, and the credit level is only valid for this connection request.

For example, when an ordinary user A connects to a special virtual machine on the external network through a mobile device, the management node determines that the security policy corresponding to the typical scenario of "using a mobile device to access a virtual machine on the external network" for this connection request is implemented by the management node, and its credit level is low. ; When ordinary user A connects to the special virtual machine through the intranet again through the thin client, the management node determines that the security policy corresponding to the typical scenario of "using the thin client to access the virtual machine on the intranet" for this connection request is determined by the management node. The credit level is high.

S205. The management node sends indication information to the access device according to the security policy, where the indication information is used to instruct the access device to establish a connection with the server.

Specifically, when the security policy allows the access device to establish a connection with the virtual machine, the management node sends indication information to the access device, where the indication information is used to instruct the access device to establish a connection with the virtual machine. The virtual machine establishes a connection. If the security policy determined by the management node according to the access information and the security control policy does not allow the access device to establish a connection with the server, this connection request ends.

For example, as shown in Table 1, if a special user uses a mobile device to send a connection request for accessing a special virtual machine to the virtual desktop management system on the external network, the management node determines that the security policy for this connection request is to restrict access , the special user shown is not allowed to connect to the normal virtual machine, and this connection request will end.

Further, the access device establishes a connection with the server.

Specifically, a communication connection is established between the desktop proxy of the access device and the desktop proxy of the server.

Those skilled in the art should understand that, in the virtual desktop infrastructure, the connection established between the access device and the server is only a communication connection between the desktop agent, which is used to transmit instructions between the management node and the desktop agent , message, at this time, the virtual machine and the access device need to implement the corresponding security policy before the user can log into the operating system of the remote desktop.

Through the content described in steps S201 to S205 above, the administrator presets security control policies in the management node, that is, at least one typical scenario is formed according to the combination of user type, access device type, and remote desktop type, and each typical scenario corresponds to a When a user requests to establish a connection with a remote desktop through an access device, the user type, access device type, and remote desktop type carried in this connection request are compared with typical scenarios in the security control policy to determine According to the typical scenario matching this connection request and the security policy corresponding to the matching typical scenario, different security control items are implemented on the access device and server according to the requirements of the determined security policy, which is different from the existing technology that relies on users The security control of the operation authority and the operation authority of the remote access of the server or virtual machine can implement differentiated security control on connection requests in different scenarios, and improve the information security of the virtual desktop infrastructure.

Further, the specific implementation process of the determined security policy is shown in Figure 3, the method includes:

S301. The management node sends the determined security policy to the server.

Specifically, the determined security policy is the security policy determined by the method in FIG. 2 .

For example, with the security control policy shown in Table 1, if a special user uses a mobile device to access a common virtual machine on the external network, the management node will send the following security policy to the server:

Return GPS data;

Return camera data;

Return microphone data;

Add digital watermark to image;

Turn off the clipboard redirection function;

Turn off file system redirection.

S302. The server sends the determined security policy to the access device.

Specifically, the server and the access device communicate through a desktop agent, and the desktop agent in the server sends the security policy determined in step S301 to the desktop agent in the access device.

S303. The access device collects access device data according to requirements of the determined security policy.

Specifically, the determined security policy includes collecting at least one of GPS data, camera data, and microphone data, and the access device collects access device data according to requirements in the determined security policy. In the specific implementation process, according to the needs of specific business scenarios, different security policies can be configured in the preset security control policies shown in Table 1, and it is required whether the access device data needs to be returned.

For example, if the security policy corresponding to the typical scenario matching the connection request requires returning GPS data, camera data, and microphone data, then:

When the access device has a GPS device, the GPS module in the access device collects the GPS address information of the access device and sends it to the server through the desktop agent;

When the access device has a camera and/or a microphone, the camera and/or microphone module in the access device is used to collect the camera image and/or microphone sound of the access device and send it to the desktop agent in the virtual machine.

Optionally, the access device data may also include the access device MAC address.

It is worth noting that the camera data or microphone data collected by the access device can be real-time data or data stored in the access device; on the other hand, the camera data or microphone data collected by the access device can be a complete The data may also be a part of the complete data, which is not limited in the present invention.

Optionally, when the security policy received by the access device requires the data of the access device to be returned, the interface of the access device can give corresponding prompts and judgment information. If the user chooses to allow the collection of access device data, the return Access the device data, and allow the user to continue to complete the operation of logging in to the virtual machine; if the user chooses not to allow the collection of access device data, the connection request is interrupted.

S304. The access device sends the access device data to the server.

S305. The server sends the access device data to the management node.

S306. The management node saves the access device data.

Specifically, the management node saves the access device data sent back by the access device, and records the access device data of each connection request of the access device, so as to perform regular security audits of the system.

S307. The access device implements the determined security policy.

Specifically, the access device enables or disables corresponding functions on the access device based on the determined security policy requirements, that is, whether to map the client file system of the access device to the server, whether to The contents of the clipboard of the device can be transferred to the server, and whether to add a watermark to the image of the connected device.

For example, as shown in Table 1, the security control policy, if the user type, access device type, and access network type carried in the connection request of the access device and the typical scenario "Special users use mobile devices to access ordinary virtual machine" and the credit level is extremely low, based on the requirements of the security policy corresponding to the typical matching scenario: the access device needs to add a watermark to the image of the access device, and there is no need to upload the client file of the access device to The system is mapped to the server, and there is no need to transfer the contents of the clipboard of the access device to the server; if the user type, access device type, and access network type carried in the connection request of the access device and the typical Intranet access virtual machine" is based on the requirements of the security policy corresponding to the matching typical scenario: the access device needs to pass the content of the clipboard to the server, and there is no need to add a watermark to the image of the access device. There is no need to map the file system to the server.

S308. The server implements the determined security policy.

Specifically, based on the requirements of the determined security policy, the server enables or disables corresponding functions on the server, that is, whether to map the file system to the access device, whether to transfer the contents of the server clipboard to the access device, whether to transfer Add a watermark to the image on the server of the connected device.

For example, as shown in Table 1, if the security control policy shown in Table 1, if the connection request of the access device is determined to match the typical scenario of "a special user uses a mobile device to access a common virtual machine on the external network", the server will Corresponding security policy: It is necessary to add a watermark to the image delivered to the server of the access device, it is not necessary to map the file system to the access device, and it is not necessary to transfer the contents of the clipboard to the access device. If the connection request of the access device matches the typical scenario of "using a personal computer to access a virtual machine on the intranet", the server needs to map the file system to the access device based on the security policy corresponding to the matching typical scenario , there is no need to transfer the content in the clipboard to the access device, and there is no need to add a watermark to the picture delivered to the server of the access device.

Through the description of the above content, according to the requirements of the security policy matching this connection request, the GPS data, camera data, and microphone data of the access device are collected and stored in the management node. Compared with the existing technology, the collection and Saving access device data can periodically conduct security audits on connection requests in the virtual desktop management system, improving enterprise information security. On the other hand, for each connection request, different security control items are implemented on the access device and the server, thereby solving the problem in the prior art that differentiated control cannot be achieved in different access scenarios, thereby improving The information security of enterprise business.

Optionally, in another possible embodiment of the present invention, in the preset security control policy, a preset score segment can also be set for each typical scenario, that is, for user type, access device type , each combination of access network environment type and remote desktop type sets a preset score segment, and for each of the user type, access device type, access network environment type, and remote desktop type carried in the connection request Mark points by type, such as 5 points when the access device is a mobile device, 10 points when the access device is a personal computer or thin client; 5 points for ordinary users, 10 points for special users; 10 points for intranet access ; 5 points are marked for external network access; 5 points are marked for ordinary virtual machines; 10 points are marked for special virtual machines. When the management node receives the connection request, it obtains the user type, access device type, access network environment type, and remote desktop type carried in the connection request, and scores them, and compares the total score of this connection request with each According to the preset score segment corresponding to this typical scenario, determine the score segment that matches this connection request and the security policy corresponding to the score segment, and implement the security policy on the access device and server. Using the above method, you can also It solves the problem in the prior art that it is impossible to distinguish different connection requests for differentiated security control, and improves the information security of the enterprise.

It should be understood that in various embodiments of the present invention, the sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of each process should be determined by its functions and internal logic, rather than by the embodiment of the present invention. The implementation process constitutes any limitation.

To sum up, the security control method provided by the embodiment of the present invention presets the security control strategy in the management node, according to the user type, access device type, remote desktop type and preset Compared with the security control strategy of the current connection request, determine the typical scenario that matches this connection request and the security strategy corresponding to the typical scenario, and implement different security strategies for the access device and server in this connection request, which is comparable to the existing technology. Compared with this method, it solves the problem that the security of connection requests cannot be controlled differently in different access scenarios, and improves the information security of enterprises. In addition, by configuring the function of returning access device data in the security policy, the access device data in the connection request is recorded and saved, which is convenient for security audit and also enhances the security protection of remote desktop access.

FIG. 4 is a schematic diagram of a virtual desktop management system 400 in an embodiment of the present invention. As shown in the figure, the virtual desktop management system includes: a management node 401, a server 402, and an access device 403. The method includes:

The management node 401 is configured to preset a security control policy, the security control policy includes at least one typical scenario and a security policy corresponding to each of the at least one typical scenario, and each of the at least one typical scenario is a user type, access device type, and remote desktop type, each of the security policies includes at least one security control item;

The management node 401 is further configured to: obtain the user type, access device type, and remote desktop type carried in the connection request sent by the access device; Comparing the remote desktop type with the at least one typical scenario in the security control policy, determining a typical scenario matching the connection request and a security policy corresponding to the matching typical scenario; according to the determined security Sending instruction information to the access device by policy, where the instruction information is used to instruct the access device to establish a connection with the server;

The access device 403 is configured to send a connection request to the management node, where the connection request is used for the access device to request to establish a connection with the server;

The access device 403 is further configured to: receive the indication information sent by the management node, where the indication information is used to instruct the access device to establish a connection with the server.

The server 402 is configured to establish a connection with the access device according to the indication information.

Optionally, the management node 401 is further configured to: send the determined security policy to the server, the security policy of the connection request includes collecting at least one of global positioning system data, camera data, and microphone data ; Receive the access device data sent by the server, the access device data is obtained by the server notifying the access device according to the requirements of the determined security policy;

The server 402 is further configured to receive the determined security policy sent by the management node; send the determined security policy to the virtual machine; send the access device data to the management node;

The access device 403 is further configured to receive the determined security policy sent by the server; collect the data of the access device according to the requirements of the determined security policy; send the data of the access device to the said server.

It is worth noting that the above-mentioned virtual desktop management system 400 is used to execute the method described in any one of FIG. 2 to FIG. 3 , which will not be repeated here.

By presetting the security control policy in the management node, when the user requests to establish a connection with the server through different access devices, the virtual desktop management system 400 can compare the security control policy according to the user type, access device type, remote desktop type, Determine the typical scenario matching this connection request and the security policy corresponding to the matching typical scenario, compared with the prior art in which the security of the connection request is only controlled by the user or virtual machine operation authority, the connection request for different scenarios is implemented. Differentiated control enhances the information security protection of the enterprise; on the other hand, according to the requirements of the security policy, the access device data such as GPS data, camera data, microphone data, and MAC address are collected in the access device, which can control the virtual desktop infrastructure. The connection requests with lower credit levels in the architecture are subject to security audits, so as to improve the information security of enterprise business.

The method for virtual desktop security control provided according to the embodiment of the present invention is described in detail above with reference to FIGS. device.

FIG. 5 is a schematic diagram of a management node 500 provided by the present invention. As shown in the figure, the management node 500 includes a processor 501, a memory 502, a communication interface 503, and a system bus 504. The processor 501, the memory 502 and The communication interfaces 503 are connected through the system bus 504 to complete mutual communication. The memory 502 is used to store computer execution instructions. When the virtual desktop management system is running, the processor 501 executes the instructions in the memory 502. The computer executes instructions to use hardware resources in the virtual desktop management system to execute any one of the methods described in FIGS. 2 to 3 .

It should be understood that, in the embodiment of the present invention, the processor 501 may be a CPU, and the processor 501 may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

The memory 502 may include read-only memory and random-access memory, and provides instructions and data to the processor 510 . A portion of memory 502 may also include non-volatile random access memory. For example, memory 502 may also store device type information.

In addition to the data bus, the system bus 504 may also include a power bus, a control bus, and a status signal bus. However, for clarity of illustration, the various buses are labeled as system bus 504 in the figure.

By presetting the security control policy in the management node, when a user requests to establish a connection with the server through different access devices, the management node 500 can compare the user type, access device type, and remote desktop type carried in the connection request with the preset Match the security control strategy of the current connection request to determine the security strategy of this connection request. Compared with the existing technology, it realizes the differential control of connection requests in different scenarios and enhances the information security protection of the enterprise; on the other hand, according to the security According to policy requirements, access device data such as GPS data, camera data, microphone data, and MAC address can be collected in access devices, and security audits can be performed on connection requests with lower credit levels in the virtual desktop infrastructure, thereby improving enterprise security. Business information security.

FIG. 6 is a schematic diagram of an access device 600. As shown in the figure, the access device 600 includes a processor 601, a memory 602, a communication interface 603, and a system bus 604. The processor 601, the memory 602, and the communication interface 603 are connected to each other through a system bus 604 and communicate with each other. The memory 602 is used to store computer execution instructions. When the virtual desktop management system is running, the processor 601 executes the computer execution instructions in the memory 602. directive such that:

Send a connection request to the management node, the connection request is used for the access device to request to establish a connection with the server, so that the management node determines the security policy of the connection request, and sends the security policy of the connection request to said server;

Receive the security policy of the connection request sent by the server, the security policy of the connection request includes collecting at least one of global positioning system data, camera data, and microphone data;

Collect access device data according to the requirements of the security policy of the connection request;

Send the access device data to the server.

It should be understood that, in the embodiment of the present invention, the processor 601 may be a CPU, and the processor 601 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

The memory 602 may include read-only memory and random-access memory, and provides instructions and data to the processor 510 . A portion of memory 602 may also include non-volatile random access memory. For example, memory 602 may also store device type information.

In addition to the data bus, the system bus 604 may also include a power bus, a control bus, and a status signal bus. However, for clarity of illustration, the various buses are labeled as system bus 604 in the figure.

Optionally, the security policy of the connection request further includes at least one of file system redirection, clipboard redirection, and digital watermarking, then

The access device is based on the security policy of the connection request:

mapping the file system of the access device to the server; or

passing the clipboard content of the access device to the server; or

Adding a watermark to the image of the access device.

Through the above description, the access device 600 can collect GPS data, camera data, microphone data, MAC address and other access device data in the access device 600 based on the requirements of the management node to determine the security policy, and send it back to the management node for storage. , compared with the prior art, by storing the access device data in the management node, security audits can be periodically performed on the connection requests in the virtual desktop infrastructure, thereby improving the information security of the business of the enterprise.

7 is a schematic diagram of a server 700. As shown in the figure, the server 700 includes: a processor 701, a memory 702, a communication interface 703, and a system bus 704. The processor 701, the memory 702, and the communication interface 703 are connected through The system bus 704 connects and completes mutual communication, and the memory 702 is used to store computer-executable instructions. When the virtual desktop management system is running, the processor 701 executes the computer-executable instructions in the memory 702, so that :

receiving a security policy sent by the management node, the security policy including at least one of global positioning system data, camera data, and microphone data;

sending the security policy to the access device, so that the access device collects access device data according to the requirements of the security policy;

receiving the access device data sent by the access device;

sending the access device to the management node, so that the management node saves the access device data.

It should be understood that, in the embodiment of the present invention, the processor 701 may be a CPU, and the processor 701 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

The memory 702 may include read-only memory and random-access memory, and provides instructions and data to the processor 510 . A portion of memory 702 may also include non-volatile random access memory. For example, memory 702 may also store device type information.

In addition to the data bus, the system bus 704 may also include a power bus, a control bus, and a status signal bus. However, for clarity of illustration, the various buses are labeled as system bus 704 in the figure.

Optionally, the security policy further includes: at least one of file system redirection, clipboard redirection, and digital watermarking, then

The server based on the security policy:

mapping the file system of the server to the access device; or

passing the content of the server's clipboard to the access device; or

Adding a watermark to the image sent by the server to the access device.

Through the above description, the server 700 can implement different security control items based on the security policy determined by the management node, and send the security policy to the access device, and send the access device data returned by the access device to the management node, The management node saves the access device data. Compared with the prior art, the management node can respond to connection requests in different scenarios according to the security policies determined by the user type, access device type, and remote desktop type carried in the connection request. Implement differentiated control to improve the information security of enterprise business.

Those skilled in the art can appreciate that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (14)

1. A method for virtual desktop security control, characterized in that a security control strategy is preset in a management node, and the security control strategy includes at least one typical scenario and a security strategy corresponding to each of the at least one typical scenario , each of the at least one typical scenario is a combination of user type, access device type, and remote desktop type, and each of the security policies includes at least one security control item; the method includes: The management node receives a connection request sent by the access device, and the connection request is used for the access device to request to establish a connection with the server; The management node acquires the user type, access device type, and remote desktop type carried in the connection request; The management node compares the user type, access device type, and remote desktop type carried in the connection request with the at least one typical scenario in the security control policy, and determines a typical scenario that matches the connection request and a security policy corresponding to the typical matching scenario; The management node sends indication information to the access device according to the determined security policy, where the indication information is used to instruct the access device to establish a connection with the server. 2. according to the described method of claim 1, it is characterized in that, described method also comprises: The management node sends the determined security policy to the server, and the determined security policy includes collecting at least one of global positioning system data, camera data, and microphone data of the access device; The management node receives the access device data sent by the server, and the access device data is obtained by the server notifying the access device according to the determined security policy; The management node saves the access device data. 3. The method according to claim 2, wherein the access device data obtained by the access device according to the determined security policy is specifically: The access device receives the determined security policy sent by the server; The access device collects the access device data according to the requirements of the determined security policy; The access device sends the access device data to the server. 4. The method according to claim 1, wherein the method further comprises: The management node sends the determined security policy to the server, the determined security policy includes at least one of file system redirection, clipboard redirection, and digital watermark, so that the server based on the Determined security policy: mapping the file system of the server to the access device; or passing the content of the server's clipboard to the access device; or Adding a watermark to the image sent by the server to the access device. 5. method according to claim 4, is characterized in that, described method also comprises: The server sends the determined security policy to the access device, so that the access device: based on the determined security policy: mapping the file system of the access device to the server; or passing the clipboard content of the access device to the server; or Adding a watermark to the image of the access device. 6. A method for virtual desktop security control, characterized in that the method comprises: The access device sends a connection request to the management node, the connection request is used for the access device to request to establish a connection with the server, so that the management node determines the security policy of the connection request, and uses the determined security policy sent to said server; The access device receives the determined security policy sent by the server, and the determined security policy includes collecting at least one of global positioning system data, camera data, and microphone data; The access device collects access device data according to the requirements of the security policy of the connection request; The access device sends the access device data to the server. 7. The method according to claim 6, wherein the determined security policy further comprises at least one of file system redirection, clipboard redirection, and digital watermarking, then The access device is based on the security policy of the connection request: mapping the file system of the access device to the server; or passing the clipboard content of the access device to the server; or Adding a watermark to the image of the access device. 8. A method for virtual desktop security control, characterized in that the method comprises: The server receives the security policy sent by the management node, and the security policy includes at least one of global positioning system data, camera data, and microphone data; The server sends the security policy to the access device, so that the access device collects access device data according to the requirements of the security policy; The server receives the access device data sent by the access device; The server sends the access device to the management node, so that the management node saves the access device data. 9. The method according to claim 8, wherein the security policy further comprises: at least one of file system redirection, clipboard redirection, and digital watermarking, then The server based on the security policy: mapping the file system of the server to the access device; or passing the content of the server's clipboard to the access device; or Adding a watermark to the image sent by the server to the access device. 10. A virtual desktop management system, characterized in that, the virtual desktop management system includes: a server, a management node, and an access device: The management node is used to preset a security control strategy, the security control strategy includes at least one typical scenario and a security strategy corresponding to each of the at least one typical scenario, and each of the at least one typical scenario is a user type . A combination of access device type and remote desktop type, each of the security policies includes at least one security control item; The management node is further configured to: obtain the user type, access device type, and remote desktop type carried in the connection request sent by the access device; Comparing the remote desktop type with the at least one typical scenario in the security control policy, determining a typical scenario matching the connection request and a security policy corresponding to the matching typical scenario; according to the determined security policy sending indication information to the access device, where the indication information is used to instruct the access device to establish a connection with the server; The access device is configured to send a connection request to the management node, where the connection request is used for the access device to request to establish a connection with a server; The access device is further configured to: receive the indication information sent by the management node, where the indication information is used to instruct the access device to establish a connection with the server. The server is configured to establish a connection with the access device according to the indication information. 11. according to the described method of claim 10, it is characterized in that, described method also comprises: The management node is further configured to send the determined security policy to the server, the determined security policy includes collecting at least one of global positioning system data, camera data, and microphone data; receiving the information sent by the server Accessing device data, the accessing device data is obtained by the server notifying the accessing device according to the requirements of the determined security policy; saving the accessing device data; The server is further configured to receive the determined security policy sent by the management node; send the determined security policy to the virtual machine; send the access device data to the management node; The access device is further configured to receive the determined security policy sent by the server; collect the data of the access device according to the requirements of the determined security policy; send the data of the access device to the server. 12. A management node, characterized in that the management node includes a processor, a memory, a communication interface, and a system bus, and the processor, the memory, and the communication interface are connected through the system bus and complete mutual communication, so The memory is used to store computer-executable instructions, and when the virtual desktop management system is running, the processor executes the computer-executable instructions in the memory to utilize hardware resources in the virtual desktop management system to perform claims 1 and 2 and the method described in any one of 4. 13. An access device, characterized in that the access device includes a processor, a memory, a communication interface, and a system bus, and the processor, the memory, and the communication interface are connected through the system bus and complete mutual communication , the memory is used to store computer-executable instructions, and when the virtual desktop management system is running, the processor executes the computer-executable instructions in the memory to utilize hardware resources in the virtual desktop management system to perform claim 6 and the method described in 7. 14. A server, characterized in that, the server includes a processor, a memory, a communication interface, and a system bus, and the processor, the memory, and the communication interface are connected through the system bus and complete mutual communication, and the memory is used to store computer-executable instructions in the virtual desktop management system, and when the virtual desktop management system is running, the processor executes the computer-executable instructions in the memory so as to utilize the hardware resources in the virtual desktop management system to execute claims 8 and 9. Methods.