CN105871939A

CN105871939A - Virtual machine safety isolation system under network environment

Info

Publication number: CN105871939A
Application number: CN201610479366.0A
Authority: CN
Inventors: 杨越
Original assignee: Individual
Current assignee: Individual
Priority date: 2016-06-26
Filing date: 2016-06-26
Publication date: 2016-08-17
Also published as: WO2018000537A1

Abstract

The invention provides a virtual machine safety isolation system under a network environment. The virtual machine safety isolation system comprises a secret key management subsystem and an isolation subsystem, and is characterized in that (1), a real computer access a virtual machine and a firewall before accessing the internet so as to scan network communication flowing through the real computer; (2), the firewall is connected with the virtual machine and the virtual machine is connected with the real computer through a data copying system; (3), a false unprotected computer is installed on the virtual machine and a virtual machine safety isolation scheme is set on the false unprotected computer so as to enable an intruder to identify true information difficultly.

Description

Virtual machine security isolation system under network environment

Technical field

The present invention relates to computer safety field, particularly computer safety guarantee in a network environment.

Background technology

Development in science and technology now is swift and violent, bank, computer, mobile phone, and game identification number is closely bound up with us, with Sample has some illegal geeks to have begun to carry out gray zone, is engaged in unlawful activities.At mobile interchange In the net epoch, the value of userspersonal information unprecedentedly highlights, and the commercial value that " big data " can be brought will be drawn Lead a dramatic change, steal personal computer confidential information, subscriber data.DDOS attack on network, Virus disseminating, fishing webpage, the pornographic various information of violence reaction.At present, using technology a lot, one is to use Hardware isolated is dangerous, and two is to install antivirus software, and three are, are separated by two computers, and one uses online merit Can, another is then suspension state, and four are, limits surf time place, and five is to use minority's system such as LINUX, Fructus Mali pumilae etc., some is effective, and being also intended to but more is connected into the Internet, will give Hacker's chance.From the perspective of from technical standpoint, as long as being connected into the Internet when just do not have safe.One safety is provided Network environment be essential condition.

Summary of the invention

Therefore present invention aims to above deficiency supplement, it is provided that a kind of safe and reasonable is reliable Network environment, it is possible to meeting user, to use network to feel at ease relieved.

Inventive solution is to utilize the computer that can surf the Net to set up a virtual computerized environment, it is possible to complete Become to crack down upon evil forces visitor's intrusion behavior, can carry out data analysis, use, and safety completes any instruction task, and And ensure that this computer is not by any virus, hacker attacks.

The invention have the benefit that this is simple to operate, low cost, it is adaptable to promote on a large scale, it is possible to Ensure the safe handling of this computer.

The concrete solution of the present invention is to provide virtual machine security isolation system under a kind of network environment, including:

(1) before true computer is linked in the Internet, access of virtual machine and fire wall, to flowing through its network Communication is scanned；

(2) being connected with virtual machine by fire wall, virtual machine is connected with true computer by data copy system；

(3) falseness is installed on a virtual machine to run nakedly computer, virtual machine peace is set on falseness runs nakedly computer Full isolation scheme, so that invader is difficult to identification real information.

Preferably, wherein fire wall is network firewall, for the network service flowing through it is scanned, Or close the port that do not uses, or forbid the outgoing communication of particular port, block Trojan Horse, or forbid From the access of special website, thus prevent all communications from not clear invader.

The concrete scheme of the present invention also resides in a kind of secure virtual machine shielding system of offer, including: two subsystems System, i.e. key management subsystem and separaant system.

Preferably, key management subsystem includes key negotiation module and key management module, and key consults mould Block is responsible for managing server request key with key, and key management module is positioned in key management server, negative Duty management distribution key.

Preferably, separaant system mainly contains: block device isolation module, internal memory isolation module and desktop association View isolation module.Block device isolation module complete to block device request selective transparent encryption, internal memory every Completing to control desktop security inspection by extension ACM framework from module, desktop protocol isolation module is by right The encryption of input and output makes desktop protocol become safer.

Preferably, block device includes hard disk, CDROM, floppy disk.

According to below in conjunction with the accompanying drawing detailed description to the specific embodiment of the invention, those skilled in the art will More understand the above-mentioned of the present invention and other purposes, advantage and feature.

Accompanying drawing explanation

Some describing the present invention the most by way of example, and not by way of limitation in detail are specifically real Execute example.Reference identical in accompanying drawing denotes same or similar parts or part.People in the art Member is it should be understood that what these accompanying drawings were not necessarily drawn to scale.The target of the present invention and feature are in view of as follows Description taken together with the accompanying drawings will be apparent from, in accompanying drawing:

Accompanying drawing 1 is according to virtual machine security isolation method flow chart under the network environment of the embodiment of the present invention.

Accompanying drawing 2 is according to the system module view of virtual machine under the network environment of the embodiment of the present invention.

Detailed description of the invention

With reference now to accompanying drawing, the description of details will be provided according to the present invention.

With reference to the accompanying drawings 1, virtual machine security isolation system under a kind of network environment, including:

(1) before true computer is linked in the Internet, access of virtual machine and fire wall, wherein fire wall is net Network fire wall, the network service to flowing through it is scanned, and so can filter out some and attack, Yi Mianqi Being performed on a target computer, fire wall can also close the port not used, moreover it is possible to forbids particular port Outgoing communication, block Trojan Horse.It addition, fire wall can forbid the access from special website, Thus prevent all communications from not clear invader；

The partition method using virtual machine to carry out under network environment observes three principles, ensures to perform effect i.e. as far as possible Rate, reduces the isolated operation impact on system execution efficiency as far as possible, it addition, use the spy of existed system as far as possible Property, and need to consider the deployment complexity of real network environmental applications, select simple mode as far as possible.Empty Intend shielding system uses a key management server, be responsible for each key corresponding for virtual machine uuid, When a certain virtual machine activation, key consultative management service sets up safety meeting by Diffie-Hellman algorithm Words, to the key that key management server request virtual machine is corresponding after session establishment, by key transmission after request Use to block device and desktop protocol communication encryption module, desktop protocol encrypting module and desktop protocol the two Module all uses transparent encryption mode, upper-level virtual machine cannot perceive the existence of encrypting module, and internal memory is isolated Module is present in Hypervisor, is extended, it is achieved to virutal machine memory in ACM module basis Tracking and regular the automatically generating of ACM, realize the security control to desktop by pre-fishing mode.

With reference to the accompanying drawings 2, whole system can be divided into two subsystems: key management subsystem and separaant system. Key management subsystem includes key negotiation module and key management module, and key negotiation module is responsible for and key Management server request key, key management module is positioned in key management server, is responsible for distributing secret Key.Separaant system mainly contains: block device isolation module, internal memory isolation module and desktop protocol isolation mode Block.Block device isolation module completes the selective transparent encryption to block device request, and internal memory isolation module leads to Crossing extension ACM framework to complete to control desktop security inspection, desktop protocol isolation module is by input and output Encryption make desktop protocol become safer.

Although the present invention is described by reference to specific illustrative embodiment, but will not be by these The restriction of embodiment and only limited by accessory claim.Skilled artisan would appreciate that permissible In the case of without departing from protection scope of the present invention and spirit, embodiments of the invention can be modified and Amendment.

Claims

1. virtual machine security isolation system under a network environment, it is characterised in that including:

Virtual machine security isolation system under a kind of network environment the most according to claim 1, its feature exists It is network firewall in wherein said fire wall, for the network service flowing through it is scanned, or closes The port not used, or forbid the outgoing communication of particular port, block Trojan Horse, or forbid from spy The access of different website, thus prevent all communications from not clear invader.

3., for the secure virtual machine shielding system that claim 1-2 is any one of, its feature exists In including: two subsystems, i.e. key management subsystem and separaant system.

Secure virtual machine shielding system the most according to claim 3, it is characterised in that: wherein said secret Key management subsystem includes key negotiation module and key management module, and key negotiation module is responsible for and key pipe Reason server request key, key management module is positioned in key management server, is responsible for distributing key.

Secure virtual machine shielding system the most according to claim 3, it is characterised in that: described separaant System mainly contains: block device isolation module, internal memory isolation module and desktop protocol isolation module, described piece Equipment blocking module completes the selective transparent encryption to block device request, and described internal memory isolation module passes through Extension ACM framework completes to control desktop security inspection, and described desktop protocol isolation module is by defeated to input The encryption gone out makes desktop protocol become safer.

Secure virtual machine shielding system the most according to claim 5, it is characterised in that: described block device Including hard disk, CDROM, floppy disk.