WO2018000537A1 - 网络环境下虚拟机安全隔离系统 - Google Patents

网络环境下虚拟机安全隔离系统 Download PDF

Info

Publication number
WO2018000537A1
WO2018000537A1 PCT/CN2016/095103 CN2016095103W WO2018000537A1 WO 2018000537 A1 WO2018000537 A1 WO 2018000537A1 CN 2016095103 W CN2016095103 W CN 2016095103W WO 2018000537 A1 WO2018000537 A1 WO 2018000537A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual machine
isolation
module
secret key
key management
Prior art date
Application number
PCT/CN2016/095103
Other languages
English (en)
French (fr)
Inventor
杨越
Original Assignee
杨越
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杨越 filed Critical 杨越
Publication of WO2018000537A1 publication Critical patent/WO2018000537A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls

Definitions

  • the invention relates to the field of computer security, in particular to the security of computers in a network environment.
  • the fifth is to use niche systems such as LINUX, Apple, etc. Some of them are effective, but more are still connected to the Internet, which will give hackers a chance. From a technical point of view, there is no time to connect to the Internet. Providing a secure network environment is an essential condition.
  • the object of the present invention is to supplement the above deficiencies, and provide a safe, reasonable and reliable network environment, which can satisfy the user's peace of mind in using the network.
  • the solution of the invention is to use a computer with Internet access to form a virtual computer environment, and can complete anti-hacking behavior, can perform data analysis, use, and safely complete any instruction task, and And to ensure that the computer is not subject to any viruses, hackers.
  • the invention has the advantages that the operation is simple, the cost is low, and the utility model is suitable for wide-scale promotion, and can ensure the safe use of the computer.
  • a specific solution of the present invention is to provide a virtual machine security isolation system in a network environment, including:
  • the firewall is a network firewall for scanning network traffic flowing through it, or closing unused ports, or prohibiting outbound communication of a specific port, blocking a Trojan horse, or prohibiting access from a special site, thereby preventing from coming from Unknown all communication of the intruder.
  • the specific solution of the present invention is also to provide a virtual machine security isolation system, comprising: two subsystems, namely a secret key management subsystem and an isolation subsystem.
  • the key management subsystem includes a secret key negotiation module and a secret key management module
  • the secret key negotiation module is responsible for requesting a secret key with the secret key management server
  • the secret key management module is located in the secret key management server and is responsible for managing the distribution key.
  • the isolation subsystem mainly comprises: a block device isolation module, a memory isolation module and a desktop protocol isolation module.
  • the block device isolation module completes selective transparent encryption of the block device request
  • the memory isolation module completes the desktop security check control by extending the ACM framework
  • the desktop protocol isolation module makes the desktop protocol more secure by encrypting the input and output.
  • the block device comprises a hard disk, a CDROM, a floppy disk.
  • FIG. 1 is a flow chart of a method for security isolation of a virtual machine in a network environment according to an embodiment of the invention.
  • FIG. 2 is a system module view of a virtual machine in a network environment according to an embodiment of the present invention.
  • a virtual machine security isolation system in a network environment includes:
  • the firewall is a network firewall, and scans the network communication flowing through it, so that some attacks can be filtered out to prevent it from being executed on the target computer. You can also turn off unused ports, and also disable outbound traffic for specific ports, blocking Trojan horses. In addition, the firewall can block access from special sites, thereby preventing all communications from unknown intruders;
  • the use of virtual machines for isolation in a network environment adheres to three principles, namely, ensuring execution efficiency as much as possible, minimizing the impact of isolation operations on system execution efficiency. In addition, the characteristics of existing systems are used as much as possible, and the actual network environment applications need to be considered. Deploy complexity and try to choose a simple way.
  • the virtual isolation system uses a key management server to manage the key corresponding to each virtual machine uuid.
  • the key negotiation management service establishes a secure session through the Diffie-Hellman algorithm.
  • the key management server requests the key corresponding to the virtual machine, and after the request, transfers the key to the block device and the desktop protocol communication encryption module, the desktop protocol encryption module and the desktop protocol.
  • the modules are transparently encrypted.
  • the upper-layer VM cannot detect the existence of the encryption module.
  • the memory isolation module exists in the hypervisor and is extended on the basis of the ACM module to implement the tracking of the virtual machine memory and the automatic generation of ACM rules.
  • the fishing method achieves security control of the desktop.
  • the entire system can be divided into two subsystems: a secret key management subsystem and an isolation subsystem.
  • the key management subsystem includes a secret key negotiation module and a secret key management module.
  • the secret key negotiation module is responsible for requesting a secret key with the secret key management server, and the secret key management module is located in the secret key management server and is responsible for managing the distribution key.
  • the isolation subsystem mainly includes: a block device isolation module, a memory isolation module, and a desktop protocol isolation module.
  • the block device isolation module completes selective transparent encryption of the block device request, and the memory isolation module completes the desktop security check control by extending the ACM framework, and the desktop protocol isolation module makes the desktop protocol more secure by encrypting the input and output.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了一种网络环境下虚拟机安全隔离系统，包括：(1)在互联网联入真实电脑之前，接入虚拟机和防火墙，对流经它的网络通信进行扫描；(2)将防火墙与虚拟机连接，虚拟机通过数据拷贝系统与真实电脑连接；(3)在虚拟机上安装一台虚假裸奔电脑，在虚假裸奔电脑上设置虚拟机安全隔离方案，从而使得入侵者难以辨识真实信息。还提供一种虚拟机安全隔离系统，包括秘钥管理子系统和隔离子系统。

Description

网络环境下虚拟机安全隔离系统 技术领域
本发明涉及计算机安全领域，特别是计算机在网络环境下的安全保障。
背景技术
现在科技发展迅猛，银行，计算机，手机，游戏密码与我们息息相关，同样有一些不法计算机高手已经开始进行灰色地带，从事非法活动。在移动互联网时代，用户个人信息的价值空前凸显，“大数据”所能带来的商业价值将引领一场巨大变革，盗取个人计算机机密信息，用户资料。网络上的DDOS攻击，病毒传播，钓鱼网页，色情暴力反动各种信息。目前，采用技术很多，一是用硬件隔离危险，二是安装杀毒软件，三是，将两台电脑分开，一台使用上网功能，另一台则是断网状态，四是，限制上网时间地点，五是采用小众系统例如LINUX，苹果等等，有些是有效果的，但是更多的还是要连入互联网，就会给黑客机会。从技术角度说，只要连入互联网就没有安全的时候。提供一个安全的网络环境是必不可少的条件。
发明内容
因此本发明的目的在于针对以上不足进行补充，提供一种安全合理可靠的网络环境，能够满足用户使用网络安心放心。
本发明解决方案是利用能上网的电脑组建一个虚拟的电脑环境，并可以完成反黑客入侵行为，可以进行数据分析，使用，并安全完成任何指令任务，并 且保证该电脑不受到任何病毒，黑客入侵。
本发明的有益效果为：该操作简单，成本低，适用于大范围的推广，能够保证该计算机的安全使用。
本发明具体解决方案是提供一种网络环境下虚拟机安全隔离系统，包括：
(1)在互联网联入真实电脑之前，接入虚拟机和防火墙，对流经它的网络通信进行扫描；
(2)将防火墙与虚拟机连接，虚拟机通过数据拷贝系统与真实电脑连接；
(3)在虚拟机上安装一台虚假裸奔电脑，在虚假裸奔电脑上设置虚拟机安全隔离方案，从而使得入侵者难以辨识真实信息。
优选的，其中防火墙为网络防火墙，用于对流经它的网络通信进行扫描，或关闭不使用的端口，或禁止特定端口的流出通信，封锁特洛伊木马，或禁止来自特殊站点的访问，从而防止来自不明入侵者的所有通信。
本发明的具体方案还在于提供一种虚拟机安全隔离系统，包括：两个子系统，即秘钥管理子系统和隔离子系统。
优选的，秘钥管理子系统包括秘钥协商模块和秘钥管理模块，秘钥协商模块负责与秘钥管理服务器请求秘钥，秘钥管理模块位于秘钥管理服务器中，负责管理分发秘钥。
优选的，隔离子系统主要含有：块设备隔离模块、内存隔离模块和桌面协议隔离模块。块设备隔离模块完成对块设备请求的有选择性透明加密，内存隔离模块通过扩展ACM框架完成对桌面安全检查控制，桌面协议隔离模块通过对输入输出的加密使得桌面协议变得更安全。
优选的，块设备包括硬盘，CDROM，软盘。
根据下文结合附图对本发明具体实施例的详细描述，本领域技术人员将会更加明了本发明的上述以及其他目的、优点和特征。
附图说明
后文将参照附图以示例性而非限制性的方式详细描述本发明的一些具体实施例。附图中相同的附图标记标示了相同或类似的部件或部分。本领域技术人员应该理解，这些附图未必是按比例绘制的。本发明的目标及特征考虑到如下结合附图的描述将更加明显，附图中：
附图1为根据本发明实施例的网络环境下虚拟机安全隔离方法流程图。
附图2为根据本发明实施例的网络环境下虚拟机的系统模块视图。
具体实施方式
现在参考附图，根据本发明将给出细节的描述。
根据附图1，一种网络环境下虚拟机安全隔离系统，包括：
(1)在互联网联入真实电脑之前，接入虚拟机和防火墙，其中防火墙为网络防火墙，对流经它的网络通信进行扫描，这样能够过滤掉一些攻击，以免其在目标计算机上被执行，防火墙还可以关闭不使用的端口，还能禁止特定端口的流出通信，封锁特洛伊木马。另外，防火墙可以禁止来自特殊站点的访问，从而防止来自不明入侵者的所有通信；
(2)将防火墙与虚拟机连接，虚拟机通过数据拷贝系统与真实电脑连接；
(3)在虚拟机上安装一台虚假裸奔电脑，在虚假裸奔电脑上设置虚拟机安全隔离方案，从而使得入侵者难以辨识真实信息。
使用虚拟机进行网络环境下的隔离方法遵守三个原则，即尽量保证执行效率，尽量降低隔离操作对系统执行效率的影响，另外，尽量使用已有系统的特性，并且需要考虑实际网络环境应用的部署复杂性，尽量选择简单的方式。虚拟隔离系统中使用一个秘钥管理服务器，负责管理每个虚拟机uuid对应的密钥，在某一台虚拟机启动时，秘钥协商管理服务通过Diffie-Hellman算法建立安全会话，会话建立后向秘钥管理服务器请求虚拟机对应的秘钥，请求后将秘钥传送给块设备和桌面协议通讯加密模块使用，桌面协议加密模块和桌面协议这两个 模块均采用透明加密方式，上层虚拟机无法感知到加密模块的存在，内存隔离模块存在于Hypervisor中，在ACM模块基础上进行扩展，实现对虚拟机内存的跟踪以及ACM规则的自动生成，通过预钓鱼方式实现对桌面的安全控制。
根据附图2，整个系统可以分为两个子系统：秘钥管理子系统和隔离子系统。秘钥管理子系统包括秘钥协商模块和秘钥管理模块，秘钥协商模块负责与秘钥管理服务器请求秘钥，秘钥管理模块位于秘钥管理服务器中，负责管理分发秘钥。隔离子系统主要含有：块设备隔离模块、内存隔离模块和桌面协议隔离模块。块设备隔离模块完成对块设备请求的有选择性透明加密，内存隔离模块通过扩展ACM框架完成对桌面安全检查控制，桌面协议隔离模块通过对输入输出的加密使得桌面协议变得更安全。
虽然本发明已经参考特定的说明性实施例进行了描述，但是不会受到这些实施例的限定而仅仅受到附加权利要求的限定。本领域技术人员应当理解可以在不偏离本发明的保护范围和精神的情况下对本发明的实施例能够进行改动和修改。

Claims (6)

  1. 一种网络环境下虚拟机安全隔离系统，其特征在于包括：
    (1)在互联网联入真实电脑之前，接入虚拟机和防火墙，对流经它的网络通信进行扫描；
    (2)将防火墙与虚拟机连接，虚拟机通过数据拷贝系统与真实电脑连接；
    (3)在虚拟机上安装一台虚假裸奔电脑，在虚假裸奔电脑上设置虚拟机安全隔离方案，从而使得入侵者难以辨识真实信息。
  2. 根据权利要求1所述的一种网络环境下虚拟机安全隔离系统，其特征在于其中所述防火墙为网络防火墙，用于对流经它的网络通信进行扫描，或关闭不使用的端口，或禁止特定端口的流出通信，封锁特洛伊木马，或禁止来自特殊站点的访问，从而防止来自不明入侵者的所有通信。
  3. 一种用于权利要求1-2任意一个所述的虚拟机安全隔离系统，其特征在于包括：两个子系统，即秘钥管理子系统和隔离子系统。
  4. 根据权利要求3所述的虚拟机安全隔离系统，其特征在于：其中所述秘钥管理子系统包括秘钥协商模块和秘钥管理模块，秘钥协商模块负责与秘钥管理服务器请求秘钥，秘钥管理模块位于秘钥管理服务器中，负责管理分发秘钥。
  5. 根据权利要求3所述的虚拟机安全隔离系统，其特征在于：所述隔离子系统主要含有：块设备隔离模块、内存隔离模块和桌面协议隔离模块，所述块设备隔离模块完成对块设备请求的有选择性透明加密，所述内存隔离模块通过扩展ACM框架完成对桌面安全检查控制，所述桌面协议隔离模块通过对输入输出的加密使得桌面协议变得更安全。
  6. 根据权利要求5所述的虚拟机安全隔离系统，其特征在于：所述块设备包括硬盘，CDROM，软盘。
PCT/CN2016/095103 2016-06-26 2016-08-14 网络环境下虚拟机安全隔离系统 WO2018000537A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610479366.0 2016-06-26
CN201610479366.0A CN105871939A (zh) 2016-06-26 2016-06-26 网络环境下虚拟机安全隔离系统

Publications (1)

Publication Number Publication Date
WO2018000537A1 true WO2018000537A1 (zh) 2018-01-04

Family

ID=56655579

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/095103 WO2018000537A1 (zh) 2016-06-26 2016-08-14 网络环境下虚拟机安全隔离系统

Country Status (2)

Country Link
CN (1) CN105871939A (zh)
WO (1) WO2018000537A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3373544A1 (en) * 2017-03-07 2018-09-12 ABB Schweiz AG Automatic communication network system hardening

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101409714A (zh) * 2008-11-18 2009-04-15 华南理工大学 一种基于虚拟机的防火墙系统
CN201499183U (zh) * 2009-09-14 2010-06-02 陈博东 一种虚拟网络分隔系统
CN102567217A (zh) * 2012-01-04 2012-07-11 北京航空航天大学 一种面向mips平台的内存虚拟化方法
US20130132691A1 (en) * 2011-11-22 2013-05-23 Gaurav Banga Approaches for efficient physical to virtual disk conversion
CN103577771A (zh) * 2013-11-08 2014-02-12 中科信息安全共性技术国家工程研究中心有限公司 一种基于磁盘加密的虚拟桌面数据防泄漏保护技术
CN104125192A (zh) * 2013-04-23 2014-10-29 鸿富锦精密工业（深圳）有限公司 虚拟机安全保护系统及方法
CN204334621U (zh) * 2014-11-25 2015-05-13 甘肃省科学技术情报研究所 一种网络安全管理装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101645873B (zh) * 2008-08-07 2012-08-22 联想(北京)有限公司 一种计算机以及虚拟机环境中实现网络隔离的方法
CN101673215B (zh) * 2008-09-09 2012-12-12 联想(北京)有限公司 一种虚拟环境中用户管理装置及方法
CN101668022B (zh) * 2009-09-14 2012-09-12 陈博东 一种建立在虚拟机上的虚拟网络隔离系统及实现方法
CN102523215B (zh) * 2011-12-15 2014-10-01 北京海云捷迅科技有限公司 基于kvm虚拟化平台的虚拟机在线杀毒系统
CN103414558A (zh) * 2013-07-17 2013-11-27 电子科技大学 一种基于xen云平台的虚拟机块设备隔离方法

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101409714A (zh) * 2008-11-18 2009-04-15 华南理工大学 一种基于虚拟机的防火墙系统
CN201499183U (zh) * 2009-09-14 2010-06-02 陈博东 一种虚拟网络分隔系统
US20130132691A1 (en) * 2011-11-22 2013-05-23 Gaurav Banga Approaches for efficient physical to virtual disk conversion
CN102567217A (zh) * 2012-01-04 2012-07-11 北京航空航天大学 一种面向mips平台的内存虚拟化方法
CN104125192A (zh) * 2013-04-23 2014-10-29 鸿富锦精密工业（深圳）有限公司 虚拟机安全保护系统及方法
CN103577771A (zh) * 2013-11-08 2014-02-12 中科信息安全共性技术国家工程研究中心有限公司 一种基于磁盘加密的虚拟桌面数据防泄漏保护技术
CN204334621U (zh) * 2014-11-25 2015-05-13 甘肃省科学技术情报研究所 一种网络安全管理装置

Also Published As

Publication number Publication date
CN105871939A (zh) 2016-08-17

Similar Documents

Publication Publication Date Title
RU2738021C2 (ru) Система и способы для дешифрования сетевого трафика в виртуализированной среде
US10361998B2 (en) Secure gateway communication systems and methods
El Kafhali et al. Security threats, defense mechanisms, challenges, and future directions in cloud computing
Modi et al. A survey on security issues and solutions at different layers of Cloud computing
Subashini et al. A survey on security issues in service delivery models of cloud computing
CN104065651B (zh) 一种面向云计算的信息流可信保障方法
US11755753B2 (en) Mechanism to enable secure memory sharing between enclaves and I/O adapters
RU2628925C1 (ru) Система и способ защищенной передачи аудиоданных от микрофона к процессам
Hashemi et al. Taxonomy of the security aspects of cloud computing systems-a survey
Alrasheed et al. Cloud computing security and challenges: issues, threats, and solutions
WO2018000537A1 (zh) 网络环境下虚拟机安全隔离系统
WU et al. A survey on cloud security
Keshavarzi Traditional host based intrusion detection systems’ challenges in cloud computing
Pandey Security attacks in cloud computing
Yuhala et al. Fortress: Securing IoT Peripherals with Trusted Execution Environments
Feng et al. Security and Privacy in E-learning
Coppolino et al. Securing FIWARE with TEE Technology
Khan et al. Security and Privacy Issues in Cloud Computing
Kaur et al. PARAMETRIC ANALYSIS TO ENHANCE SECURITY IN CLOUD COMPUTING TO PREVENT ATTACKS IN LIVE MIGRATION.
Agarwal et al. Analysis of cyberthreats and cybersecurity of IoT devices
Zheng Computer Network Security and Effective Measures for the Era of Big Data
Huber System Architectures for Data Confidentiality and Frameworks for Main Memory Extraction
Song et al. Android Data-Clone Attack via Operating System Customization
EP3113066B1 (en) Computer security architecture and related computing method
Santhosh Krishna et al. Authentication Key Generator for Data Sharing on Cloud—A Review

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16906934

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16906934

Country of ref document: EP

Kind code of ref document: A1