WO2021072877A1

WO2021072877A1 - Secure starting method and apparatus for cloud host, and computer device and storage medium

Info

Publication number: WO2021072877A1
Application number: PCT/CN2019/118430
Authority: WO
Inventors: 沈勇
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-10-15
Filing date: 2019-11-14
Publication date: 2021-04-22
Also published as: CN111090470A

Abstract

Disclosed are a secure starting method and apparatus for a cloud host, and a computer device and a storage medium. The method comprises: when a starting instruction, triggered by a user, for a specified cloud host is received, acquiring, according to a preset rule, asset information corresponding to the specified cloud host; determining whether there are vulnerabilities, corresponding to the asset information of the specified cloud host, stored in a preset vulnerability database; if so, acquiring the last shutdown time of the specified cloud host and release times respectively corresponding to the vulnerabilities; according to the last shutdown time and the release times, determining whether there is a specified vulnerability, of which the release time is within a specified time period, in all the vulnerabilities; and if so, starting the specified cloud host in a pre-created secure isolation area. According to the preset application, the specified cloud host can be effectively prevented from being invaded or attacked by vulnerabilities during use, and the security of the specified cloud host after starting is guaranteed.

Description

Safe starting method, device, computer equipment and storage medium of cloud host

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on October 15, 2019, the application number is 2019109790501, and the invention title is "the secure boot method, device, computer equipment and storage medium of the cloud host", and its entire content Incorporated in this application by reference.

Technical field

This application relates to the technical field of cloud computing, and in particular to a secure startup method, device, computer equipment, and storage medium of a cloud host.

Background technique

Cloud computing is currently an important field and direction in the development of IT technology, and it is gradually infiltrating all areas of society. Cloud host is an important part of cloud computing in infrastructure applications. It is located at the bottom of the cloud computing industry chain and its products are derived from cloud computing platforms. The platform integrates the three core elements of Internet applications: computing, storage, and network, and provides users with public Internet infrastructure services. Cloud hosting is a kind of similar to VPS (Virtual Private Server, virtual private server) the virtualization technology of the host, VPS uses virtual software (such as VZ or VM) to virtualize multiple parts similar to independent hosts on a host, which can realize single-machine multi-user, and each part can be used. As a separate operating system, the management method is the same as that of the host. The cloud host virtualizes multiple parts similar to independent hosts on a group of host machine clusters. Each host machine in the cluster has an image of the cloud host machine, which greatly improves the security and stability of the virtual host machine. In addition, in order to facilitate users to access cloud computing anytime and anywhere, cloud hosts can usually be accessed directly from the public network (Internet), and even managed.

In the existing various cloud computing systems, each cloud host will face the security risk of the protection gap. Specifically, when the cloud host is in the shutdown state, since the cloud host will repair all currently known security vulnerabilities when it is shut down, it can be considered that the cloud host in the shutdown state is also in a safe state. However, when the cloud host is restarted and exposed to the public network, the external environment at this time may change compared to before the shutdown. If there are new security vulnerabilities related to the cloud host, the cloud host may be attacked by attackers on the public network at any time, and the security of the cloud host is greatly threatened.

technical problem

The main purpose of this application is to provide a secure startup method, device, computer equipment and storage medium for a cloud host, which aims to solve the problem that when the cloud host is restarted from the shutdown state and exposed to the existing various cloud computing systems When on the public network, you may be attacked by attackers on the public network at any time, and the security of the cloud host is vulnerable to technical problems that are greatly threatened.

Technical solutions

In order to achieve the purpose of the above application, this application proposes a secure startup method for a cloud host. The method includes the steps:

Upon receiving a user-triggered start instruction for a specified cloud host, obtain asset information corresponding to the specified cloud host according to preset rules, where the asset information includes at least operating system information; determine whether the preset vulnerability database is Vulnerabilities corresponding to the asset information of the designated cloud host are stored, wherein the number of the vulnerabilities is one or more;

If yes, obtain the last shutdown time of the designated cloud host and the release time corresponding to each of the vulnerabilities;

According to the last shutdown time and each of the release times, determine whether there is a specified vulnerability whose release time is within a specified period of time among all the vulnerabilities;

If yes, start the designated cloud host in a pre-created security isolation zone, wherein the network access function of the designated cloud host will be disabled in the security isolation zone.

This application also provides a secure boot device for a cloud host, including:

The first obtaining module is configured to obtain asset information corresponding to the specified cloud host according to preset rules when a user-triggered start instruction for the specified cloud host is received, wherein the asset information includes at least operating system information;

The first judgment module is used to judge whether there are vulnerabilities corresponding to the asset information of the designated cloud host stored in the preset vulnerability database, wherein the number of the vulnerabilities is one or more;

The second obtaining module is configured to, if yes, obtain the last shutdown time of the designated cloud host and the release time corresponding to each of the vulnerabilities;

The second judgment module is used for judging whether there are specified vulnerabilities whose release time is within a specified period of time among all the vulnerabilities according to the last shutdown time and each of the release times;

The isolation module is configured to, if yes, start the designated cloud host in a pre-created security isolation area, wherein the network access function of the specified cloud host will be disabled in the security isolation area.

The present application also provides a computer device, including a memory and a processor, the memory stores computer-readable instructions, and the processor implements the steps of the above method when the computer-readable instructions are executed by the processor.

The present application also provides a computer-readable storage medium on which computer-readable instructions are stored, and when the computer-readable instructions are executed by a processor, the steps of the foregoing method are implemented.

Beneficial effect

The secure startup method, device, computer equipment, and storage medium of a cloud host provided in this application, upon receiving a user-triggered startup instruction for a specified cloud host, acquire asset information corresponding to the specified cloud host according to preset rules , Wherein the asset information includes at least operating system information; it is judged whether there are vulnerabilities corresponding to the asset information of the designated cloud host stored in the preset vulnerability database, wherein the number of the vulnerabilities is one or more; if so , Obtain the last shutdown time of the designated cloud host and the release time corresponding to each of the vulnerabilities; according to the last shutdown time and each release time, determine whether there is a release time in all the vulnerabilities The specified vulnerabilities within a specified time period; if so, the specified cloud host is started in a pre-created security isolation area, wherein the network access function of the specified cloud host will be disabled in the security isolation area. This application will intelligently place the designated cloud host in the pre-created security isolation zone for startup when a new vulnerability related to it occurs during the last shutdown of the designated cloud host, so that after the designated cloud host is started Temporarily disable the network access function of the designated cloud host, effectively avoiding the intrusion or attack of the designated cloud host by vulnerabilities during use, and ensuring the security of the designated cloud host after it is started.

Description of the drawings

FIG. 1 is a schematic flowchart of a method for secure startup of a cloud host according to an embodiment of the present application;

FIG. 2 is a schematic structural diagram of a secure boot device of a cloud host according to an embodiment of the present application;

Fig. 3 is a schematic structural diagram of a computer device according to an embodiment of the present application.

The best mode of the present invention

It should be understood that the specific embodiments described here are only used to explain the present application, and are not used to limit the present application.

Referring to Fig. 1, a secure boot method of a cloud host according to an embodiment of the present application includes:

S1: Acquire asset information corresponding to the designated cloud host according to preset rules when receiving a startup instruction for a designated cloud host triggered by a user, where the asset information includes at least operating system information;

S2: Determine whether there are vulnerabilities corresponding to the asset information of the designated cloud host stored in the preset vulnerability database, where the number of the vulnerabilities is one or more;

S3: If yes, obtain the last shutdown time of the designated cloud host and the release time corresponding to each of the vulnerabilities;

S4: According to the last shutdown time and each of the release times, determine whether there are specified vulnerabilities whose release time is within a specified period of time among all the vulnerabilities;

S5: If yes, start the designated cloud host, and when the designated cloud host is started, place the designated cloud host in a preset security isolation area to suspend the network access function of the designated cloud host.

As described in the above steps S1 to S5, the execution subject of the embodiment of the present invention is a secure boot device for a cloud host, specifically a host cluster used to virtual out the cloud host, through which the host cluster can realize the For the secure startup of the host, the above-mentioned designated cloud host is any cloud host among all the cloud hosts virtualized by the host cluster. Specifically, it is first judged whether a user-triggered start instruction for the designated cloud host is received; when the start instruction is received, the asset information corresponding to the designated cloud host is obtained according to preset rules, wherein the asset information includes at least the operating system Information, for example, the operating system is windowsserver2012, and the RDP service version 11.0 is used to provide a remote desktop. In addition, the asset information may also include cloud host service information and key application information. In addition, the foregoing preset rules may include: obtaining asset information corresponding to the specified cloud host by querying the cloud platform corresponding to the specified cloud host, or by invoking the specified scanning tool. Then, according to the above asset information, it is determined whether there are vulnerabilities corresponding to the asset information of the above designated cloud host stored in the preset vulnerability database, wherein the number of the above vulnerabilities is one or more, and the above vulnerability database stores passing The crawler tool crawls the vulnerability information related to various operating systems corresponding to the cloud host and the vulnerability information related to the cloud host service from the target website in real time. If the vulnerability database stores the vulnerability corresponding to the asset information of the specified cloud host, the last shutdown time of the specified cloud host and the release time corresponding to each of the aforementioned vulnerabilities are obtained. Among them, for example, the form of any vulnerability information crawled can be CVE20190004-rdp vulnerability, released on July 02, 2019. The affected system is all versions of the rdp service before version 12.0, and the release time of the corresponding vulnerability is 2019 /07/02. Then, based on the last shutdown time and each of the above release times, it is determined whether there are specified vulnerabilities in all the vulnerabilities whose release time is within the specified time period, where the above specified time period is included between the above shutdown time and the above current time period. If there are specified vulnerabilities whose release time is within the specified time period, the above-mentioned designated cloud host will be started in the pre-created security quarantine area, and the network access function of the designated cloud host will be disabled in the above-mentioned security quarantine area. In this embodiment, when a new vulnerability related to the designated cloud host occurs during the last shutdown period, the designated cloud host will be intelligently placed in the pre-created security isolation zone for startup, thereby starting on the designated cloud host Then temporarily disable the network access function of the designated cloud host, effectively avoiding the intrusion or attack of the designated cloud host by vulnerabilities during use, and ensuring the security of the designated cloud host after it is started. Furthermore, if there are no specified vulnerabilities whose release time is within the specified period of time among all vulnerabilities, indicating that no related vulnerabilities appeared during the last shutdown of the specified cloud host, the startup of the specified cloud host will be completed directly , And there is no need to place the designated cloud host in a security quarantine area. In order to effectively guarantee the user experience of the designated cloud host.

Further, in an embodiment of the present application, the above step S1 includes:

S100: Determine whether an asset management tool is installed in the designated cloud host, where the asset management tool is used to periodically synchronize asset information corresponding to the designated cloud host to the designated cloud platform;

S101: If an asset management tool is installed, search for the asset information from the designated cloud platform;

S102: If an asset management tool is not installed, call a designated scanning tool to perform scanning processing on the designated cloud host to obtain the asset information.

As described in the above steps S100 to S102, the asset information may specifically include the operating system information corresponding to the specified cloud host, as well as the cloud host service information and key application information in the specified cloud host. The cloud platform corresponding to the specified cloud host can be queried. Or by calling the specified scanning tool to obtain the asset information corresponding to the specified cloud host. Specifically, first determine whether an asset management tool is installed in the specified cloud host. The asset management tool has a synchronization function for asset information of the specified cloud host. When the asset management tool is installed in the specified cloud host, the specified cloud host The host will periodically synchronize the internal asset information to the corresponding designated cloud platform through the above asset management tool, so that the designated cloud platform will store the asset information of the designated cloud host. If it is determined that an asset management tool is installed in the designated cloud host, the above asset information can be found from the designated cloud platform corresponding to the above designated cloud host. If there is no asset management tool installed in the designated cloud host, the designated scanning tool can be called to scan the cloud platform to obtain the above asset information. The designated scanning tool can be nmap, and the nmap tool can be used to perform the scanning process on the cloud platform. Specify the cloud host to send the operating system detection command $nmap-O[target IP], so that the designated cloud host will query its own asset information after receiving the system detection command, and then the asset information returned by the designated cloud host can be obtained. After obtaining the asset information of the designated cloud host, it can then intelligently identify whether there are vulnerabilities corresponding to the designated cloud host in the vulnerability database based on the asset information.

Further, in an embodiment of the present application, before the foregoing step S2, the method includes:

S200: Use crawler tools to grab the first vulnerability information related to various operating systems corresponding to the cloud host and the second vulnerability information related to the cloud host service from the target website in real time;

S201: Create a vulnerability database;

S202: Store the first vulnerability information and the second vulnerability information in the vulnerability database.

As described in the above steps S200 to S202, before the judgment process of judging whether the vulnerability corresponding to the specified cloud host is stored in the preset vulnerability database according to the asset information, the process of generating the vulnerability database is also included. Specifically, first, a crawler tool is used to grab the first vulnerability information related to various operating systems corresponding to the cloud host and the second vulnerability information related to the cloud host service from the target website in real time. Wherein, the above-mentioned first vulnerability information may include vulnerability information corresponding to the first vulnerability, and first patch information corresponding to the first vulnerability. Similarly, the aforementioned second vulnerability information may include vulnerability information corresponding to the second vulnerability, and second patch information corresponding to the second vulnerability. In addition, crawler tools refer to web crawlers (also known as web spiders or web robots), which are programs or scripts that automatically crawl information on the World Wide Web in accordance with certain rules. The crawler tool includes but is not limited to the Python crawler tool. In addition, the aforementioned target website is an authoritative website at home and abroad for publishing vulnerabilities related to cloud hosting. Specifically, the host cluster uses a crawler tool to execute a crawler file to crawl vulnerability information that meets the data crawling conditions set by the crawler file. The crawler file includes, but is not limited to, two data crawling conditions of target URL and search keywords. The target URL is the URL of the target website corresponding to the first vulnerability information that needs to be crawled and the second vulnerability information in the crawler file, and the URL (short for Uniform Resource Locator, that is, uniform resource locator) is correct A concise representation of the location and access method of resources obtained from the Internet is the address of a standard resource on the Internet. Search keywords refer to keywords in the crawler file that are used to limit the common characteristics of the first vulnerability information and the second vulnerability information to be crawled by the crawler file. After obtaining the above-mentioned first vulnerability information and the second vulnerability information, create a vulnerability database, and then store the first vulnerability information and the second vulnerability information in the above-mentioned vulnerability database to form a subsequent use to determine whether there is a possible threat Specify the vulnerability database of the security vulnerabilities of the cloud host.

Further, in an embodiment of the present application, before the above step S4, the method includes:

S400: Obtain the current time;

S401: Determine the time period included between the last shutdown time and the current time as the designated time period.

As described in the above steps S400 to S401, before the step of judging whether there are specified vulnerabilities whose release time is within a specified period of time among all the foregoing vulnerabilities, the step of determining the specified period of time is also included. Specifically, the current time is first obtained, The above-mentioned current time has the same accuracy as the above-mentioned last shutdown time, but the accuracy is not specifically limited. For example, the above-mentioned accuracy can be accurate to year, month and day, for example, the current time can be 2019/07/11, or even It can be accurate to the year, month, day, and so on, so I won’t go into too much detail here. After the current time and the aforementioned last shutdown time are obtained, the time period included between the last shutdown time and the aforementioned current time is determined as the aforementioned designated time period. For example, if the current time is 2019/07/11 and the last shutdown time is 2019/07/01, it can be determined that the above specified time period includes: 2019/07/01-2019/07/11. This embodiment determines the specified time period based on the current time and the last shutdown time of the specified cloud host, which is beneficial to subsequently accurately identifying whether there are specified vulnerabilities in the vulnerability database that threaten the security of the specified cloud host based on the specified time period. , And then intelligently select the opening method for the designated cloud host based on the recognition result.

Further, in an embodiment of the present application, after the above step S5, the method includes:

S500: Determine whether the specified patch corresponding to the specified vulnerability is stored in the vulnerability database;

S501: If yes, download the designated patch, and store the designated patch in a designated storage area in the designated cloud host through a designated transmission method;

S502: Send an installation instruction for installing the specified patch to the specified cloud host, so that the specified cloud host installs the specified patch according to the installation instruction, and returns a corresponding patch installation result, where the patch Installation results include successful or failed installation;

S503: Determine whether the specified patch is successfully installed according to the patch installation result returned by the specified cloud host;

S504: If yes, transfer the designated cloud host out of the security isolation area to restore the normal network access function of the designated cloud host.

As mentioned in the above steps S500 to S504, after the designated cloud host is placed in the security quarantine area, the designated cloud host will be removed from the security only after the designated cloud host has successfully installed the designated patch corresponding to the above-mentioned specified vulnerability. Remove from the quarantine area to ensure the safety of the designated cloud host. Specifically, it is first determined whether the vulnerability database stores the designated patch corresponding to the designated vulnerability. If the above specified patch is stored in the vulnerability database, the specified patch will be downloaded, and the specified patch will be stored in the specified storage area in the specified cloud host through the specified transmission method. Among them, the above-mentioned designated transmission method is the local area network transmission method or the Bluetooth transmission method. After the host cluster downloads the above-mentioned designated patch, it transmits the downloaded designated patch to the designated storage area in the designated cloud host by using the designated transmission method internally. , Since the transmission process does not need to use network resources, the designated cloud host will not be attacked by attackers on the public network when receiving the designated patch, which effectively guarantees the security of the designated cloud host in the process of storing the designated patch In addition, the installation process of the designated cloud host to install the designated patch does not require a network, which further increases the security of the designated cloud host. In addition, the above-mentioned designated storage area is not specifically limited, and can be set according to actual needs. For example, it can be a newly created area dedicated to storing the designated patch, or an area with a larger storage space in the designated cloud host. ,and many more. After finishing storing the specified patch in the above specified storage area, an installation instruction to install the specified patch will be sent to the specified cloud host, so that the specified cloud host can download and install the specified patch according to the above installation instruction, and return to the corresponding patch installation As a result, the patch installation result includes installation success or installation failure. Then, according to the patch installation result returned by the designated cloud host, it is further judged whether the above-mentioned designated patch is successfully installed. If the specified patch is successfully installed in the specified cloud host, the specified cloud host will be transferred out of the aforementioned security quarantine area to restore the normal network access function of the specified cloud host, so that the specified cloud host can perform normal operations after the network access function is restored. Work to ensure the user’s sense of experience when using the designated cloud host. Further, if the installation of the specified patch fails, the specified cloud host will return the patch installation result that the installation failed. At this time, the specified cloud host will not be transferred out of the security quarantine area, but the reason for the failure of the specified patch installation will be found first; Then, according to the failure reason of the failure of the specified patch installation, control the specified cloud host to re-download and install the above specified patch, and after confirming that the specified patch is successfully installed in the specified cloud host, transfer the specified cloud host out of the above security The quarantine area enables the normal network access function of the designated cloud host to be restored only when the designated patch is successfully installed, effectively ensuring the security of the designated cloud host.

In an embodiment of the present application, after the above step S504, the method includes:

S5040: Acquire first usage data of a first host machine corresponding to the designated cloud host according to a first preset period, where the first usage data includes at least a CPU usage rate, a memory usage rate, and a network interface bandwidth usage rate ；

S5041: Analyze and process the first usage data, and determine whether the first usage data is greater than a preset standard threshold;

S5042: If yes, find out the second host machine whose second usage data is less than the standard threshold from all the host machines;

S5043: Migrate the designated cloud host from the first host to the second host.

As described in the above steps S5040 to S5043, after the designated cloud host is transferred out of the security quarantine area, in the normal working process of the designated cloud host, if the first host corresponding to the designated cloud host is in a high load state , The host cluster also has the function of intelligent migration for the specified cloud host. Specifically, after the startup of the specified cloud host is completed, the first usage data of the first host corresponding to the specified cloud host is acquired according to the first preset period, where the first preset period is not specifically limited, for example Can be set to one hour. In addition, the aforementioned usage data includes CPU usage, memory usage, and network interface bandwidth usage. Then analyze and process the first usage data, and determine whether the above-mentioned first usage data is greater than a preset standard threshold. For different types of first usage data, the same number of standard thresholds corresponding to the type are set. . In addition, the specific value of the standard threshold is not specifically limited, and can be set by the host cluster, or can also be set by the user according to requirements. For example, the standard threshold corresponding to CPU usage can be set to 80%, the standard threshold corresponding to memory usage can be set to 75%, and the standard threshold corresponding to network interface bandwidth usage can be set to 85%. If the above-mentioned first usage data is greater than the preset standard threshold value, it indicates that the first host machine corresponding to the designated cloud host is currently in a high-load state, and the first host machine has fewer computable resources. At this time, the second host with the second usage data less than the above standard threshold will be found from all the hosts in the host cluster, and the designated cloud host will be migrated from the above first host to the above second host to achieve Intelligently migrate the designated cloud host from the first host with excessive load to the second host with lower load, so that the computing resources of the designated cloud host are optimized, thereby effectively improving the operating efficiency and response speed of the designated cloud host. It also guarantees the safety of the first host. Further, if the number of second host machines is more than one, the designated host machine with the lowest data value corresponding to the second usage data is selected from all the second host machines, and then the designated cloud host machine is selected from the above-mentioned first host machine. The host machine is migrated to the above specified host machine. By filtering out the designated host with the lowest data value corresponding to the second usage data from all the second hosts, not only the operating efficiency and response speed of the designated cloud host can be improved, but also the load balance for all the hosts can be achieved.

Further, in an embodiment of the present application, after the above step S504, the method includes:

S5044: Acquire the available resource space in the cloud hard disk corresponding to the designated cloud host according to the second preset period;

S5045: Analyze and process the available resource space, and determine whether the available resource space is less than a preset resource space threshold;

S5046: If yes, filter out the junk data in the cloud hard disk;

S5047: Send a garbage removal instruction to the designated cloud host to control the designated cloud host to clear the junk data according to the garbage removal instruction.

As described in the above steps S5044 to S5047, after the designated cloud host is transferred out of the above-mentioned security quarantine area, the available resource space in the designated cloud host in a normal working state will be monitored and processed to ensure that the designated cloud host can have Sufficient available resource space. Specifically, after the specified cloud host is started, the available resource space in the cloud hard disk corresponding to the specified cloud host is acquired according to a second preset period, where the second preset period is not specifically limited, for example, it can be set to One hour. Then it is judged whether the above-mentioned available resource space is less than the preset resource space threshold. The specific value of the above-mentioned resource space threshold is not specifically limited. It can be set by the host cluster, or can also be set by the user according to the needs. For example, the resource space The threshold can be set to 5g. If the available resource space is less than the preset resource space threshold, it indicates that the current available resource space of the designated cloud host is small, and the cloud hard disk corresponding to the designated cloud host is under high pressure. At this time, the junk data in the cloud hard disk will be filtered out. The junk data includes the remaining designated cloud host configuration files, useless temporary files, useless files that have been deleted/uninstalled, and the hard disk and/or volume have not been formatted. Successfully leftover files, etc. After the junk data is filtered out, the garbage removal instruction is sent to the designated cloud host to control the designated cloud host to clean up the junk data according to the garbage removal instruction. Specifically, the management tool or the designated cloud host can be used to clean up the junk data. Application software to realize the automatic removal of the above-mentioned junk data. This embodiment automatically and intelligently removes junk data in the cloud hard disk corresponding to the specified cloud host when the current available resources of the specified cloud host are low, effectively reducing the pressure and burden of the specified cloud host, and releasing the specified cloud host. The redundant and useless resources on the cloud host can be used to process the junk data in the cloud hard disk corresponding to the designated cloud host in an orderly and timely manner, avoid unnecessary waste of resources, improve the utilization efficiency of the internal resources of the designated cloud host, and finally improve the designated cloud The operating efficiency and response speed of the host.

2, an embodiment of the present application also provides a secure boot device for a cloud host, including:

The first obtaining module 1 is configured to obtain asset information corresponding to the specified cloud host according to a preset rule when a user-triggered start instruction for a specified cloud host is received, wherein the asset information includes at least operating system information;

The first judgment module 2 is used for judging whether there are vulnerabilities corresponding to the asset information of the designated cloud host stored in the preset vulnerability database, wherein the number of the vulnerabilities is one or more;

The second obtaining module 3 is configured to, if yes, obtain the last shutdown time of the designated cloud host and the release time corresponding to each of the vulnerabilities;

The second judgment module 4 is used for judging whether there are specified vulnerabilities whose release time is within a specified period of time among all the vulnerabilities according to the last shutdown time and each of the release times;

The isolation module 5 is configured to, if yes, start the designated cloud host in a pre-created security isolation area, wherein the network access function of the specified cloud host will be disabled in the security isolation area.

In this embodiment, the realization process of the functions and functions of the first acquisition module, the first judgment module, the second acquisition module, the second judgment module, and the isolation module in the secure boot device of the cloud host is detailed in the above cloud host The implementation process corresponding to steps S1 to S5 in the safe boot method will not be repeated here.

Further, in an embodiment of the present application, the above-mentioned first acquisition module includes:

The first determining unit is configured to determine whether an asset management tool is installed in the designated cloud host, wherein the asset management tool is used to periodically synchronize asset information corresponding to the designated cloud host to the designated cloud platform;

The first searching unit is configured to search for the asset information from the designated cloud platform if an asset management tool is installed;

The first calling unit is configured to, if the asset management tool is not installed, call a designated scanning tool to perform scanning processing on the designated cloud host, so as to obtain the asset information.

In this embodiment, the implementation process of the functions and roles of the first determining unit, the first searching unit, and the first calling unit in the secure boot device of the cloud host is detailed in the corresponding steps S100 to S100 to the secure boot method of the cloud host. The implementation process of S102 will not be repeated here.

Further, in an embodiment of the present application, the secure boot device of the cloud host includes:

The crawling module is used to grab the first vulnerability information related to various operating systems corresponding to the cloud host and the second vulnerability information related to the cloud host service from the target website in real time through a crawler tool;

Create module to create a vulnerability database;

The first storage module is used to store the first vulnerability information and the second vulnerability information in the vulnerability database.

In this embodiment, the implementation process of the functions and roles of the grab module, creation module, and first storage module in the secure boot device of the cloud host is detailed in the implementation of corresponding steps S200 to S202 in the secure boot method of the cloud host. The process will not be repeated here.

The third obtaining module is used to obtain the current time;

The first determining module is configured to determine the time period included between the last shutdown time and the current time as the designated time period.

In this embodiment, the implementation process of the functions and roles of the third acquiring module and the first determining module in the secure startup device of the cloud host is detailed in the implementation process corresponding to steps S400 to S401 in the secure startup method of the cloud host. I won't repeat them here.

The second determining module is used to determine whether the specified patch corresponding to the specified vulnerability is stored in the vulnerability database;

The second storage module is configured to download the specified patch if it is, and store the specified patch in a specified storage area in the specified cloud host through a specified transmission method;

The first sending module is configured to send an installation instruction for installing the specified patch to the specified cloud host, so that the specified cloud host installs the specified patch according to the installation instruction, and returns the corresponding patch installation result, Wherein, the patch installation result includes installation success or installation failure;

The third judgment module is configured to judge whether the specified patch is successfully installed according to the patch installation result returned by the specified cloud host;

The transfer module is used for transferring the designated cloud host out of the security isolation area, so as to restore the normal network access function of the designated cloud host.

In this embodiment, the realization process of the functions and roles of the second determination module, the second storage module, the first sending module, the third judgment module, and the transfer module in the secure boot device of the cloud host is detailed in the above cloud host The implementation process corresponding to steps S500 to S504 in the secure boot method will not be repeated here.

The fourth acquiring module is configured to acquire the first usage data of the first host machine corresponding to the designated cloud host according to the first preset period, where the first usage data includes at least a CPU usage rate, a memory usage rate, and Network interface bandwidth usage rate;

The fourth judgment module is configured to analyze and process the first usage data, and judge whether the first usage data is greater than a preset standard threshold;

The searching module is configured to, if yes, find out the second host machine whose second usage data is less than the standard threshold value from all the host machines;

The migration module is used to migrate the designated cloud host from the first host to the second host.

In this embodiment, the implementation process of the functions and roles of the fourth acquisition module, the fourth judgment module, the search module, and the migration module in the secure boot device of the cloud host is detailed in the corresponding step S5040 in the secure boot method of the cloud host. The implementation process to S5043 will not be repeated here.

A fifth acquiring module, configured to acquire the available resource space in the cloud hard disk corresponding to the designated cloud host according to a second preset period;

The fifth judgment module is configured to analyze and process the available resource space, and judge whether the available resource space is less than a preset resource space threshold;

The screening module is used to screen out junk data in the cloud hard disk if so;

The second sending module is configured to send a garbage removal instruction to the designated cloud host to control the designated cloud host to clear the junk data according to the garbage removal instruction.

In this embodiment, the implementation process of the functions and roles of the fifth acquiring module, the fifth determining module, the screening module, and the second sending module in the secure boot device of the cloud host is detailed in the corresponding method in the secure boot method of the cloud host. The implementation process of steps S5044 to S5047 will not be repeated here.

Referring to FIG. 3, an embodiment of the present application also provides a computer device. The computer device may be a server, and its internal structure may be as shown in FIG. 3. The computer equipment includes a processor, a memory, a network interface, and a database connected through a system bus. Among them, the processor designed for the computer equipment is used to provide calculation and control capabilities. The memory of the computer device includes a volatile or non-volatile storage medium and internal memory. The volatile or non-volatile storage medium stores an operating system, computer readable instructions, and a database. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in the volatile or non-volatile storage medium. The database of the computer equipment is used to store data such as asset information and vulnerabilities. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer-readable instruction is executed by the processor, the method for secure startup of the cloud host shown in any of the above exemplary embodiments is realized. Those skilled in the art can understand that the structure shown in FIG. 3 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the devices and computer equipment to which the solution of the present application is applied.

An embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium may be volatile or non-volatile, and computer-readable instructions are stored thereon. When executed by one or more processors, the steps in the foregoing embodiment of the secure boot method for a cloud host are realized when executed by one or more processors.

In summary, the secure startup method, device, computer equipment, and storage medium of the cloud host provided in the embodiments of the present application, upon receiving a user-triggered startup instruction for a specified cloud host, obtain the Asset information corresponding to the designated cloud host, where the asset information includes at least operating system information; determine whether a predetermined vulnerability database stores vulnerabilities corresponding to the asset information of the designated cloud host, wherein the number of vulnerabilities Is one or more; if so, obtain the last shutdown time of the designated cloud host and the release time corresponding to each of the vulnerabilities; according to the last shutdown time and each release time, it is determined that all the Whether there are specified vulnerabilities in the vulnerabilities whose release time is within a specified period of time; if so, start the designated cloud host in the pre-created security isolation zone, where the network access function of the specified cloud host is in the security isolation zone Will be disabled. This application will intelligently place the designated cloud host in the pre-created security isolation zone for startup when a new vulnerability related to it occurs during the last shutdown of the designated cloud host, so that after the designated cloud host is started Temporarily disable the network access function of the designated cloud host, effectively avoiding the intrusion or attack of the designated cloud host by vulnerabilities during use, and ensuring the security of the designated cloud host after it is started.

A person of ordinary skill in the art can understand that all or part of the processes in the methods of the foregoing embodiments can be implemented by computer-readable instructions to instruct relevant hardware. The computer-readable instructions can be stored in a non-volatile or In a volatile computer-readable storage medium, when the computer-readable instructions are executed, they may include the processes of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and/or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not a limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

The above are only the preferred embodiments of this application, and do not limit the scope of this application. Any equivalent structure or equivalent process transformation made using the content of the specification and drawings of this application, or directly or indirectly applied to other related The technical field is equally included in the scope of patent protection of this application.

Claims

A method for securely starting a cloud host, which is characterized in that it includes:

When receiving a user-triggered start instruction for a designated cloud host, acquiring asset information corresponding to the designated cloud host according to a preset rule, where the asset information includes at least operating system information;

Judging whether there are vulnerabilities corresponding to the asset information of the designated cloud host stored in the preset vulnerability database, wherein the number of the vulnerabilities is one or more;

If yes, obtain the last shutdown time of the designated cloud host and the release time corresponding to each of the vulnerabilities;

According to the last shutdown time and each of the release times, determine whether there is a specified vulnerability whose release time is within a specified period of time among all the vulnerabilities;

If yes, start the designated cloud host in a pre-created security isolation zone, wherein the network access function of the designated cloud host will be disabled in the security isolation zone.
The secure startup method of a cloud host according to claim 1, wherein the step of obtaining asset information corresponding to the designated cloud host according to a preset rule comprises:

Determining whether an asset management tool is installed in the designated cloud host, wherein the asset management tool is used to periodically synchronize asset information corresponding to the designated cloud host to the designated cloud platform;

If an asset management tool is installed, search for the asset information from the designated cloud platform;

If the asset management tool is not installed, call the designated scanning tool to scan the designated cloud host to obtain the asset information.
The method for secure startup of a cloud host according to claim 1, wherein before the step of determining whether a vulnerability corresponding to the asset information of the designated cloud host is stored in the preset vulnerability database, the method further include:

Through the crawler tool, the first vulnerability information related to various operating systems corresponding to the cloud host and the second vulnerability information related to the cloud host service are captured from the target website in real time;

Create a vulnerability database;

The first vulnerability information and the second vulnerability information are stored in the vulnerability database.
The method for secure startup of a cloud host according to claim 1, wherein said determining whether there is a release time in all said vulnerabilities is within a specified time period according to said last shutdown time and each said release time Before the step of specifying vulnerabilities, the method also includes:

Get the current time;

The time period included between the last shutdown time and the current time is determined as the designated time period.
The method for safely starting a cloud host according to claim 1, wherein after the step of starting the designated cloud host in a pre-created security isolation zone, the method further comprises:

Determining whether the specified patch corresponding to the specified vulnerability is stored in the vulnerability database;

If yes, download the designated patch, and store the designated patch in a designated storage area in the designated cloud host through a designated transmission method;

Send an installation instruction for installing the specified patch to the specified cloud host, so that the specified cloud host installs the specified patch according to the installation instruction, and returns a corresponding patch installation result, wherein the patch installation result Including successful or failed installation;

Judging whether the specified patch is successfully installed according to the patch installation result returned by the specified cloud host;

If yes, transfer the designated cloud host out of the security isolation area to restore the normal network access function of the designated cloud host.
The secure startup method of a cloud host according to claim 5, wherein after the step of transferring the designated cloud host out of the security isolation area to restore the normal network access function of the designated cloud host, The method also includes:

Acquiring first usage data of a first host machine corresponding to the designated cloud host according to a first preset period, where the first usage data includes at least a CPU usage rate, a memory usage rate, and a network interface bandwidth usage rate;

Analyzing and processing the first usage data, and determining whether the first usage data is greater than a preset standard threshold;

If yes, find out the second host machine whose second usage data is less than the standard threshold from all the host machines;

Migrating the designated cloud host from the first host to the second host.
The secure startup method of a cloud host according to claim 5, wherein after the step of transferring the designated cloud host out of the security isolation area to restore the normal network access function of the designated cloud host, The method also includes:

Acquiring, according to a second preset period, the available resource space in the cloud hard disk corresponding to the designated cloud host;

Analyzing and processing the available resource space, and determining whether the available resource space is less than a preset resource space threshold;

If yes, filter out the junk data in the cloud hard disk;

Sending a garbage removal instruction to the designated cloud host to control the designated cloud host to clear the garbage data according to the garbage removal instruction.
A secure boot device for a cloud host, which is characterized in that it includes:

The first obtaining module is configured to obtain asset information corresponding to the specified cloud host according to preset rules when a user-triggered start instruction for the specified cloud host is received, wherein the asset information includes at least operating system information;

The first judgment module is used to judge whether there are vulnerabilities corresponding to the asset information of the designated cloud host stored in the preset vulnerability database, wherein the number of the vulnerabilities is one or more;

The second obtaining module is configured to, if yes, obtain the last shutdown time of the designated cloud host and the release time corresponding to each of the vulnerabilities;

The second judgment module is used for judging whether there are specified vulnerabilities whose release time is within a specified period of time among all the vulnerabilities according to the last shutdown time and each of the release times;

The isolation module is configured to, if yes, start the designated cloud host in a pre-created security isolation area, wherein the network access function of the specified cloud host will be disabled in the security isolation area.
The secure boot device for a cloud host according to claim 8, wherein the first obtaining module comprises:

The first determining unit is configured to determine whether an asset management tool is installed in the designated cloud host, wherein the asset management tool is used to periodically synchronize asset information corresponding to the designated cloud host to the designated cloud platform;

The first searching unit is configured to search for the asset information from the designated cloud platform if an asset management tool is installed;

The first calling unit is configured to, if the asset management tool is not installed, call a designated scanning tool to perform scanning processing on the designated cloud host, so as to obtain the asset information.
The secure boot device of a cloud host according to claim 8, wherein the device comprises:

The crawling module is used to grab the first vulnerability information related to various operating systems corresponding to the cloud host and the second vulnerability information related to the cloud host service from the target website in real time through a crawler tool;

Create module to create a vulnerability database;

The first storage module is used to store the first vulnerability information and the second vulnerability information in the vulnerability database.
The secure boot device of a cloud host according to claim 8, wherein the device comprises:

The third obtaining module is used to obtain the current time;

The first determining module is configured to determine the time period included between the last shutdown time and the current time as the designated time period.
The secure boot device of a cloud host according to claim 8, wherein the device comprises:

The second determining module is used to determine whether the specified patch corresponding to the specified vulnerability is stored in the vulnerability database;

The second storage module is configured to download the specified patch if it is, and store the specified patch in a specified storage area in the specified cloud host through a specified transmission method;

The first sending module is configured to send an installation instruction for installing the specified patch to the specified cloud host, so that the specified cloud host installs the specified patch according to the installation instruction, and returns the corresponding patch installation result, Wherein, the patch installation result includes installation success or installation failure;

The third judgment module is configured to judge whether the specified patch is successfully installed according to the patch installation result returned by the specified cloud host;

The transfer module is used for transferring the designated cloud host out of the security isolation area, so as to restore the normal network access function of the designated cloud host.
The secure boot device of a cloud host according to claim 12, wherein the device comprises:

The fourth acquiring module is configured to acquire the first usage data of the first host machine corresponding to the designated cloud host according to the first preset period, where the first usage data includes at least a CPU usage rate, a memory usage rate, and Network interface bandwidth usage rate;

The fourth judgment module is configured to analyze and process the first usage data, and judge whether the first usage data is greater than a preset standard threshold;

The searching module is configured to, if yes, find out the second host machine whose second usage data is less than the standard threshold value from all the host machines;

The migration module is used to migrate the designated cloud host from the first host to the second host.
The secure boot device of a cloud host according to claim 12, wherein the device comprises:

A fifth acquiring module, configured to acquire the available resource space in the cloud hard disk corresponding to the designated cloud host according to a second preset period;

The fifth judgment module is configured to analyze and process the available resource space, and judge whether the available resource space is less than a preset resource space threshold;

The screening module is used to screen out junk data in the cloud hard disk if so;

The second sending module is configured to send a garbage removal instruction to the designated cloud host to control the designated cloud host to clear the junk data according to the garbage removal instruction.
A computer device includes a memory and a processor, the memory stores computer-readable instructions, and is characterized in that, when the processor executes the computer-readable instructions, a method for safely starting a cloud host is realized, and the cloud host is Start method, including:

When receiving a user-triggered start instruction for a designated cloud host, acquiring asset information corresponding to the designated cloud host according to a preset rule, where the asset information includes at least operating system information;

Judging whether there are vulnerabilities corresponding to the asset information of the designated cloud host stored in the preset vulnerability database, wherein the number of the vulnerabilities is one or more;

If yes, obtain the last shutdown time of the designated cloud host and the release time corresponding to each of the vulnerabilities;

According to the last shutdown time and each of the release times, determine whether there is a specified vulnerability whose release time is within a specified period of time among all the vulnerabilities;

If yes, start the designated cloud host in a pre-created security isolation zone, wherein the network access function of the designated cloud host will be disabled in the security isolation zone.
The computer device according to claim 15, wherein the step of obtaining asset information corresponding to the designated cloud host according to a preset rule comprises:

Determining whether an asset management tool is installed in the designated cloud host, wherein the asset management tool is used to periodically synchronize asset information corresponding to the designated cloud host to the designated cloud platform;

If an asset management tool is installed, search for the asset information from the designated cloud platform;

If the asset management tool is not installed, call the designated scanning tool to scan the designated cloud host to obtain the asset information.
The computer device according to claim 15, wherein before the step of determining whether a vulnerability corresponding to the asset information of the designated cloud host is stored in the preset vulnerability database, the method further comprises:

Through the crawler tool, the first vulnerability information related to various operating systems corresponding to the cloud host and the second vulnerability information related to the cloud host service are captured from the target website in real time;

Create a vulnerability database;

The first vulnerability information and the second vulnerability information are stored in the vulnerability database.
A computer-readable storage medium having computer-readable instructions stored thereon, wherein the computer-readable instructions are executed by a processor to realize a secure startup method of a cloud host, and the secure startup method of the cloud host includes:

When receiving a user-triggered start instruction for a designated cloud host, acquiring asset information corresponding to the designated cloud host according to a preset rule, where the asset information includes at least operating system information;

Judging whether there are vulnerabilities corresponding to the asset information of the designated cloud host stored in the preset vulnerability database, wherein the number of the vulnerabilities is one or more;

If yes, obtain the last shutdown time of the designated cloud host and the release time corresponding to each of the vulnerabilities;

According to the last shutdown time and each of the release times, determine whether there is a specified vulnerability whose release time is within a specified period of time among all the vulnerabilities;

If yes, start the designated cloud host in a pre-created security isolation zone, wherein the network access function of the designated cloud host will be disabled in the security isolation zone.
The computer-readable storage medium according to claim 18, wherein the step of obtaining asset information corresponding to the designated cloud host according to a preset rule comprises:

Determining whether an asset management tool is installed in the designated cloud host, wherein the asset management tool is used to periodically synchronize asset information corresponding to the designated cloud host to the designated cloud platform;

If an asset management tool is installed, search for the asset information from the designated cloud platform;

If the asset management tool is not installed, call the designated scanning tool to scan the designated cloud host to obtain the asset information.
The computer-readable storage medium according to claim 18, wherein before the step of determining whether a vulnerability corresponding to the asset information of the designated cloud host is stored in the preset vulnerability database, the method further comprises :

Through the crawler tool, the first vulnerability information related to various operating systems corresponding to the cloud host and the second vulnerability information related to the cloud host service are captured from the target website in real time;

Create a vulnerability database;

The first vulnerability information and the second vulnerability information are stored in the vulnerability database.