WO2021184726A1 - 漏洞扫描方法、装置、计算机装置及计算机存储介质 - Google Patents

漏洞扫描方法、装置、计算机装置及计算机存储介质 Download PDF

Info

Publication number
WO2021184726A1
WO2021184726A1 PCT/CN2020/119059 CN2020119059W WO2021184726A1 WO 2021184726 A1 WO2021184726 A1 WO 2021184726A1 CN 2020119059 W CN2020119059 W CN 2020119059W WO 2021184726 A1 WO2021184726 A1 WO 2021184726A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual
scanning
bridge
network bridge
virtual host
Prior art date
Application number
PCT/CN2020/119059
Other languages
English (en)
French (fr)
Inventor
覃华伟
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2021184726A1 publication Critical patent/WO2021184726A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security

Definitions

  • This application relates to the field of network security technology, and in particular to a vulnerability scanning method, device, computer device, and computer storage medium.
  • Cloud computing management platform is an open source project that aims to provide software for the construction and management of virtual public clouds and virtual private clouds (Virtual Private Cloud, VPC). It can run on the Linux operating system and is based on the virtual cloud computing management platform. The construction of public cloud and VPC can make full use of large-scale physical resources.
  • the virtual network of the cloud computing management platform is formed by a bridge, which is a virtual switch that works at the link layer.
  • the firewall of the cloud computing management platform can be implemented by loading the security component (Security Group) Iptables on the bridge.
  • IP layer also known as IP layer
  • IP layer can perform security detection on IP data packets, but cannot detect data packets at the link layer, making the firewall have network security loopholes.
  • a vulnerability scanning method includes:
  • Target virtual host Searching for a target node to which the target virtual host belongs, and the target virtual host is connected to an integrated network bridge in the target node through a virtual network bridge;
  • a vulnerability scanning device comprising:
  • the determining module is used to determine the target virtual host to be scanned
  • a creation module configured to create a scanning virtual host connected to the virtual bridge on the target node, and the scanning virtual host carries a scanning tool
  • An obtaining module configured to obtain the communication authorization of the virtual network bridge to the scanning virtual host
  • An adjustment module configured to adjust the communication authorization of the virtual network bridge to the integrated network bridge, so that the virtual network bridge is disconnected from the integrated network bridge;
  • the calling module is used to call the scanning tool for scanning the virtual host to scan the target virtual machine for vulnerabilities through the virtual bridge.
  • a computer device includes a processor, and the processor implements the following steps when the processor is used to execute a computer program stored in a memory:
  • Target virtual host Searching for a target node to which the target virtual host belongs, and the target virtual host is connected to an integrated network bridge in the target node through a virtual network bridge;
  • Target virtual host Searching for a target node to which the target virtual host belongs, and the target virtual host is connected to an integrated network bridge in the target node through a virtual network bridge;
  • This application scans the vulnerabilities of the target virtual host and reduces the impact of the scanning process on the network.
  • Fig. 1 is a flowchart of a vulnerability scanning method provided by an embodiment of the present application.
  • Fig. 2 is a structural diagram of a vulnerability scanning device provided by an embodiment of the present application.
  • Fig. 3 is a schematic diagram of a computer device provided by an embodiment of the present application.
  • the vulnerability scanning method of the present application is applied to one or more computer devices.
  • the computer device is a device that can automatically perform numerical calculation and/or information processing in accordance with pre-set or stored instructions.
  • Its hardware includes, but is not limited to, a microprocessor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), Programmable Gate Array (Field-Programmable Gate Array, FPGA), Digital Signal Processor (DSP), embedded devices, etc.
  • the computer device may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server.
  • the computer device can interact with the user through a keyboard, a mouse, a remote control, a touch panel, or a voice control device.
  • Fig. 1 is a flowchart of a vulnerability scanning method provided in Embodiment 1 of the present application.
  • the vulnerability scanning method is applied to a proxy server in a network.
  • the network includes one or more nodes, and each node runs one or more virtual hosts.
  • the nodes may be computing nodes (physical hosts), cloud servers, etc. .
  • the vulnerability scanning method scans the vulnerabilities of the target virtual host.
  • the vulnerability scanning method includes:
  • a virtual machine scan request sent by a node in the network where the proxy server is located may be received, and the virtual host in the virtual machine scan request may be determined as the target virtual host.
  • a virtual machine scan request sent by node A in the network where the proxy server is located may be received, and the virtual machine scan request may be a UDP (User Datagram Protocol, User Datagram Protocol) message, and scan the virtual machine
  • UDP User Datagram Protocol
  • the virtual host a in the request is determined as the target virtual host.
  • the virtual machine scanning request may also include multiple virtual hosts, so as to determine the multiple virtual hosts as target virtual hosts.
  • the node in the network where the proxy server is located can verify that the pre-added virtual host stops executing the task running on the virtual host before adding the virtual host to the virtual machine scan request, so that the task running on the virtual host is avoided Interfered by vulnerability scanning.
  • the virtual host information stored in the local database may be read, and the virtual machine in the virtual host information may be periodically determined as the target host.
  • the MAC (Media Access Control Address) address of virtual host b the MAC address of virtual host c, and the virtual host number of virtual host d.
  • Virtual host c and virtual host d are determined as the target host.
  • the MAC address may be the unique identifier of the virtual host.
  • the integrated network bridge can be analogous to a switch, the switch can be used to connect multiple nodes (computing nodes, physical hosts, or servers, etc.), and the integrated network bridge can be used to connect multiple virtual machines.
  • the virtual network bridge may be used to connect the integrated network bridge and multiple virtual machines, and the function of a firewall may be realized by loading a security component.
  • the integrated network bridge connected to the target virtual host may be searched for through the MAC address of the target virtual host, and the target node may be searched for through the integrated network bridge.
  • Receive the returned UDP message and obtain the integrated bridge connected to the target virtual host a from the returned UDP message.
  • the integrated bridge-target node mapping table is obtained, and the integrated bridge-target node mapping table is searched for the target node corresponding to the integrated bridge connected to the target virtual host a.
  • the target node to which the target virtual host belongs may be found through the stored location information of the virtual machine.
  • an executable script may be generated according to the configuration information of the virtual network bridge and the configuration information of the scanning virtual host, and the executable script may be issued to the target node, so that the target node The executable node is executed to create a scanning virtual host connected to the virtual bridge.
  • the scanning virtual host connected to the virtual network bridge can be created by calling the creation interface of the target node.
  • the scanning virtual host Before scanning the target virtual virtual machine, it is necessary to obtain the communication authorization of the virtual network bridge to the scanning virtual host. If the virtual network bridge does not perform communication authorization to the scanning virtual host, the scanning virtual The host cannot communicate with the target virtual host through the virtual bridge, and the scanning virtual host cannot perform vulnerability scanning on the target virtual machine.
  • the obtaining the communication authorization of the virtual bridge for the scanning virtual host includes:
  • the authorized network control list is issued to the virtual network bridge, so that the virtual network bridge stores the authorized network control list in a local network control list.
  • the authorized network control list records network control rules, and the virtual network bridge can perform network control on the packets received by the virtual network bridge according to the network control rules. For example, the virtual network bridge performs network control such as receiving, forwarding, discarding, and broadcasting on the received message according to the local network control list.
  • the authorized network control list is generated according to the MAC address of the virtual host, the MAC address of the virtual host is "123.125.71.60", and the network control rule recorded in the data network control list is "iptables -A INPUT -i" veth_1 -s 123.125.71.60 -p tcp -sport 60 -j ACCEPT".
  • the authorized network control list can be sent to the virtual bridge by scanning the remote control interface of the virtual host.
  • the scanning virtual host includes a scanning interface
  • the MAC address of the scanning virtual host may be the MAC address of the scanning interface
  • the connection between the virtual network bridge and the integrated network bridge can be disconnected, that is, the virtual network bridge cannot be connected to other virtual hosts and/or computing of the integrated network bridge.
  • the nodes communicate to avoid interference to other virtual hosts and/or computing nodes during the scanning process of the target virtual virtual machine.
  • the adjusting the communication authorization of the virtual network bridge to the integrated network bridge includes:
  • the forbidden network control list is issued to the virtual network bridge, so that the virtual network bridge stores the forbidden network control list in a local network control list.
  • the message of the target virtual host is received by sending a detection request to the target virtual host, and the MAC address of the integrated network bridge is obtained from the message returned by the target virtual host.
  • the authorized network control list is generated according to the MAC address of the virtual host, the MAC address of the virtual host is "123.125.71.61”, and the network control rule recorded in the data network control list is "iptables -A INPUT -i" veth_1 -s 123.125.71.61 -p tcp -sport 62 -j DROP", "iptables -A OUT -i veth_1 -s 123.125.71.61 -p tcp -sport 62 -j DROP".
  • the banned network control list can be sent to the virtual bridge by scanning the remote control interface of the virtual host.
  • the scanning tool for scanning the virtual host may be invoked through the remote control interface of the scanning virtual host, and the scanning tool for scanning the virtual host performs vulnerability scanning on the target virtual machine through the virtual bridge.
  • the scanning result output by the scanning tool that scans the virtual host can be obtained.
  • the scanning result may include the vulnerabilities of the scanned target virtual host or the absence of vulnerabilities of the target virtual host.
  • the vulnerability scanning method of the first embodiment determines the target virtual host to be scanned; searches for the target node to which the target virtual host belongs, and the target virtual host is connected to the integrated network bridge in the target node through a virtual network bridge; Create a scanning virtual host connected to the virtual bridge on the target node, the scanning virtual host carries a scanning tool; obtain the communication authorization of the virtual bridge to the scanning virtual host; adjust the virtual bridge to all The communication authorization of the integrated network bridge causes the virtual network bridge to disconnect from the integrated network bridge; the scanning tool that scans the virtual host is invoked to scan the target virtual machine for vulnerabilities through the virtual network bridge.
  • the vulnerabilities of the target virtual host are scanned, and the influence of the scanning process on the network is reduced.
  • the method before the obtaining the communication authorization of the virtual network bridge for the scanning virtual host, the method further includes: obtaining the permission to scan the target virtual host.
  • the authorization to scan the target virtual host may be verified; if there is no authorization to scan the target virtual host, the target The virtual host or the target node requests permission to scan the target virtual host.
  • the method further includes:
  • the scan log may include the vulnerabilities of the target virtual host scanned during multiple vulnerability scans.
  • the scanning virtual host includes a remote control interface
  • the proxy server can invoke the scanning tool for scanning the virtual host through the remote control interface
  • the method further includes:
  • Restore the communication authorization of the virtual network bridge to the integrated network bridge can open the communication channel between the virtual network bridge and the integrated network bridge.
  • Fig. 2 is a structural diagram of the vulnerability scanning device provided in the second embodiment of the present application.
  • the vulnerability scanning device 20 is applied to a proxy server in a network.
  • the network includes one or more nodes, and each node runs one or more virtual hosts.
  • the nodes may be computing nodes (physical hosts) or cloud servers. Wait.
  • the vulnerability scanning of this device is to scan the vulnerabilities of the target virtual host.
  • the vulnerability scanning device 20 may include a determination module 201, a search module 202, a creation module 203, an acquisition module 204, an adjustment module 205, and a calling module 206.
  • the determining module 201 is used to determine the target virtual host to be scanned.
  • a virtual machine scan request sent by a node in the network where the proxy server is located may be received, and the virtual host in the virtual machine scan request may be determined as the target virtual host.
  • a virtual machine scan request sent by node A in the network where the proxy server is located may be received, and the virtual machine scan request may be a UDP (User Datagram Protocol, User Datagram Protocol) message, and scan the virtual machine
  • UDP User Datagram Protocol
  • the virtual host a in the request is determined as the target virtual host.
  • the virtual machine scanning request may also include multiple virtual hosts, so as to determine the multiple virtual hosts as target virtual hosts.
  • the node in the network where the proxy server is located can verify that the pre-added virtual host stops executing the task running on the virtual host before adding the virtual host to the virtual machine scan request, so that the task running on the virtual host is avoided Interfered by vulnerability scanning.
  • the virtual host information stored in the local database may be read, and the virtual machine in the virtual host information may be periodically determined as the target host.
  • the MAC (Media Access Control Address) address of virtual host b the MAC address of virtual host c, and the virtual host number of virtual host d.
  • Virtual host c and virtual host d are determined as the target host.
  • the MAC address may be the unique identifier of the virtual host.
  • the searching module 202 is configured to search for a target node to which the target virtual host belongs, and the target virtual host is connected to an integrated network bridge in the target node through a virtual network bridge.
  • the integrated network bridge can be analogous to a switch, the switch can be used to connect multiple nodes (computing nodes, physical hosts, or servers, etc.), and the integrated network bridge can be used to connect multiple virtual machines.
  • the virtual network bridge may be used to connect the integrated network bridge and multiple virtual machines, and the function of a firewall may be realized by loading a security component.
  • the integrated network bridge connected to the target virtual host may be searched for through the MAC address of the target virtual host, and the target node may be searched for through the integrated network bridge.
  • Receive the returned UDP message and obtain the integrated bridge connected to the target virtual host a from the returned UDP message.
  • the integrated bridge-target node mapping table is obtained, and the integrated bridge-target node mapping table is searched for the target node corresponding to the integrated bridge connected to the target virtual host a.
  • the target node to which the target virtual host belongs may be found through the stored location information of the virtual machine.
  • the creation module 203 is configured to create a scanning virtual host connected to the virtual bridge on the target node, and the scanning virtual host carries a scanning tool.
  • an executable script may be generated according to the configuration information of the virtual network bridge and the configuration information of the scanning virtual host, and the executable script may be issued to the target node, so that the target node The executable node is executed to create a scanning virtual host connected to the virtual bridge.
  • the scanning virtual host connected to the virtual network bridge can be created by calling the creation interface of the target node.
  • the obtaining module 204 is configured to obtain the communication authorization of the virtual network bridge for the scanning virtual host.
  • the scanning virtual host Before scanning the target virtual virtual machine, it is necessary to obtain the communication authorization of the virtual bridge to the scanning virtual host. If the virtual bridge does not authorize the scanning virtual host to communicate, the scanning virtual The host cannot communicate with the target virtual host through the virtual bridge, and the scanning virtual host cannot perform vulnerability scanning on the target virtual machine.
  • the obtaining the communication authorization of the virtual bridge for the scanning virtual host includes:
  • the authorized network control list is issued to the virtual network bridge, so that the virtual network bridge stores the authorized network control list in a local network control list.
  • the authorized network control list records network control rules, and the virtual network bridge can perform network control on the packets received by the virtual network bridge according to the network control rules. For example, the virtual network bridge performs network control such as receiving, forwarding, discarding, and broadcasting on the received message according to the local network control list.
  • the authorized network control list is generated according to the MAC address of the virtual host, the MAC address of the virtual host is "123.125.71.60", and the network control rule recorded in the data network control list is "iptables -A INPUT -i" veth_1 -s 123.125.71.60 -p tcp -sport 60 -j ACCEPT".
  • the authorized network control list can be sent to the virtual bridge by scanning the remote control interface of the virtual host.
  • the scanning virtual host includes a scanning interface
  • the MAC address of the scanning virtual host may be the MAC address of the scanning interface
  • the adjustment module 205 is configured to adjust the communication authorization of the virtual network bridge to the integrated network bridge, so that the virtual network bridge is disconnected from the integrated network bridge.
  • the connection between the virtual network bridge and the integrated network bridge can be disconnected, that is, the virtual network bridge cannot be connected to other virtual hosts and/or computing of the integrated network bridge.
  • the nodes communicate to avoid interference to other virtual hosts and/or computing nodes during the scanning process of the target virtual virtual machine.
  • the adjusting the communication authorization of the virtual network bridge to the integrated network bridge includes:
  • the forbidden network control list is issued to the virtual network bridge, so that the virtual network bridge stores the forbidden network control list in a local network control list.
  • the message of the target virtual host is received by sending a detection request to the target virtual host, and the MAC address of the integrated network bridge is obtained from the message returned by the target virtual host.
  • the authorized network control list is generated according to the MAC address of the virtual host, the MAC address of the virtual host is "123.125.71.61”, and the network control rule recorded in the data network control list is "iptables -A INPUT -i" veth_1 -s 123.125.71.61 -p tcp -sport 62 -j DROP", "iptables -A OUT -i veth_1 -s 123.125.71.61 -p tcp -sport 62 -j DROP".
  • the banned network control list can be sent to the virtual bridge by scanning the remote control interface of the virtual host.
  • the calling module 206 is configured to call the scanning tool for scanning the virtual host to scan the target virtual machine for vulnerabilities through the virtual bridge.
  • the scanning tool for scanning the virtual host may be invoked through the remote control interface of the scanning virtual host, and the scanning tool for scanning the virtual host performs vulnerability scanning on the target virtual machine through the virtual bridge.
  • the scanning result output by the scanning tool that scans the virtual host can be obtained.
  • the scanning result may include the vulnerabilities of the scanned target virtual host or the absence of vulnerabilities of the target virtual host.
  • the vulnerability scanning device 20 of the second embodiment determines the target virtual host to be scanned; searches for the target node to which the target virtual host belongs, and the target virtual host is connected to an integrated network bridge in the target node through a virtual network bridge; Creating a scanning virtual host connected to the virtual bridge on the target node, the scanning virtual host carrying a scanning tool; acquiring the communication authorization of the virtual bridge to the scanning virtual host; adjusting the virtual bridge pair
  • the communication authorization of the integrated network bridge causes the virtual network bridge to disconnect from the integrated network bridge; the scanning tool that scans the virtual host is invoked to scan the target virtual machine for vulnerabilities through the virtual network bridge .
  • the vulnerabilities of the target virtual host are scanned, and the influence of the scanning process on the network is reduced.
  • the acquiring module is further configured to acquire the permission to scan the target virtual host before the acquiring the communication authorization of the virtual bridge to the scanning virtual host.
  • the authorization to scan the target virtual host may be verified; if there is no authorization to scan the target virtual host, the target The virtual host or the target node requests permission to scan the target virtual host.
  • the vulnerability scanning device 20 may further include: a receiving module, configured to receive the scanning log returned by the scanning virtual host.
  • the scan log may include the vulnerabilities of the target virtual host scanned during multiple vulnerability scans.
  • the scanning virtual host includes a remote control interface
  • the calling module is further configured to call the scanning tool for scanning the virtual host through the remote control interface.
  • the vulnerability scanning device 20 may further include: a recovery module, configured to perform vulnerability scanning on the target virtual machine through the virtual bridge after the scanning tool that calls the scanning virtual host To restore the communication authorization of the virtual network bridge to the integrated network bridge.
  • a recovery module configured to perform vulnerability scanning on the target virtual machine through the virtual bridge after the scanning tool that calls the scanning virtual host To restore the communication authorization of the virtual network bridge to the integrated network bridge.
  • Restoring the communication authorization of the virtual network bridge to the integrated network bridge can open the communication channel between the virtual network bridge and the integrated network bridge.
  • This embodiment provides a computer storage medium.
  • the computer-readable storage medium may be volatile or non-volatile.
  • the computer storage medium stores a computer program that is executed when the computer program is executed by a processor.
  • the steps in the above embodiment of the vulnerability scanning method are, for example, 101-106 shown in Figure 1:
  • each module in the above-mentioned device embodiment is realized, for example, the modules 201-206 in Fig. 2:
  • the determining module 201 is used to determine the target virtual host to be scanned
  • the searching module 202 is configured to search for the target node to which the target virtual host belongs, and the target virtual host is connected to an integrated network bridge in the target node through a virtual network bridge;
  • the creation module 203 is configured to create a scanning virtual host connected to the virtual bridge on the target node, and the scanning virtual host carries a scanning tool;
  • the obtaining module 204 is configured to obtain the communication authorization of the virtual network bridge to the scanning virtual host;
  • the adjustment module 205 is configured to adjust the communication authorization of the virtual network bridge to the integrated network bridge, so that the virtual network bridge is disconnected from the integrated network bridge;
  • the calling module 206 is configured to call the scanning tool for scanning the virtual host to scan the target virtual machine for vulnerabilities through the virtual bridge.
  • FIG. 3 is a schematic diagram of a computer device provided in Embodiment 4 of this application.
  • the computer device 30 includes a memory 301, a processor 302, and a computer program 303 stored in the memory 301 and running on the processor 302, such as a vulnerability scanning program.
  • the processor 302 executes the computer program 303, the steps in the above-mentioned vulnerability scanning method embodiment are implemented, for example, 101-106 shown in Fig. 1:
  • each module in the above-mentioned device embodiment is realized, for example, the modules 201-206 in Fig. 2:
  • the determining module 201 is used to determine the target virtual host to be scanned
  • the searching module 202 is configured to search for the target node to which the target virtual host belongs, and the target virtual host is connected to an integrated network bridge in the target node through a virtual network bridge;
  • the creation module 203 is configured to create a scanning virtual host connected to the virtual bridge on the target node, and the scanning virtual host carries a scanning tool;
  • the obtaining module 204 is configured to obtain the communication authorization of the virtual network bridge to the scanning virtual host;
  • the adjustment module 205 is configured to adjust the communication authorization of the virtual network bridge to the integrated network bridge, so that the virtual network bridge is disconnected from the integrated network bridge;
  • the calling module 206 is configured to call the scanning tool for scanning the virtual host to scan the target virtual machine for vulnerabilities through the virtual bridge.
  • the computer program 303 may be divided into one or more modules, and the one or more modules are stored in the memory 301 and executed by the processor 302 to complete the method.
  • the one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program 303 in the computer device 30.
  • the computer program 303 may be divided into the determination module 201, the search module 202, the creation module 203, the acquisition module 204, the adjustment module 205, and the invocation module 206 in FIG. 2.
  • the specific functions of each module refer to the second embodiment.
  • the computer device 30 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server.
  • a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server.
  • the schematic diagram 3 is only an example of the computer device 30 and does not constitute a limitation on the computer device 30. It may include more or less components than those shown in the figure, or combine certain components, or be different.
  • the computer device 30 may also include input and output devices, network access devices, buses, and so on.
  • the so-called processor 302 may be a central processing unit (Central Processing Unit, CPU), other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor can be a microprocessor or the processor 302 can also be any conventional processor, etc.
  • the processor 302 is the control center of the computer device 30, which uses various interfaces and lines to connect the entire computer device 30. Various parts.
  • the memory 301 may be used to store the computer program 303, and the processor 302 implements the computer device by running or executing the computer program or module stored in the memory 301 and calling data stored in the memory 301 30 various functions.
  • the memory 301 may mainly include a storage program area and a storage data area.
  • the storage program area may store an operating system, an application program required by at least one function (such as a sound playback function, an image playback function, etc.), etc.; the storage data area may Data (such as audio data, etc.) created in accordance with the use of the computer device 30 and the like are stored.
  • the memory 301 may include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a Secure Digital (SD) card, a flash memory card (Flash Card), At least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device.
  • non-volatile memory such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a Secure Digital (SD) card, a flash memory card (Flash Card), At least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device.
  • the integrated module of the computer device 30 is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • this application implements all or part of the processes in the above-mentioned embodiments and methods, and can also be completed by instructing relevant hardware through a computer program.
  • the computer program can be stored in a computer storage medium. When executed by the processor, the steps of the foregoing method embodiments can be implemented.
  • the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file, or some intermediate forms.
  • the computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory) .
  • all the above-mentioned data can also be stored in a node of a blockchain.
  • a node of a blockchain For example, network control lists and scan logs, etc., these data can be stored in the blockchain node.
  • the blockchain referred to in the present invention is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, encryption algorithm, etc.
  • modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional modules in the various embodiments of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware, or in the form of hardware plus software functional modules.
  • the above-mentioned integrated modules implemented in the form of software functional modules may be stored in a computer readable storage medium.
  • the above-mentioned software function module is stored in a storage medium and includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor execute the method described in the various embodiments of this application. Part of the steps.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请提供了一种漏洞扫描方法及相关设备。所述方法确定待扫描的目标虚拟主机；查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；获取所述虚拟网桥对所述扫描虚拟主机的通信授权；调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。本申请扫描了目标虚拟主机的漏洞，减小了扫描过程对网络的影响。

Description

漏洞扫描方法、装置、计算机装置及计算机存储介质
本申请要求于2020年3月18日提交中国专利局、申请号为CN202010193479.0，发明名称为“漏洞扫描方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络安全技术领域，具体涉及一种漏洞扫描方法、装置、计算机装置及计算机存储介质。
 背景技术
云计算管理平台(Openstack)是一个旨在为虚拟公有云及虚拟私有云(Virtual Private Cloud，VPC)的建设与管理提供软件的开源项目，可以运行于Linux操作系统，基于云计算管理平台的虚拟公有云及VPC的建设可实现大规模的物理资源的充分利用。云计算管理平台的虚拟网络由网桥（Bridge）组建，网桥是工作在链路层（Link Layer）的虚拟交换机。
为了保障云计算管理平台的安全运行，需要给云计算管理平台部署防火墙。云计算管理平台的防火墙可以通过在网桥上加载安全组件（Security Group）Iptables来实现。
 技术问题
发明人意识到Iptables工作在网络层（Network Layer，也称IP层），可以对IP数据包进行安全检测，无法检测在链路层的数据包，使得防火墙存在网络安全的漏洞。
针对相关技术中的问题，目前尚未提出有效的解决方案。
 技术解决方案
一种漏洞扫描方法，所述方法包括：
确定待扫描的目标虚拟主机；
查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
一种漏洞扫描装置，所述装置包括：
确定模块，用于确定待扫描的目标虚拟主机；
查找模块，用于查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
创建模块，用于在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
获取模块，用于获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
调整模块，用于调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
调用模块，用于调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
一种计算机装置，所述计算机装置包括处理器，所述处理器用于执行存储器中存储的计算机程序时实现如下步骤：
确定待扫描的目标虚拟主机；
查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
一种计算机存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现如下步骤：
确定待扫描的目标虚拟主机；
查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
 有益效果
本申请扫描了目标虚拟主机的漏洞，减小了扫描过程对网络的影响。
 附图说明
图1是本申请实施例提供的漏洞扫描方法的流程图。
图2是本申请实施例提供的漏洞扫描装置的结构图。
图3是本申请实施例提供的计算机装置的示意图。
 本发明的实施方式
为了能够更清楚地理解本申请的上述目的、特征和优点，下面结合附图和具体实施例对本申请进行详细描述。需要说明的是，在不冲突的情况下，本申请的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多具体细节以便于充分理解本申请，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
除非另有定义，本文所使用的所有的技术和科学术语与属于本申请的技术领域的技术人员通常理解的含义相同。本文中在本申请的说明书中所使用的术语只是为了描述具体的实施例的目的，不是旨在于限制本申请。
优选地，本申请的漏洞扫描方法应用在一个或者多个计算机装置中。所述计算机装置是一种能够按照事先设定或存储的指令，自动进行数值计算和/或信息处理的设备，其硬件包括但不限于微处理器、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程门阵列(Field－Programmable Gate Array，FPGA)、数字处理器(Digital Signal Processor，DSP)、嵌入式设备等。
所述计算机装置可以是桌上型计算机、笔记本、掌上电脑及云端服务器等计算设备。所述计算机装置可以与用户通过键盘、鼠标、遥控器、触摸板或声控设备等方式进行人机交互。
实施例一
图1是本申请实施例一提供的漏洞扫描方法的流程图。所述漏洞扫描方法应用于网络中的代理服务器，所述网络包括一个或多个节点，每个节点上运行一个或多个虚拟主机，所述节点可以是计算节点（物理主机）、云服务器等。
所述漏洞扫描方法扫描目标虚拟主机的漏洞。
如图1所示，所述漏洞扫描方法包括：
101，确定待扫描的目标虚拟主机。
在一具体实施例中，可以接收代理服务器所在的网络中的节点发出的虚拟机扫描请求，将所述虚拟机扫描请求中的虚拟主机确定为所述目标虚拟主机。
例如，可以接收所述代理服务器所在的网络中的节点A发出的虚拟机扫描请求，所述虚拟机扫描请求可以是UDP（用户数据报协议，User Datagram Protocol）报文，将所述虚拟机扫描请求中的虚拟主机a确定为目标虚拟主机。
所述虚拟机扫描请求也可以包括多个虚拟主机，以将多个虚拟主机确定为目标虚拟主机。所述代理服务器所在的网络中的节点可以在向所述虚拟机扫描请求中添加虚拟主机之前，验证预添加的虚拟主机停止执行运行于该虚拟主机的任务，使运行于该虚拟主机的任务避免受漏洞扫描的干扰。
在另一实施例中，可以读取本地数据库中存储的虚拟主机信息，周期性地将所述虚拟主机信息中的虚拟机确定为所述目标主机。
例如，读取本地数据库中存储的三个虚拟主机信息（虚拟主机b的MAC（Media Access Control Address）地址、虚拟主机c的MAC地址、虚拟主机d的虚拟主机号），每间隔一天将虚拟机b、虚拟主机c、虚拟主机d确定为所述目标主机。其中，MAC地址可以是虚拟主机的唯一标识。
102，查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接。
所述综合网桥可以类比为交换机，交换机可以用于连接多个节点（计算节点、物理主机或服务器等），所述综合网桥可以用于连接多个虚拟机。
所述虚拟网桥可以用于连接所述综合网桥和多个虚拟机，且可以通过加载安全组件实现防火墙的功能。
在一具体实施例中，可以通过所述目标虚拟主机的MAC地址查找与所述目标虚拟主机连接的综合网桥，通过所述综合网桥查找所述目标节点。
例如，在代理服务器所在的网络中广播目的地为目标虚拟主机a的MAC地址的UDP报文。接收返回的UDP报文，从返回的UDP报文中获取与目标虚拟主机a连接的综合网桥。获取综合网桥-目标节点映射表，通过查所述综合网桥-目标节点映射表查找与目标虚拟主机a连接的综合网桥对应的目标节点。
在另一实施例中，可以通过存储的虚拟机的位置信息查找所述目标虚拟主机所属的目标节点。
103，在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具。
在一具体实施例中，可以根据所述虚拟网桥的配置信息和所述扫描虚拟主机的配置信息生成可运行脚本，将所述可运行脚本下发至所述目标节点，使所述目标节点执行所述可运行节点，以创建与所述虚拟网桥连接的扫描虚拟主机。
在另一实施例中，可以通过调用所述目标节点的创建接口实现创建与所述虚拟网桥连接的扫描虚拟主机。
104，获取所述虚拟网桥对所述扫描虚拟主机的通信授权。
在对所述目标虚拟虚拟机进行扫描之前，需要获取所述虚拟网桥对所述扫描虚拟主机的通信授权，若所述虚拟网桥没有对所述扫描虚拟主机进行通信授权，所述扫描虚拟主机不能通过所述虚拟网桥与所述目标虚拟主机进行通信，所述扫描虚拟主机也就不能对所述目标虚拟机进行漏洞扫描。
在一具体实施例中，所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权包括：
根据所述扫描虚拟主机的MAC地址生成授权网络控制列表；
将所述授权网络控制列表下发至所述虚拟网桥，使所述虚拟网桥将所述授权网络控制列表存储至本地网络控制列表。
所述授权网络控制列表中记录了网络控制规则，所述虚拟网桥可以根据所述网络控制规则对所述虚拟网桥接收到的报文进行网络控制。例如，所述虚拟网桥根据所述本地网络控制列表对接收到的报文进行接收、转发、丢弃、广播等网络控制。
例如，根据描虚拟主机的MAC地址生成授权网络控制列表，描虚拟主机的MAC地址为“123.125.71.60”，数据网络控制列表中记录的网络控制规则为“iptables -A INPUT -i veth_1 -s 123.125.71.60 -p tcp -sport 60 -j ACCEPT”。可以通过扫描虚拟主机的远程控制接口将授权网络控制列表下发至所述虚拟网桥。
在另一实施例中，所述扫描虚拟主机包括扫描接口，所述扫描虚拟主机的MAC地址可以是所述扫描接口的MAC地址。
105，调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接。
在对所述目标虚拟虚拟机进行扫描之前，可以断开所述虚拟网桥与所述综合网桥的连接，即使得所述虚拟网桥不能与综合网桥连接的其他虚拟主机和/或计算节点进行通信，避免对所述目标虚拟虚拟机的扫描过程对其他虚拟主机和/或计算节点产生干扰。
所述调整所述虚拟网桥对所述综合网桥的通信授权包括：
获取所述综合网桥的MAC地址；
根据所述综合网桥的MAC地址生成禁权网络控制列表；
将所述禁权网络控制列表下发至所述虚拟网桥，使所述虚拟网桥将所述禁权网络控制列表存储至本地网络控制列表。
例如，通过向所述目标虚拟主机发送探测请求的方式接收所述目标虚拟主机的报文，从所述目标虚拟主机返回的报文中获取所述综合网桥的MAC地址。根据描虚拟主机的MAC地址生成授权网络控制列表，描虚拟主机的MAC地址为“123.125.71.61”，数据网络控制列表中记录的网络控制规则为“iptables -A INPUT -i veth_1 -s 123.125.71.61 -p tcp -sport 62 -j DROP”、“iptables -A OUT -i veth_1 -s 123.125.71.61 -p tcp -sport 62 -j DROP”。可以通过扫描虚拟主机的远程控制接口将禁权网络控制列表下发至所述虚拟网桥。
106，调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
在一具体实施例中，可以通过扫描虚拟主机的远程控制接口调用所述扫描虚拟主机的扫描工具，所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
可以获取所述扫描虚拟主机的扫描工具输出的扫描结果。所述扫描结果可以包括扫描到的所述目标虚拟主机的漏洞或所述目标虚拟主机无漏洞。
实施例一的漏洞扫描方法确定待扫描的目标虚拟主机；查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；获取所述虚拟网桥对所述扫描虚拟主机的通信授权；调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。实施例一扫描了目标虚拟主机的漏洞，减小了扫描过程对网络的影响。
在另一实施例中，在所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权之前，所述方法还包括：获取对所述目标虚拟主机进行扫描的权限。
可以在所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权之前，验证对所述目标虚拟主机进行扫描的权限；若没有对所述目标虚拟主机进行扫描的权限，向所述目标虚拟主机或所述目标节点请求对所述目标虚拟主机进行扫描的权限。
在另一实施例中，所述方法还包括：
接收所述扫描虚拟主机返回的扫描日志。
所述扫描日志可以包括多次漏洞扫描过程中扫描到的所述目标虚拟主机的漏洞。
在另一实施例中，所述扫描虚拟主机包括远程控制接口，所述代理服务器可以通过所述远程控制接口调用所述扫描虚拟主机的扫描工具。
在另一实施例中，在所述调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描之后，所述方法还包括：
恢复所述虚拟网桥对所述综合网桥的通信授权。恢复所述虚拟网桥对所述综合网桥的通信授权可以开启所述虚拟网桥与所述综合网桥的通信通道。
实施例二
图2是本申请实施例二提供的漏洞扫描装置的结构图。所述漏洞扫描装置20应用于网络中的代理服务器，所述网络包括一个或多个节点，每个节点上运行一个或多个虚拟主机，所述节点可以是计算节点（物理主机）、云服务器等。本装置的漏洞扫描是扫描目标虚拟主机的漏洞。如图2所示，所述漏洞扫描装置20可以包括确定模块201、查找模块202、创建模块203、获取模块204、调整模块205、调用模块206。
确定模块201，用于确定待扫描的目标虚拟主机。
在一具体实施例中，可以接收代理服务器所在的网络中的节点发出的虚拟机扫描请求，将所述虚拟机扫描请求中的虚拟主机确定为所述目标虚拟主机。
例如，可以接收所述代理服务器所在的网络中的节点A发出的虚拟机扫描请求，所述虚拟机扫描请求可以是UDP（用户数据报协议，User Datagram Protocol）报文，将所述虚拟机扫描请求中的虚拟主机a确定为目标虚拟主机。
所述虚拟机扫描请求也可以包括多个虚拟主机，以将多个虚拟主机确定为目标虚拟主机。所述代理服务器所在的网络中的节点可以在向所述虚拟机扫描请求中添加虚拟主机之前，验证预添加的虚拟主机停止执行运行于该虚拟主机的任务，使运行于该虚拟主机的任务避免受漏洞扫描的干扰。
在另一实施例中，可以读取本地数据库中存储的虚拟主机信息，周期性地将所述虚拟主机信息中的虚拟机确定为所述目标主机。
例如，读取本地数据库中存储的三个虚拟主机信息（虚拟主机b的MAC（Media Access Control Address）地址、虚拟主机c的MAC地址、虚拟主机d的虚拟主机号），每间隔一天将虚拟机b、虚拟主机c、虚拟主机d确定为所述目标主机。其中，MAC地址可以是虚拟主机的唯一标识。
查找模块202，用于查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接。
所述综合网桥可以类比为交换机，交换机可以用于连接多个节点（计算节点、物理主机或服务器等），所述综合网桥可以用于连接多个虚拟机。
所述虚拟网桥可以用于连接所述综合网桥和多个虚拟机，且可以通过加载安全组件实现防火墙的功能。
在一具体实施例中，可以通过所述目标虚拟主机的MAC地址查找与所述目标虚拟主机连接的综合网桥，通过所述综合网桥查找所述目标节点。
例如，在代理服务器所在的网络中广播目的地为目标虚拟主机a的MAC地址的UDP报文。接收返回的UDP报文，从返回的UDP报文中获取与目标虚拟主机a连接的综合网桥。获取综合网桥-目标节点映射表，通过查所述综合网桥-目标节点映射表查找与目标虚拟主机a连接的综合网桥对应的目标节点。
在另一实施例中，可以通过存储的虚拟机的位置信息查找所述目标虚拟主机所属的目标节点。
创建模块203，用于在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具。
在一具体实施例中，可以根据所述虚拟网桥的配置信息和所述扫描虚拟主机的配置信息生成可运行脚本，将所述可运行脚本下发至所述目标节点，使所述目标节点执行所述可运行节点，以创建与所述虚拟网桥连接的扫描虚拟主机。
在另一实施例中，可以通过调用所述目标节点的创建接口实现创建与所述虚拟网桥连接的扫描虚拟主机。
获取模块204，用于获取所述虚拟网桥对所述扫描虚拟主机的通信授权。
在对所述目标虚拟虚拟机进行扫描之前，需要获取所述虚拟网桥对所述扫描虚拟主机的通信授权，若所述虚拟网桥没有对所述扫描虚拟主机进行通信授权，所述扫描虚拟主机不能通过所述虚拟网桥与所述目标虚拟主机进行通信，所述扫描虚拟主机也就不能对所述目标虚拟机进行漏洞扫描。
在一具体实施例中，所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权包括：
根据所述扫描虚拟主机的MAC地址生成授权网络控制列表；
将所述授权网络控制列表下发至所述虚拟网桥，使所述虚拟网桥将所述授权网络控制列表存储至本地网络控制列表。
所述授权网络控制列表中记录了网络控制规则，所述虚拟网桥可以根据所述网络控制规则对所述虚拟网桥接收到的报文进行网络控制。例如，所述虚拟网桥根据所述本地网络控制列表对接收到的报文进行接收、转发、丢弃、广播等网络控制。
例如，根据描虚拟主机的MAC地址生成授权网络控制列表，描虚拟主机的MAC地址为“123.125.71.60”，数据网络控制列表中记录的网络控制规则为“iptables -A INPUT -i veth_1 -s 123.125.71.60 -p tcp -sport 60 -j ACCEPT”。可以通过扫描虚拟主机的远程控制接口将授权网络控制列表下发至所述虚拟网桥。
在另一实施例中，所述扫描虚拟主机包括扫描接口，所述扫描虚拟主机的MAC地址可以是所述扫描接口的MAC地址。
调整模块205，用于调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接。
在对所述目标虚拟虚拟机进行扫描之前，可以断开所述虚拟网桥与所述综合网桥的连接，即使得所述虚拟网桥不能与综合网桥连接的其他虚拟主机和/或计算节点进行通信，避免对所述目标虚拟虚拟机的扫描过程对其他虚拟主机和/或计算节点产生干扰。
所述调整所述虚拟网桥对所述综合网桥的通信授权包括：
获取所述综合网桥的MAC地址；
根据所述综合网桥的MAC地址生成禁权网络控制列表；
将所述禁权网络控制列表下发至所述虚拟网桥，使所述虚拟网桥将所述禁权网络控制列表存储至本地网络控制列表。
例如，通过向所述目标虚拟主机发送探测请求的方式接收所述目标虚拟主机的报文，从所述目标虚拟主机返回的报文中获取所述综合网桥的MAC地址。根据描虚拟主机的MAC地址生成授权网络控制列表，描虚拟主机的MAC地址为“123.125.71.61”，数据网络控制列表中记录的网络控制规则为“iptables -A INPUT -i veth_1 -s 123.125.71.61 -p tcp -sport 62 -j DROP”、“iptables -A OUT -i veth_1 -s 123.125.71.61 -p tcp -sport 62 -j DROP”。可以通过扫描虚拟主机的远程控制接口将禁权网络控制列表下发至所述虚拟网桥。
调用模块206，用于调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
在一具体实施例中，可以通过扫描虚拟主机的远程控制接口调用所述扫描虚拟主机的扫描工具，所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
可以获取所述扫描虚拟主机的扫描工具输出的扫描结果。所述扫描结果可以包括扫描到的所述目标虚拟主机的漏洞或所述目标虚拟主机无漏洞。
实施例二的漏洞扫描装置20确定待扫描的目标虚拟主机；查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；获取所述虚拟网桥对所述扫描虚拟主机的通信授权；调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。实施例二扫描了目标虚拟主机的漏洞，减小了扫描过程对网络的影响。
在另一实施例中，所述获取模块还用于在所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权之前，获取对所述目标虚拟主机进行扫描的权限。
可以在所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权之前，验证对所述目标虚拟主机进行扫描的权限；若没有对所述目标虚拟主机进行扫描的权限，向所述目标虚拟主机或所述目标节点请求对所述目标虚拟主机进行扫描的权限。
在另一实施例中，所述漏洞扫描装置20还可以包括：接收模块，用于接收所述扫描虚拟主机返回的扫描日志。
所述扫描日志可以包括多次漏洞扫描过程中扫描到的所述目标虚拟主机的漏洞。
在另一实施例中，所述扫描虚拟主机包括远程控制接口，所述调用模块还用于通过所述远程控制接口调用所述扫描虚拟主机的扫描工具。
在另一实施例中，所述漏洞扫描装置20还可以包括：恢复模块，用于在所述调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描之后，恢复所述虚拟网桥对所述综合网桥的通信授权。
恢复所述虚拟网桥对所述综合网桥的通信授权可以开启所述虚拟网桥与所述综合网桥的通信通道。
实施例三
本实施例提供一种计算机存储介质，该计算机可读存储介质可以是易失性的，也可以是非易失性的，该计算机存储介质上存储有计算机程序，该计算机程序被处理器执行时实现上述漏洞扫描方法实施例中的步骤，例如图1所示的101-106：
101，确定待扫描的目标虚拟主机；
102，查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
103，在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
104，获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
105，调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
106，调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
或者，该计算机程序被处理器执行时实现上述装置实施例中各模块的功能，例如图2中的模块201-206：
确定模块201，用于确定待扫描的目标虚拟主机；
查找模块202，用于查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
创建模块203，用于在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
获取模块204，用于获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
调整模块205，用于调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
调用模块206，用于调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
实施例四
图3为本申请实施例四提供的计算机装置的示意图。所述计算机装置30包括存储器301、处理器302以及存储在所述存储器301中并可在所述处理器302上运行的计算机程序303，例如漏洞扫描程序。所述处理器302执行所述计算机程序303时实现上述漏洞扫描方法实施例中的步骤，例如图1所示的101-106：
101，确定待扫描的目标虚拟主机；
102，查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
103，在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
104，获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
105，调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
106，调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
或者，该计算机程序被处理器执行时实现上述装置实施例中各模块的功能，例如图2中的模块201-206：
确定模块201，用于确定待扫描的目标虚拟主机；
查找模块202，用于查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
创建模块203，用于在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
获取模块204，用于获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
调整模块205，用于调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
调用模块206，用于调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
示例性的，所述计算机程序303可以被分割成一个或多个模块，所述一个或者多个模块被存储在所述存储器301中，并由所述处理器302执行，以完成本方法。所述一个或多个模块可以是能够完成特定功能的一系列计算机程序指令段，该指令段用于描述所述计算机程序303在所述计算机装置30中的执行过程。例如，所述计算机程序303可以被分割成图2中的确定模块201、查找模块202、创建模块203、获取模块204、调整模块205、调用模块206，各模块具体功能参见实施例二。
所述计算机装置30可以是桌上型计算机、笔记本、掌上电脑及云端服务器等计算设备。本领域技术人员可以理解，所述示意图3仅仅是计算机装置30的示例，并不构成对计算机装置30的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件，例如所述计算机装置30还可以包括输入输出设备、网络接入设备、总线等。
所称处理器302可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器302也可以是任何常规的处理器等，所述处理器302是所述计算机装置30的控制中心，利用各种接口和线路连接整个计算机装置30的各个部分。
所述存储器301可用于存储所述计算机程序303，所述处理器302通过运行或执行存储在所述存储器301内的计算机程序或模块，以及调用存储在存储器301内的数据，实现所述计算机装置30的各种功能。所述存储器301可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序（比如声音播放功能、图像播放功能等）等；存储数据区可存储根据计算机装置30的使用所创建的数据（比如音频数据等）等。此外，存储器301可以包括非易失性存储器，例如硬盘、内存、插接式硬盘，智能存储卡（Smart Media Card， SMC），安全数字（Secure Digital， SD）卡，闪存卡（Flash Card）、至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。
所述计算机装置30集成的模块如果以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实现上述实施例方法中的全部或部分流程，也可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一计算机存储介质中，该计算机程序在被处理器执行时，可实现上述各个方法实施例的步骤。其中，所述计算机程序包括计算机程序代码，所述计算机程序代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质可以包括：能够携带所述计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器（ROM，Read-Only Memory）。
在另一实施例中，本申请所提供的漏洞扫描方法，为进一步保证上述所有出现的数据的私密和安全性，上述所有数据还可以存储于一区块链的节点中。例如网络控制列表及扫描日志等等，这些数据均可存储在区块链节点中。
需要说明的是，本发明所指区块链是分布式数据存储、点对点传输、共识机制、加密算法等计算机技术的新型应用模式
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理模块，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用硬件加软件功能模块的形式实现。
上述以软件功能模块的形式实现的集成的模块，可以存储在一个计算机可读取存储介质中。上述软件功能模块存储在一个存储介质中，包括若干指令用以使得一台计算机设备（可以是个人计算机，服务器，或者网络设备等）或处理器（processor）执行本申请各个实施例所述方法的部分步骤。
对于本领域技术人员而言，显然本申请不限于上述示范性实施例的细节，而且在不背离本申请的精神或基本特征的情况下，能够以其他的具体形式实现本申请。因此，无论从哪一点来看，均应将实施例看作是示范性的，而且是非限制性的，本申请的范围由所附权利要求而不是上述说明限定，因此旨在将落在权利要求的等同要件的含义和范围内的所有变化涵括在本申请内。不应将权利要求中的任何附关联图标记视为限制所涉及的权利要求。此外，显然“包括”一词不排除其他模块或步骤，单数不排除复数。系统权利要求中陈述的多个模块或装置也可以由一个模块或装置通过软件或者硬件来实现。第一，第二等词语用来表示名称，而并不表示任何特定的顺序。
最后应说明的是，以上实施例仅用以说明本申请的技术方案而非限制，尽管参照较佳实施例对本申请进行了详细说明，本领域的普通技术人员应当理解，可以对本申请的技术方案进行修改或等同替换，而不脱离本申请技术方案的精神和范围。

Claims (20)

  1. 一种漏洞扫描方法，其中，所述方法包括：
    确定待扫描的目标虚拟主机；
    查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
    在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
    获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
    调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
    调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
  2. 如权利要求1所述的方法，其中，所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权包括：
    根据所述扫描虚拟主机的MAC地址生成授权网络控制列表；
    将所述授权网络控制列表下发至所述虚拟网桥，使所述虚拟网桥将所述授权网络控制列表存储至本地网络控制列表。
  3. 如权利要求1所述的方法，其中，所述调整所述虚拟网桥对所述综合网桥的通信授权包括：
    获取所述综合网桥的MAC地址；
    根据所述综合网桥的MAC地址生成禁权网络控制列表；
    将所述禁权网络控制列表下发至所述虚拟网桥，使所述虚拟网桥将所述禁权网络控制列表存储至本地网络控制列表。
  4. 如权利要求1-3中任一项所述的方法，其中，在所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权之前，所述方法还包括：
    获取对所述目标虚拟主机进行扫描的权限。
  5. 如权利要求1-3中任一项所述的方法，其中，所述方法还包括：
    接收所述扫描虚拟主机返回的扫描日志。
  6. 如权利要求1-3中任一项所述的方法，其中，所述扫描虚拟主机包括远程控制接口，所述方法还包括：
    代理服务器通过所述远程控制接口调用所述扫描虚拟主机的扫描工具。
  7. 如权利要求1-3中任一项所述的方法，其中，在所述调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描之后，所述方法还包括：
    恢复所述虚拟网桥对所述综合网桥的通信授权。
  8. 一种漏洞扫描装置，其中，所述装置包括：
    确定模块，用于确定待扫描的目标虚拟主机；
    查找模块，用于查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
    创建模块，用于在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
    获取模块，用于获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
    调整模块，用于调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
    调用模块，用于调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
  9. 一种计算机装置，其中，所述计算机装置包括处理器，所述处理器用于执行存储器中存储的计算机程序以实现如下步骤：
    确定待扫描的目标虚拟主机；
    查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
    在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
    获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
    调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
    调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
  10. 如权利要求9所述的计算机装置，其中，所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权包括：
    根据所述扫描虚拟主机的MAC地址生成授权网络控制列表；
    将所述授权网络控制列表下发至所述虚拟网桥，使所述虚拟网桥将所述授权网络控制列表存储至本地网络控制列表。
  11. 如权利要求9所述的计算机装置，其中，所述调整所述虚拟网桥对所述综合网桥的通信授权包括：
    获取所述综合网桥的MAC地址；
    根据所述综合网桥的MAC地址生成禁权网络控制列表；
    将所述禁权网络控制列表下发至所述虚拟网桥，使所述虚拟网桥将所述禁权网络控制列表存储至本地网络控制列表。
  12. 如权利要求9-11中任一项所述的计算机装置，其中，在所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权之前，所述处理器用于执行存储器中存储的计算机程序还实现如下步骤：
    获取对所述目标虚拟主机进行扫描的权限。
  13. 如权利要求9-11中任一项所述的计算机装置，其中，所述处理器用于执行存储器中存储的计算机程序还实现如下步骤：
    接收所述扫描虚拟主机返回的扫描日志。
  14. 如权利要求9-11中任一项所述的计算机装置，其中，所述扫描虚拟主机包括远程控制接口，所述处理器用于执行存储器中存储的计算机程序还实现如下步骤：
    代理服务器通过所述远程控制接口调用所述扫描虚拟主机的扫描工具。
  15. 如权利要求9-11中任一项所述的计算机装置，其中，在所述调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描之后，所述处理器用于执行存储器中存储的计算机程序还实现如下步骤：
    恢复所述虚拟网桥对所述综合网桥的通信授权。
  16. 一种计算机存储介质，所述计算机存储介质上存储有计算机程序，其中，所述计算机程序被处理器执行时实现如下步骤：
    确定待扫描的目标虚拟主机；
    查找所述目标虚拟主机所属的目标节点，所述目标虚拟主机通过虚拟网桥与所述目标节点中的综合网桥连接；
    在所述目标节点上创建与所述虚拟网桥连接的扫描虚拟主机，所述扫描虚拟主机载有扫描工具；
    获取所述虚拟网桥对所述扫描虚拟主机的通信授权；
    调整所述虚拟网桥对所述综合网桥的通信授权，使所述虚拟网桥断开与所述综合网桥的连接；
    调用所述扫描虚拟主机的扫描工具通过所述虚拟网桥对所述目标虚拟机进行漏洞扫描。
  17. 如权利要求16所述的计算机存储介质，其中，所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权包括：
    根据所述扫描虚拟主机的MAC地址生成授权网络控制列表；
    将所述授权网络控制列表下发至所述虚拟网桥，使所述虚拟网桥将所述授权网络控制列表存储至本地网络控制列表。
  18. 如权利要求16所述的计算机存储介质，其中，所述调整所述虚拟网桥对所述综合网桥的通信授权包括：
    获取所述综合网桥的MAC地址；
    根据所述综合网桥的MAC地址生成禁权网络控制列表；
    将所述禁权网络控制列表下发至所述虚拟网桥，使所述虚拟网桥将所述禁权网络控制列表存储至本地网络控制列表。
  19. 如权利要求16-18中任一项所述的计算机存储介质，其中，在所述获取所述虚拟网桥对所述扫描虚拟主机的通信授权之前，所述计算机程序被处理器执行时还实现如下步骤：
    获取对所述目标虚拟主机进行扫描的权限。
  20. 如权利要求16-18中任一项所述的计算机存储介质，其中，所述计算机程序被处理器执行时还实现如下步骤：
    接收所述扫描虚拟主机返回的扫描日志。
PCT/CN2020/119059 2020-03-18 2020-09-29 漏洞扫描方法、装置、计算机装置及计算机存储介质 WO2021184726A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010193479.0A CN111585949B (zh) 2020-03-18 2020-03-18 漏洞扫描方法及相关设备
CN202010193479.0 2020-03-18

Publications (1)

Publication Number Publication Date
WO2021184726A1 true WO2021184726A1 (zh) 2021-09-23

Family

ID=72124841

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/119059 WO2021184726A1 (zh) 2020-03-18 2020-09-29 漏洞扫描方法、装置、计算机装置及计算机存储介质

Country Status (2)

Country Link
CN (1) CN111585949B (zh)
WO (1) WO2021184726A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111585949B (zh) * 2020-03-18 2023-04-07 平安科技（深圳）有限公司 漏洞扫描方法及相关设备
CN112235300B (zh) * 2020-10-14 2023-10-24 腾讯科技（深圳）有限公司 云虚拟网络漏洞检测方法、系统、装置及电子设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150317169A1 (en) * 2014-05-04 2015-11-05 Midfin Systems Inc. Constructing and operating high-performance unified compute infrastructure across geo-distributed datacenters
CN105095023A (zh) * 2015-08-18 2015-11-25 北京皮尔布莱尼软件有限公司 一种云主机创建装置、方法和计算设备
CN109168185A (zh) * 2018-11-12 2019-01-08 杭州安恒信息技术股份有限公司 一种基于网络命名空间的网络扫描方法及装置
CN109639705A (zh) * 2018-12-27 2019-04-16 成都国信安信息产业基地有限公司 云平台安全检测方法
CN110855796A (zh) * 2019-11-22 2020-02-28 北京浪潮数据技术有限公司 一种云平台web防护方法、系统、设备及计算机介质
CN111585949A (zh) * 2020-03-18 2020-08-25 平安科技（深圳）有限公司 漏洞扫描方法及相关设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8438270B2 (en) * 2010-01-26 2013-05-07 Tenable Network Security, Inc. System and method for correlating network identities and addresses
CN103825891B (zh) * 2014-02-19 2017-04-26 曙光云计算技术有限公司 云网络环境下的安全漏洞扫描系统
CN106559391B (zh) * 2015-09-28 2021-01-01 中国移动通信集团公司 一种漏洞扫描的方法及装置
US10320750B1 (en) * 2016-03-30 2019-06-11 Amazon Technologies, Inc. Source specific network scanning in a distributed environment
CN106845215B (zh) * 2016-12-30 2020-04-14 北京瑞星网安技术股份有限公司 基于虚拟化环境下的安全防护方法及装置
CN107171979A (zh) * 2017-06-30 2017-09-15 广州市品高软件股份有限公司 基于云计算和sdn的漏洞扫描方法及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150317169A1 (en) * 2014-05-04 2015-11-05 Midfin Systems Inc. Constructing and operating high-performance unified compute infrastructure across geo-distributed datacenters
CN105095023A (zh) * 2015-08-18 2015-11-25 北京皮尔布莱尼软件有限公司 一种云主机创建装置、方法和计算设备
CN109168185A (zh) * 2018-11-12 2019-01-08 杭州安恒信息技术股份有限公司 一种基于网络命名空间的网络扫描方法及装置
CN109639705A (zh) * 2018-12-27 2019-04-16 成都国信安信息产业基地有限公司 云平台安全检测方法
CN110855796A (zh) * 2019-11-22 2020-02-28 北京浪潮数据技术有限公司 一种云平台web防护方法、系统、设备及计算机介质
CN111585949A (zh) * 2020-03-18 2020-08-25 平安科技（深圳）有限公司 漏洞扫描方法及相关设备

Also Published As

Publication number Publication date
CN111585949A (zh) 2020-08-25
CN111585949B (zh) 2023-04-07

Similar Documents

Publication Publication Date Title
US20210344692A1 (en) Providing a virtual security appliance architecture to a virtual cloud infrastructure
US20210119961A1 (en) Resolution of domain name requests in heterogeneous network environments
US8937960B2 (en) Managing communications for modified computer networks
RU2707717C2 (ru) Мобильная аутентификация в мобильной виртуальной сети
US10776489B2 (en) Methods and systems for providing and controlling cryptographic secure communications terminal operable to provide a plurality of desktop environments
US20130107889A1 (en) Distributed Address Resolution Service for Virtualized Networks
US11552953B1 (en) Identity-based authentication and access control mechanism
US8949411B2 (en) Determining whether a device is inside a network
US11063923B2 (en) Authenticator plugin interface
CN111585887B (zh) 基于多个网络的通信方法、装置、电子设备及存储介质
WO2021184726A1 (zh) 漏洞扫描方法、装置、计算机装置及计算机存储介质
US11627158B2 (en) Mitigation of route hijacking techniques in a network
CN110661710B (zh) 一种虚拟化系统的报文传输方法及装置
US11757827B2 (en) Network security from host and network impersonation
US9473518B2 (en) Securing network communications with logical partitions
WO2021241828A1 (ko) 가상머신을 제공하는 방법 및 장치
US20230188338A1 (en) Limiting use of encryption keys in an integrated circuit device
US20240223440A1 (en) Synchronizing communication channel state information for high flow availability
WO2023216584A1 (zh) 一种获得应用感知网络标识的方法及相关设备
US20240069909A1 (en) Software bill of materials handshake for cloud-based code execution
CN117155694A (zh) 一种私有云防火墙配置的方法及设备
JP2002199003A (ja) 移動端末位置登録方法及びその実施装置
CN112182530A (zh) 通过主控系统控制操作系统权限的方法及装置
CN116260600A (zh) 网络地址识别方法、装置及系统
CN111726236A (zh) 一种状态识别信息生成方法、系统、装置及其存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20925356

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20925356

Country of ref document: EP

Kind code of ref document: A1