A secure access control method, device and system based on cloud environment

Abstract

The present invention discloses a secure access control method based on a cloud environment, which obtains the mirror traffic of a business virtual machine through the API of a cloud management platform, and sends the mirror traffic to a cloud security audit virtual machine. The process does not require changes to the network environment and architecture of the business virtual machine, and the process only requires calling the API of the cloud management platform, thereby achieving secure access control through the cloud security audit virtual machine without changing the network architecture of the business host on the cloud. The present invention also provides a secure access control device based on a cloud environment and a secure access control system based on a cloud environment, which also have the above-mentioned beneficial effects.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a cloud environment-based security access control method, a cloud environment-based security access control device, and a cloud environment-based security access control system. Background Art

[0002] With the vigorous development of cloud computing, the establishment of cloud data centers has become a general trend. However, faced with the increasing amount of data and increasingly difficult-to-detect virus threats in the cloud environment, traditional equipment often finds it difficult to meet security requirements while ensuring performance requirements. At present, major manufacturers have launched their own cloud security products to enable cloud security capabilities, but the security products on the market still follow the architectural logic of traditional security products. Most of them are just virtualization, and do not propose targeted solutions based on some characteristics of the cloud environment. At the same time, security vendors are unable to transform the cloud network environment, resulting in the difficulty of implementing security capabilities in the cloud network environment. How to make good use of the characteristics of the cloud environment to protect the security of the cloud environment has become a hot topic in the industry.

[0003] After actual investigation, we found that there are a large number of cloud security products of different models and types from different manufacturers on the market. However, they are all software products that are independently deployed in the cloud environment. Generally, it is necessary to directly mount the virtual machine on the cloud security product, or to pull the traffic to the cloud security product to identify and protect against network threats. This security product deployment method is relatively complex, and the network changes to the cloud business host are relatively large; once the cloud security product goes down, it is difficult to achieve business migration; in addition, the original security capability resources of the cloud platform are not fully utilized, resulting in a certain degree of duplication. Therefore, how to provide a security access control solution that is simple to deploy and does not require changes to the network architecture of the cloud business host is an urgent problem that technicians in this field need to solve. Summary of the invention

[0004] An object of the present invention is to provide a cloud environment-based security access control method, which can realize security access control without changing the network architecture of the cloud business host; another object of the present invention is to provide a cloud environment-based security access control device and a cloud environment-based security access control system, which can realize security access control without changing the network architecture of the cloud business host.

[0005] In order to solve the above technical problems, the present invention provides a cloud environment-based security access control method, which is applied to a cloud security audit virtual machine, comprising:

[0006] Obtain the image traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform;

[0007] Auditing the mirrored traffic;

[0008] When the mirror traffic is abnormal, the API of the cloud management platform is called to send a security group policy to the network space where the business virtual machine corresponding to the abnormal mirror traffic is located, so as to control the traffic of the business virtual machine through the security group policy.

[0009] Optionally, the cloud security audit virtual machine is set in a separate logically isolated network space.

[0010] Optionally, obtaining the mirror traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform includes:

[0011] When the business virtual machine initiates a link to the outside, the mirror traffic of the business virtual machine is obtained at the virtual network layer through the API of the cloud management platform.

[0012] Optionally, the auditing the mirrored traffic includes:

[0013] The feature library set in the cloud security audit virtual machine is called, and the connection behavior feature when the business virtual machine initiates a link externally is used as an index to audit the mirror traffic.

[0014] Optionally, the connection behavior feature includes any one or any combination of the following:

[0015] Time characteristics, flow characteristics, and frequency characteristics.

[0016] Optionally, the auditing the mirrored traffic includes:

[0017] The feature library set in the cloud security audit virtual machine is called, and the mirror traffic is audited by taking the data content sent after the business virtual machine initiates a link externally as an index.

[0018] Optionally, the data content includes any one or any combination of the following:

[0019] Message header, external connection address and port.

[0020] Optionally, when the mirrored traffic is abnormal, calling the API of the cloud management platform to issue a security group policy to the network space where the business virtual machine corresponding to the abnormal mirrored traffic is located, so as to control the traffic of the business virtual machine through the security group policy includes:

[0021] When the mirrored traffic is in the first state, maintaining the link initiated externally by the business virtual machine;

[0022] When the mirrored traffic is in the second state, the API of the cloud management platform is called to issue a security group policy to the network space where the business virtual machine corresponding to the mirrored traffic in the second state is located, so as to block the traffic data sent by the business virtual machine through the security group policy;

[0023] When the mirrored traffic is in the third state, repeat the step of auditing the mirrored traffic until the mirrored traffic is in the first state or the second state.

[0024] The present invention also provides a cloud environment-based security access control device, which is applied to a cloud security audit virtual machine, comprising:

[0025] The acquisition module is used to obtain the image traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform;

[0026] An audit module, used for auditing the mirrored traffic;

[0027] The control module is used to call the API of the cloud management platform when the mirror traffic is abnormal, and send a security group policy to the network space where the business virtual machine corresponding to the abnormal mirror traffic is located, so as to control the traffic of the business virtual machine through the security group policy.

[0028] The present invention also provides a cloud environment-based security access control system, including a cloud management platform, a cloud security audit virtual machine and a business virtual machine, wherein the cloud management platform is communicatively connected to the cloud security audit virtual machine, and the cloud management platform is communicatively connected to the business virtual machine;

[0029] The cloud security audit virtual machine is used for:

[0030] Obtain the mirror traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform;

[0031] Auditing the mirrored traffic;

[0032] When the mirror traffic is abnormal, the API of the cloud management platform is called to send a security group policy to the network space where the business virtual machine corresponding to the abnormal mirror traffic is located, so as to control the traffic of the business virtual machine through the security group policy.

[0033] A cloud environment-based security access control method provided by the present invention is applied to cloud security audit virtual machines, including obtaining the mirror traffic of business virtual machines at the virtual network layer through the API of a cloud management platform; auditing the mirror traffic; when the mirror traffic is abnormal, calling the API of the cloud management platform to issue a security group policy to the network space where the business virtual machine corresponding to the abnormal mirror traffic is located, so as to control the traffic of the business virtual machine through the security group policy.

[0034] The mirror traffic of the business virtual machine is obtained through the API of the cloud management platform, and the mirror traffic is sent to the cloud security audit virtual machine. This process does not require changes to the network environment and architecture of the business virtual machine. The process only requires calling the API of the cloud management platform. In this way, secure access control can be achieved through the cloud security audit virtual machine without changing the network architecture of the business host on the cloud.

[0035] The present invention also provides a cloud environment-based security access control device and a cloud environment-based security access control system, which also have the above-mentioned beneficial effects and will not be described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions of the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 A flowchart of a cloud environment-based secure access control method provided by an embodiment of the present invention;

[0038] Figure 2 A flowchart of a specific cloud environment-based secure access control method provided by an embodiment of the present invention;

[0039] Figure 3 A structural block diagram of a cloud environment-based security access control device provided by an embodiment of the present invention;

[0040] Figure 4 A structural block diagram of a cloud environment-based security access control system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The core of the present invention is to provide a secure access control method based on a cloud environment. In the prior art, there are a large number of cloud security products of different models and types from different manufacturers on the market, but they are all software products independently deployed in the cloud environment. Generally, it is necessary to directly mount the virtual machine on the cloud security product, or to pull the traffic to the cloud security product to realize the identification and protection of network threats. This security product deployment method is relatively complicated, and the network changes to the business host on the cloud are relatively large; and once the cloud security product goes down, it is difficult to achieve business migration; in addition, it does not fully utilize the original security capability resources of the cloud platform, resulting in a certain degree of duplication.

[0042] The present invention provides a cloud environment-based security access control method, which is applied to cloud security audit virtual machines, including obtaining the mirror traffic of business virtual machines at the virtual network layer through the API of the cloud management platform; auditing the mirror traffic; when the mirror traffic is abnormal, calling the API of the cloud management platform to issue a security group policy to the network space where the business virtual machine corresponding to the abnormal mirror traffic is located, so as to control the traffic of the business virtual machine through the security group policy.

[0043] The mirror traffic of the business virtual machine is obtained through the API of the cloud management platform, and the mirror traffic is sent to the cloud security audit virtual machine. This process does not require changes to the network environment and architecture of the business virtual machine. The process only requires calling the API of the cloud management platform. In this way, secure access control can be achieved through the cloud security audit virtual machine without changing the network architecture of the business host on the cloud.

[0044] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0045] Please refer to Figure 1 , Figure 1 A flowchart of a cloud environment-based secure access control method provided by an embodiment of the present invention.

[0046] The following invention embodiment provides a cloud environment-based security access control method specifically applied to a cloud security audit virtual machine, which can audit the acquired traffic to determine whether there are anomalies in the traffic, such as information leakage caused by virus infection.

[0047] See also Figure 1 In an embodiment of the present invention, a cloud environment-based secure access control method includes:

[0048] S101: Obtain the mirror traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform.

[0049] The above cloud management platform is a cloud environment management platform. It manages the resources and environment required for application operation based on cloud API (Application Programming Interface), manages the OS (operating system) environment and applications of application operation through proxy or non-proxy methods, supports various public clouds, private clouds and traditional IT physical machines and virtual machines at the infrastructure layer, and supports various architecture applications running on IaaS (Infrastructure as a Service) or physical machines.

[0050] In an embodiment of the present invention, the cloud security audit virtual machine will specifically connect to the API corresponding to the cloud management platform, and the above-mentioned cloud management platform will mirror the business traffic generated by the business virtual machine connected to the cloud management platform through its own API to obtain mirrored traffic. Correspondingly, in this step, the cloud security audit virtual machine will directly obtain the above-mentioned mirrored traffic at the virtual network layer through the API of the cloud management platform in order to audit the mirrored traffic. It should be emphasized that, since in an embodiment of the present invention, the cloud security audit virtual machine will specifically connect to the API corresponding to the cloud management platform, therefore, in an embodiment of the present invention, specifically through the cloud management platform's own support for the API, the traffic is directly copied to the cloud security audit virtual machine at the overlay level, that is, the virtual network layer, without the need to directly connect to the SDN (Software Defined Network) switch.

[0051] In this step, the mirrored traffic obtained by the cloud security audit virtual machine is equivalent to the business traffic generated by the business virtual machine. It should be noted that since the cloud security audit virtual machine usually corresponds to multiple business virtual machines at the same time, the traffic of multiple business virtual machines is audited at the same time. Therefore, under normal circumstances, the above-mentioned mirrored traffic usually includes the identification information of the corresponding business virtual machine.

[0052] S102: Audit the mirrored traffic.

[0053] In this step, the cloud security audit virtual machine will audit the acquired mirror traffic to determine whether the corresponding business virtual machine is infected with malicious viruses. The specific process of the cloud security audit virtual machine auditing the mirror traffic will be described in detail in the following invention embodiments, and will not be repeated here.

[0054] S103: When the mirrored traffic is abnormal, the API of the cloud management platform is called to send a security group policy to the network space where the business virtual machine corresponding to the abnormal mirrored traffic is located, so as to control the traffic of the business virtual machine through the security group policy.

[0055] The above security group is a virtual firewall that is owned by the cloud and has state detection and packet filtering capabilities. It is used to divide security domains on the cloud. By configuring security group rules, that is, by issuing security group policies, you can control the inbound and outbound traffic of virtual machine instances in the security group. The network space where the above business virtual machines are located is the VPC where the business virtual machines are located. VPC is a customized logically isolated network space on the cloud. It is mainly a network-level function. Its purpose is to build an isolated virtual network environment on the cloud that can manage configurations and policies. You can customize network segment division, IP addresses, and routing policies in VPC, and implement multi-layer security protection through security groups and network ACLs (access control lists).

[0056] It should be noted that, as a preference, in an embodiment of the present invention, the cloud security audit virtual machine is set in a separate logically isolated network space. That is, the above-mentioned cloud security audit virtual machine is specifically set in a separate VPC. When the cloud security audit virtual machine is specifically set in a separate VPC, the traffic in other VPCs can be mirrored to the VPC where the cloud security audit virtual machine is located so that the cloud security audit virtual machine can audit the traffic of business virtual machines in different VPCs connected to the same cloud management platform. When the cloud security audit virtual machine and a business virtual machine are in the same VPC, the cloud security audit virtual machine can usually only audit the traffic of business virtual machines in the same VPC.

[0057] In this step, in this step, when the cloud security audit virtual machine detects that a certain mirror traffic is abnormal, it will call the corresponding API of the cloud management platform to send a security group policy to the network space where the corresponding business virtual machine is located, so as to control the traffic of the business virtual machine through the security group policy; that is, when the traffic of the business virtual machine in the cloud environment is mirrored to the cloud security audit virtual machine, the cloud security audit virtual machine can analyze the mirror traffic, set different level standards according to the analysis results, and then call the API of the cloud management platform to send a security group policy to the VPC where the business virtual machine is located, so as to achieve the effect of security control and dynamic protection. It should be noted that in the embodiment of the present invention, the cloud security audit virtual machine controls the traffic of the business virtual machine by calling the cloud platform API and using the VPC security policy to control the traffic at the overlay level.

[0058] A cloud environment-based security access control method provided by an embodiment of the present invention is applied to cloud security audit virtual machines, including obtaining the mirror traffic of business virtual machines at the virtual network layer through the API of a cloud management platform; auditing the mirror traffic; when the mirror traffic is abnormal, calling the API of the cloud management platform to issue a security group policy to the network space where the business virtual machine corresponding to the abnormal mirror traffic is located, so as to control the traffic of the business virtual machine through the security group policy.

[0059] The mirror traffic of the business virtual machine is obtained through the API of the cloud management platform, and the mirror traffic is sent to the cloud security audit virtual machine. This process does not require changes to the network environment and architecture of the business virtual machine. The process only requires calling the API of the cloud management platform. In this way, secure access control can be achieved through the cloud security audit virtual machine without changing the network architecture of the business host on the cloud.

[0060] The specific contents of the cloud environment-based secure access control method provided by the present invention will be described in detail in the following invention embodiments.

[0061] Please refer to Figure 2 , Figure 2 A flowchart of a specific cloud environment-based security access control method provided by an embodiment of the present invention.

[0062] See also Figure 2 In an embodiment of the present invention, a cloud environment-based secure access control method includes:

[0063] S201: When the business virtual machine initiates a connection to the outside, the mirror traffic of the business virtual machine is obtained at the virtual network layer through the API of the cloud management platform.

[0064] In this step, specifically, when the business virtual machine initiates a link to the outside, the cloud security audit virtual machine obtains the mirror traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform. Because when the business virtual machine leaks information due to virus infection, it needs to communicate with external terminals. Therefore, in this step, specifically, when a monitored business virtual machine initiates a link to the outside, the mirror traffic of the business virtual machine is obtained at the virtual network layer through the API of the cloud management platform. The rest of the content of this step has been introduced in detail in S101 of the above-mentioned invention embodiment, and will not be repeated here.

[0065] S202: Calling a feature library set in the cloud security audit virtual machine, using the connection behavior feature when the business virtual machine initiates an external link as an index, to audit the mirror traffic.

[0066] In an embodiment of the present invention, a feature library is provided in the cloud security audit virtual machine, and the feature library may specifically store connection behavior features of known viruses. When a host is infected with a virus, the data generated by the interaction between the server and the client, namely, C / S data, will usually be interacted through a TCP connection. In the interaction process, connection behavior will inevitably be generated, and the connection behavior has its own characteristics, namely, connection behavior characteristics. Specifically, in an embodiment of the present invention, the connection behavior characteristics generally include any one or any combination of the following: time characteristics, traffic characteristics, and frequency characteristics. Of course, in the embodiment of the present invention, there is no specific limitation on the connection behavior characteristics, and it depends on the specific circumstances.

[0067] In this step, the connection behavior characteristics of the mirrored traffic will be analyzed, and the corresponding pre-stored connection behavior characteristics will be retrieved from the feature library. If there are, it means that the connection initiated by the business virtual machine is caused by a virus and needs to be blocked in the subsequent steps.

[0068] It should be noted that for unknown, highly disguised virus abnormal external connections, in this step, since the above connection behavior characteristics usually include multiple parameters, when searching in the feature library according to each parameter in the connection behavior characteristics, the level corresponding to the current connection behavior can be specifically output, that is, the similarity between the current connection behavior and the known virus connection behavior can be output. The specific process of this similarity can refer to the existing technology and will not be repeated here. In the subsequent steps, the corresponding security group policy can be determined according to the similarity to perform targeted adjustments.

[0069] Furthermore, in an embodiment of the present invention, the connection behavior features of known viruses stored in the feature library can be updated in real time to ensure that abnormal connection behaviors can be effectively detected.

[0070] S203: Calling a feature library set in the cloud security audit virtual machine, using the data content sent after the business virtual machine initiates a link to the outside as an index, to audit the mirror traffic.

[0071] In an embodiment of the present invention, a feature library is provided in the cloud security audit virtual machine, and the feature library can specifically store external connection interaction data of known viruses. That is, in this step, after the business virtual machine establishes a link with the external client and sends data, the external connection interaction data sent during the link will be audited. Specifically, in the embodiment of the present invention, the data content generated during the external connection interaction may include any one or any combination of the following: message header, external connection address, and port. Of course, in the embodiment of the present invention, there is no specific limitation on the data content, depending on the specific situation. In this step, the cloud security audit virtual machine will specifically analyze the data content generated by the external connection of the corresponding business virtual machine from the mirrored traffic, and compare the data content with the external connection interaction data of known viruses stored in the feature library, so as to effectively identify abnormal external connections of viruses.

[0072] Consistent with the above S202, in this step, the level corresponding to the current data content can be specifically output, that is, the similarity between the current data content and the known virus sending data can be output. The specific process of the similarity can refer to the prior art and will not be repeated here. In the subsequent steps, the corresponding security group policy can be determined according to the similarity to perform targeted adjustments.

[0073] Furthermore, in an embodiment of the present invention, the connection behavior features of known viruses stored in the feature library can be updated in real time to ensure that abnormal connection behaviors can be effectively detected.

[0074] It should be noted that there is no clear order between this step and the above S202, and it can be executed in parallel or any one of the steps can be executed first, depending on the specific situation, and no specific limitation is made here. At the same time, in the embodiment of the present invention, S202 and S203 can also be executed one by one, without having to execute both steps at the same time. The specific content is determined by the specific situation and is specifically limited here.

[0075] S204: When the mirrored traffic is in the first state, the link initiated externally by the service virtual machine is maintained.

[0076] Specifically, in this step, when it is determined through S202 and S203 that the acquired mirrored traffic is in the first state, ie, a safe green state, it is necessary to maintain the link initiated externally by the business virtual machine corresponding to the mirrored traffic to ensure normal execution of the business.

[0077] S205: When the mirrored traffic is in the second state, the API of the cloud management platform is called to send a security group policy to the network space where the business virtual machine corresponding to the mirrored traffic in the second state is located, so as to block the traffic data sent by the business virtual machine through the security group policy.

[0078] Specifically, in this step, when it is determined through S202 and S203 that the acquired mirror traffic is in the second state, i.e., the dangerous red state, it means that the external link behavior of the business virtual machine corresponding to the mirror traffic is caused by a virus, and the host corresponding to the business virtual machine has been infected with the virus. At this time, in this step, it is necessary to send a security group policy to the network space where the business virtual machine corresponding to the mirror traffic in the second state is located to block the business virtual machine from continuing to send data externally. At the same time, in this step, the maintenance personnel will also be alerted so that the maintenance personnel can perform targeted maintenance.

[0079] S206: When the mirrored traffic is in the third state, repeat the step of auditing the mirrored traffic until the mirrored traffic is in the first state or the second state.

[0080] Specifically, in this step, when it is determined through S202 and S203 that the acquired mirrored traffic is in the third state, that is, the yellow state with certain risks, it means that the external link behavior of the business virtual machine corresponding to the mirrored traffic may be a virus-generated behavior and needs to be recharged and observed. Therefore, in this step, it will loop to the audit steps of S202 and S203 until the mirrored traffic is in the first state or the second state. When the mirrored traffic is in the first state, the corresponding S204 needs to be executed; when the mirrored traffic is in the second state, the corresponding S205 needs to be executed.

[0081] The embodiment of the present invention provides a cloud environment-based security access control method, which deploys a cloud security audit virtual machine on the cloud and calls the cloud platform API to mirror the internal and external traffic of the cloud business virtual machine to the cloud security audit virtual machine. The cloud security audit virtual machine can update the virus characteristics and behavior characteristics in real time by connecting to the cloud server. When the traffic passes through the cloud security audit virtual machine, it can audit and identify different traffic behaviors, and issue VPC security group policies by calling the cloud management platform API to block abnormal traffic; or notify the administrator to manually intervene and maintain the audit. This solution does not require the transformation of the cloud network architecture, and relies on cloud characteristics and dynamic adjustment strategies to effectively analyze and protect known and unknown virus threats.

[0082] A cloud environment-based security access control device provided by an embodiment of the present invention is introduced below. The cloud environment-based security access control device described below and the cloud environment-based security access control method described above can refer to each other.

[0083] A cloud environment-based security access control device described below is specifically applied to the above-mentioned cloud security audit virtual machine. The corresponding functional modules of the following device are mainly used to implement the various execution steps corresponding to the cloud security audit virtual machine, and the remaining contents can be referenced to each other.

[0084] Please refer to Figure 3 , Figure 3 A structural block diagram of a cloud environment-based security access control device provided by an embodiment of the present invention.

[0085] Reference Figure 3 In an embodiment of the present invention, a cloud environment-based security access control device may include:

[0086] The acquisition module 100 is used to obtain the mirror traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform.

[0087] The audit module 200 is used to audit the mirrored traffic.

[0088] The control module 300 is used to call the API of the cloud management platform when the mirror traffic is abnormal, and send a security group policy to the network space where the business virtual machine corresponding to the abnormal mirror traffic is located, so as to control the traffic of the business virtual machine through the security group policy.

[0089] Preferably, in an embodiment of the present invention, the cloud security audit virtual machine is set in a separate logically isolated network space.

[0090] Preferably, in the embodiment of the present invention, the acquisition module 100 is specifically used for:

[0091] When the business virtual machine initiates a link to the outside, the mirror traffic of the business virtual machine is obtained at the virtual network layer through the API of the cloud management platform.

[0092] Preferably, in the embodiment of the present invention, the audit module 200 is specifically used for:

[0093] The feature library set in the cloud security audit virtual machine is called, and the connection behavior feature when the business virtual machine initiates a link externally is used as an index to audit the mirror traffic.

[0094] Preferably, in an embodiment of the present invention, the connection behavior feature includes any one or any combination of the following:

[0095] Time characteristics, flow characteristics, and frequency characteristics.

[0096] Preferably, in the embodiment of the present invention, the audit module 200 is specifically used for:

[0097] The feature library set in the cloud security audit virtual machine is called, and the mirror traffic is audited by taking the data content sent after the business virtual machine initiates a link externally as an index.

[0098] Preferably, in the embodiment of the present invention, the data content includes any one or any combination of the following:

[0099] Message header, external connection address and port.

[0100] Preferably, in the embodiment of the present invention, the control module 300 includes:

[0101] The first state unit is used to maintain the link initiated by the business virtual machine to the outside when the mirrored traffic is in the first state.

[0102] The second state unit is used to call the API of the cloud management platform when the mirrored traffic is in the second state, and send a security group policy to the network space where the business virtual machine corresponding to the mirrored traffic in the second state is located, so as to block the traffic data sent by the business virtual machine through the security group policy.

[0103] The third state unit is used to repeat the step of auditing the mirrored traffic when the mirrored traffic is in a third state until the mirrored traffic is in the first state or the second state.

[0104] The cloud-based security access control device of this embodiment is used to implement the aforementioned cloud-based security access control method. Therefore, the specific implementation method of the cloud-based security access control device can be seen in the implementation method of the cloud-based security access control method in the previous text. For example, the acquisition module 100, the audit module 200, and the control module 300 are respectively used to implement steps S101 to S103 in the above-mentioned power grid data application method. Therefore, its specific implementation method can refer to the description of the corresponding each part of the implementation method, which will not be repeated here.

[0105] A cloud-based security access control system provided in an embodiment of the present invention is introduced below. The cloud-based security access control system described below and the cloud-based security access control method and cloud-based security access control device described above can refer to each other.

[0106] Please refer to Figure 4 , Figure 4 A structural block diagram of a cloud environment-based security access control system provided by an embodiment of the present invention.

[0107] Reference Figure 4 The cloud environment-based security access control system device includes a cloud management platform 11, a cloud security audit virtual machine 12 and a business virtual machine 13, wherein the cloud management platform 11 is communicatively connected to the cloud security audit virtual machine 12, and the cloud management platform 11 is communicatively connected to the business virtual machine 13;

[0108] The cloud security audit virtual machine 12 is used for:

[0109] Obtain the mirror traffic of the business virtual machine 13 at the virtual network layer through the API of the cloud management platform 11;

[0110] Auditing the mirrored traffic;

[0111] When the mirrored traffic is abnormal, the API of the cloud management platform 11 is called to send a security group policy to the network space where the business virtual machine 13 corresponding to the abnormal mirrored traffic is located, so as to control the traffic of the business virtual machine through the security group policy.

[0112] Preferably, in an embodiment of the present invention, the cloud security audit virtual machine is set in a separate logically isolated network space.

[0113] Preferably, in an embodiment of the present invention, the cloud security audit virtual machine 12 is specifically used for:

[0114] When the business virtual machine initiates a link to the outside, the mirror traffic of the business virtual machine is obtained at the virtual network layer through the API of the cloud management platform.

[0115] Preferably, in an embodiment of the present invention, the cloud security audit virtual machine 12 is specifically used for:

[0116] The feature library set in the cloud security audit virtual machine is called, and the connection behavior feature when the business virtual machine initiates a link externally is used as an index to audit the mirror traffic.

[0117] Preferably, in an embodiment of the present invention, the connection behavior feature includes any one or any combination of the following:

[0118] Time characteristics, flow characteristics, and frequency characteristics.

[0119] Preferably, in an embodiment of the present invention, the cloud security audit virtual machine 12 is specifically used for:

[0120] The feature library set in the cloud security audit virtual machine is called, and the mirror traffic is audited by taking the data content sent after the business virtual machine initiates a link externally as an index.

[0121] Preferably, in the embodiment of the present invention, the data content includes any one or any combination of the following:

[0122] Message header, external connection address and port.

[0123] Preferably, in an embodiment of the present invention, the cloud security audit virtual machine 12 is specifically used for:

[0124] When the mirrored traffic is in the first state, maintaining the link initiated externally by the business virtual machine;

[0125] When the mirrored traffic is in the second state, the API of the cloud management platform is called to issue a security group policy to the network space where the business virtual machine corresponding to the mirrored traffic in the second state is located, so as to block the traffic data sent by the business virtual machine through the security group policy;

[0126] When the mirrored traffic is in the third state, repeat the step of auditing the mirrored traffic until the mirrored traffic is in the first state or the second state.

[0127] The cloud-based security access control system of this embodiment is used to implement the aforementioned cloud-based security access control method. Therefore, the specific implementation method of the cloud-based security access control system can be seen in the embodiment section of the cloud-based security access control method in the previous text. Therefore, its specific implementation method can refer to the description of the corresponding embodiments of each part, which will not be repeated here.

[0128] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0129] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0130] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0131] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0132] The above is a detailed introduction to a cloud environment-based security access control method, a cloud environment-based security access control device, and a cloud environment-based security access control system provided by the present invention. This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, the present invention can also be improved and modified, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A secure access control method based on a cloud environment, characterized in that: Applied to cloud security audit virtual machines, including: Obtain the image traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform; Auditing the mirrored traffic; When the mirrored traffic is abnormal, the API of the cloud management platform is called to send a security group policy to the network space where the business virtual machine corresponding to the abnormal mirrored traffic is located, so as to control the traffic of the business virtual machine through the security group policy; The cloud security audit virtual machine is set in a separate logically isolated network space; The method of obtaining the image traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform includes: When the business virtual machine initiates a link to the outside, the mirror traffic of the business virtual machine is obtained at the virtual network layer through the API of the cloud management platform.

2. The method according to claim 1, characterized in that The auditing of the mirrored traffic includes: The feature library set in the cloud security audit virtual machine is called, and the connection behavior feature when the business virtual machine initiates a link externally is used as an index to audit the mirror traffic.

3. The method according to claim 2, characterized in that The connection behavior characteristics include any one or any combination of the following: Time characteristics, flow characteristics, and frequency characteristics.

4. The method according to claim 1, characterized in that: The auditing of the mirrored traffic includes: The feature library set in the cloud security audit virtual machine is called, and the mirror traffic is audited by taking the data content sent after the business virtual machine initiates a link externally as an index.

5. The method according to claim 4, characterized in that The data content includes any one or any combination of the following: Message header, external connection address and port.

6. The method according to claim 1, characterized in that When the mirrored traffic is abnormal, calling the API of the cloud management platform to send a security group policy to the network space where the business virtual machine corresponding to the abnormal mirrored traffic is located, so as to control the traffic of the business virtual machine through the security group policy includes: When the mirrored traffic is in the first state, maintaining the link initiated externally by the business virtual machine; When the mirrored traffic is in the second state, the API of the cloud management platform is called to issue a security group policy to the network space where the business virtual machine corresponding to the mirrored traffic in the second state is located, so as to block the traffic data sent by the business virtual machine through the security group policy; When the mirrored traffic is in the third state, repeat the step of auditing the mirrored traffic until the mirrored traffic is in the first state or the second state.

7. A secure access control device based on a cloud environment, characterized in that: Applied to cloud security audit virtual machines, including: The acquisition module is used to obtain the image traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform; An audit module, used for auditing the mirrored traffic; A control module is used to call the API of the cloud management platform when the mirror traffic is abnormal, and issue a security group policy to the network space where the business virtual machine corresponding to the abnormal mirror traffic is located, so as to control the traffic of the business virtual machine through the security group policy; The cloud security audit virtual machine is set in a separate logically isolated network space; The acquisition module is specifically used for: When the business virtual machine initiates a link to the outside, the mirror traffic of the business virtual machine is obtained at the virtual network layer through the API of the cloud management platform.

8. A secure access control system based on a cloud environment, characterized in that: It includes a cloud management platform, a cloud security audit virtual machine and a business virtual machine, wherein the cloud management platform is communicatively connected to the cloud security audit virtual machine, and the cloud management platform is communicatively connected to the business virtual machine; The cloud security audit virtual machine is used for: Obtain the mirror traffic of the business virtual machine at the virtual network layer through the API of the cloud management platform; Auditing the mirrored traffic; When the mirrored traffic is abnormal, the API of the cloud management platform is called to send a security group policy to the network space where the business virtual machine corresponding to the abnormal mirrored traffic is located, so as to control the traffic of the business virtual machine through the security group policy; The cloud security audit virtual machine is set in a separate logically isolated network space; The cloud security audit virtual machine is specifically used for: When the business virtual machine initiates a link to the outside, the mirror traffic of the business virtual machine is obtained at the virtual network layer through the API of the cloud management platform.

Images