Server for security system management of multiple virtual cloud and method operation thereof

Abstract

According to various embodiments, a server for managing a security system of a plurality of virtual clouds comprises: a communication interface; and a processor; wherein the processor is configured to obtain at least one original information from each of a plurality of external electronic devices through the communication interface, generate at least one virtual machine cloud information based on a pre-configured replication system based on the at least one original information, perform security operations based on a pre-configured code detection system based on the at least one virtual machine cloud information, transmit the at least one virtual machine cloud information with completed security operations through the communication interface to the plurality of external electronic devices and / or an external electronic device of an administrator, and delete the at least one virtual machine cloud information.

Description

Technology Field

[0001] Various embodiments of the present invention relate to a server for managing security systems of multiple virtual clouds and a method for operating the same. Background Technology

[0003] Traditionally, while it was possible to protect against problems caused by persistent hackers and system bugs by utilizing direct information, this was impossible due to privacy concerns. To overcome this, various virtualization management solutions based on virtual machines, such as VMWare vSphere, Microsoft Hyper-V, and OpenStack, have existed. These solutions can provide automated virtual machine deployment and management functions in cloud environments and include capabilities for creating and managing virtual machines on cloud services such as Google Cloud, AWS, and Azure.

[0004] However, conventionally, there were issues such as security checks not being automated and being performed as a separate process, as well as a lack of functionality to convert the virtual machine environment into an independent secure cloud environment. Furthermore, conventional systems lacked the ability to apply security measures in real-time after a check, maintained a secure state in the virtual cloud environment automatically after the check, and provided a function to automatically remove the cloud after the check was completed.

[0005] Therefore, to overcome these problems, there is a need for a system and method that can provide replication time independently while allowing for easy identification of issues, and overcome security problems by utilizing this information while immediately deleting it. Prior art literature

[0007] Korean Patent Publication No. 10-2586870 (Oct. 04, 2023) Korean Patent Publication No. 10-2343501 (Dec. 22, 2021) The problem to be solved

[0008] Accordingly, the present embodiment can provide a server and a method for operating the same that can generate at least one acquired original information into an independent virtual machine cloud, automatically calculate vulnerabilities while generating a report thereon, and transmit the generated report and vulnerability information. means of solving the problem

[0010] According to various embodiments, a server for managing a security system of a plurality of virtual clouds comprises: a communication interface; and a processor; wherein the processor is configured to obtain at least one original information from each of a plurality of external electronic devices through the communication interface, generate at least one virtual machine cloud information based on a pre-configured replication system based on the at least one original information, perform security operations based on a pre-configured code detection system based on the at least one virtual machine cloud information, transmit the at least one virtual machine cloud information with completed security operations through the communication interface to the plurality of external electronic devices and / or an external electronic device of an administrator, and delete the at least one virtual machine cloud information.

[0011] According to various other embodiments, in a method for operating a server for managing a security system of a plurality of virtual clouds, the method is configured to acquire at least one original information from each of a plurality of external electronic devices through a communication interface, generate at least one virtual machine cloud information based on a pre-configured replication system based on the at least one original information through a processor, perform a security operation based on a pre-configured code detection system based on the at least one virtual machine cloud information through the processor, transmit the at least one virtual machine cloud information, for which the security operation has been completed, to the plurality of external electronic devices and / or an external electronic device of an administrator through the communication interface, and delete the at least one virtual machine cloud information through the processor. Effects of the invention

[0013] The server according to the present embodiment can automate replication, execution, inspection, and deletion by generating at least one virtual machine cloud information based on at least one acquired original information, verifying at least one vulnerability in the virtual machine cloud information, and transmitting a report generated based on the vulnerability to an external electronic device while simultaneously deleting it. This allows for increased resource utilization while reducing management costs, eliminates the need for agent installation, minimizes inspection and system load through a remote access method (based on OS authentication), supports various operating systems (Windows Server, Linux family), and has the advantage of automatically managing inspection scripts and results. Brief explanation of the drawing

[0015] FIG. 1 illustrates a block diagram of a server and a network according to various embodiments of the present invention. FIG. 2 is a flowchart illustrating a method of operation of a server according to various embodiments of the present invention. FIG. 3 is an example diagram briefly illustrating the process of a server operating according to various embodiments of the present invention. FIG. 4 is an example diagram illustrating various representations of vulnerability analysis by a server according to various embodiments of the present invention. Specific details for implementing the invention

[0016] Hereinafter, various embodiments of this document are described with reference to the accompanying drawings. The embodiments and the terms used therein are not intended to limit the technology described in this document to specific embodiments and should be understood to include various modifications, equivalents, and / or substitutions of said embodiments. In relation to the description of the drawings, similar reference numerals may be used for similar components. A singular expression may include a plural expression unless the context clearly indicates otherwise. In this document, expressions such as "A or B" or "at least one of A and / or B" may include all possible combinations of items listed together. Expressions such as "first," "second," "first," or "second" may modify said components regardless of order or importance and are used only to distinguish one component from another and do not limit said components. When it is mentioned that a certain (e.g., 1st) component is "(functionally or telecommunicationally) connected" or "connected" to another (e.g., 2nd) component, said certain component may be directly connected to said other component or connected through another component (e.g., 3rd component).

[0017] In this document, "configured to" may be used interchangeably with, depending on the context, for example, hardware- or software-wise, "suitable for," "capable of," "modified to," "made to," "capable of," or "designed to." In some cases, the expression "device configured to" may mean that the device is "capable of" in conjunction with other devices or components. For example, the phrase "processor configured to perform A, B, and C" may mean a dedicated processor for performing the corresponding operations (e.g., an embedded processor), or a general-purpose processor capable of performing the corresponding operations by executing one or more software programs stored in a memory device (e.g., a CPU or application processor).

[0018] An electronic device according to various embodiments of the present document may include, for example, at least one of a smartphone, a tablet PC, a desktop PC, a laptop PC, a netbook computer, a workstation, and a server.

[0019] Referring to FIG. 1, an electronic device (101) within a network environment (100) in various embodiments is described. The electronic device (101) may include a bus (110), a processor (120), a memory (130), an input / output interface (140), a display (150), and a communication interface (160). In some embodiments, the electronic device (101) may omit at least one of the components or additionally include other components. The bus (110) may include a circuit that connects the components (110-160) to each other and transmits communication (e.g., control messages or data) between the components. The processor (120) may include one or more of a central processing unit, an application processor, or a communication processor (CP). The processor (120) may, for example, perform operations or data processing regarding the control and / or communication of at least one other component of the electronic device (101).

[0020] The memory (130) may include volatile and / or non-volatile memory. The memory (130) may store instructions or data related to at least one other component of the electronic device (101), for example. According to one embodiment, the memory (130) may store software and / or a program (140).

[0021] The input / output interface (140) can, for example, transmit commands or data input from a patient or other external device to other component(s) of the electronic device (101), or output commands or data received from other component(s) of the electronic device (101) to the patient or other external device.

[0022] The display (150) may include, for example, a liquid crystal display (LCD), a light-emitting diode (LED) display, an organic light-emitting diode (OLED) display, a microelectromechanical system (MEMS) display, or an electronic paper display. The display (150) may display various content (e.g., text, images, videos, icons, and / or symbols, etc.) to a patient, for example. The display (150) may include a touch screen and may receive touch, gesture, proximity, or hovering input using, for example, an electronic pen or a part of the patient's body. The communication interface (160) may establish communication between, for example, the electronic device (101) and an external device (e.g., a first external electronic device (102), a second external electronic device (104), or a server (108)). For example, the communication interface (160) can be connected to a network (162) via wireless or wired communication to communicate with an external device (e.g., a second external electronic device (104) or a server (108)).

[0023] Wireless communication may include cellular communication using at least one of, for example, LTE, LTE-A (LTE Advance), CDMA (code division multiple access), WCDMA (wideband CDMA), UMTS (universal mobile telecommunications system), WiBro (Wireless Broadband), or GSM (Global System for Mobile Communications). According to one embodiment, wireless communication may include at least one of, for example, WiFi (wireless fidelity), Bluetooth, Bluetooth Low Energy (BLE), Zigbee, NFC (near field communication), Magnetic Secure Transmission, Radio Frequency (RF), or Body Area Network (BAN). According to one embodiment, wireless communication may include GNSS. GNSS may be, for example, GPS (Global Positioning System), Glonass (Global Navigation Satellite System), Beidou Navigation Satellite System (hereinafter "Beidou"), or Galileo, the European global satellite-based navigation system. Hereinafter, in this document, "GPS" may be used interchangeably with "GNSS". Wired communication may include at least one of, for example, USB (universal serial bus), HDMI (high definition multimedia interface), RS-232 (recommended standard 232), power line communication, or POTS (plain old telephone service).The network (162) may include at least one of a telecommunications network, for example, a computer network (e.g., LAN or WAN), the Internet, or a telephone network.

[0024] Each of the first and second external electronic devices (102, 104, 106) may be the same or a different type of device as the electronic device (101). According to various embodiments, all or part of the operations performed on the electronic device (101) may be performed on one or more other electronic devices (e.g., electronic devices (102, 104, 106), or a server (108). According to one embodiment, when the electronic device (101) needs to perform a function or service automatically or upon request, the electronic device (101) may request at least some of the associated functions from another device (e.g., electronic devices (102, 104, 106), or a server (108)) instead of performing the function or service itself or additionally. The other electronic device (e.g., electronic devices (102, 104, 106), or a server (108)) may perform the requested function or additional functions and transmit the result to the electronic device (101). The electronic device (101) may provide the requested function or service by processing the received result as is or additionally. For this purpose, for example, cloud computing, distributed computing, or client-server computing technologies may be used.

[0026] FIG. 2 is a flowchart illustrating a method of operation of a server according to various embodiments of the present invention.

[0027] FIG. 3 is an example diagram briefly illustrating the process of a server operating according to various embodiments of the present invention.

[0028] FIG. 4 is an example diagram illustrating various representations of vulnerability analysis by a server according to various embodiments of the present invention.

[0030] In operation 201, a server (108) (e.g., processor (120) of FIG. 1) can obtain at least one original information from each of a plurality of external electronic devices (101, 102, 104, 106) through a communication interface (e.g., communication interface (160) of FIG. 1). According to one embodiment, at least the original information may include security information, management information, disk information, and memory information for each of the plurality of external electronic devices (101, 102, 104, 106). Specifically, the security information may include authentication and access control information for each of the plurality of external electronic devices (101, 102, 104, 106), may include encryption keys and / or authentication tokens, and may include security settings and firewall rules for each of the plurality of external electronic devices (101, 102, 104, 106). Additionally, management information may include firmware and software version information for each of the plurality of external electronic devices (101, 102, 104, 106), remote control and maintenance status information, and network settings and connection status. Additionally, disk information may include capacity and usage information for each of the plurality of external electronic devices (101, 102, 104, 106), file system type and status, and bad sectors and error logs. Additionally, memory information may include RAM usage and available memory size for each of the plurality of external electronic devices (101, 102, 104, 106), cache and virtual memory status, and memory leak or overload information. Afterward, the server (108) can input at least one original information, including security information, management information, disk information, and memory information for each of the multiple external electronic devices (101, 102, 104, 106), into the replication system.

[0031] In operation 203, the server (108) (e.g., the processor (120) of FIG. 1) can generate at least one virtual machine cloud information based on at least one original information based on a pre-configured replication system, as illustrated in FIG. 3. According to one embodiment, the pre-configured replication system may include snapshot-based replication, which can create a virtual machine by capturing the state of an existing operating environment; image-based replication, which can create a virtual machine using a predefined OS (e.g., Windows) and application packages; and live migration, which can convert a system running on a physical server into a virtual machine. Subsequently, the server (108) can generate at least one virtual machine cloud information using the pre-configured replication system. Additionally, it may include a virtual machine image composed of a virtual disk file with a specific OS and software installed, network configuration information including an IP address and a virtual network interface, storage information including the allocated virtual disk capacity, CPU and memory (e.g., memory (130) of FIG. 1) including the allocated virtual CPU (vCPU) and RAM size, and operational policies and security settings including virtual machine access control and firewall rules.

[0032] In operation 205, the server (108) (e.g., the processor (120) of FIG. 1) can perform security operations based on a code detection system pre-configured in at least one virtual machine cloud information, as illustrated in FIG. 4. According to one embodiment, the code detection system may include an automatic capture system for at least one web service and a malware linkage system that automatically links at least one malware system. Specifically, the automatic capture system may be configured to periodically automatically capture and store login pages and main service pages from at least one virtual machine cloud information and a website in the same state as actual web information, and to detect abnormal patterns by detecting input information of a virtual user (e.g., login information, account information). Additionally, the malware linkage system may include a result value of detecting that malware (e.g., phishing site, fake login page, script-based data theft attack) is included in at least one actual program, and may include a function to automatically notify the security system if necessary while identifying new forms of threats by comparing the detected malware with a database.

[0033] According to another embodiment, the server (108) may determine to output at least one web evidence information based on at least one automatic capture system in at least one virtual machine cloud information, as illustrated in FIG. 4, and may determine at least one malicious code extraction information based on a malicious code linkage system in at least one virtual machine cloud information. Specifically, the server (108) may include information storing a specific state of a website or web application (e.g., login page, payment page, screen with malicious code inserted, etc.) in at least one virtual machine cloud information, as well as screenshots, HTML source code, network traffic, DOM structure information, and executed JavaScript code information. Subsequently, as illustrated in FIG. 4 (b), when a specific event (e.g., user login, access to a specific URL, occurrence of suspicious activity, etc.) occurs in at least one virtual machine cloud information, the server (108) may automatically save information of the corresponding page and dynamically load and analyze a virtual website (unauthorized website). Additionally, the server (108) can extract files containing malware, malicious script code, C&C (command and control) server addresses, and execution logs of malware from a malware integration system based on at least one virtual machine cloud information, as illustrated in (c) of FIG. 4. Afterward, the server (108) can determine whether the malware analyzed based on the malware integration system is a new threat or the same threat by comparing it with an actual database (e.g., VirusTotal, MITRE ATT&CK).Additionally, the server (108) can detect whether malicious code is included by analyzing web evidence information automatically captured based on the malicious code linkage system from at least one virtual machine cloud information based on the malicious code linkage system, and can analyze the characteristics and behavior of the malicious code by linking with an actual malicious code analysis engine (e.g., YARA, Cuckoo Sandbox, Suricata), and can extract the characteristics of the malicious code based on execution logs and network traffic after safely executing a suspicious webpage or file from at least one virtual machine cloud information. Additionally, the server (108) can analyze vulnerabilities regarding non-users (agentless) from at least one virtual machine cloud information as illustrated in FIG. 4 (a). Here, the non-user can be set as a virtual user formed to extract vulnerability information regarding actual countermeasure information from at least one virtual machine cloud information.

[0034] In operation 207, the server (108) (e.g., processor (120) of FIG. 1) can transmit at least one virtual machine cloud information, for which a security operation has been completed, to a plurality of external electronic devices (101, 102, 104, 106) and / or an administrator's external electronic device (101, 102, 104, 106) through a communication interface (e.g., communication interface (160) of FIG. 1). According to one embodiment, the server (108) can store at least one web evidence information and at least one malicious code extraction information, and the determined result information in memory (e.g., memory (130) of FIG. 1), and can automatically input the result information into a pre-configured report form to generate a result report and a vulnerability check response guideline report, and can transmit the result report and the response guideline report to a plurality of external electronic devices (101, 102, 104, 106) and / or an administrator's external electronic device (101, 102, 104, 106) through a communication interface (e.g., communication interface (160) of FIG. 1). Specifically, the server (108) can automatically generate a result report consisting of a document summarizing the inspection results, which includes a list of inspected virtual machines, discovered vulnerabilities, and modified items, and a vulnerability check response guideline report which includes a response method for security vulnerabilities, a patch guide, and additional security setting methods as response measures for vulnerabilities, in order to deliver independent environment cloud information where security work has been completed. Additionally, the server (108) can combine the result report and the vulnerability check response guideline report into a single file with the final result value in at least one independent environment cloud.Additionally, the server (108) can automatically perform security checks in a cloud-based service and transmit the environment after the check to multiple external electronic devices (101, 102, 104, 106) and / or an administrator's external electronic device (101, 102, 104, 106), and the IT system within the enterprise can periodically perform security checks and automatically report the results to the IT security team's external electronic device (101, 102, 104, 106), and regulatory authorities (Financial Supervisory Service, National Security Agency, etc.) can automate the security check process to periodically review the security status of the enterprise, and the enterprise can prove regulatory compliance by submitting a report after the security check, and a data center operator can perform security checks on a customer's virtual machine and provide the results as a report to the user's external electronic device (101, 102, 104, 106), thereby enabling security patching and maintenance work based on the vulnerability check results.

[0035] In operation 209, the server (108) (e.g., the processor (120) of FIG. 1) can delete at least one virtual machine cloud information. According to one embodiment, the server (108) can delete at least one created virtual machine cloud information to secure the information, reduce waste with previous data, and obtain reliability.

[0037] The server (108) according to the present embodiment can automate replication, execution, inspection, and deletion by generating at least one virtual machine cloud information based on at least one source information obtained, verifying at least one vulnerability in the virtual machine cloud information, and transmitting a report generated based on the vulnerability to an external electronic device (101, 102, 104, 106) and deleting it at the same time, thereby increasing resource utilization while reducing management costs, eliminating the need for agent installation, minimizing inspection and system load through a remote access method (based on OS authentication), supporting various OSs (Windows Server, Linux family), and automatically managing inspection scripts and results.

[0039] According to various embodiments, a server for managing a security system of a plurality of virtual clouds comprises: a communication interface; and a processor; wherein the processor is configured to obtain at least one original information from each of a plurality of external electronic devices through the communication interface, generate at least one virtual machine cloud information based on a pre-configured replication system based on the at least one original information, perform security operations based on a pre-configured code detection system based on the at least one virtual machine cloud information, transmit the at least one virtual machine cloud information with completed security operations through the communication interface to the plurality of external electronic devices and / or an external electronic device of an administrator, and delete the at least one virtual machine cloud information.

[0040] According to various embodiments, the at least original information includes security information, management information, disk information, and memory information for each of the plurality of external electronic devices.

[0041] According to various embodiments, the code detection system includes an automatic capture system for at least one web service and a malware linkage system that automatically links at least one malware system, and the processor is configured to determine to output at least one web evidence information based on the at least one automatic capture system from the at least one virtual machine cloud information, and to determine at least one malware extraction information based on the malware linkage system from the at least one virtual machine cloud information.

[0042] According to various embodiments, the processor further comprises a memory; wherein the processor stores result information generated while determining at least one web evidence information and at least one malicious code extraction information in the memory, automatically inputs the result information into a pre-set report form to generate a result report and a vulnerability check response guideline report, and is configured to transmit the result report and the response guideline report to the plurality of external electronic devices and / or the manager's external electronic device through the communication interface.

[0043] According to various other embodiments, in a method for operating a server for managing a security system of a plurality of virtual clouds, the method is configured to acquire at least one original information from each of a plurality of external electronic devices through a communication interface, generate at least one virtual machine cloud information based on a pre-configured replication system based on the at least one original information through a processor, perform a security operation based on a pre-configured code detection system based on the at least one virtual machine cloud information through the processor, transmit the at least one virtual machine cloud information, for which the security operation has been completed, to the plurality of external electronic devices and / or an external electronic device of an administrator through the communication interface, and delete the at least one virtual machine cloud information through the processor.

[0045] As used in this document, the terms “module” or “part” include a unit composed of hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit, for example. “Module” or “part” may be a component formed integrally or a minimum unit or part thereof that performs one or more functions. “Module” or “part” may be implemented mechanically or electronically and may include, for example, an application-specific integrated circuit (ASIC) chip, field-programmable gate arrays (FPGAs), or programmable logic device known or to be developed that performs certain operations, and may be executed by a processor (120). At least part of the device (e.g., modules or functions thereof) or method (e.g., operations) according to various embodiments may be implemented as instructions stored in a computer-readable storage medium (e.g., memory (130)) in the form of a program module. When the above instruction is executed by a processor (e.g., processor (120)), the processor may perform a function corresponding to the above instruction. Computer-readable recording media may include a hard disk, a floppy disk, a magnetic medium (e.g., magnetic tape), an optical recording medium (e.g., CD-ROM, DVD, magneto-optical medium (e.g., floptical disk), built-in memory, etc. Instructions may include code generated by a compiler or code that can be executed by an interpreter. A module or program module according to various embodiments may include at least one of the aforementioned components, some of which may be omitted, or additionally include other components. Operations performed by a module, program module, or other components according to various embodiments may be executed sequentially, in parallel, iteratively, or heuristically, or at least some operations may be executed in a different order, omitted, or other operations may be added.

[0046] Furthermore, the embodiments disclosed in this document are presented for the purpose of explaining and understanding the disclosed technical content and are not intended to limit the scope of this disclosure. Accordingly, the scope of this disclosure should be interpreted to include all modifications or various other embodiments based on the technical concept of this disclosure.

Claims

Claim 1 A server for managing a security system of multiple virtual clouds, comprising: a communication interface; and a processor; wherein the processor acquires at least one original information from each of a plurality of external electronic devices through the communication interface, generates at least one virtual machine cloud information based on the at least one original information based on a pre-configured replication system, performs a security operation based on a pre-configured code detection system on the at least one virtual machine cloud information, transmits the at least one virtual machine cloud information with the completed security operation through the communication interface to the plurality of external electronic devices and / or an administrator's external electronic device, and is configured to delete the at least one virtual machine cloud information. Claim 2 In claim 1, the server, wherein the at least original information includes security information, management information, disk information, and memory information for each of the plurality of external electronic devices. Claim 3 In claim 2, the code detection system includes an automatic capture system for at least one web service and a malware linkage system that automatically links at least one malware system, and the processor determines to output at least one web evidence information based on the at least one automatic capture system from the at least one virtual machine cloud information, and is configured to determine at least one malware extraction information based on the malware linkage system from the at least one virtual machine cloud information, a server. Claim 4 In claim 3, the server further comprises a memory; wherein the processor stores result information generated while determining the at least one web evidence information and the at least one malicious code extraction information in the memory, automatically inputs the result information into a pre-set report form to generate a result report and a vulnerability check response guideline report, and is configured to transmit the result report and the response guideline report to the plurality of external electronic devices and / or the manager's external electronic device through the communication interface. Claim 5 A method for operating a server for managing a security system of multiple virtual clouds, wherein the method comprises: acquiring at least one original information from each of a plurality of external electronic devices through a communication interface; generating at least one virtual machine cloud information based on a pre-configured replication system through a processor based on the at least one original information; performing a security operation based on a pre-configured code detection system on the at least one virtual machine cloud information through the processor; transmitting the at least one virtual machine cloud information, upon completion of the security operation, through the communication interface to the plurality of external electronic devices and / or an external electronic device of an administrator; and deleting the at least one virtual machine cloud information through the processor. Claim 6 In claim 5, the method wherein the at least original information comprises security information, management information, disk information, and memory information for each of the plurality of external electronic devices. Claim 7 In claim 6, the code detection system includes an automatic capture system for at least one web service and a malware linkage system that automatically links at least one malware system, and the method is configured to determine to output at least one web evidence information based on the at least one automatic capture system from the at least one virtual machine cloud information, and to determine at least one malware extraction information based on the malware linkage system from the at least one virtual machine cloud information. Claim 8 In claim 7, the method further comprises a memory; wherein the method stores result information generated while determining at least one web evidence information and at least one malicious code extraction information in the memory, automatically inputs the result information into a pre-set report form to generate a result report and a vulnerability check response guideline report, and is configured to transmit the result report and the response guideline report to the plurality of external electronic devices and / or the manager's external electronic device through the communication interface.

Images