A virtual machine security management system

Abstract

In view of the technical problems existing in the prior art, the present invention provides a virtual machine security management system, which includes a first operating system, a second operating system and a security protection system, wherein the output end of the first operating system is connected to the input end of the security protection system, and the input end of the second operating system is connected to the output end of the security protection system; by setting up a security management system, the operation process of the virtual machine is monitored in all directions, and risky operations can be prompted and prevented, and data backup and recovery can be achieved, thereby improving the security of the virtual machine.

Description

Technical Field

[0001] The present invention relates to the technical field of virtual machine systems, and in particular to a virtual machine security management system. Background Art

[0002] A virtual machine is a complete computer system that is simulated by software and has complete hardware system functions and runs in a completely isolated environment. Any work that can be done in a physical computer can be done in a virtual machine. When creating a virtual machine in a computer, part of the hard disk and memory capacity of the physical machine needs to be used as the hard disk and memory capacity of the virtual machine. Each virtual machine has an independent CMOS, hard disk and operating system, and can be operated like a physical machine.

[0003] Existing virtual machines are unable to properly supervise data changes and adaptability during operation, and are unable to monitor and identify risk items, resulting in a lack of security in the use of some virtual machines. Summary of the invention

[0004] The present invention aims at the technical problems existing in the prior art and provides a virtual machine security management system. By setting up a security management system, the operation process of the virtual machine can be monitored in all directions, and risky operations can be prompted and stopped. Data backup and recovery can also be achieved, thereby improving the security of the virtual machine.

[0005] The technical solution of the present invention to solve the above technical problem is as follows: a virtual machine security management system, which includes a first operating system, a second operating system and a security protection system, the output end of the first operating system is connected to the input end of the security protection system, and the input end of the second operating system is connected to the output end of the security protection system;

[0006] The first operating system is an operating system of a host computer, and is used to operate and manage the host computer;

[0007] The security protection system acts as a relay system for verifying and converting the operation and management data information of the first operating system and sending the control operation command to the second operating system;

[0008] The second operating system is an operating system of the virtual machine, which is used to provide operation and control of the virtual machine, as well as to receive control operation commands of the security protection system and complete corresponding control operation actions on the virtual machine.

[0009] Preferably, the security protection system includes an identity authentication unit, a permission management unit, a data backup unit, a data conversion unit, a reset unit and a risk control unit;

[0010] The identity verification unit is used to verify the identity information of the user, that is, only the user who passes the identity verification can operate and change the data information on this virtual machine;

[0011] The authority management unit is connected to the identity authentication unit and is used to manage the authority according to the verified user identity information and lock the operations that are not within the authority scope of the user;

[0012] The data backup unit is connected to the permission management unit, and is used to back up the data information involved in each operation of the user on the virtual machine, and store it in the security protection system to prevent the data from being unable to be restored or the change record from being found after the data is changed;

[0013] The data conversion unit is used to convert data information between the first operating system and the second operating system, and can convert the data information of the first operating system into data information that can be recognized by the second operating system;

[0014] The reset unit is used to initialize the configuration of the second operating system and restore the changed configuration information in the first operating system when the initial configuration needs to be restored during the operation of the second operating system;

[0015] The risk control unit is used to prompt and control risk operations performed in the second operating system, and the risk operations are configured in advance in the security protection system.

[0016] Preferably, the identity authentication unit is one or at least two of face recognition verification, fingerprint verification, and account and password verification.

[0017] Preferably, the data backup unit comprises a data reading and writing module and a data storage module, and the data reading and writing module is used to read and write the data storage module.

[0018] Preferably, the data conversion unit includes a data format conversion module and a system conversion module; the data format conversion module is used to convert format information of data, and the system conversion module is used to switch between operating systems.

[0019] Preferably, the risk control unit includes a risk warning module and a risk tracking module; the risk warning module provides risk warnings based on risk operation items stored in advance, and the risk tracking module tracks the risk operation box as it continues to be operated until the operation is completed. If new risk items appear during the process of completing the operation, it jumps back to the identity authentication unit for identity authentication and authority verification.

[0020] Preferably, when a risky operation occurs for the first time, the authentication unit is jumped back to perform identity authentication and further verify the authority information of the user according to the identity information of the user. If the user has the authority to execute the risky operation, the operation is continued; otherwise, the operation is locked.

[0021] The beneficial effects of the present invention are as follows: the present invention provides a virtual machine security management system, which, by setting up a security management system, can monitor the operation process of the virtual machine in all directions, and can prompt and stop risky operations, and can also realize data backup and recovery, thereby improving the security of the virtual machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a principle block diagram of the present invention. DETAILED DESCRIPTION

[0023] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0024] In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a mechanical connection or an electrical connection, or it can be the internal connection between two components. It can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to the specific circumstances.

[0025] like Figure 1 As shown, this embodiment discloses a virtual machine security management system, which includes a first operating system, a second operating system and a security protection system, wherein the output end of the first operating system is connected to the input end of the security protection system, and the input end of the second operating system is connected to the output end of the security protection system;

[0026] The first operating system is an operating system of a host computer, and is used to operate and manage the host computer;

[0027] The security protection system acts as a relay system for verifying and converting the operation and management data information of the first operating system and sending the control operation command to the second operating system;

[0028] The second operating system is an operating system of the virtual machine, which is used to provide operation and control of the virtual machine, as well as to receive control operation commands of the security protection system and complete corresponding control operation actions on the virtual machine.

[0029] In this embodiment, the security protection system is embedded in or installed on the first operating system, and serves as a communication bridge between the first operating system and the second operating system, wherein the second operating system serves as the operating system of the virtual machine and is used to control and operate the virtual machine. In addition to providing a medium for data interaction between the first operating system and the second operating system, the security protection system also performs data monitoring and supervision between the first operating system and the second operating system. The monitoring and supervision is to monitor the risks, permissions and potential impacts in each data transmission or data change to prevent the system from being affected by the operation of the virtual machine.

[0030] Preferably, the security protection system includes an identity authentication unit, a permission management unit, a data backup unit, a data conversion unit, a reset unit and a risk control unit;

[0031] The identity verification unit is used to verify the identity information of the user, that is, only the user who passes the identity verification can operate and change the data information on this virtual machine;

[0032] The authority management unit is connected to the identity authentication unit and is used to manage the authority according to the verified user identity information and lock the operations that are not within the authority scope of the user;

[0033] The data backup unit is connected to the permission management unit, and is used to back up the data information involved in each operation of the user on the virtual machine, and store it in the security protection system to prevent the data from being unable to be restored or the change record from being found after the data is changed;

[0034] The data conversion unit is used to convert data information between the first operating system and the second operating system, and can convert the data information of the first operating system into data information that can be recognized by the second operating system;

[0035] The reset unit is used to initialize the configuration of the second operating system and restore the changed configuration information in the first operating system when the initial configuration needs to be restored during the operation of the second operating system;

[0036] The risk control unit is used to prompt and control risk operations performed in the second operating system, and the risk operations are configured in advance in the security protection system.

[0037] In this embodiment, the identity authentication unit is executed before entering or creating a virtual machine. First, the identity authentication unit can confirm the identity of the user. Secondly, after the identity authentication, it can be clear whether the user has the authority to create a virtual machine on the host computer; therefore, in this embodiment, the identity authentication unit and the authority management unit are related. The user's authority needs to be verified once when the identity authentication is performed. And, each time the identity authentication and authority verification are performed, the label of the current execution node is carried, that is, the node is returned immediately after the verification is completed. The significance of the data backup unit is that it can perform backup management on the operation process, and can return to any node of the completed operation for reconfiguration and operation, and can analyze the cause of the error through the data backup unit after the execution is completed or an error occurs. The data conversion unit can complete the data translation and switching between the two operating systems. Specifically, it can realize the switching between multiple different operating systems and the conversion between multiple different data formats. The reset unit can be triggered at any operation node, and after the triggering, it is restored to the appearance when the virtual machine was just established. The risk control unit provides risk control and risk prompts during virtual machine operation to ensure that both systems are running in a common normal state.

[0038] Preferably, the identity authentication unit is one or at least two of face recognition verification, fingerprint verification, and account and password verification.

[0039] Preferably, the data backup unit comprises a data reading and writing module and a data storage module, and the data reading and writing module is used to read and write the data storage module.

[0040] Preferably, the data conversion unit includes a data format conversion module and a system conversion module; the data format conversion module is used to convert format information of data, and the system conversion module is used to switch between operating systems.

[0041] Preferably, the risk control unit includes a risk warning module and a risk tracking module; the risk warning module provides risk warnings based on risk operation items stored in advance, and the risk tracking module tracks the risk operation box as it continues to be operated until the operation is completed. If new risk items appear during the process of completing the operation, it jumps back to the identity authentication unit for identity authentication and authority verification.

[0042] Preferably, when a risky operation occurs for the first time, the authentication unit is jumped back to perform identity authentication and further verify the authority information of the user according to the identity information of the user. If the user has the authority to execute the risky operation, the operation is continued; otherwise, the operation is locked.

[0043] In this embodiment, in addition to identity and authority verification required when risky operations occur, identity and authority verification can also be set to be required when performing special tasks, and the special task can only be executed after verification is completed; for example, when changing the system configuration or performing certain irreversible operations.

[0044] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0045] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims

1. A virtual machine security management system, characterized in that: It includes a first operating system, a second operating system and a safety protection system, wherein the output end of the first operating system is connected to the input end of the safety protection system, and the input end of the second operating system is connected to the output end of the safety protection system; The first operating system is an operating system of a host computer, and is used to operate and manage the host computer; The security protection system acts as a relay system for verifying and converting the operation and management data information of the first operating system and sending the control operation command to the second operating system; The second operating system is an operating system of the virtual machine, which is used to provide operation and control of the virtual machine, and receive control operation commands of the security protection system and complete corresponding control operation actions on the virtual machine; the security protection system includes an identity authentication unit, a permission management unit, a data backup unit, a data conversion unit, a reset unit and a risk control unit; The identity verification unit is used to verify the identity information of the user, that is, only the user who passes the identity verification can operate and change the data information on this virtual machine; The authority management unit is connected to the identity authentication unit and is used to manage the authority according to the verified user identity information and lock the operations that are not within the authority scope of the user; The data backup unit is connected to the permission management unit, and is used to back up the data information involved in each operation of the user on the virtual machine, and store it in the security protection system to prevent the data from being unable to be restored or the change record from being found after the data is changed; The data conversion unit is used to convert data information between the first operating system and the second operating system, and can convert the data information of the first operating system into data information that can be recognized by the second operating system; The reset unit is used to initialize the configuration of the second operating system and restore the changed configuration information in the first operating system when the initial configuration needs to be restored during the operation of the second operating system; The risk control unit is used to prompt and control the risk operation performed in the second operating system, and the risk operation is configured in advance in the security protection system; the identity authentication unit is one or at least two of face recognition verification, fingerprint verification, and account password verification; the data backup unit includes a data reading and writing module and a data storage module, and the data reading and writing module is used to read and write the data storage module; the data conversion unit includes a data format conversion module and a system conversion module; the data format conversion module is used to convert the format information of the data, and the system conversion module is used to switch between operating systems; the risk control unit includes a risk prompt module and a risk tracking module; The risk warning module issues risk warnings based on risk operation items stored in advance, and the risk tracking module tracks the risk operation items as they are continued to be operated until the operation is completed. If a new risk item appears during the process from the beginning to the completion of the operation, the module jumps back to the identity verification unit for identity verification and authority verification; When a risky operation occurs for the first time, the system jumps back to the identity authentication unit for identity authentication and further verifies the user's permission information based on the user's identity information. If the user has the permission to execute the risky operation, the system continues; otherwise, the operation is locked.

Images