A method, device, equipment and storage medium for enhancing virtual machine security

Abstract

The application relates to the field of virtual machine security, and discloses a method, device and equipment for enhancing virtual machine security and a storage medium, the method comprising the following steps: disabling a console of a virtual machine; running a host system on the virtual machine; deploying a socket communication channel between the host and the virtual machine; performing user authentication according to the socket communication channel, and executing a command in a limited command list after successful authentication. The above method disables the original console of the virtual machine, deploys the socket communication channel between the host and the virtual machine after running the host system on the virtual machine, performs user authentication based on the socket communication channel, limits the command list, and realizes administrator configuration, so that the operation of the virtual machine can be limited, the production environment needs can be met, and the safety of the production environment can be maximally ensured.

Description

Technical Field

[0001] This invention relates to the field of virtual machine security, and in particular to a method, apparatus, device, and storage medium for enhancing virtual machine security. Background Technology

[0002] Virtualization refers to the operation of computer components on a virtual basis. Virtualization technology can expand hardware capacity, simplify software reconfiguration, enable resource sharing in Internet Technology (IT) infrastructure, and reduce IT costs. Virtual machine technology is a type of virtualization technology. A virtual machine (VM) refers to a complete computer system simulated by software, possessing full hardware system functionality and running in a completely isolated environment. Tasks that can be performed on a physical computer can also be performed in a virtual machine.

[0003] However, traditional virtual machine serial port access permissions are often too broad, granting access to running programs, configuration files, and data files, posing significant security risks in production environments. Abnormal operations, such as executing commands like `watch` on the serial port, can lead to unused serial port access, compromising system stability.

[0004] Therefore, how to solve the problem of excessive virtual machine serial port access permissions, which poses many hidden dangers to the production environment, is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a method, apparatus, device, and storage medium for enhancing virtual machine security, which can limit operations on virtual machines, meet the needs of the production environment, and maximize the security of the production environment. The specific solution is as follows:

[0006] A method for enhancing virtual machine security includes:

[0007] Disable the virtual machine's console;

[0008] The host system runs on the virtual machine;

[0009] Deploy a socket communication channel between the host machine and the virtual machine;

[0010] User authentication is performed based on the socket communication channel, and commands from a limited command list are executed upon successful authentication.

[0011] Preferably, in the method for enhancing virtual machine security provided in the embodiments of the present invention, before disabling the virtual machine's console, the method further includes:

[0012] Modify the libvirt.spec configuration file in the libvirt source code and compile it to generate the libvirt virtualization component.

[0013] Preferably, in the method for enhancing virtual machine security provided in the embodiments of the present invention, in addition to disabling the virtual machine's console, the method further includes:

[0014] Add and display a message indicating that the console is not supported.

[0015] Preferably, in the method for enhancing virtual machine security provided in the embodiments of the present invention, after running the host system on the virtual machine, the method further includes:

[0016] Install the virtual machine system through a graphical interface; or...

[0017] When the host machine has no graphics card, virt-manager is used to remotely operate the virtualization components on the host machine via the network to install the virtual machine system.

[0018] Preferably, in the method for enhancing virtual machine security provided in the embodiments of the present invention, after deploying the socket communication channel between the host machine and the virtual machine, the method further includes:

[0019] The TCP protocol is selected, and a limited port is used for communication between the host machine and the virtual machine.

[0020] Preferably, in the method for enhancing virtual machine security provided in the embodiments of the present invention, while executing commands from a limited command list, it further includes:

[0021] The command parameters of the commands in the limited command list are restricted.

[0022] Preferably, the method for enhancing virtual machine security provided in the embodiments of the present invention further includes:

[0023] Determine whether the socket communication channel is disconnected within a set time period;

[0024] If so, the system will automatically exit the host system and clear any remaining sessions.

[0025] This invention also provides an apparatus for enhancing virtual machine security, comprising:

[0026] The console disable module is used to disable the virtual machine's console.

[0027] The system runtime module is used to run the host system on the virtual machine;

[0028] The channel deployment module is used to deploy a socket communication channel between the host machine and the virtual machine.

[0029] The authentication execution module is used to authenticate users based on the socket communication channel and execute commands from a limited command list after successful authentication.

[0030] This invention also provides a device for enhancing virtual machine security, including a processor and a memory, wherein the processor executes a computer program stored in the memory to implement the method for enhancing virtual machine security as described above in this invention.

[0031] This invention also provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the method for enhancing virtual machine security as described above in this invention.

[0032] As can be seen from the above technical solution, the method for enhancing virtual machine security provided by the present invention includes: disabling the virtual machine's console; running the host system on the virtual machine; deploying a socket communication channel between the host machine and the virtual machine; performing user authentication based on the socket communication channel; and executing commands from a limited command list after successful authentication.

[0033] The method for enhancing virtual machine security provided by this invention disables the original console of the virtual machine, deploys a socket communication channel between the host machine and the virtual machine after running the host system on the virtual machine, and performs user authentication based on the socket communication channel to limit the list of commands, which can be configured by the administrator. This can limit the operation on the virtual machine, meet the needs of the production environment, and ensure the security of the virtual machine production environment to the greatest extent.

[0034] Furthermore, the present invention also provides corresponding apparatus, devices, and computer-readable storage media for enhancing virtual machine security, further making the above-mentioned methods more practical, and the apparatus, devices, and computer-readable storage media have corresponding advantages. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0036] Figure 1A flowchart illustrating a method for enhancing virtual machine security provided in an embodiment of the present invention;

[0037] Figure 2 This is a schematic diagram of the structure of the device for enhancing virtual machine security provided in an embodiment of the present invention. Detailed Implementation

[0038] Virtualization is a solution for simplifying management and optimizing resources, much like a spacious, open office building where walls are almost invisible. Users can create more autonomous and suitable workspaces at the same cost, maximizing space utilization. This involves re-planning limited, fixed resources according to different needs to achieve maximum utilization. However, traditional virtual machine serial port access permissions are excessive, granting modification rights to running programs and configuration files, as well as access to data files. This poses many security risks in production environments. Especially when performing abnormal operations, such as executing commands like `watch` on the serial port, it can lead to serial port device overload and uncertainty in system stability. Therefore, this invention provides a method to enhance virtual machine security by limiting operations on the virtual machine, addressing the problem of excessive virtual machine serial port access permissions and the associated risks in production environments.

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] This invention provides a method for enhancing virtual machine security, such as... Figure 1 As shown, it includes the following steps:

[0041] S101. Disable the virtual machine's console;

[0042] It should be noted that the aforementioned console is the original console of the virtual machine itself. In this invention, the original console of the virtual machine needs to be disabled in order to disable the serial port service.

[0043] S102. Run the host system on the virtual machine;

[0044] Specifically, the virtual machine can be a KVM (Kernel-based Virtual Machine) virtual machine. KVM is an open-source system virtualization module that uses Linux's own scheduler for management. This invention chooses to install the virtual machine under KVM. When executing step S102, the host system can run on the KVM virtual machine.

[0045] S103. Deploy the socket communication channel between the host machine and the virtual machine;

[0046] In this step, a socket communication channel can be deployed between the host machine and the KVM virtual machine. In practical applications, socket communication allows for direct data transmission after a connection is established, and proactive information push can be implemented during connection. A socket, also known as a socket interface, provides a port for communication with the outside world within a program. This invention, by deploying a socket communication channel, provides a channel for data transmission between the host machine and the virtual machine, and is simple to use.

[0047] S104. Perform user authentication based on the socket communication channel, and execute commands from the limited command list after successful authentication.

[0048] In this step, user authentication is performed based on the socket communication channel established in step 103, supporting the execution of commands from a limited command list. It should be noted that the above user authentication can be performed using multi-user groups / multi-user methods, including but not limited to super administrators, security personnel, and monitors. Different limited command lists are supported for different user groups, and access directories are restricted.

[0049] In the above-described method for enhancing virtual machine security provided in this embodiment of the invention, the original console of the virtual machine is disabled, and after the host system is run on the virtual machine, a socket communication channel between the host and the virtual machine is deployed. User authentication is performed based on the socket communication channel to limit the list of commands, which can be configured by the administrator. This can limit the operation on the virtual machine, meet the needs of the production environment, and maximize the security of the virtual machine production environment.

[0050] Furthermore, in a specific implementation, the method for enhancing virtual machine security provided in the above embodiments of the present invention may further include, before executing step S101 to disable the virtual machine's console, modifying the source code configuration file and compiling to generate virtualization components.

[0051] Preferably, the source code configuration file is modified and compiled to generate a virtualization component. Specifically, this may include modifying the libvirt.spec configuration file in the libvirt source code and compiling it to generate the libvirt virtualization component. Libvirt is an open-source API (Application Programming Interface), daemon, and management tool for managing virtualization platforms. Libvirt provides a convenient way to manage virtual machines and other collections of virtualization functionalities, such as storage and network interface management. This invention modifies the libvirt.spec configuration file in the libvirt source code and recompiles it to generate the libvirt virtualization component to manage virtual machines, disabling the original virtual machine console.

[0052] In specific implementation, the method for enhancing virtual machine security provided in the embodiments of the present invention may further include, while performing step S101 to disable the virtual machine's console, adding and displaying a prompt message indicating that the console is not supported. For example, adding the prompt "option: console is not supported".

[0053] It should be noted that this invention can also disable the serial port service by disabling console.service after the virtual machine system starts, without modifying the libvirt source code.

[0054] In specific implementation, the method for enhancing virtual machine security provided in the above embodiments of the present invention may further include, after running the host system on the virtual machine in step S102, installing the virtual machine system through a graphical interface; or, when the host machine has no graphics card, using virt-manager to remotely operate the virtualization components on the host machine through the network to install the virtual machine system.

[0055] Specifically, the above steps address two scenarios: the host machine has a graphics card and the virtual machine system is installed. When the host machine has a graphics card, the installation can be performed via a graphical interface, eliminating the need for a serial port. When the host machine lacks a graphics card, virt-manager can be used to remotely operate the virtualization components on the host machine over a network to install the virtual machine system. Using an unattended installation method, after importing the ks file, the installation of the virtual machine system can be completed without manual intervention.

[0056] In specific implementation, in the above-described method for enhancing virtual machine security provided in the embodiments of the present invention, after executing step S103 to deploy the socket communication channel between the host machine and the virtual machine, it may further include: selecting the Transmission Control Protocol (TCP) mode and using a limited port to perform communication between the host machine and the virtual machine.

[0057] Specifically, in the above steps, the communication method in the deployed socket communication channel can be TCP, a connection-oriented, reliable, byte-stream-based transport layer communication protocol. Additionally, the communication channel uses a limited port. In practical applications, other unnecessary ports should be disabled.

[0058] In specific implementation, the method for enhancing virtual machine security provided in the embodiments of the present invention may further include, while executing the commands in the limited command list in step S104, limiting the command parameters of the commands in the limited command list.

[0059] Specifically, in the above steps, the commands in the limited command line list can have their parameters restricted. Since some important directories in the virtual machine system are generally only read-only by users, by restricting the command parameters, the security of important directories in the virtual machine system can be guaranteed even if there are commands with extended privileges in the limited command line list.

[0060] In specific implementation, the method for enhancing virtual machine security provided in the embodiments of the present invention may further include, after executing commands from the limited command list in step S104: auditing user login and operation logs, periodically analyzing and investigating system security; and periodically changing user passwords to ensure password complexity, including numbers, letters, uppercase and lowercase letters, and special characters. This can further improve the security of the virtual machine.

[0061] Furthermore, in a specific implementation, the method for enhancing virtual machine security provided in the embodiments of the present invention may further include: determining whether the socket communication channel is disconnected within a set time period; if so, automatically exiting the host system and clearing residual sessions.

[0062] Specifically, in the above steps, the socket communication channel between the host machine and the virtual machine is configured with an automatic timeout exit mechanism. If the virtual machine is not operated for a set period of time, system resources are released in a timely manner, and residual sessions are cleared to avoid session residue occupying system space and affecting the stable operation of the virtual machine system. Preferably, the set time period can be set to 2 minutes, but other time periods are also possible, depending on the actual situation, and are not limited here.

[0063] The following is a specific example illustrating the method for enhancing virtual machine security provided in this embodiment of the invention. The specific steps are as follows:

[0064] Step 1: Modify the source code configuration file, compile to generate virtualization components, disable the virtual machine's console, and add and display a message indicating that the console is not supported.

[0065] Specifically, the libvirt.spec configuration file in the libvirt source code is modified to recompile and generate the libvirt virtualization component, disable the original console of the KVM virtual machine, and add the prompt "option: console is not supported" to disable the serial port service.

[0066] Step 2: Run the host system on the virtual machine.

[0067] Specifically, the host system runs on a KVM virtual machine.

[0068] Step 3: Install the virtual machine system through the graphical interface; or, when the host machine has no graphics card, use virt-manager to remotely operate the virtualization components on the host machine over the network to install the virtual machine system.

[0069] Specifically, the installation of the virtual machine system can be performed through a graphical interface, without the need for serial port support. For cases where the host machine lacks a graphics card, virt-manager can be used to remotely operate the virtualization components on the host machine via the network to install the virtual machine system. Using an unattended installation method, after importing the ks file, the installation of the virtual machine system can be completed without manual intervention.

[0070] It should be noted that this invention can also disable the virtual machine's console.service after the virtual machine system starts, without modifying the libvirt source code, thereby disabling the serial port service.

[0071] Step 4: Deploy a socket communication channel between the host machine and the virtual machine, and use the TCP protocol and a limited port for communication between the host machine and the virtual machine.

[0072] Specifically, when deploying a socket communication channel between the host machine and the KVM virtual machine, the TCP protocol should be used, a limited port should be used, and other unnecessary ports should be disabled.

[0073] Step 5: Perform user authentication based on the socket communication channel. After successful authentication, execute commands from the limited command list and restrict the command parameters of the commands in the limited command list.

[0074] Specifically, based on the communication channel between the host machine and the virtual machine deployed in step four, user authentication is performed, supporting the execution of commands from a limited command list. User authentication here can employ multi-user group / multi-user methods, including but not limited to super administrators, security personnel, and monitors. Different limited command lists are supported for different user groups, and access directories are restricted.

[0075] The command parameters in the aforementioned limited command line list can be restricted because some important directories in the virtual machine system generally only have read permissions for users. In this invention, by restricting the command parameters, even if there are extended permissions commands in the limited command line list, the security of important directories in the virtual machine system can still be guaranteed.

[0076] Step 6: Audit user login and operation logs regularly to check system security; change user passwords regularly to ensure password complexity, which must include numbers, letters, uppercase and lowercase letters, and special characters.

[0077] Step 7: Determine whether the socket communication channel is disconnected within the set time period; if so, automatically exit the host system and clear any remaining sessions.

[0078] Specifically, the socket communication channel between the host machine and the virtual machine is configured with an automatic timeout exit mechanism, typically 2 minutes. If there is no operation for more than 2 minutes, system resources are released in a timely manner and residual sessions are cleared to avoid session residue occupying system space and affecting the stable operation of the virtual machine system.

[0079] Based on the same inventive concept, this invention also provides an apparatus for enhancing virtual machine security. Since the principle of this apparatus in solving the problem is similar to that of the aforementioned method for enhancing virtual machine security, the implementation of this apparatus can refer to the implementation of the method for enhancing virtual machine security, and the repeated parts will not be described again.

[0080] In specific implementation, the device for enhancing virtual machine security provided in the embodiments of the present invention, such as... Figure 2 As shown, it specifically includes:

[0081] Console Disabling Module 11 is used to disable the virtual machine's console.

[0082] System running module 12 is used to run the host system on the virtual machine;

[0083] Channel deployment module 13 is used to deploy a socket communication channel between the host machine and the virtual machine;

[0084] The authentication execution module 14 is used to authenticate users based on the socket communication channel and execute commands from a limited command list after successful authentication.

[0085] In the above-described device for enhancing virtual machine security provided in this embodiment of the invention, the original console of the virtual machine can be disabled through the interaction of the above four modules. After the host system is run on the virtual machine, a socket communication channel between the host and the virtual machine is deployed, and user authentication is performed based on the socket communication channel to limit the list of commands. This allows for administrator configuration, thereby limiting the operation of the virtual machine, meeting the needs of the production environment, and maximizing the security of the virtual machine production environment.

[0086] In practical implementation, system operation module 12 can be used to run the host system on a KVM virtual machine. Channel deployment module 13 can be used to deploy a socket communication channel between the host machine and the KVM virtual machine.

[0087] Furthermore, in specific implementations, the apparatus for enhancing virtual machine security provided in the embodiments of the present invention may further include:

[0088] The component generation module is used to modify the source code configuration file and compile it to generate virtualization components.

[0089] Specifically, the component generation module can be used to modify the libvirt.spec configuration file in the libvirt source code and compile it to generate the libvirt virtualization component. This modification of the libvirt.spec configuration file and recompilation to generate the libvirt virtualization component enables the management of virtual machines and disables the original virtual machine console.

[0090] Furthermore, in specific implementations, the apparatus for enhancing virtual machine security provided in the embodiments of the present invention may further include:

[0091] The prompt module is used to add and display prompts for cases where the console is not supported.

[0092] Specifically, the prompt message added and displayed by the prompt module can be "option:console is not supported".

[0093] Furthermore, in specific implementations, the apparatus for enhancing virtual machine security provided in the embodiments of the present invention may further include:

[0094] The system installation module is used to install virtual machine systems through a graphical interface; it is also used to install virtual machine systems by remotely operating the virtualization components on the host machine via the network using virt-manager when the host machine has no graphics card.

[0095] The above system installation module can be used to install the system unattended. After importing the ks file, the installation of the virtual machine system can be completed without manual intervention.

[0096] Furthermore, in specific implementations, the apparatus for enhancing virtual machine security provided in the embodiments of the present invention may further include:

[0097] The communication module is used to select the TCP protocol and use a limited port for communication between the host machine and the virtual machine.

[0098] Furthermore, in specific implementations, the apparatus for enhancing virtual machine security provided in the embodiments of the present invention may further include:

[0099] The parameter limiting module is used to limit the command parameters of commands in a limited list of commands.

[0100] When there are extended privilege commands in the limited command line list, the security of important directories in the virtual machine system can also be guaranteed by using the above parameter limitation module.

[0101] Furthermore, in specific implementations, the apparatus for enhancing virtual machine security provided in the embodiments of the present invention may further include:

[0102] The logging module is used to audit user login and operation logs, and to periodically analyze and investigate system security.

[0103] The password modification module is used to periodically change user passwords, ensuring password complexity and requiring the inclusion of numbers, letters, uppercase and lowercase letters, and special characters.

[0104] Furthermore, in specific implementations, the apparatus for enhancing virtual machine security provided in the embodiments of the present invention may further include:

[0105] The judgment module is used to determine whether the socket communication channel is disconnected within a set time period; if so, it automatically exits the host system and clears the residual sessions.

[0106] Specifically, the judgment module can be used to determine whether to operate the virtual machine within a set time period (e.g., 2 seconds). If no operation is performed, the virtual machine will automatically exit the host system, release system resources in a timely manner, and clear residual sessions to avoid session residue occupying system space and affecting the stable operation of the virtual machine system.

[0107] For more detailed information on the working process of each of the above modules, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0108] Accordingly, embodiments of the present invention also disclose a device for enhancing virtual machine security, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the method for enhancing virtual machine security disclosed in the foregoing embodiments. For more specific details of the above method, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0109] Furthermore, the present invention also discloses a computer-readable storage medium for storing a computer program; when the computer program is executed by a processor, it implements the aforementioned method for enhancing virtual machine security. For more specific details regarding the above method, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0110] The aforementioned devices for enhancing virtual machine security can vary considerably due to differences in configuration and performance, and may include one or more processors and memory, and one or more storage media (e.g., one or more mass storage devices) for storing applications or data. The memory and storage media can be transient or persistent storage. The program stored on the storage media may include one or more modules, each module including a series of instructions operating on the device. Furthermore, the processor may be configured to communicate with the storage media and execute the series of instructions stored on the storage media on the device for enhancing virtual machine security.

[0111] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatuses, devices, and storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0112] In the several embodiments provided in this application, it should be understood that the disclosed apparatus, devices, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0113] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0114] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0115] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a function call device, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0116] In summary, the present invention provides a method for enhancing virtual machine security, comprising: disabling the virtual machine's console; running a host system on the virtual machine; deploying a socket communication channel between the host machine and the virtual machine; performing user authentication based on the socket communication channel; and executing commands from a limited command list upon successful authentication. This method disables the virtual machine's original console, runs a host system on the virtual machine, deploys a socket communication channel between the host machine and the virtual machine, and performs user authentication based on the socket communication channel to limit the command list, allowing administrator configuration. This restricts operations on the virtual machine, meeting the needs of a production environment while maximizing the security of the virtual machine production environment. Furthermore, the present invention also provides corresponding devices, equipment, and computer-readable storage media for enhancing virtual machine security, further enhancing the practicality of the method. These devices, equipment, and computer-readable storage media offer corresponding advantages.

[0117] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0118] The above provides a detailed description of the method, apparatus, device, and storage medium for enhancing virtual machine security provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for enhancing virtual machine security, characterized in that, include: Modify the libvirt.spec configuration file in the libvirt source code to compile and generate the libvirt virtualization component to manage virtual machines and disable the virtual machine console. The host system runs on the virtual machine; When the host machine has a graphics card, the virtual machine system can be installed through a graphical interface; or... When the host machine has no graphics card, virt-manager is used to remotely operate the virtualization components on the host machine over the network, and the ks file is imported in an unattended installation mode to install the virtual machine system. Deploy a socket communication channel between the host machine and the virtual machine; the socket communication channel between the host machine and the virtual machine is equipped with an automatic timeout exit mechanism. If the virtual machine is not operated for a set period of time, system resources are released and residual sessions are cleared. User authentication is performed based on the socket communication channel, and commands from a limited command list are executed upon successful authentication. Determine whether the socket communication channel is disconnected within a set time period; If disconnected, the system will automatically exit the host system and clear any remaining sessions.

2. The method for enhancing virtual machine security according to claim 1, characterized in that, Disabling the virtual machine's console also includes: Add and display a message indicating that the console is not supported.

3. The method for enhancing virtual machine security according to claim 1, characterized in that, After deploying the socket communication channel between the host machine and the virtual machine, the following is also included: The TCP protocol is selected, and a limited port is used for communication between the host machine and the virtual machine.

4. The method for enhancing virtual machine security according to claim 1, characterized in that, In addition to executing commands from a limited list of commands, it also includes: The command parameters of the commands in the limited command list are restricted.

5. A device for enhancing virtual machine security, characterized in that, include: The component generation module is used to modify the libvirt.spec configuration file in the libvirt source code and compile it to generate libvirt virtualization components to enable virtual machine management; The console disable module is used to disable the virtual machine's console. The system runtime module is used to run the host system on the virtual machine; The system installation module is used to install the virtual machine system through a graphical interface when the host machine has a graphics card; or, when the host machine does not have a graphics card, it uses virt-manager to remotely operate the virtualization components on the host machine via the network and imports the ks file in an unattended installation mode to install the virtual machine system. The channel deployment module is used to deploy a socket communication channel between the host machine and the virtual machine. The socket communication channel between the host machine and the virtual machine is equipped with an automatic timeout exit mechanism. If the virtual machine is not operated for a set period of time, system resources are released and residual sessions are cleared. The authentication execution module is used to authenticate users based on the socket communication channel and execute commands from a limited command list after successful authentication. The judgment module is used to determine whether the socket communication channel is disconnected within a set time period; if it is disconnected, it will automatically exit the host system and clear any residual sessions.

6. A device for enhancing virtual machine security, characterized in that, It includes a processor and a memory, wherein the processor implements the method for enhancing virtual machine security as described in any one of claims 1 to 4 when executing a computer program stored in the memory.

7. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the method for enhancing virtual machine security as described in any one of claims 1 to 4.

Images