A file security issuing method and system based on a virtualization system

Abstract

Disclosed are a file security issuing method and system based on a virtualization system, which comprises the following steps: obtaining an encrypted file in an isolated network domain by one-way access of the virtualization system, parsing the encrypted file and storing the parsed file in the virtualization system; building and starting a lighttpd service for file transmission, configuring access information of the file to be downloaded in an external network domain, and issuing a downloading instruction to a cloud host in the external network domain which needs to download the file by the virtualization system; and issuing the file to the cloud host according to the request of the cloud host by the virtualization system after analyzing the downloading restriction and the request legality. The security of file issuing is enhanced by improving the file itself, the network and the access control.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data transmission, and particularly relates to a file security issuing method and system based on a virtualization system. BACKGROUND

[0002] With the rapid development of computer technology, the openness of the Internet makes file transmission very convenient and fast. However, due to the openness of the Internet and the development of hacker technology, network space security has become one of the concerns. Network space has gradually developed into the fifth strategic space after sea, land, air and sky, and is the core, key and basis of affecting national security, social stability, economic development and cultural communication. Therefore, network security and file transmission security in the file issuing process have become the focus.

[0003] In the current file issuing process, in order to facilitate, most of the file source data and file download users are placed in the external network domain, and the users can access all the files at will. However, some file data is confidential, and there is a great risk of leakage if it is stored in the external network domain. In addition, if the file download users can download files at will and transmit the issued files to each other, it will cause uncontrollability in the file issuing process, and the security isolation between files will also be greatly affected.

[0004] Therefore, the protection of file data and network security and the control of the issuing process at the same time of normal file issuing are the guarantee of file security issuing.

[0005] Most of the current file issuing technologies directly store file data in clear text on the server in the same domain as the file download users, use Apache technology, and the users download files by sending requests to the file data server. After the download is completed, the file data can be transmitted at will. This way realizes the function of file issuing, but it is very unsafe to directly store the clear text data file in the external network domain, and once it is leaked, it will cause incalculable loss. Therefore, the following problems exist:

[0006] 1. File data is not encrypted; clear text file is directly stored on the server, and the security is low;

[0007] 2. No network isolation; users directly access the file server, so that the file server is exposed in the external network domain, and there is a risk of file leakage;

[0008] 3. Lack of file access control; users can access all files, and no file isolation is performed, so the privacy protection of the files is not in place;

[0009] 4. The file transmission control is missing; users can transfer the issued files at will, and the control of file transmission is not in place;

[0010] 5. Apache constantly forks and switches under intensive concurrency, resulting in high server resource occupation and unreasonable resource utilization. SUMMARY

[0011] In order to solve the above technical problems in the prior art, the present application provides a file security issuing method and system based on a virtualization system to solve the above technical problems.

[0012] According to one aspect of the present application, a file security issuing method based on a virtualization system is provided, comprising:

[0013] S1: The virtualization system unidirectionally accesses and acquires encrypted files in the isolated network domain, parses the encrypted files and stores them in the local virtualization system;

[0014] S2: A lighttpd service for file transmission is built and enabled, access information of the files to be downloaded in the external network domain is configured, and the virtualization system issues a download instruction to the cloud host in the external network domain that needs to download the files;

[0015] S3: The virtualization system parses the download restrictions and the request legality according to the request of the cloud host, and issues the files to the cloud host.

[0016] In some specific embodiments, the isolated network domain and the external network domain are physically isolated, and the virtualization system, the isolated network domain and the external network domain are limited to unidirectional access.

[0017] In some specific embodiments, the files are encrypted and stored in the isolated network domain in the form of fragments, the virtualization system unidirectionally accesses and acquires the encrypted files in the isolated network domain through token, in response to the request received by the file server in the isolated network domain, the file service parses and verifies the legality of the request and the token, and then issues the corresponding file data, and the encrypted files are parsed and stored in the local virtualization system through an algorithm.

[0018] In some specific embodiments, configuring the access information of the files to be downloaded in the external network domain specifically includes: the IP, port, access path or combination thereof to be accessed.

[0019] In some specific embodiments, the virtualization system executes the qemu-agent-command command through the qemu-guest-agent daemon process, and issues the download instruction to the cloud host in the external network domain that needs to download the files.

[0020] In some specific embodiments, the qemu-guest-agent daemon process of the cloud host receives, analyzes and executes the instruction through the serial port, sends a download request to the virtualization system.

[0021] In some specific embodiments, in response to the virtualization system receiving the request sent by the cloud host, the lighttpd analyzes and judges whether the request meets the download restriction, and confirms the legitimacy of the request: for a valid request, the lighttpd creates a CGI process, passes the request header and request body to the CGI program, waits for the CGI to process and receive the processing result from the CGI process, and issues the file to the cloud host.

[0022] In some specific embodiments, the virtualization system isolates the cloud host in the external network domain through a VLAN.

[0023] According to a second aspect of the present application, a computer readable storage medium is provided, which stores one or more computer programs, and the one or more computer programs are executed by a computer processor to implement the method of any one of the above.

[0024] According to a third aspect of the present application, a file security issuing system based on a virtualization system is provided, which comprises:

[0025] An isolated network domain configured to encrypt and store files in a fragmented form, and issue corresponding file data according to an access request of the virtualization system;

[0026] A virtualization system configured to access and obtain encrypted files in the isolated network domain in a one-way manner, analyze and store the encrypted files locally, build and enable a lighttpd service for file transmission, configure access information of the files to be downloaded in the external network domain, and issue a download instruction to the cloud host in the external network domain that needs to download the files;

[0027] An external network domain configured to receive, analyze and execute the instruction, send a download request to the virtualization system, and receive the file issued by the virtualization system.

[0028] The application provides a file security issuing method and system based on a virtualization system, which has the following technical effects: on the one hand, the file itself is encrypted and stored, thereby improving the security of the file source data; on the other hand, domain isolation is performed on the network, and the external network domain and the isolated network domain are completely physically isolated and cannot communicate, thereby greatly reducing the risk of file leakage; in addition, when the file is transmitted, the cloud host can only download the file issued to the cloud host and cannot download the file of other cloud hosts, thereby realizing accurate control of the file issuing; the cloud hosts are network-isolated and cannot access and transmit the issued file, thereby enhancing the privacy of the file transmission; and finally, the combination of the three can effectively improve the security of the whole file issuing process.Lighttpd is relatively lightweight compared with Apache, thereby reducing the pressure on server resources. BRIEF DESCRIPTION OF DRAWINGS

[0029] The accompanying drawings are included to provide a further understanding of embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate the embodiments and, together with the description, serve to explain the principles of the application. Other embodiments and many of the intended advantages of the present application will be readily appreciated as the same becomes better understood by reference to the following detailed description when considered in connection with the accompanying drawings. Other features, objects, and advantages of the application will become apparent from the detailed description taken in connection with the accompanying drawings:

[0030] Figure 1 is an exemplary system architecture diagram to which the present application can be applied;

[0031] Figure 2 is a flowchart of a file security issuing method based on a virtualization system of one embodiment of the present application;

[0032] Figure 3 is a framework diagram of a file security issuing system based on a virtualization system of one embodiment of the present application;

[0033] Figure 4 is a structural schematic diagram of a computer system of an electronic device suitable for implementing the embodiments of the present application. DETAILED DESCRIPTION

[0034] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that, for the convenience of description, only the parts related to the application are shown in the drawings.

[0035] It should be noted that the embodiments and features in the embodiments in the present application can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and embodiments.

[0036] Figure 1 An exemplary system architecture 100 in which a file security issuing method based on a virtualization system can be applied is shown.

[0037] As shown in Figure 1 , the system architecture 100 can include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is a medium for providing a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links, or fiber optic cables, and the like.

[0038] A user can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, and the like. Various applications can be installed on the terminal devices 101, 102, 103, such as data processing applications, data visualization applications, web browser applications, and the like.

[0039] The terminal devices 101, 102, 103 can be hardware or software. When the terminal devices 101, 102, 103 are hardware, they can be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like. When the terminal devices 101, 102, 103 are software, they can be installed in the above-listed electronic devices. They can be implemented as multiple software or software modules (for example, software or software modules for providing distributed services), or as a single software or software module. No specific limitation is made herein.

[0040] The server 105 can be a server that provides various services, such as a background information processing server that provides support for the mapping table data displayed on the terminal devices 101, 102, 103. The background information processing server can process the obtained logical address and generate a processing result.

[0041] It should be noted that the method provided by the embodiments of the present application can be executed by the server 105 or the terminal devices 101, 102, 103, and the corresponding apparatus is generally provided in the server 105 or the terminal devices 101, 102, 103.

[0042] It should be noted that the server can be hardware or software. When the server is hardware, it can be implemented as a distributed server cluster composed of multiple servers, or as a single server. When the server is software, it can be implemented as multiple software or software modules (for example, software or software modules for providing distributed services), or as a single software or software module. No specific limitation is made herein.

[0043] It should be understood that Figure 1 The number of terminal devices, networks and servers in the above-mentioned system is only illustrative. Any number of terminal devices, networks and servers can be provided according to implementation needs.

[0044] According to an embodiment of the present application, a file security issuing method based on a virtualization system, Figure 1 A flow chart of a file security issuing method based on a virtualization system according to an embodiment of the present application is shown. As shown in Figure 1 The method comprises the following steps:

[0045] S201: The virtualization system unidirectionally accesses encrypted files in the isolated network domain, parses the encrypted files and stores them in the virtualization system locally.

[0046] In a specific embodiment, the files are encrypted and stored in the isolated network domain in the form of fragments. The virtualization system unidirectionally accesses the encrypted files in the isolated network domain through a token. In response to the file server in the isolated network domain receiving a request, the file server parses and verifies the legality of the request and the token, and then issues corresponding file data. The encrypted files are parsed by an algorithm and stored in the virtualization system locally. The file data in the isolated network domain is the data source of the entire file issuing. The encrypted storage of the data source file fragments, the identity confirmation of the file server when the virtualization system accesses the file data, and the decryption of the file data are one of the core invention points of the present application for realizing file data security. Placing the file data in the isolated network domain, effective network isolation is the greatest protection for the file data.

[0047] S202: A lighttpd service for file transmission is built and enabled. Access information of the cloud host in the external network domain that needs to download files is configured. The virtualization system issues a download instruction to the cloud host in the external network domain that needs to download files. Through the lighttpd service, the cloud host downloads the files for fine control; the cloud host is specified to only request to download specified files, which is a key to file issuing isolation, and ensures the security of file transmission, which is another important invention point of the present application.

[0048] In a specific embodiment, configuring the access information of the cloud host in the external network domain that needs to download files specifically comprises: IP, port, access path or a combination thereof that needs to be accessed, to realize access control of the cloud host in the external network domain to the files.

[0049] In specific embodiments, the virtualization system executes the qemu-agent-command command through the qemu-guest-agent daemon to issue a download instruction to the cloud host in the external network domain that needs to download the file. The qemu-guest-agent daemon of the cloud host receives, analyzes and executes the instruction through the serial port, and sends a download request to the qemu-guest-agent daemon of the virtualization system cloud host, which receives, analyzes and executes the instruction through the serial port, and sends a download request to the virtualization system.

[0050] S203: The virtualization system parses the download restriction and the request legality according to the request of the cloud host, and issues the file to the cloud host.

[0051] In specific embodiments, in response to the virtualization system receiving the request sent by the cloud host, the lighttpd parses and judges whether the request meets the download restriction, and confirms the legality of the request: for a valid request, the lighttpd creates a CGI process, passes the request header and request body to the CGI program, waits for the CGI to process and receive the processing result from the CGI process, and issues the file to the cloud host.

[0052] In specific embodiments, the physical isolation between the isolated network domain and the external network domain, and the one-way access limitation among the virtualization system, the isolated network domain and the external network domain. The virtualization system isolates the cloud host in the external network domain through VLAN. Network isolation of the cloud host through VLAN is the key to control the issued file, which is another important point of the application. At the same time, the light service in the application improves the resource utilization of the server.

[0053] Continuing to refer to Figure 3 , Figure 3 A framework diagram of a file security issuing system based on a virtualization system according to an embodiment of the application is shown. The system specifically includes an isolated network domain 301, a virtualization system 302 and an external network domain 303. The isolated network domain 301 is configured to encrypt and store files in a fragmented form, and issue corresponding file data according to the access request of the virtualization system; the virtualization system 302 is configured to access the encrypted files in the isolated network domain in one direction, analyze and store the encrypted files locally, build and enable the lighttpd service for file transmission, configure the access information of the cloud host in the external network domain that needs to download the file, and issue a download instruction to the cloud host in the external network domain that needs to download the file; the external network domain 303 is configured to receive, analyze and execute the instruction, send a download request to the virtualization system, and receive the file issued by the virtualization system. The file security issuing system of the embodiment aims to achieve normal file issuing while considering file data security, network access security and control of file issuing. In view of the deficiencies in the prior art, the following improvements are made:

[0054] 1. Source file encryption is stored in the file server, further protecting the security of file data;

[0055] 2. Isolation of the network places file data in the isolated network domain, avoiding the problem of file exposure in the external network;

[0056] 3. The virtualization system implements network isolation between cloud hosts that cannot access each other, preventing the transmission of downloaded files between cloud hosts, and allowing cloud hosts to access the virtualization system only in one direction;

[0057] 4. By fine-grained control of cloud host access to files, the effect of allowing only specified cloud hosts to download specified files is achieved;

[0058] 5. Replace Apache with lighttpd, which uses Multiplex technology, optimized code, very small size, low resource consumption (relative to Apache), and very fast response speed.

[0059] In the file delivery system of the embodiment, it specifically includes network isolation, file delivery and cloud host isolation.

[0060] In a specific embodiment, network isolation specifically embodies physical isolation between the isolated network domain and the external network domain, and cannot interconnect; the virtualization system to the isolated network domain, the external network domain to the virtualization system are limited to one-way access through the firewall, by controlling the source of access information, greatly reducing the risk of file data leakage, and ensuring the security of file data in the isolated network domain.

[0061] In a specific embodiment, file delivery specifically embodies two parts: file acquisition and file transmission. The specific steps of file acquisition are as follows:

[0062] 1. The file is encrypted and stored in the isolated network domain in the form of fragmentation, and the virtualization system accesses the encrypted file in the isolated network domain through token one-way access;

[0063] 2. The file server in the isolated network domain receives the request;

[0064] 3. The file service parses and verifies the legality of the request and token, and then delivers the corresponding file data;

[0065] 4. The encrypted file is parsed by an algorithm and stored in the local virtualization system.

[0066] The specific steps of file transmission are as follows:

[0067] 1. File transmission relies on lighttpd service, after the file is stored in the local virtualization system, the corresponding lighttpd service is built and started;

[0068] 2. Configure the access information of the file that needs to be downloaded in the external network domain, including the IP, port, access path and other information that needs to be accessed, and through the combination of these information, the access control of the cloud host to the file in the external network domain is realized;

[0069] 3. The virtualization system executes the qemu-agent-command command through the qemu-guest-agent daemon process, and issues a download instruction to the cloud host that needs to download the file in the external network domain;

[0070] 4. The cloud host qemu-guest-agent daemon process receives the instruction through the serial port and parses the instruction;

[0071] 5. The cloud host executes the instruction and sends a download request to the virtualization system;

[0072] 6. The virtualization system receives the request sent by the cloud host, lighttpd parses and judges whether the request meets the download restriction, and confirms the legality of the request;

[0073] 7. For a valid request, lighttpd first forks a CGI process, then passes the request header (through the environment parameter) and the request body (through the pipe) to the CGI program, waits for the CGI processing and receives the processing result from the CGI process, and finally issues the file to the cloud host.

[0074] In a specific embodiment, cloud host isolation is specifically embodied as the virtualization system isolates the cloud host in the external network domain through VLAN, and the cloud hosts cannot access and communicate with each other, avoiding illegal transmission of the issued file between the cloud hosts.

[0075] The file security issuing method and system based on the virtualization system of the application improve the security of file issuing through the improvement of the file itself, network and access control. On the one hand, the file itself is encrypted and stored, improving the security of the file source data; on the other hand, the network is isolated, the external network domain is completely physically isolated from the isolated network domain, and cannot communicate, greatly reducing the risk of file leakage; in addition, during file transmission, the cloud host can only download the file issued to the cloud host, and cannot download the file of other cloud hosts, realizing precise control of file issuing; the network isolation between cloud hosts cannot access and transmit the issued file, enhancing the privacy of file transmission. Finally, the combination of the three effectively improves the security of the entire file issuing process. Lighttpd is relatively lightweight compared to Apache, reducing the pressure on server resources.

[0076] The following refers to Figure 4It shows a schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application. Figure 4 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0077] like Figure 4 As shown, the computer system includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 402 or programs loaded from storage section 408 into random access memory (RAM) 403. RAM 403 also stores various programs and data required for the operation of system 400. CPU 401, ROM 402, and RAM 403 are interconnected via bus 404. Input / output (I / O) interface 405 is also connected to bus 404.

[0078] The following components are connected to I / O interface 405: an input section 406 including a keyboard, mouse, etc.; an output section 407 including a liquid crystal display (LCD) and speakers, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card and a modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to I / O interface 405 as needed. A removable medium 411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 410 as needed so that computer programs read from it can be installed into storage section 408 as needed.

[0079] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program in accordance with embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable storage medium, the computer program comprising program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 409, and / or installed from the removable media 411. When the computer program is executed by the central processing unit (CPU) 401, the above-described functions defined in the methods of the present application are performed. It should be noted that the computer readable storage medium of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, be - but is not limited to - an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as part of a carrier wave, in which the computer readable program code is carried. Such a propagated data signal can take any of a variety of forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer readable signal medium can also be any computer readable storage medium that can be used for by or in connection with an instruction execution system, apparatus or device, and that can contain or store a program for use by or in connection with an instruction execution system, apparatus or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the above.

[0080] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0081] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0082] The modules involved in the embodiments of the present application can be implemented in the form of software or hardware.

[0083] As another aspect, the application further provides a computer readable storage medium, which can be included in the electronic device described in the above embodiments, or can exist independently without being assembled into the electronic device. The computer readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: virtualize system unidirectional access to obtain an encrypted file in an isolated network domain, parse the encrypted file and store to a local virtualization system; build and enable a lighttpd service for file transmission, configure access information of a file to be downloaded in an external network domain, and the virtualization system issues a download instruction to a cloud host in the external network domain which needs to download the file; the virtualization system parses the download restriction and the request legality according to the request of the cloud host, and issues the file to the cloud host.

[0084] The above description is merely the preferred embodiments of the present application and the explanation of the applied technical principles. It should be understood by those skilled in the art that the inventive scope involved in the present application is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combinations of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features can be replaced with the technical features disclosed in the present application (but not limited to) having similar functions to form technical solutions.

Claims

1. A file security issuing method based on a virtualization system, characterized in that, The method comprises the following steps: S1: the virtualization system unidirectionally accesses and acquires an encrypted file in the isolated network domain, parses the encrypted file, and stores the parsed file in the local of the virtualization system; S2: a lighttpd service for file transmission is built and enabled, access information of the cloud host in the external network domain that needs to download a file is configured, and the virtualization system sends a download instruction to the cloud host in the external network domain that needs to download a file; S3: the virtualization system parses the download restriction and the request legality according to the request of the cloud host, and sends a file to the cloud host; The virtualization system sends a download instruction to the cloud host in the external network domain that needs to download a file through a qemu-guest-agent daemon process and a qemu-agent-command command, the qemu-guest-agent daemon process of the cloud host receives, parses, and executes the instruction through a serial port, sends a download request to the virtualization system, and in response to the request sent by the cloud host, the lighttpd parses and judges whether the request meets the download restriction, and confirms the legality of the request: for a valid request, the lighttpd creates a CGI process, passes the request header and request body to the CGI program, processes the received result from the CGI process, and sends a file to the cloud host, and the virtualization system isolates the cloud host in the external network domain through a VLAN.

2. The file security issuing method based on a virtualization system according to claim 1, wherein, The isolated network domain and the external network domain are physically isolated, and the virtualization system, the isolated network domain, and the external network domain are limited to unidirectional access. 3.The file security issuing method based on virtualization system according to claim 1, wherein, The file is stored in the isolated network domain in a fragmented form, the virtualization system unidirectionally accesses and acquires the encrypted file in the isolated network domain through a token, in response to a request received by a file server in the isolated network domain, the file server parses and verifies the legality of the request and the token, and sends corresponding file data, parses the encrypted file through an algorithm, and stores the parsed file in the local of the virtualization system.

4. The method of claim 1, wherein the method further comprises: Configuring access information of the cloud host in the external network domain that needs to download a file specifically includes: IP, port, access path, or a combination thereof that needs to be accessed.

5. A computer readable storage medium having stored thereon one or more computer programs. The one or more computer programs are executed by a computer processor to implement the method of any one of claims 1 to 4. 6.A file security issuing system based on a virtualization system, characterized in that, The system comprises: an isolated network domain configured to store a file in a fragmented form, and send corresponding file data according to an access request of a virtualization system; a virtualization system configured to unidirectionally access and acquire an encrypted file in the isolated network domain, parse the encrypted file, and store the parsed file in the local of the virtualization system, build and enable a lighttpd service for file transmission, configure access information of the cloud host in the external network domain that needs to download a file, and send a download instruction to the cloud host in the external network domain that needs to download a file; an external network domain configured to receive, parse, and execute the instruction, send a download request to the virtualization system, and receive a file sent by the virtualization system; The virtualization system executes the qemu-agent-command command through the qemu-guest-agent daemon, and issues a download instruction to a cloud host in an external network domain that needs to download a file; the qemu-guest-agent daemon of the cloud host receives, analyzes and executes the instruction through a serial port, and sends a download request to the virtualization system; in response to the virtualization system receiving the request sent by the cloud host, the lighttpd analyzes and judges whether the request meets the download restriction, and confirms the legality of the request; for a valid request, the lighttpd creates a CGI process, passes the request header and request body to the CGI program, waits for the CGI to process and receive the processing result from the CGI process, and issues the file to the cloud host; and the virtualization system isolates the cloud host in the external network domain through a VLAN.

Images