Virtual machine isolation method, device and computer equipment

Abstract

The application relates to a virtual machine isolation method, device, computer equipment, storage medium and computer program product. The method comprises the following steps: after receiving a virtual machine isolation request, determining a target virtual machine according to a target virtual machine identifier, determining an isolation object on the target virtual machine according to an isolation object identifier, and isolating the isolation object to a virtual machine security space of the target virtual machine when detecting that the isolation object is running. The application constructs a virtual machine security space in a target virtual machine in advance, so that object isolation corresponding to the isolation object is realized in the virtual machine security space, behavior isolation in a virtual machine running process can be effectively obtained, and virtual machine security protection can be effectively realized.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a virtual machine isolation method, apparatus, and computer device. Background Technology

[0002] With the development of computer and network technologies, cloud technology has emerged. It refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. Cloud technology is typically combined with virtualization technology, such as using virtual machines (VMs) to build cloud service platforms. A VM is a software-simulated computer system with complete hardware system functionality, running in a completely isolated environment. Any task that can be performed on a physical computer can also be performed in a VM. Cloud workload security has become an indispensable fundamental capability of cloud platforms and a fiercely contested area for cloud providers and security vendors.

[0003] Traditionally, cloud workload security is primarily handled through memory and process analysis based on VMI technology provided by XenServer, thereby protecting the security of services within virtual machines. However, this technology can only provide memory and process detection, and its security protection capabilities are limited. Summary of the Invention

[0004] Therefore, it is necessary to provide a virtual machine isolation method, device, computer equipment, computer-readable storage medium, and computer program product that can effectively achieve virtual machine security protection on cloud platforms, addressing the aforementioned technical problems.

[0005] Firstly, this application provides a virtual machine isolation method. The method includes:

[0006] Receive a virtual machine isolation request, the virtual machine isolation request including a target virtual machine identifier and an isolation object identifier;

[0007] The target virtual machine is determined based on the target virtual machine identifier, and the isolation object on the target virtual machine is determined based on the isolation object identifier;

[0008] When the isolated object is detected to be running, the isolated object is isolated to the virtual machine security space of the target virtual machine.

[0009] Secondly, this application also provides a virtual machine isolation device. The device includes:

[0010] The request acquisition module is used to receive virtual machine isolation requests, wherein the virtual machine isolation request includes a target virtual machine identifier and an isolation object identifier;

[0011] An object identification module is used to determine a target virtual machine based on the target virtual machine identifier and to determine an isolated object on the target virtual machine based on the isolated object identifier.

[0012] The object isolation module is used to isolate the isolated object to the virtual machine security space of the target virtual machine when the isolated object is detected to be running.

[0013] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0014] Receive a virtual machine isolation request, the virtual machine isolation request including a target virtual machine identifier and an isolation object identifier;

[0015] The target virtual machine is determined based on the target virtual machine identifier, and the isolation object on the target virtual machine is determined based on the isolation object identifier;

[0016] When the isolated object is detected to be running, the isolated object is isolated to the virtual machine security space of the target virtual machine.

[0017] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0018] Receive a virtual machine isolation request, the virtual machine isolation request including a target virtual machine identifier and an isolation object identifier;

[0019] The target virtual machine is determined based on the target virtual machine identifier, and the isolation object on the target virtual machine is determined based on the isolation object identifier;

[0020] When the isolated object is detected to be running, the isolated object is isolated to the virtual machine security space of the target virtual machine.

[0021] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0022] Receive a virtual machine isolation request, the virtual machine isolation request including a target virtual machine identifier and an isolation object identifier;

[0023] The target virtual machine is determined based on the target virtual machine identifier, and the isolation object on the target virtual machine is determined based on the isolation object identifier;

[0024] When the isolated object is detected to be running, the isolated object is isolated to the virtual machine security space of the target virtual machine.

[0025] The aforementioned virtual machine isolation method, apparatus, computer equipment, storage medium, and computer program product, upon receiving a virtual machine isolation request, determine a target virtual machine based on the target virtual machine identifier, determine an isolation object on the target virtual machine based on the isolation object identifier, and when the isolation object is detected to be running, isolate the isolation object to the virtual machine security space of the target virtual machine. This application, by pre-constructing a virtual machine security space within the target virtual machine, thereby achieving object isolation corresponding to the isolation object within the virtual machine security space, can effectively obtain behavioral isolation during virtual machine operation, thus effectively achieving virtual machine security protection. Attached Figure Description

[0026] Figure 1 This is a diagram illustrating the application environment of a virtual machine isolation method in one embodiment;

[0027] Figure 2 This is a flowchart illustrating a virtual machine isolation method in one embodiment;

[0028] Figure 3 This is a flowchart illustrating a virtual machine isolation method implemented on the server side in one embodiment;

[0029] Figure 4 This is a flowchart illustrating a virtual machine isolation method implemented on the virtual machine side in one embodiment;

[0030] Figure 5 This is a flowchart illustrating a virtual machine isolation method for implementing behavior monitoring in one embodiment;

[0031] Figure 6 This is a flowchart illustrating the steps of constructing a virtual machine security space in one embodiment;

[0032] Figure 7 This is a flowchart illustrating the steps of obtaining the symbol table library in one embodiment;

[0033] Figure 8 This is a schematic diagram illustrating the isolation effect of a security-sensitive module in one embodiment;

[0034] Figure 9 This is a flowchart illustrating the virtual machine isolation method in another embodiment;

[0035] Figure 10 This is a schematic diagram illustrating the isolation effect of the virtual machine internal behavior monitoring process in one embodiment;

[0036] Figure 11This is a schematic diagram of a virtual machine system architecture used to implement virtual machine isolation in one embodiment;

[0037] Figure 12 This is a schematic diagram of the overall workflow for implementing virtual machine isolation in one embodiment;

[0038] Figure 13 This is a schematic diagram of the process from the cloud console to the security analysis software in one embodiment;

[0039] Figure 14 This is a schematic diagram illustrating the process of building and setting up virtual machine security space in one embodiment.

[0040] Figure 15 This is a flowchart illustrating the process of intercepting internal virtual machine behavior in one embodiment;

[0041] Figure 16 This is a structural block diagram of a virtual machine isolation device in one embodiment;

[0042] Figure 17 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0044] This application specifically relates to cloud technology, which refers to the collective term for network technology, information technology, integration technology, management platform technology, and application technology based on cloud computing business models. These technologies can form resource pools, allowing for flexible and convenient on-demand use. Cloud computing technology will become a crucial support. The backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may eventually possess its own identification mark, requiring transmission to a backend system for logical processing. Data at different levels will be processed separately, and various industry data will all require robust system support, which can only be achieved through cloud computing.

[0045] This application primarily relates to a virtual machine security isolation and monitoring method based on cloud security technology. Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms applied based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior detection. It uses a large network of clients to monitor abnormal software behavior on the network, obtains the latest information on Trojans and malware on the Internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client. The main research directions in cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information and improve the ability to control network-wide security events and risks; 3. Cloud security services, which mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0046] Technical terms used in this solution:

[0047] Secure World (SW) is a trusted execution environment isolated in the kernel space of a virtual machine, used to execute security-sensitive applications, such as information gathering agents.

[0048] The virtual machine runtime environment space NW: Normal World, is the normal operating environment of the virtual machine, as opposed to the safe space.

[0049] Switch Gate (SG): A call gate module that allows users to switch between secure space and normal space.

[0050] Trusted Application Module (TM): An application that runs in a secure environment and cannot be attacked.

[0051] EPT (Extended Page Table): Intel introduced memory virtualization technology, which adds a first-level page table to the original page table to realize the mapping from the guest physical address to the physical machine physical address, namely GPG address translation.

[0052] Guest Virtual Address (GVG): The virtual address within the virtual machine's own address space.

[0053] Guest Physical Address (GPG): The physical address within the virtual machine's own address space.

[0054] Physical address GPG: Gost Physical Address, the physical address in the physical machine's address space.

[0055] KVM Gypervisor (Kernel Virtual Machine Gypervisor): A KVM virtual machine monitor.

[0056] The SGX (Software Guard Extensions) CPU chip provides a hardware-level hardware isolation environment that can protect selected code and data from being leaked and modified.

[0057] The virtual machine isolation method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, virtual machine 102 communicates with server 104 via a network, specifically connected to a virtual machine monitor on server 104. Terminal 106 can also communicate with server 104 via a network. Virtual machine 102 has a pre-built virtual machine security space corresponding to its runtime environment. Virtual machine 102 and server 104 form a virtual machine system. The data storage system can store the data that server 104 needs to process. The data storage system can be integrated on server 104 or placed on the cloud or other servers. When a user on terminal 106 needs to isolate an object within virtual machine 102, they can send a virtual machine isolation request to server 104 based on the identifier of the object to be isolated and the identifier of virtual machine 102. Server 104 receives the virtual machine isolation request; determines the target virtual machine as virtual machine 102 based on the target virtual machine identifier, and identifies the isolated object on the target virtual machine based on the isolated object identifier; when the isolated object on virtual machine 102 is detected running, it is isolated to the virtual machine security space within virtual machine 102. Specifically, virtual machine 102 includes a KVM (Kernel Virtual Machine) virtual machine, with the KVM Gypervisor serving as the virtual machine monitor. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Terminal 106 can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these.

[0058] In one embodiment, such as Figure 2 As shown, a virtual machine isolation method is provided, which can be applied to... Figure 1 Taking the virtual machine system built on virtual machine 102 and server 104 as an example, the following steps are included:

[0059] Step 201: Receive a virtual machine isolation request. The virtual machine isolation request includes the target virtual machine identifier and the isolation object identifier.

[0060] Step 203: Determine the target virtual machine based on the target virtual machine identifier, and determine the isolation object on the target virtual machine based on the isolation object identifier.

[0061] The virtual machine isolation request is submitted by a worker on terminal 106, requesting server 104 to isolate a specified object within the virtual machine. The virtual machine isolation request includes a target virtual machine identifier and an isolation object identifier. The target virtual machine identifier corresponds to the target virtual machine, allowing the server to identify the virtual machine requiring isolation. The isolation object identifier corresponds to the isolation object, used to determine the object within the virtual machine that needs to be isolated. In one embodiment, the isolation object specifically refers to the runtime behavior of the virtual machine. In another embodiment, the isolation object specifically refers to the kernel module within the virtual machine.

[0062] Specifically, when a user on terminal 106 needs to isolate a specified object in virtual machine 102 to achieve purposes such as protecting the security of the isolated object, they can generate a corresponding virtual machine isolation request based on the object to be isolated and the virtual machine (i.e., virtual machine 102) where the object resides, and send the virtual machine isolation request to server 104. The virtual machine isolation request specifically includes a target virtual machine identifier and an isolated object identifier. The server can then receive the virtual machine isolation request, parse the virtual machine isolation request to obtain the target virtual machine identifier and the isolated object identifier, and then perform corresponding isolation control processing on the target virtual machine based on the target virtual machine identifier and the isolated object identifier.

[0063] Step 205: When the isolated object is detected to be running, the isolated object is isolated to the virtual machine security space of the target virtual machine.

[0064] The virtual machine secure space, or Secure World, refers to a trusted execution environment pre-isolated within the virtual machine's kernel space, used to execute security-sensitive applications, such as security-sensitive modules or agent programs used for data collection.

[0065] Specifically, after identifying the isolation object, the virtualization software layer within the virtual machine system monitors the behavior of the target virtual machine to determine whether the isolation object is running on the target virtual machine. If the isolation object is a running event within the virtual machine, it monitors whether a real-time process within the virtual machine has reached the isolation object. Once it reaches this point, the real-time process can be isolated and executed within the virtual machine's secure space. Simultaneously, software within the secure space can perform tasks such as data collection. When the isolation object is a security-sensitive module within the virtual machine, the virtualization software layer can identify the startup behavior of the security-sensitive module and isolate it within the virtual machine's secure space, protecting it from system attacks.

[0066] The aforementioned virtual machine isolation method, upon receiving a virtual machine isolation request, determines the target virtual machine based on its identifier, identifies the isolation object on the target virtual machine based on its identifier, and isolates the isolation object to the virtual machine security space of the target virtual machine when the isolation object is detected running. This application, by pre-constructing a virtual machine security space within the target virtual machine, achieves object isolation corresponding to the isolation object within the virtual machine security space, effectively obtaining behavioral isolation during virtual machine operation, thereby effectively realizing virtual machine security protection.

[0067] In one embodiment, such as Figure 3 As shown, a virtual machine isolation method is provided, which can be applied to... Figure 1 Taking server 104 as an example, the explanation includes the following steps:

[0068] Step 302: Receive a virtual machine isolation request. The virtual machine isolation request includes a target virtual machine identifier and an isolation object identifier. The target virtual machine identifier corresponds to the target virtual machine, and the isolation object identifier corresponds to the isolation object.

[0069] Step 304: Construct virtual machine isolation instructions based on the isolation object identifier. The virtual machine isolation instructions are used to implement virtual machine isolation operations corresponding to the isolation object within the virtual machine security space of the target virtual machine.

[0070] Step 306: Send virtual machine isolation command to the target virtual machine.

[0071] The virtual machine isolation command is sent to virtual machine 102 to control it to perform corresponding isolation processing. The virtual machine isolation command includes data characterizing the isolated object, and virtual machine 102 can execute isolation operations based on the command. The virtual machine secure space, or Secure World, refers to a trusted execution environment pre-isolated in the virtual machine's kernel space, used to execute security-sensitive applications, such as security-sensitive modules or agent programs used for data collection.

[0072] Specifically, once the target virtual machine identifier and the isolation object are determined, corresponding virtual machine isolation instructions can be constructed based on the isolation object. These instructions allow control of the target virtual machine, thereby achieving isolation of the isolation object on the target virtual machine. For example, if the isolation object is a runtime behavior of the virtual machine, the runtime environment can be switched to the virtual machine's safe space after the virtual machine reaches the corresponding behavior, achieving isolation. Conversely, if the isolation object is a kernel module running within the virtual machine, the kernel module is isolated to the virtual machine's safe space after startup to protect it.

[0073] The aforementioned virtual machine isolation method, after obtaining a virtual machine isolation request, constructs a virtual machine isolation instruction based on the isolation object identifier and sends the virtual machine isolation instruction to the target virtual machine. The virtual machine isolation instruction can be used to implement virtual machine isolation operations corresponding to the isolation object within the virtual machine security space of the target virtual machine. This application, by pre-constructing a virtual machine security space within the target virtual machine, and thereby implementing virtual machine isolation operations corresponding to the isolation object within that space, can effectively achieve virtual machine isolation processing during virtual machine operation, thus effectively protecting virtual machine security.

[0074] In one embodiment, such as Figure 4 As shown, a virtual machine isolation method is provided, which can be applied to... Figure 1 Taking virtual machine 102 as an example, the following steps are included:

[0075] Step 401: Receive the virtual machine isolation instruction and extract the isolation object identifier from the virtual machine isolation instruction.

[0076] Virtual machine 102 specifically includes the virtualization software layer and the virtual machine itself. For example, for a KVM virtual machine, it specifically includes the KVM virtualization software layer and Qemu (a virtual operating system emulator). Qemu includes the Qemu process and the virtual machine kernel. Qemu is responsible for receiving operations from the security analysis software, acting as a bridge between the security analysis software and the KVM module, and is responsible for configuration initialization. The virtualization software layer is the core of the entire system, receiving control commands from Qemu, and then performing operations such as address space isolation and Qemu injection within the virtual machine. An isolation object identifier corresponds to an isolation object; by parsing the obtained isolation object identifier, the objects within the virtual machine that need to be isolated can be determined.

[0077] Specifically, the virtual machine isolation command is generated by server 104 and then sent to Qemu in virtual machine 102 via the network. Qemu can parse the command and extract the isolation object identifier. After identifying the isolation object identifier, Qemu can forward the parsed isolation object identifier to the virtualization software layer, where the isolation of the isolation object is implemented.

[0078] Step 403: Determine the quarantined object based on the quarantined object identifier.

[0079] In this context, the isolated object refers to the target object to be isolated in the virtual machine isolation method of this application. Specifically, the isolated object can be the running behavior of the virtual machine or the kernel module that has been installed in the virtual machine.

[0080] Step 405: When the isolated object is running, isolate the isolated object to the virtual machine security space.

[0081] The virtual machine secure space, or Secure World, refers to a trusted execution environment pre-isolated within the virtual machine's kernel space, used to execute security-sensitive applications, such as security-sensitive modules or agent programs used for data collection.

[0082] Specifically, after identifying an isolation object, the virtualization software layer monitors the behavior of the virtual machine to determine whether the isolation object is running. If the isolation object is a running process within the virtual machine, it monitors whether a real-time process within the virtual machine has reached the isolation object. Once it reaches this point, the real-time process can be isolated and executed within the virtual machine's secure space. Simultaneously, software within the secure space can perform tasks such as data collection. When the isolation object is a security-sensitive module within the virtual machine, the virtualization software layer can identify the startup behavior of the security-sensitive module and isolate it within the virtual machine's secure space, protecting it from system attacks.

[0083] The aforementioned virtual machine isolation method involves extracting the isolation object identifier from the virtual machine isolation instruction after receiving it; determining the isolation object based on the isolation object identifier; and isolating the isolation object to the virtual machine security space when it runs. This application, by pre-constructing a virtual machine security space, isolates the isolation object to the virtual machine security space when it runs, thereby achieving isolation processing of the isolation object and effectively protecting the virtual machines on the cloud platform.

[0084] In one embodiment, such as Figure 5 As shown, the isolated object identifier is used to characterize the behavior to be monitored. Step 203 includes:

[0085] Step 502: Construct behavior monitoring points corresponding to the behaviors to be monitored based on the identifiers of the isolated objects.

[0086] Step 205 includes:

[0087] Step 504: Construct behavior interception instructions based on behavior monitoring points.

[0088] Step 506: When the virtual machine behavior in the virtual machine runtime environment space of the target virtual machine reaches the behavior monitoring point, the switching gate is invoked through the behavior interception instruction.

[0089] Step 508: Switch the execution flow of virtual machine behavior to the virtual machine security space of the target virtual machine through the switching gate, and obtain the behavior monitoring data corresponding to the behavior monitoring point through the preset information collection agent program.

[0090] The isolation object identifier is used to characterize the behavior to be monitored. Specifically, the isolation object identifier can be an event type identifier. Server 104 identifies which events in the virtual machine belong to the monitored behavior based on the event type identifier. The virtual machine isolation monitoring instruction refers to monitoring the behavior while isolating it within the virtual machine's secure space, and acquiring the corresponding behavioral data for subsequent analysis. The behavior interception instruction is used to isolate the virtual machine's behavior during runtime. The behavior monitoring point can be generated by server 104 based on the virtual address in the virtual machine's symbol table. After receiving the behavior monitoring point, virtual machine 102 can generate the corresponding behavior interception instruction. The switch gate is a call gate module that enables switching between the virtual machine's secure space and the runtime environment space. The preset information collection agent program is an information collection program pre-injected into the virtual machine's secure space. It mainly collects the corresponding behavioral data of the virtual machine when the virtual machine's behavior is isolated within the secure space, and then feeds the collected behavioral data back to server 104.

[0091] Specifically, behavior interception instructions are added to the virtual machine kernel via system call handling functions and exception handling functions. When virtual machine behavior in the virtual machine runtime environment reaches a behavior monitoring point, the behavior interception instructions call the switching gate between the virtual machine safe space and the virtual machine runtime environment, thereby transferring the virtual machine behavior executed by the virtual machine kernel to the virtual machine safe space and isolating the corresponding behavior to be monitored to run in the virtual machine safe space. During operation, the information collection agent program pre-injected in the virtual machine safe space can directly monitor behavior data, obtain the behavior monitoring data corresponding to the behavior monitoring point, and then feed the obtained behavior monitoring data back to the server 104. In one embodiment, the virtual machine 102 is specifically a KVM virtual machine. In this case, the pre-injected information collection agent program specifically notifies the KVM virtualization software layer through an event, and the KVM virtualization software layer forwards the event notification to the behavior analysis software in the server. This process has two implementation methods. In one embodiment, the analysis software can be notified directly through ioeventfd. In another embodiment, the security analysis software can be notified through eventfd via Qemu. In one specific embodiment, if the staff of terminal 102 needs to monitor the behavior inside the virtual machine, they can identify the isolated object as the behavior to be monitored using the isolation object identifier. At this time, the virtual machine isolation instruction is a virtual machine isolation monitoring instruction, used to isolate and monitor the behavior to be monitored within the virtual machine. First, server 104 needs to construct behavior monitoring points based on the behavior identifier. This process mainly requires determining the virtual address corresponding to the action to be monitored through the behavior to be monitored, and then constructing the behavior monitoring points based on the virtual address. Then, virtual machine isolation monitoring instructions need to be constructed based on the behavior monitoring points to operate the virtual machine for isolation monitoring. After receiving the virtual machine isolation monitoring instructions, the target virtual machine (virtual machine 102) can set corresponding behavior interception instructions to intercept the behavior corresponding to the behavior to be monitored. The intercepted behavior is then imported into the virtual machine's secure space, and the behavior isolation monitoring corresponding to the behavior monitoring points is achieved through a preset information collection agent program, obtaining complete behavior monitoring data during the virtual machine's operation. This behavior monitoring data is then sent to server 102, which performs specific analysis based on this data. In one embodiment, server 102 runs security analysis software that can perform security analysis on virtual machine 102 using behavior monitoring data. In this embodiment, corresponding behavior interception instructions are generated based on behavior monitoring points, and then the behavior of the virtual machine is intercepted within the virtual machine runtime environment using these instructions. This effectively ensures the accuracy of behavior interception, thereby guaranteeing the effectiveness of virtual machine isolation.

[0092] In one embodiment, step 504 includes:

[0093] Obtain the behavior type corresponding to the behavior monitoring point.

[0094] When the behavior type is CPU behavior monitoring, a virtual machine control structure domain is set up to build behavior interception instructions based on the virtual machine control structure domain.

[0095] When the behavior type is non-CPU behavior monitoring, the guest virtual address in the virtual machine isolation monitoring instruction is processed for address translation to obtain the physical machine physical address, and behavior interception instructions are constructed based on the physical machine physical address.

[0096] The behavior types specifically include CPU behavior and non-CPU behavior. The interception instructions constructed by these two types of behavior are different. The Virtual Machine Control Structure (VMCS) domain stores the values ​​of privileged registers and control information in root mode and non-root mode. It is operated by the hardware CPU, and each VMCS corresponds to one VCPU and can only be bound to one physical CPU. The guest virtual address parameter GVG is sequentially converted to GPG, GVG, and GPG. To achieve memory virtualization and allow the guest to use an isolated, zero-based, and contiguous memory space, KVM introduces a new address space: the Guest Physical Address Space (GPG). This address space is not a true physical address space; it is merely a mapping of the host virtual address space onto the guest address space. For the guest, the guest physical address space is a contiguous address space starting from zero. However, for the host, the guest physical address space is not necessarily contiguous; it may map across several non-contiguous host address ranges. The most important aspect of implementing memory virtualization is translating guest virtual addresses (GVGs) to host physical addresses. Based on this translation and the guest page table, the mapping between the guest virtual address space and the guest physical address space can be achieved, i.e., the translation from GVG to GPG.

[0097] Specifically, the behavior interception instruction may also include its corresponding monitoring object, including CPU behavior monitoring and non-CPU behavior monitoring. When the behavior type is CPU behavior monitoring, a virtual machine control structure domain needs to be set up to construct the behavior interception instruction based on the virtual machine control structure domain. When the behavior type is non-CPU behavior monitoring, address translation processing is performed on the guest virtual address in the virtual machine isolation monitoring instruction to obtain the physical machine physical address, so as to construct the behavior interception instruction based on the physical machine physical address. In one embodiment, before step 506, the following is also included:

[0098] Obtain the monitoring point type corresponding to the behavior monitoring point.

[0099] When the monitoring point type is a user space monitoring point, a system call function is written to the address of the user space monitoring point, and a corresponding system call handling function is created. The system call handling function is used to call the switching gate.

[0100] When the monitoring point type is a kernel space monitoring point, an exception function is written to the address of the user space monitoring point, and a corresponding exception handling function is created. The exception handling function is used to call the switching gate.

[0101] Specifically, behavior monitoring points include different types, including user-mode monitoring points and kernel-mode monitoring points. When the kernel running in the monitored virtual machine's runtime environment reaches a monitoring point, an exception is triggered, and a switch gate can be invoked through the corresponding system call handler. If the behavior monitoring point is in user mode, a system call is triggered, and the system call handler jumps to the switch gate. If it is in kernel mode, a custom exception is triggered, and the custom exception handler jumps to the switch gate. Therefore, before isolating the virtual machine, a system call handler or exception handler needs to be written according to the location of the behavior monitoring point in the virtual machine to enable the invocation of the switch gate. The switch gate in this application is mainly responsible for switching the execution flow from the virtual machine's runtime environment space to the virtual machine's safe space. During the switching process, the switch gate first disables interrupts to ensure that the processing cannot be interrupted. Since the intercepted events are all custom, the analysis software dynamically writes their addresses into the switch gate's data area when setting hooks. Therefore, the address sequence jumping to the switch gate can be judged to ensure the legality of the switch. Furthermore, atomic operations are performed on the entire process to ensure its integrity. In this embodiment, by identifying the monitoring point type corresponding to the monitoring point, a function call is written to the corresponding location in the virtual machine kernel. This allows for effective switching of the virtual machine execution flow through a switching gate, switching the execution flow from the virtual machine runtime environment space to the virtual machine safe space.

[0102] In one embodiment, such as Figure 6 As shown, the method also includes:

[0103] Step 601: Obtain the security space construction request corresponding to the target virtual machine.

[0104] Step 603: Based on the security space, construct a request to obtain the symbol table library of the target virtual machine.

[0105] Step 605: Construct a virtual machine security space in the target virtual machine according to the symbol table library, and inject the preset information collection agent program into the virtual machine security space.

[0106] A symbol table is a data structure used in language translators (such as compilers and interpreters). In a symbol table, each identifier in the program's source code is bound to its declaration or usage information, such as its data type, scope, and memory address. Server 102, when performing virtual machine isolation, needs to build a symbol table library corresponding to the target virtual machine to achieve analysis, isolation, and monitoring of the target virtual machine. In one embodiment, the symbol table can specifically be parsed into JSON format.

[0107] Specifically, before using the virtual machine isolation method of this application, it is necessary to build a corresponding virtual machine security space in the target virtual machine. Building a virtual machine security space requires the symbol table library corresponding to the target virtual machine. Therefore, when a user needs to construct a virtual machine security space corresponding to the target virtual machine, they must first send a security space construction request to the server 104. The server 104 will first obtain the symbol table library of the target virtual machine based on the security space construction request, and then further construct a security space construction instruction based on the symbol table library. This instruction is then sent to the target virtual machine, thereby constructing a virtual machine security space in the target virtual machine and injecting a preset information collection agent program into the virtual machine security space. In one embodiment, the virtual machine 102 in this application is implemented using a KVM virtual machine, which includes Qemu and the KVM virtualization software layer. After obtaining the symbol table, the server 102 first sends a security space construction instruction to Qemu. Qemu receives and parses the command; if it is a security space construction instruction, Qemu passes the operation to the KVM virtualization software layer via ioctl. The KVM virtualization software layer receives ioctl commands and parses the parameters. If it is a secure space construction instruction, it creates a SW-EPT and maps new physical pages to the highest memory segment (the size of which can be set according to needs), while the original EPT (NW-EPT) remains unchanged. The virtual machine secure space has a global view, mapping all the memory of the virtual machine. The virtual machine secure space operates under controlled conditions. Finally, a preset information collection agent is injected into the virtual machine secure space, and guest page table entries are built for it using virtual addresses not used by the ordinary kernel. In this embodiment, upon receiving a secure space construction request, the corresponding symbol table library is obtained based on the secure space construction request, and a secure space construction instruction is constructed, thereby effectively controlling the target virtual machine to construct a virtual machine secure space and ensuring the effectiveness of subsequent isolation or behavior monitoring processes.

[0108] In one embodiment, such as Figure 7 As shown, step 603 includes:

[0109] Step 702: Based on the security space construction request, obtain the virtual machine symbol table transfer script corresponding to the target virtual machine.

[0110] Step 704: Obtain the symbol table library of the target virtual machine through the virtual machine symbol table transfer script.

[0111] The virtual machine symbol table transfer script can automatically transfer the symbol table (Linux, Windows), system type, kernel version, etc. of the target virtual machine's current running system to server 104, thereby obtaining the target virtual machine's symbol table library. The specific method of obtaining the symbol table depends on the type of the target virtual machine.

[0112] Specifically, symbol table library construction can be achieved through a virtual machine symbol table transfer script. First, the user sets the target virtual machine, and the console obtains the corresponding symbol table transfer script based on the target virtual machine's type. The symbol table transfer script can retrieve the symbol table library of the target virtual machine. Server 104 can send the symbol table transfer script to virtual machine 102, where it runs to obtain the symbol table library of the target virtual machine (virtual machine 102). In this embodiment, using the virtual machine symbol table transfer script corresponding to the target virtual machine to construct the symbol table library effectively ensures the efficiency of symbol table library construction.

[0113] In one embodiment, step 704 includes:

[0114] Obtain the symbol table identifier of the target virtual machine through the virtual machine symbol table passing script.

[0115] The symbol table data is searched within the preset symbol table database by using the symbol table identifier.

[0116] When the symbol table data corresponding to the symbol table identifier is found, the symbol table library of the target virtual machine is constructed by using the symbol table data found in the preset symbol table database.

[0117] When the symbol table data corresponding to the symbol table identifier is not found, the symbol table data is obtained from the target virtual machine by passing the virtual machine symbol table through the virtual machine symbol table transfer script, and the symbol table library of the target virtual machine is constructed using the obtained symbol table data.

[0118] The symbol table identifier is a unique identifier for the symbol table, used for symbol table identification. In one embodiment, the symbol table identifier is specifically the hash value of the symbol table. The preset symbol table database refers to a pre-built symbol table database used to store the extracted symbol table libraries.

[0119] Specifically, the virtual machine symbol table transfer script can use vsock to upload the hash value of the symbol table to server 104. Server 104 uses the hash value to search for symbol table data in the preset symbol table database, determining whether the symbol table is an existing symbol table in the database. If it is an existing symbol table, a symbol table library is built using the symbol table hash value as an index, thus assigning virtual machines with the same hash value to a single entry. If no symbol table data corresponding to the symbol table identifier is found, the symbol table data needs to be obtained from the target virtual machine based on the virtual machine symbol table transfer script. The obtained symbol table data is then used to build the symbol table library for the target virtual machine, resulting in a new symbol table library. The symbol table data of this newly generated library can then be saved to the preset symbol table database. In this application, symbol table identification and lookup are performed using symbol table identifiers, thereby effectively improving the efficiency of the symbol table library construction process.

[0120] In one embodiment, the isolation object identifier includes a kernel module identifier, and the virtual machine isolation instruction includes a kernel isolation instruction; step 205 specifically includes: intercepting the startup requests of each kernel module in the target virtual machine; and isolating the kernel modules containing the isolation label to the virtual machine security space of the target virtual machine.

[0121] Specifically, in addition to isolating virtual machine behavior, virtual machine isolation can also isolate the startup of kernel modules installed on the virtual machine. The kernel modules are pre-installed on the virtual machine, and during installation, the virtual machine 102 adds tags to the newly installed kernel modules according to the instructions of the server 104, thereby isolating security-sensitive modules from ordinary kernel modules. When the virtualization software layer of the virtual machine receives a startup request for the virtual machine kernel module, in order to isolate security-sensitive modules, it can identify whether the newly started kernel module contains a preset isolation tag. If it does, it indicates that it is a security-sensitive module and needs to be isolated; otherwise, isolation is not required. In this embodiment, identifying security-sensitive modules through the tags contained in the virtual machine kernel module can effectively ensure the accuracy of control during the virtual machine kernel startup process and prevent security-sensitive modules from being detected and eliminated by the system.

[0122] In one embodiment, before the step of intercepting the startup requests of each kernel module in the target virtual machine, the method further includes: obtaining module pre-installation instructions; adding isolation tags to the corresponding pre-installed kernel modules according to the module pre-installation instructions, and then installing the pre-installed kernel modules into the target virtual machine. The isolation tags are used to isolate the pre-installed kernel modules into the virtual machine security space of the target virtual machine after the pre-installed kernel modules are running.

[0123] Specifically, in addition to isolating and monitoring the behavior executed on the virtual machine, the solution of this application can also isolate the kernel module on the virtual machine, thereby protecting it from attacks on the virtual machine system. When isolating the kernel module, the isolation object identifier is specifically used to characterize the pre-installed kernel module that needs to be isolated. At this time, the server 104 can construct a kernel isolation instruction based on the kernel module identifier. This kernel isolation instruction is specifically used to add an isolation tag to the pre-installed kernel module corresponding to the kernel module identifier, and then install the pre-installed kernel module to the target virtual machine. The isolation tag can be used to isolate the pre-installed kernel module to the virtual machine's safe space after it runs. When the virtual machine loads the kernel module, it can first identify whether the kernel module includes an isolation tag. If the kernel module contains an isolation tag, it needs to be isolated to the virtual machine's safe space; if it does not contain an isolation tag, it can run directly without isolation processing. In this embodiment, isolating the original kernel module of the virtual machine through the kernel isolation instruction can effectively protect the operation of security-sensitive kernel modules.

[0124] This application also provides an application scenario in which the above-described virtual machine isolation method is applied. Specifically, the virtual machine isolation method is applied in this scenario as follows:

[0125] In this application scenario, the virtual machine can specifically be a KVM virtual machine, and the user implements isolation and protection through the server's cloud console. When the user needs to isolate security-sensitive modules within the virtual machine for module protection, this application's kernel module protection can be used to achieve virtual machine isolation. Kernel module protection primarily uses virtualization software to isolate the modules inside the virtual machine into a trusted execution environment, ensuring the correct execution of the kernel modules and preventing their control flow from being intercepted or data from being leaked. Specific effects are as follows... Figure 8 As shown, firstly, users tag pre-installed kernel modules in virtual machines via the cloud console. These tags include security-sensitive tags and ordinary tags. Then, these tagged pre-installed kernel modules are installed in the virtual machine. When a kernel module in the virtual machine starts, the KVM virtualization software layer intercepts the kernel module's startup behavior. Finally, measures are taken based on the tags: if it is a security-sensitive kernel module, it is isolated in the virtual machine's secure space (SW) to protect it from system attacks.

[0126] This application also provides another application scenario, which applies the virtual machine isolation method described above. A complete flowchart of the virtual machine isolation method can be found here. Figure 9 Specifically, the virtual machine isolation method is applied in this application scenario as follows:

[0127] In this application scenario, the virtual machine can specifically be a KVM virtual machine, and the user achieves isolation and protection through the server's cloud console. When the user needs to monitor the internal behavior of the virtual machine securely and efficiently, the virtual machine internal behavior monitoring solution of this application can achieve monitoring of the internal behavior of the virtual machine based on virtual machine isolation. Kernel module protection mainly uses virtualization software to isolate the modules inside the virtual machine into a trusted execution environment, ensuring the correct execution of the kernel module and preventing its control flow from being intercepted and data from being leaked. This is mainly achieved by using KVM Gypervisor to capture pre-defined behaviors inside the virtual machine and to hide and protect the monitoring operations and monitoring points, thereby achieving anti-bypass and anti-probing effects. The specific effects of this solution can be seen in [reference needed]. Figure 10 As shown, firstly, when a virtual machine (VM) starts up, KVM Gypervisor isolates it into a secure space and automatically injects a data acquisition agent (security agent) into this secure space. Secondly, the user sends the behaviors and symbol tables to be monitored to KVM Gypervisor via the cloud console. Then, KVM Gypervisor dynamically sets monitoring items for the VM based on the pre-monitored behavior list and symbol table, and protects the monitoring points. Finally, when the VM kernel or the VM's application runs to a monitored item, the secure space intercepts these pre-monitored behaviors. The data acquisition agent then captures the corresponding behavioral data and transmits the captured behavioral data to the analysis software in KVM Gypervisor for analysis and evaluation. The solution mainly includes the following components: KVM virtualization software layer, Qemu, VM, and security analysis software (KVM Gypervisor). The VM includes NW (normal space), SG (switching gate), and SW (secure space). Its specific structure can be found in [reference needed]. Figure 11In this system, the security analysis software is responsible for analyzing and judging the monitored behaviors. Qemu receives operations from the security analysis software, acts as a bridge between the security analysis software and the KVM module, and is responsible for configuration initialization. KVM is the core of the entire system, receiving control commands from Qemu and performing address space isolation, agent injection, and other functions. The protected module is an abstract term that can represent behavior monitoring agents, security-sensitive kernel modules, etc. The injected agent is responsible for collecting and forwarding behavior data to the analysis software. When the system monitors behavior within a virtual machine, the user submits the behaviors to be monitored through the security analysis software in the cloud console. Qemu then receives the commands from the security analysis software and uses the KVM virtualization software layer to implement original data protection and security event interception settings in the virtual machine's normal space. Simultaneously, it injects agent programs and constructs the address space isolation EPI table in the secure space. When the behavior process in the normal space reaches the interception point, it can switch to the secure space through a switching gate and obtain the corresponding behavior information through the agent program. In addition to the components mentioned above, integration with a cloud console is also required to enable users to better utilize the solution of this invention. The overall workflow between the modules in the system is as follows: Figure 12 As shown: 1) First, the user selects the VM to be monitored in the cloud console; the cloud console automatically sends the symbol table transfer script to the corresponding virtual machine based on the selected VM list. 2) The script is automatically installed in the virtual machine, passing the symbol table information to the security analysis software running on the KVM Gypervisor. 3) The security analysis software formats the symbol table, establishes a connection with the Qemu process corresponding to the monitored VM, and then notifies Qemu to build a Service Shift (SW) and set up behavior monitoring. 4) Qemu notifies KVM to build a SW for the VM, expands the VM's physical memory, informs the VM of the types of events to be intercepted, and establishes a channel between the analysis software and KVM for behavior monitoring setup and protection. 5) KVM creates the SW, injects the agent into the SW, and sets up behavior interception through CPU domain bit control and instruction modification, passing the behavior to the SW's agent. 6) When the system in the normal space reaches an event interception point, it determines whether the event's behavior is a kernel space behavior to proceed with subsequent processing. If it is a kernel space behavior, it triggers an exception and jumps to a switching gate; otherwise, it jumps to the switching gate via a software interrupt. Then, it switches the address space through the switching gate and executes in the safe space. The agent then obtains the behavior corresponding to the event interception point, parses and records the behavior, and transmits the data to the security analysis software via KVM for analysis. The above behavior will be explained separately. First, the steps from the cloud console to the security analysis software (KVMGypervisor) can be referred to in detail. Figure 13As shown, the cloud console provides a symbol table transfer script, which can automatically transfer the symbol table (Linux, Windows), system type, kernel version, etc. of the system currently running on the VM to the analysis software running KVMGypervisor. Users set up the VMs to be monitored in the console, and the console issues the symbol table transfer script to the corresponding VM based on the VM type. The transfer script uses vsock to upload the hash value of the symbol table to the analysis software. The analysis software verifies whether the hash value exists. If it does not exist, it instructs the script to continue transferring the symbol table, system type, and kernel version. Otherwise, it establishes a connection with Qemu and queries the VM's unique identifier. Then, it builds a symbol table library using the symbol table hash value as an index, grouping VMs with the same hash value into one table entry. For ease of use, the analysis software parses the symbol table into JSON format. The second step is the construction of the virtual machine security space and the setting up of behavior monitoring (security analysis software - Qemu - KVM). For details, please refer to [link to relevant documentation]. Figure 14As shown, 1) After obtaining the symbol table, the security analysis software first sends a SW build command to Qemu and sets corresponding monitoring events based on symbolic address changes. Qemu receives and parses the command. If it is an SW build command, Qemu passes the operation to KVM via ioctl. KVM receives the ioctl command, parses the parameters, and if it is an SW build command, creates an SW-EPT and maps a new physical page to the highest memory segment (the size can be set according to needs), while the original EPT (NW-EPT) remains unchanged. The SW has a global view, mapping all the memory of the virtual machine. The SW runs under controlled conditions. Finally, the agent is injected into the SW, and a guest page table entry is built for it using virtual addresses not used by the ordinary kernel, while a memory-sharing-based communication channel is built. 2) The security analysis software builds behavior monitoring points based on the virtual addresses in the symbol table and sends behavior monitoring commands to Qemu. Qemu receives the command and parses the parameters. If it is a behavior monitoring build command, it passes the operation to KVM via ioctl. KVM receives ioctl commands and parses the parameters. If it's a CPU event behavior monitoring command, it sets the VMCS domain. Otherwise, it converts the parameter GVG to GPG, GVG, or GPG. If the monitoring point is in user space, a custom system call is written to this address, and a system call handler is added to the VM kernel. If the monitoring point is in kernel space, a specific exception is written to this address, and an exception handler is added to the VM kernel. Furthermore, KVM sets the internal page table containing the inserted exception instruction to executable only. If a process inside the VM reads or writes to it, EPTMisconfig is triggered, and KVM switches it to SW-EPT (the behavior monitoring point is the original instruction, unchanged) and enables singlestep mode. After the memory is read, it switches back to the monitored state. The third step is the virtual machine behavior interception and address space switching (NW-SG-SW) process. Because KVM isolates the VM's address space, the VM includes NW (and its running software), SG, and SW (and their running software). For a detailed explanation of the behavior interception process, please refer to [link to relevant documentation]. Figure 15As shown. 1) When the kernel running in the monitored NW reaches the monitoring point, an exception is triggered. If the monitoring point is in user mode, a system call is triggered, and the system call handler jumps to the SG. If it is in kernel mode, a custom exception is triggered, and the custom exception handler jumps to the SG. 2) Switching Gate SG: The switching gate is responsible for switching the execution flow from NW to SW. The SG first disables interrupts to ensure that the processing cannot be interrupted. Since the intercepted events are custom, the analysis software dynamically writes their addresses into the data area of ​​the SG when setting hooks. Therefore, the address sequence jumping to the SG can be judged to ensure the legality of the switch. In addition, atomic operations are performed on the entire process to ensure the integrity of the processing. Finally, the SW is switched to NW. 3) The agent in the SW performs detailed analysis and recording of the intercepted events and behaviors, and executes the original instructions. When the collected behavioral data meets certain conditions, it will transmit the behavioral data to the security analysis software in batches. The agent first notifies the KVM through the event, and the KVM forwards the event notification to the analysis software. This process can be implemented in two ways: either by directly notifying the analysis software via ioeventfd, or by notifying the security analysis software via Qemu through eventfd. The security analysis software then reads the behavioral data uploaded by the agent to perform corresponding behavioral analysis and obtain the behavioral analysis results required for virtual machine isolation monitoring.

[0128] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0129] Based on the same inventive concept, this application also provides a virtual machine isolation device for implementing the virtual machine isolation method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more virtual machine isolation device embodiments provided below can be found in the limitations of the virtual machine isolation method described above, and will not be repeated here.

[0130] In one embodiment, such as Figure 16As shown, a virtual machine isolation device is provided, including: a request acquisition module 1601, an object identification module 1603, and an object isolation module 1605, wherein:

[0131] The request acquisition module 1601 is used to receive virtual machine isolation requests, which include the target virtual machine identifier and the isolation object identifier.

[0132] The object identification module 1603 is used to determine the target virtual machine based on the target virtual machine identifier and to determine the isolated object on the target virtual machine based on the isolated object identifier.

[0133] The object isolation module 1605 is used to isolate the isolated object to the virtual machine security space of the target virtual machine when the isolated object is detected to be running.

[0134] In one embodiment, the isolated object identifier is used to characterize the behavior to be monitored; the object identification module 1603 is specifically used to: construct the behavior monitoring point corresponding to the behavior to be monitored based on the isolated object identifier; the object isolation module 1605 is specifically used to: construct the behavior interception instruction based on the behavior monitoring point; when the virtual machine behavior in the virtual machine runtime environment space of the target virtual machine is executed to the behavior monitoring point, the switching gate is called through the behavior interception instruction; the execution flow of the virtual machine behavior is switched to the virtual machine security space of the target virtual machine through the switching gate, and the behavior monitoring data corresponding to the behavior monitoring point is obtained through the preset information collection agent program.

[0135] In one embodiment, the object isolation module 1605 is specifically used to: obtain the behavior type corresponding to the behavior monitoring point; when the behavior type is CPU behavior monitoring, set the virtual machine control structure domain to construct a behavior interception instruction based on the virtual machine control structure domain; when the behavior type is non-CPU behavior monitoring, perform address translation processing on the guest virtual address in the virtual machine isolation monitoring instruction to obtain the physical machine physical address, and construct a behavior interception instruction based on the physical machine physical address.

[0136] In one embodiment, the behavior interception instruction includes a system call handling function and an exception handling function. The device also includes a function creation module, used to: obtain the monitoring point type corresponding to the behavior monitoring point; when the monitoring point type is a user space monitoring point, write the system call function to the address of the user space monitoring point and create a corresponding system call handling function, the system call handling function being used to call the switching gate; when the monitoring point type is a kernel space monitoring point, write the exception function to the address of the user space monitoring point and create a corresponding exception handling function, the exception handling function being used to call the switching gate.

[0137] In one embodiment, the apparatus further includes a security space construction module, configured to: obtain a security space construction request corresponding to the target virtual machine; obtain a symbol table library of the target virtual machine based on the security space construction request; construct a virtual machine security space in the target virtual machine according to the symbol table library; and inject a preset information collection agent program into the virtual machine security space.

[0138] In one embodiment, the security space construction module is further configured to: obtain the virtual machine symbol table transfer script corresponding to the target virtual machine based on the security space construction request; and obtain the symbol table library of the target virtual machine through the virtual machine symbol table transfer script.

[0139] In one embodiment, the security space construction module is further configured to: obtain the symbol table identifier of the target virtual machine through the virtual machine symbol table transfer script; search for symbol table data in a preset symbol table database using the symbol table identifier; when the symbol table data corresponding to the symbol table identifier is found, construct the symbol table library of the target virtual machine using the symbol table data found in the preset symbol table database; when the symbol table data corresponding to the symbol table identifier is not found, obtain the symbol table data from the target virtual machine based on the virtual machine symbol table transfer script, and construct the symbol table library of the target virtual machine using the obtained symbol table data.

[0140] In one embodiment, the isolation object identifier includes a kernel module identifier, and the virtual machine isolation instruction includes a kernel isolation instruction; the object isolation module 1605 is specifically used to: intercept the startup requests of each kernel module in the target virtual machine; and isolate the kernel modules containing the isolation label to the virtual machine security space of the target virtual machine.

[0141] In one embodiment, a tag setting module is further included, which is used to: obtain a module pre-installation instruction; add an isolation tag to the corresponding pre-installation kernel module according to the module pre-installation instruction, and then install the pre-installation kernel module to the target virtual machine. The isolation tag is used to isolate the pre-installation kernel module to the virtual machine security space of the target virtual machine after the pre-installation kernel module is running.

[0142] Each module in the aforementioned virtual machine isolation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0143] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 17As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data related to the virtual machine isolation process. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a virtual machine isolation method.

[0144] Those skilled in the field can understand, Figure 17 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0145] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0146] Receive virtual machine isolation requests, which include the target virtual machine identifier and the isolation object identifier;

[0147] The target virtual machine is determined based on the target virtual machine identifier, and the isolation object on the target virtual machine is determined based on the isolation object identifier.

[0148] When an isolated object is detected to be running, the isolated object is isolated to the virtual machine security space of the target virtual machine.

[0149] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0150] Receive virtual machine isolation requests, which include the target virtual machine identifier and the isolation object identifier;

[0151] The target virtual machine is determined based on the target virtual machine identifier, and the isolation object on the target virtual machine is determined based on the isolation object identifier.

[0152] When an isolated object is detected to be running, the isolated object is isolated to the virtual machine security space of the target virtual machine.

[0153] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0154] Receive virtual machine isolation requests, which include the target virtual machine identifier and the isolation object identifier;

[0155] The target virtual machine is determined based on the target virtual machine identifier, and the isolation object on the target virtual machine is determined based on the isolation object identifier.

[0156] When an isolated object is detected to be running, the isolated object is isolated to the virtual machine security space of the target virtual machine.

[0157] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0158] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRGM), magnetic random access memory (MRGM), ferroelectric random access memory (FRGM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RGM) or external cache memory, etc. By way of illustration and not limitation, RGM can take many forms, such as Static Random Access Memory (SRGM) or Dynamic Random Access Memory (DRGM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0159] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0160] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A virtual machine isolation method, characterized in that, The method includes: Receive a virtual machine isolation request, the virtual machine isolation request including the target virtual machine identifier and the isolation object identifier; The target virtual machine is determined based on the target virtual machine identifier, and the isolation object on the target virtual machine is determined based on the isolation object identifier; the target virtual machine is a KVM virtual machine. Constructing a virtual machine security space in the target virtual machine includes: creating a SW-EPT and mapping a new physical page for the highest memory segment, while leaving the NW-EPT unchanged; When the isolated object is detected to be running, the isolated object is isolated to the virtual machine security space of the target virtual machine, specifically including: Based on the isolated object identifier, construct behavior monitoring points corresponding to the behavior to be monitored; construct behavior interception instructions based on the behavior monitoring points; When the virtual machine behavior in the virtual machine runtime environment space of the target virtual machine reaches the behavior monitoring point, the switching gate is invoked through the behavior interception instruction; the execution flow of the virtual machine behavior is switched to the virtual machine security space of the target virtual machine through the switching gate; Furthermore, the internal page table for inserting exception instructions is set to be executable only. If a process inside the VM reads or writes to it, EPTMisconfig will be triggered to switch it to SW-EPT and enable singlestep mode.

2. The method according to claim 1, characterized in that, The method further includes: obtaining behavior monitoring data corresponding to the behavior monitoring point through a preset information collection agent program.

3. The method according to claim 1, characterized in that, The behavior interception instruction constructed based on the behavior monitoring points includes: Obtain the behavior type corresponding to the behavior monitoring point; When the behavior type is CPU behavior monitoring, a virtual machine control structure domain is set up to construct behavior interception instructions based on the virtual machine control structure domain; When the behavior type is non-CPU behavior monitoring, the guest virtual address in the virtual machine isolation monitoring instruction is processed by address translation to obtain the physical machine physical address, so as to construct a behavior interception instruction based on the physical machine physical address.

4. The method according to claim 1, characterized in that, The behavior interception instruction includes a system call processing function and an exception handling function. Before invoking the switching gate via the behavior interception instruction when the virtual machine behavior within the virtual machine runtime environment of the target virtual machine reaches the behavior monitoring point, the instruction further includes: Obtain the monitoring point type corresponding to the behavior monitoring point; When the monitoring point type is a user space monitoring point, a system call function is written into the address of the user space monitoring point, and a corresponding system call processing function is created. The system call processing function is used to call the switching gate. When the monitoring point type is a kernel space monitoring point, an exception function is written to the address of the user space monitoring point, and a corresponding exception handling function is created. The exception handling function is used to call the switching gate.

5. The method according to claim 1, characterized in that, The method further includes: Obtain the security space construction request corresponding to the target virtual machine; Based on the security space construction request, obtain the symbol table library of the target virtual machine; A virtual machine security space is constructed in the target virtual machine according to the symbol table library, and a preset information collection agent is injected into the virtual machine security space.

6. The method according to claim 5, characterized in that, The step of obtaining the symbol table library of the target virtual machine based on the security space construction request includes: Based on the security space construction request, obtain the virtual machine symbol table transfer script corresponding to the target virtual machine; The symbol table library of the target virtual machine is obtained through the virtual machine symbol table passing script.

7. The method according to claim 6, characterized in that, The step of obtaining the symbol table library of the target virtual machine through the virtual machine symbol table transfer script includes: The symbol table identifier of the target virtual machine is obtained through the script that passes the virtual machine symbol table; The symbol table data is searched in the preset symbol table database using the symbol table identifier; When the symbol table data corresponding to the symbol table identifier is found, the symbol table library of the target virtual machine is constructed by finding the symbol table data in the preset symbol table database; When the symbol table data corresponding to the symbol table identifier is not found, the symbol table data is obtained from the target virtual machine based on the virtual machine symbol table transfer script, and the symbol table library of the target virtual machine is constructed using the obtained symbol table data.

8. The method according to claim 1, characterized in that, The isolated object includes a kernel module; The step of isolating the isolated object to the virtual machine security space of the target virtual machine when the isolated object is detected to be running includes: Intercept the startup requests of each kernel module within the target virtual machine; The kernel module containing the isolation label is isolated to the virtual machine security space of the target virtual machine.

9. The method according to claim 8, characterized in that, Before intercepting the startup requests of each kernel module within the target virtual machine, the process also includes: Obtain module pre-installation instructions; After adding an isolation tag to the corresponding pre-installed kernel module according to the module pre-installation instructions, the pre-installed kernel module is installed to the target virtual machine. The isolation tag is used to isolate the pre-installed kernel module to the virtual machine security space of the target virtual machine after the pre-installed kernel module is running.

10. A virtual machine isolation method, characterized in that, The method includes: Receive a virtual machine isolation request, the virtual machine isolation request including a target virtual machine identifier and an isolation object identifier, the target virtual machine identifier corresponding to a target virtual machine, and the isolation object identifier corresponding to an isolation object; the target virtual machine is a KVM virtual machine; The virtual machine isolation instructions are constructed based on the isolation object identifier. The virtual machine isolation instructions are used to implement behavioral isolation corresponding to the isolation object within the virtual machine security space of the target virtual machine. The construction process of the virtual machine security space includes: creating SW-EPT and mapping a new physical page for the highest memory segment, while NW-EPT remains unchanged. Sending the virtual machine isolation instruction to the target virtual machine, so that the target virtual machine isolates the isolation object to the virtual machine safe space when the isolation object is running, specifically includes: constructing a behavior monitoring point corresponding to the behavior to be monitored based on the isolation object identifier; constructing a behavior interception instruction based on the behavior monitoring point; when the virtual machine behavior in the virtual machine runtime environment space of the target virtual machine is executed to the behavior monitoring point, calling a switching gate through the behavior interception instruction; switching the execution flow of the virtual machine behavior to the virtual machine safe space of the target virtual machine through the switching gate; and setting the internal page table of the inserted exception instruction to be executable only. If a process inside the VM reads or writes to it, EPTMisconfig will be triggered to switch it to SW-EPT and enable singlestep mode.

11. A virtual machine isolation method, characterized in that, Applied to a target virtual machine, wherein the target virtual machine is a KVM virtual machine, the method includes: Receive virtual machine isolation instructions and extract the isolation object identifier from the virtual machine isolation instructions; The isolation object is determined based on the isolation object identifier; When the isolated object is running, it is isolated to the virtual machine safe space. Specifically, this includes: constructing a behavior monitoring point corresponding to the behavior to be monitored based on the isolated object identifier; constructing a behavior interception instruction based on the behavior monitoring point; when the virtual machine behavior in the virtual machine runtime environment space of the target virtual machine is executed to the behavior monitoring point, calling the switching gate through the behavior interception instruction; switching the execution flow of the virtual machine behavior to the virtual machine safe space of the target virtual machine through the switching gate; and setting the internal page table of the inserted exception instruction to be executable only. If a process inside the VM reads or writes to it, EPTMisconfig will be triggered to switch it to SW-EPT and enable singlestep mode. The construction process of the virtual machine security space includes: creating the SW-EPT and mapping a new physical page for the highest memory segment, while the NW-EPT remains unchanged.

12. A virtual machine isolation device, characterized in that, The device includes: The request acquisition module is used to receive virtual machine isolation requests, wherein the virtual machine isolation request includes a target virtual machine identifier and an isolation object identifier; An object identification module is used to determine a target virtual machine based on the target virtual machine identifier, and to determine an isolated object on the target virtual machine based on the isolated object identifier; the target virtual machine is a KVM virtual machine. The security space construction module is used to construct a virtual machine security space in the target virtual machine, specifically including: creating SW-EPT and mapping a new physical page for the highest segment of memory, while NW-EPT remains unchanged; The object isolation module is used to isolate the isolated object to the virtual machine security space of the target virtual machine when the isolated object is detected to be running. Specifically, it includes: constructing a behavior monitoring point corresponding to the behavior to be monitored based on the identifier of the isolated object; constructing a behavior interception instruction based on the behavior monitoring point; when the virtual machine behavior in the virtual machine runtime environment space of the target virtual machine is executed to the behavior monitoring point, calling a switching gate through the behavior interception instruction; switching the execution flow of the virtual machine behavior to the virtual machine security space of the target virtual machine through the switching gate; and setting the internal page table of the inserted exception instruction to be executable only. If a process inside the VM reads or writes to it, it will trigger EPTMisconfig to switch it to SW-EPT and enable singlestep mode.

13. The apparatus according to claim 12, characterized in that, The object recognition module is also used to obtain behavior monitoring data corresponding to the behavior monitoring point through a preset information collection agent program.

14. The apparatus according to claim 12, characterized in that, The object isolation module is specifically used for: obtaining the behavior type corresponding to the behavior monitoring point; when the behavior type is CPU behavior monitoring, setting the virtual machine control structure domain to construct behavior interception instructions based on the virtual machine control structure domain; when the behavior type is non-CPU behavior monitoring, performing address translation processing on the guest virtual address in the virtual machine isolation monitoring instruction to obtain the physical machine physical address, and constructing behavior interception instructions based on the physical machine physical address.

15. The apparatus according to claim 12, characterized in that, The behavior interception instruction includes a system call handling function and an exception handling function. The device also includes a function creation module, used to: obtain the monitoring point type corresponding to the behavior monitoring point; when the monitoring point type is a user space monitoring point, write the system call function to the address of the user space monitoring point and create a corresponding system call handling function, which is used to call the switching gate; when the monitoring point type is a kernel space monitoring point, write the exception function to the address of the user space monitoring point and create a corresponding exception handling function, which is used to call the switching gate.

16. The apparatus according to claim 12, characterized in that, The secure space construction module is further configured to: obtain a secure space construction request corresponding to the target virtual machine; obtain the symbol table library of the target virtual machine based on the secure space construction request; construct a virtual machine secure space in the target virtual machine according to the symbol table library; and inject a preset information collection agent program into the virtual machine secure space.

17. The apparatus according to claim 16, characterized in that, The secure space construction module is also used to: obtain the virtual machine symbol table transfer script corresponding to the target virtual machine based on the secure space construction request; and obtain the symbol table library of the target virtual machine through the virtual machine symbol table transfer script.

18. The apparatus according to claim 17, characterized in that, The secure space construction module is further configured to: obtain the symbol table identifier of the target virtual machine through the virtual machine symbol table transfer script; search for symbol table data in a preset symbol table database using the symbol table identifier; when the symbol table data corresponding to the symbol table identifier is found, construct the symbol table library of the target virtual machine using the symbol table data found in the preset symbol table database; when the symbol table data corresponding to the symbol table identifier is not found, obtain the symbol table data from the target virtual machine based on the virtual machine symbol table transfer script, and construct the symbol table library of the target virtual machine using the obtained symbol table data.

19. The apparatus according to claim 12, characterized in that, The isolated objects include kernel modules; the object isolation module is specifically used to: intercept the startup requests of each kernel module in the target virtual machine; and isolate the kernel modules containing the isolation tag to the virtual machine security space of the target virtual machine.

20. The apparatus according to claim 19, characterized in that, The device further includes a tag setting module, used to: obtain module pre-installation instructions; add isolation tags to the corresponding pre-installed kernel module according to the module pre-installation instructions, and then install the pre-installed kernel module to the target virtual machine. The isolation tags are used to isolate the pre-installed kernel module to the virtual machine security space of the target virtual machine after the pre-installed kernel module is running.

21. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 11.

22. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.

23. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.

Images