A novel KVM cloud host micro-isolation method

Abstract

The application discloses a novel KVM cloud host micro-isolation method, comprising a virtual machine kernel micro-isolation module based on a Netfilter framework, a host rear-end processing module for realizing a semi-virtualization channel and a cloud host micro-isolation management platform for providing a cloud user with a network strategy configuration interaction capability of a cloud host, and has the beneficial effects that based on a semi-virtualization technology and a kernel Netfilter framework Hook technology, kernel layer configuration capability of a virtual machine network is realized, and through strategy priority control, the problem of invalid security control caused by malicious or incorrect application layer configuration is avoided; based on a semi-virtualization channel, configuration data interaction is realized through a host processing rear-end and the cloud host micro-isolation management platform, a host network is used, a tenant network is not used, and when a strategy configuration is incorrect, the configuration channel can be used for repair, and the problem of cloud host disconnection caused by incorrect network strategy configuration is avoided.

Description

Technical Field

[0001] This invention relates to the field of cloud security technology, and in particular to a novel KVM cloud host micro-segmentation method. Background Technology

[0002] Cloud server micro-segmentation technology is a technique for managing cloud server networks, primarily focusing on the security of east-west traffic, which refers to traffic between different hosts within the same network. In modern network environments, east-west threats and attack risks are critical because malicious activity typically occurs within the network, not just from external networks. Current products mainly implement this through configuration using Linux's iptables or other application-layer network tools. This approach has several drawbacks:

[0003] 1) Application-layer network configuration tools such as iptables can be modified by users or any other application with root privileges, posing a security risk.

[0004] 2) Existing solutions often use tenant network interaction to configure data. When configuring network policies, misconfiguration may occur, leading to cloud host disconnection and difficulty in recovery.

[0005] In view of the shortcomings of existing technologies, a novel micro-segmentation method for KVM cloud hosts is proposed. Summary of the Invention

[0006] The purpose of this section is to outline some aspects of embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0007] In view of the above problems, the present invention is proposed.

[0008] To address the aforementioned technical problems, this invention provides the following technical solution: a novel KVM cloud host micro-segmentation method, comprising:

[0009] S1 is a virtual machine kernel micro-segmentation module based on the Netfilter framework. It performs packet interception and filtering on the five chains of Netfilter, and makes the policy priority higher than other methods or application layer configured policies. On the other hand, it establishes a communication channel with the host backend processing module, receives the micro-segmentation policy issued by the cloud host micro-segmentation management platform, and reads all the Netfilter configurations configured in the kernel and reports them to the cloud host micro-segmentation management platform.

[0010] S2 is the host backend processing module that implements the semi-virtualized channel. The host backend processing module receives the reported virtual machine network configuration data and sends the configuration data issued by the cloud host micro-segmentation management platform to the virtual machine kernel micro-segmentation module.

[0011] S3 is a cloud server micro-segmentation management platform that provides cloud users with the ability to configure and manage network policies for cloud servers.

[0012] As a preferred embodiment of the novel KVM cloud host micro-segmentation method of the present invention, wherein: the five chains of Netfilter mentioned in S1 specifically include PREROUTING, INPUT, FORWARD, OUPUT and POSTROUTING.

[0013] As a preferred embodiment of the novel KVM cloud host micro-segmentation method of the present invention, wherein: the policy that prioritizes the policy over other methods or application layer configurations as described in S1 is specifically implemented through the underlying control of the kernel policy.

[0014] As a preferred embodiment of the novel KVM cloud host micro-segmentation method of the present invention, wherein: the establishment of the communication channel in S1 specifically refers to the establishment of a data queue using a semi-virtualized VirtIO device of QEMU-KVM.

[0015] As a preferred embodiment of the novel KVM cloud host micro-segmentation method of the present invention, wherein: all Netfilter configurations mentioned in S1 include other network configurations.

[0016] As a preferred embodiment of the novel KVM cloud host micro-segmentation method of the present invention, the host backend processing module for implementing the semi-virtualization channel in S2 specifically comprises: developing and implementing a VirtIO semi-virtualization device simulation program based on QEMU-KVM virtualization technology, which runs as part of the virtual machine program in the host backend.

[0017] As a preferred embodiment of the novel KVM cloud host micro-segmentation method of the present invention, the semi-virtualization device mentioned in S2 can specifically be a character device.

[0018] As a preferred embodiment of the novel KVM cloud host micro-segmentation method of the present invention, wherein: the virtual machine network configuration data reported in S2 is specifically received through the uplink queue of VirtIO.

[0019] As a preferred embodiment of the novel KVM cloud host micro-segmentation method of the present invention, wherein: the interactive capability mentioned in S3 specifically includes cloud users being able to view and modify specific network policy configurations.

[0020] As a preferred embodiment of the novel KVM cloud host micro-segmentation method of the present invention, the interactive capability described in S3 further includes that cloud users can define automated response strategies and automatically issue micro-segmentation management and control configurations based on the specific characteristics of security events.

[0021] The beneficial effects of this invention are:

[0022] 1. Based on semi-virtualization technology and kernel Netfilter framework Hook technology, it enables kernel-level configuration of virtual machine networks. At the same time, through policy priority control, it avoids security control failures caused by malicious or misconfigured application layers.

[0023] 2. Based on the semi-virtualization channel, configuration data interaction is achieved through the host machine's processing backend and the cloud host micro-segmentation management platform. The host machine network is used, but the tenant network is not used. When the policy configuration is incorrect, it can be repaired through this configuration channel to avoid cloud host disconnection due to network policy configuration errors. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0025] Figure 1 This is an overall architecture diagram of a novel KVM cloud host micro-segmentation method according to the present invention.

[0026] Figure 2 This is a data flow diagram of a novel KVM cloud host micro-segmentation method according to the present invention. Detailed Implementation

[0027] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0028] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0029] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0030] Secondly, the present invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of the present invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not according to the usual scale. Furthermore, the schematic diagrams are merely examples and should not limit the scope of protection of the present invention. In addition, actual fabrication should include three-dimensional spatial dimensions of length, width, and depth.

[0031] Example 1

[0032] A novel KVM cloud host micro-segmentation method includes:

[0033] S1 is a virtual machine kernel micro-segmentation module implemented based on the Netfilter framework. It performs packet interception and filtering on the five chains of Netfilter, including PREROUTING, INPUT, FORWARD, OUPUT, and POSTROUTING, and gives the policy priority higher than other methods or application layer policies. This is achieved through low-level control of kernel policies. On the other hand, it uses the data queue of the semi-virtualized VirtIO device of QEMU-KVM to establish a communication channel with the host backend processing module, receives the micro-segmentation policy issued by the cloud host micro-segmentation management platform, and reads all Netfilter configurations configured in the kernel, including other network configurations, and reports them to the cloud host micro-segmentation management platform.

[0034] S2 is the host backend processing module that implements the semi-virtualized channel. Specifically, it develops and implements a VirtIO semi-virtualized device simulation program based on QEMU-KVM virtualization technology, which runs as part of the virtual machine program in the host backend. The host backend processing module receives and reports virtual machine network configuration data through the VirtIO uplink queue, and at the same time sends the configuration data issued by the cloud host micro-segmentation management platform to the virtual machine kernel micro-segmentation module.

[0035] S3 is a cloud host micro-segmentation management platform that provides cloud users with the ability to configure and manage network policies for cloud hosts. Cloud users can view and modify specific network policy configurations, or define automated response policies to automatically issue micro-segmentation control configurations based on the specific characteristics of security events.

[0036] Example 2

[0037] Reference Figure 1This is the second embodiment of the present invention. This embodiment differs from the first embodiment in that it provides a specific implementation method:

[0038] Step 1: Deploy the cloud host micro-segmentation management platform on the management physical machine B of the cloud cluster;

[0039] Step 2: Install the QEMU virtual machine program containing the semi-virtualized device simulation code from Example 1 on a physical machine in the cloud cluster;

[0040] Step 3: In the virtual machine configuration, add the relevant configurations for the semi-virtualized device from Example 1;

[0041] Step 4: The virtual machine base image used contains the semi-virtualized device driver from Example 1 and is configured to load upon startup;

[0042] Step 5: Start virtual machine A in the physical mech. The virtual machine kernel micro-segmentation module will automatically take effect and perform network policy management operations.

[0043] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A novel KVM cloud host micro-segmentation method, characterized in that, include: S1 is a virtual machine kernel micro-segmentation module based on the Netfilter framework. It performs packet interception and filtering on the five chains of Netfilter, and makes the policy priority higher than other methods or application layer configured policies. On the other hand, it establishes a communication channel with the host backend processing module, receives the micro-segmentation policy issued by the cloud host micro-segmentation management platform, and reads all the Netfilter configurations configured in the kernel and reports them to the cloud host micro-segmentation management platform. S2 is the host backend processing module that implements the semi-virtualized channel. The host backend processing module receives the reported virtual machine network configuration data and sends the configuration data issued by the cloud host micro-segmentation management platform to the virtual machine kernel micro-segmentation module. S3 is a cloud server micro-segmentation management platform that provides cloud users with the ability to configure and manage network policies for cloud servers. The policy mentioned in S1 that prioritizes the policy over other methods or application layer configurations is specifically implemented through low-level control of the kernel policy; the establishment of the communication channel mentioned in S1 is specifically the establishment of a data queue using the semi-virtualized VirtIO device of QEMU-KVM; The interactive capabilities described in S3 also include allowing cloud users to define automated response strategies and automatically distribute micro-segmentation management configurations based on the specific characteristics of security events.

2. The novel KVM cloud host micro-segmentation method according to claim 1, characterized in that: The five chains of Netfilter described in S1 specifically include PREROUTING, INPUT, FORWARD, OUPUT, and POSTROUTING.

3. The novel KVM cloud host micro-segmentation method according to claim 1, characterized in that: All Netfilter configurations described in S1 include other network configurations.

4. The novel KVM cloud host micro-segmentation method according to claim 1, characterized in that: The host backend processing module for implementing the semi-virtualized channel described in S2 is specifically: a VirtIO semi-virtualized device emulation program developed based on QEMU-KVM virtualization technology, which runs as part of the virtual machine program in the host backend.

5. The novel KVM cloud host micro-segmentation method according to claim 1, characterized in that: The semi-virtualized device mentioned in S2 can specifically be a character device.

6. The novel KVM cloud host micro-segmentation method according to claim 1, characterized in that: The virtual machine network configuration data reported in S2 is received specifically through the uplink queue of VirtIO.

7. The novel KVM cloud host micro-segmentation method according to claim 1, characterized in that: The interactive capabilities described in S3 specifically include allowing cloud users to view and modify specific network policy configurations.

Images