A security protection method and device, virtual machine, electronic device and storage medium

Abstract

The application provides a security protection method and device, a virtual machine, electronic equipment and a storage medium, and relates to the technical field of network security. The security protection method is applied to a virtual machine and comprises the following steps: obtaining traffic five-tuple information of the virtual machine through an eBPF program of the virtual machine; filtering the obtained traffic five-tuple information of the virtual machine according to a security policy through the eBPF program to obtain filtered traffic five-tuple information; the security policy is generated by a first device according to the traffic five-tuple information of the virtual machine or the security policy is preconfigured by the first device; the traffic five-tuple information of the virtual machine is sent by the virtual machine to a second device through a proxy module and is sent by the second device to the first device; and the security policy is sent by the first device to the second device and is sent by the second device to the proxy module of the virtual machine. The scheme of the application can realize a micro-isolation mechanism, generate an accurate micro-isolation policy, has good compatibility and has a full monitoring range.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a security protection method and device, a virtual machine, an electronic device and a storage medium. BACKGROUND

[0002] As a typical technology of fine control of east-west traffic, micro-segmentation is first proposed by Gartner in the related technical system of software-defined data center (SDDC) to provide security access control between hosts (virtual machines, containers) (different from the security access control between security domains in the past) and to visually manage the east-west traffic. At present, the micro-segmentation technology has been together with software-defined perimeter (SDP) and identity and access management (IAM) as the three key technologies of zero trust. The micro-segmentation solutions proposed by the industry all include micro-segmentation management functions, traffic collection functions, policy execution functions and the like, so as to realize the generation of traffic view and security policy according to traffic analysis, the issuance of the security policy for traffic security monitoring, and the realization of the traffic visual and fine management capability of micro-segmentation.

[0003] There are some commercial products in the above solutions, but most of these solutions are applied to public cloud scenarios. For a telecom operator's telecom network (i.e., a telecom network constructed using network function virtualization (NFV) / software defined network (SDN), cloud technology, and virtualization technology, in which a traditional physical hardware core network is deployed in a virtual machine or a virtual machine container, deployment and operation efficiency is improved, and cost is reduced), a Guest OS of a virtual machine (VM) that deploys a core network network element function (NF) has a manufacturer private feature, a Host OS is bound to a virtual layer and also has a manufacturer private feature, and a third-party micro-isolation agent software is installed, which has poor compatibility. Moreover, a virtualized network function (VNF) is carried on multiple VMs, these VMs are connected through a manufacturer private network, only the virtual machine and the external service virtual machine have external access interfaces, and therefore the VMs that are not exposed to the outside cannot install a third-party agent, which causes the agent to collect incomplete traffic, cannot accurately generate a traffic view, and cannot generate a micro-isolation policy. The virtual switch mode has a large impact on the performance of the virtual layer; the control based on the Hypervisor has a compatibility problem between the micro-isolation plug-in and the virtual layer; and the diversion mechanism causes pressure on the SDN controller, the switch, and the bandwidth. SUMMARY

[0004] The purpose of the present application is to provide a security protection method and device, virtual machine, electronic equipment and storage medium, to solve the problem that the existing security protection method cannot generate accurate micro-isolation policy and has poor compatibility.

[0005] In a first aspect, the present application provides a security protection method applied to a virtual machine, the method comprising:

[0006] obtaining traffic five-tuple information of the virtual machine through an extended Berkeley Packet Filter eBPF program of the virtual machine;

[0007] filtering the obtained traffic five-tuple information of the virtual machine according to a security policy through the eBPF program, and identifying abnormal traffic;

[0008] The security policy is generated by the first device according to traffic five tuple information of the virtual machine, or the security policy is preconfigured by the first device; the traffic five tuple information of the virtual machine is sent by the virtual machine to the second device through a proxy module, and is sent by the second device to the first device; and the security policy is sent by the first device to the second device, and is sent by the second device to the proxy module of the virtual machine.

[0009] Optionally, the traffic five tuple information of the virtual machine is acquired by the extended Berkeley Packet Filter (eBPF) program of the virtual machine, and the method further comprises:

[0010] The traffic five tuple information of the virtual machine is acquired by the eBPF program;

[0011] The traffic five tuple information is sent to a storage and data retrieval module of the virtual machine by the eBPF program;

[0012] The traffic five tuple information of the virtual machine is acquired from the storage and data retrieval module by the proxy module.

[0013] Optionally, in the case that the security policy is generated by the first device according to the traffic five tuple information of the virtual machine, the method further comprises:

[0014] The first information is sent to the second device by the proxy module, and the first information comprises an identity of a first virtual network function (VNF), an identity of the virtual machine, and the traffic five tuple information;

[0015] The first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0016] Optionally, before the traffic five tuple information of the virtual machine is acquired by the extended Berkeley Packet Filter (eBPF) program of the virtual machine, the method further comprises:

[0017] The security policy is stored to a storage and data retrieval module of the virtual machine by the proxy module;

[0018] The security policy is acquired from the storage and data retrieval module by the eBPF program.

[0019] Optionally, the method further comprises:

[0020] In the case that the abnormal traffic is identified, an abnormal traffic log is generated according to the abnormal traffic;

[0021] store, by the eBPF program, the traffic five-tuple information of the abnormal traffic and the abnormal traffic log to a storage and data retrieval module of the virtual machine;

[0022] preprocess, by the proxy module, the traffic five-tuple information of the abnormal traffic and the abnormal traffic log to obtain processed traffic five-tuple information of the abnormal traffic and processed abnormal traffic log;

[0023] send, by the proxy module, second information to the second device, the second information including the processed traffic five-tuple information of the abnormal traffic, the processed abnormal traffic log, an identity of a first VNF, and an identity of the virtual machine; the VNF including the virtual machine; the first VNF being a VNF connected to the first device;

[0024] receive, by the proxy module, an updated security policy sent by the first device; the updated security policy being generated by the first device according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic log in the second information sent by the second device or the updated security policy being preconfigured by the first device;

[0025] send, by the storage and data retrieval module, the updated security policy to the eBPF program;

[0026] filter, by the eBPF program, the acquired traffic five-tuple information of the virtual machine according to the updated security policy.

[0027] In a second aspect, an embodiment of the present application further provides a security protection method applied to a first device, the method comprising:

[0028] sending a security policy to a second device;

[0029] wherein the security policy is generated by the first device according to traffic five-tuple information of a virtual machine or the security policy is preconfigured by the first device, the traffic five-tuple information of the virtual machine being sent by the virtual machine to the second device through a proxy module and sent by the second device to the first device; the security policy being sent by the first device to the second device and sent by the second device to the proxy module of the virtual machine.

[0030] Optionally, the sending of the security policy to the second device comprises:

[0031] sending third information to the second device, the third information including the security policy, an identity of a first virtual network function (VNF), and an identity of the virtual machine;

[0032] The first VNF includes the virtual machine, and the first VNF is a VNF connected with the first device.

[0033] Optionally, in a case where the security policy is generated by the first device according to the traffic five-tuple information of the virtual machine, the method further includes:

[0034] receiving first information sent by the second device, the first information including identity of the first VNF, identity of the virtual machine, and traffic five-tuple information of the virtual machine;

[0035] The first VNF includes the virtual machine, and the first VNF is a VNF connected with the first device.

[0036] Optionally, the method further includes:

[0037] learning according to the first information to obtain network topology information, the network topology information including the first VNF, identity of the first VNF, the virtual machine in the first VNF, identity of each of the virtual machines, connection relationship between the first VNFs, and connection relationship between the virtual machines;

[0038] The first VNF is a VNF connected with the first device.

[0039] Optionally, the method further includes:

[0040] receiving filtered traffic five-tuple information sent by the second device, the filtered traffic five-tuple information being sent by the virtual machine to the second device through a proxy module, and the filtered traffic five-tuple information being obtained by filtering, by the virtual machine through an extended Berkeley Packet Filter (eBPF) program of the virtual machine, the traffic five-tuple information of the virtual machine according to the security policy;

[0041] learning the filtered traffic five-tuple information to obtain a learning result;

[0042] In a case where the learning result indicates that the filtered traffic five-tuple information conforms to the network topology information and the security policy, it is determined to continue receiving the filtered traffic five-tuple information sent by the second device.

[0043] Optionally, the method further includes:

[0044] In a case where the virtual machine identifies abnormal traffic by filtering the acquired traffic five-tuple information of the virtual machine according to the security policy through the eBPF program, the second information sent by the second device is received; the second information includes processed traffic five-tuple information of the abnormal traffic, processed abnormal traffic logs, an identity of the first VNF, and an identity of the virtual machine; the first VNF includes the virtual machine; the first VNF is a VNF connected with the first device; the processed traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs are obtained by the virtual machine through the proxy module by preprocessing the traffic five-tuple information of the abnormal traffic and the abnormal traffic logs; the abnormal traffic logs are generated by the virtual machine according to the abnormal traffic through the eBPF program;

[0045] An updated security policy is generated according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs, or alarm information is generated according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs.

[0046] In a case where the updated security policy is generated according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs, the updated security policy is sent to the second device.

[0047] Optionally, the generating of the updated security policy according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs comprises:

[0048] In a case where a second VNF exists and the second VNF includes a virtual machine, the updated security policy is generated according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs; the second VNF is a VNF connected with the first device after the first VNF.

[0049] The network topology information is updated according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs.

[0050] Optionally, the generating of the alarm information according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs comprises:

[0051] In a case where a second VNF does not exist or in a case where traffic generated by a VM in the second VNF is different from the abnormal traffic, the alarm information is generated according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs.

[0052] The second VNF is a VNF connected with the first device after the first VNF.

[0053] In a third aspect, the embodiments of the present application further provide a security protection method, applied to a second device, the method comprising:

[0054] receiving a security policy sent by a first device; the security policy is generated by the first device according to traffic five-tuple information of a virtual machine or the security policy is preconfigured by the first device; the traffic five-tuple information of the virtual machine is obtained by the virtual machine through an extended Berkeley Packet Filter (eBPF) program, sent by a proxy module of the virtual machine to the second device, and sent by the second device to the first device;

[0055] sending the security policy to the proxy module of the virtual machine.

[0056] Optionally, in the case that the security policy is generated by the first device according to the traffic five-tuple information of the virtual machine, the method further comprises:

[0057] receiving first information sent by the virtual machine through the proxy module, the first information comprising an identity of a first Virtual Network Function (VNF), an identity of the virtual machine, and the traffic five-tuple information;

[0058] wherein the first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0059] Optionally, the receiving of the security policy sent by the first device comprises:

[0060] receiving third information sent by the first device;

[0061] wherein the third information comprises the security policy, the identity of the first VNF, and the identity of the virtual machine.

[0062] the first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0063] Optionally, the sending of the security policy to the proxy module of the virtual machine comprises:

[0064] sending the security policy to the proxy module of the virtual machine according to the identity of the first VNF and the identity of the virtual machine in the third information;

[0065] wherein the third information comprises the security policy, the identity of the first VNF, and the identity of the virtual machine.

[0066] the first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0067] Optionally, the method further comprises:

[0068] receive the filtered traffic five tuple information sent by the proxy module;

[0069] send the filtered traffic five tuple information to the second device;

[0070] The filtered traffic five tuple information is obtained by filtering the traffic five tuple information of the virtual machine according to the security policy by the eBPF program of the virtual machine.

[0071] Optionally, the method further comprises:

[0072] In a case where the filtered traffic five tuple information determined by the eBPF program of the virtual machine indicates that there is abnormal traffic, receive second information sent by the proxy module, the second information comprising processed traffic five tuple information of abnormal traffic, processed abnormal traffic log, identity of a first VNF and identity of the virtual machine; the first VNF comprises the virtual machine, and the first VNF is a VNF connected with the first device; the processed traffic five tuple information of abnormal traffic and the processed abnormal traffic log are obtained by preprocessing, by the virtual machine through the proxy module, traffic five tuple information of abnormal traffic and abnormal traffic log; the abnormal traffic log is generated by the virtual machine according to the abnormal traffic by the eBPF program;

[0073] send the updated security policy to the proxy module, the updated security policy being generated by the first device according to the traffic five tuple information of abnormal traffic and the processed abnormal traffic log sent by the second device.

[0074] In a fourth aspect, an embodiment of the present application further provides a security protection device applied to a virtual machine, the device comprising:

[0075] a first obtaining module configured to obtain traffic five tuple information of the virtual machine by an extended Berkeley Packet Filter (eBPF) program of the virtual machine;

[0076] a first filtering module configured to filter the obtained traffic five tuple information of the virtual machine according to a security policy by the eBPF program, and identify abnormal traffic;

[0077] The security policy is generated by the first device according to traffic five-tuple information of the virtual machine, or the security policy is preconfigured by the first device; the traffic five-tuple information of the virtual machine is sent by the virtual machine to the second device through a proxy module and is sent by the second device to the first device; and the security policy is sent by the first device to the second device and is sent by the second device to the proxy module of the virtual machine.

[0078] In a fifth aspect, an embodiment of the present application further provides a security protection device applied to a first device, the device comprising:

[0079] A first sending module is configured to send a security policy to a second device.

[0080] The security policy is generated by the first device according to traffic five-tuple information of the virtual machine, or the security policy is preconfigured by the first device; the traffic five-tuple information of the virtual machine is sent by the virtual machine to the second device through a proxy module and is sent by the second device to the first device; and the security policy is sent by the first device to the second device and is sent by the second device to the proxy module of the virtual machine.

[0081] In a sixth aspect, an embodiment of the present application further provides a security protection device applied to a second device, the device comprising:

[0082] A first receiving module is configured to receive a security policy sent by a first device; the security policy is generated by the first device according to traffic five-tuple information of a virtual machine, or the security policy is preconfigured by the first device; the traffic five-tuple information of the virtual machine is obtained by the virtual machine through an extended Berkeley Packet Filter (eBPF) program, is sent by the virtual machine to the second device through a proxy module of the virtual machine, and is sent by the second device to the first device;

[0083] A second sending module is configured to send the security policy to a proxy module of the virtual machine.

[0084] In a seventh aspect, an embodiment of the present application further provides a virtual machine, comprising a transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; the processor executes the program or instruction to implement steps in the security protection method according to any one of the first aspect.

[0085] In an eighth aspect, an embodiment of the present application further provides an electronic device, which is a first device, comprising a transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; the processor executes the program or instruction to implement steps in the security protection method according to any one of the second aspect.

[0086] In a ninth aspect, an embodiment of the present application also provides an electronic device, which is a second device, comprising a transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; the processor implements the steps in the security protection method according to any one of the third aspect when executing the program or instruction.

[0087] In a tenth aspect, an embodiment of the present application also provides a readable storage medium having a program or instruction stored thereon, the program or instruction being executable on a processor to implement the steps in the security protection method according to any one of the first aspect, or to implement the steps in the security protection method according to any one of the second aspect, or to implement the steps in the security protection method according to any one of the third aspect.

[0088] The beneficial effects of the above technical solutions of the present application are as follows:

[0089] The security protection method provided by the present application obtains the traffic five-tuple information of the virtual machine through the eBPF program of the virtual machine, receives the security policy sent by the second device through the proxy module, and filters the obtained traffic five-tuple information of the virtual machine according to the security policy through the eBPF program to obtain the filtered traffic five-tuple information, wherein the security policy is generated by the first device according to the traffic five-tuple information of the virtual machine or the security policy is pre-configured by the first device and sent to the second device by the first device, which can realize the micro-isolation mechanism, generate accurate micro-isolation policy, and has good compatibility and full monitoring range. BRIEF DESCRIPTION OF DRAWINGS

[0090] Figure 1 The eBPF architecture diagram provided by the present application;

[0091] Figure 2 The flowchart of the security protection method applied to the virtual machine provided by the embodiment of the present application;

[0092] Figure 3 The structural schematic diagram of the micro-isolation system based on eBPF provided by the embodiment of the present application;

[0093] Figure 4 The architecture schematic diagram of the agent provided by the embodiment of the present application;

[0094] Figure 5 The flowchart of the security protection method applied to the first device provided by the embodiment of the present application;

[0095] Figure 6 The flowchart of the security monitoring without exception provided by the embodiment of the present application;

[0096] Figure 7 Flowchart of the security monitoring of the abnormal process provided by the embodiment of the present application;

[0097] Figure 8 Flowchart of the security protection method of the second device provided by the embodiment of the present application;

[0098] Figure 9 Detailed flowchart of the security protection method provided by the embodiment of the present application;

[0099] Figure 10 Structure schematic diagram of the security protection device applied to the virtual machine provided by the embodiment of the present application;

[0100] Figure 11 Structure schematic diagram of the security protection device applied to the first device provided by the embodiment of the present application;

[0101] Figure 12 Structure schematic diagram of the security protection device applied to the second device provided by the embodiment of the present application;

[0102] Figure 13 Structure schematic diagram of the virtual machine provided by the embodiment of the present application. DETAILED DESCRIPTION

[0103] In order to make the technical problems to be solved by the present application, the technical solutions and advantages clearer, the following will be described in detail with reference to the accompanying drawings and specific embodiments.

[0104] It should be understood that the "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment", "in an embodiment" or "in an optional embodiment" appearing throughout the specification does not necessarily mean the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner.

[0105] In various embodiments of the present application, it should be understood that the size of the serial number of the following processes does not mean the order of execution, and the execution order of the processes should be determined according to its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0106] In addition, the terms "system" and "network" are often used interchangeably in this document.

[0107] In the embodiments provided in the present application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined according to A. However, it should also be understood that the determination of B according to A does not mean that B is determined only according to A, but B can also be determined according to A and / or other information.

[0108] For the convenience of understanding, before the specific embodiment of the present application is described, the following is first described:

[0109] There are mainly the following types of micro-isolation solutions proposed in the industry:

[0110] Independent physical security devices: isolation between different security domains is performed by deploying physical security devices such as firewalls at the security domain boundary, which will result in a large number of physical security devices being deployed, and the network of the data center has the characteristics of dynamic change, without fixed physical boundaries, so the static deployment of physical security devices will result in a large amount of diversion and policy configuration;

[0111] Host agent: install agent software on each virtual machine to check the traffic in and out of the virtual machine and the application and content inside the virtual machine. This way has dependency on the virtual machine operating system;

[0112] Virtual switch: divide virtual local area networks (VLNs) and set access control lists (ACLs) on the virtual switch. This way has requirements on the capabilities of the switch;

[0113] Hypervisor-based control: Hypervisor and virtual switch cooperate to control the virtual network card of the virtual machine. This way depends on the application programming interface (API) provided by the Hypervisor;

[0114] Diversion: divert the traffic of the virtual machine to be protected to a security virtual machine or a physical security device for analysis. This way does not depend on the virtual environment and needs a diversion mechanism.

[0115] Extended Berkeley Packet Filter (eBPF) is a packet filtering technology, and an architecture diagram of eBPF is as follows: Figure 1As shown, eBPF is extended from Berkeley PacketFilter (BPF) technology, and with the help of Just-In-Time Compiler (JIT), a virtual machine is run in the kernel, and only eBPF instructions verified to be safe will be executed by the kernel. At the same time, because eBPF instructions still run in the kernel, there is no need to copy data to the user state, which greatly improves the efficiency of event processing. eBPF has obtained a large number of applications in the fields of fault diagnosis, network optimization, security control, performance monitoring, etc. eBPF needs to be executed after event triggering. These events include system calls, kernel tracepoints, call exits of kernel functions and user state functions, network events, etc. eBPF programs are loaded into the kernel in the form of bytecode, attached to the mounting point to trigger execution, and interact with the user state program through eBPF Map.

[0116] To solve the problem that the existing security protection method cannot generate accurate micro-isolation strategies and has poor compatibility, an embodiment of the present application provides a security protection method and device, a virtual machine, electronic equipment and a storage medium.

[0117] As Figure 2 shown, an embodiment of the present application provides a security protection method applied to a virtual machine, and the method comprises:

[0118] Step 201: acquiring traffic five-tuple information of the virtual machine through an extended Berkeley PacketFilter (eBPF) program of the virtual machine.

[0119] It should be noted that the security protection method provided by the embodiment of the present application is applied to an eBPF-based micro-isolation system, and a structure diagram of the eBPF-based micro-isolation system is as shown in Figure 3 .

[0120] The eBPF-based micro-isolation system comprises a micro-isolation management module and a VNF connected with the micro-isolation management module. The VNF comprises a management virtual machine (management VM) and a service virtual machine (service VM). The management VM is responsible for processing management-related functions, and the service VM is responsible for processing service-related functions. In the management VM and the service VM of the VNF, an eBPF program, an agent and a storage and data retrieval module (Map) are added respectively. In addition, a convergence forwarding module is added in the management VM.

[0121] The eBPF program in the virtual machine is a kernel eBPF, which is loaded into the kernel by the agent, is mounted on a kernel function such as TC or XDP after being verified for legitimacy, and can also be a function related to access or connection of a network protocol stack transmission control protocol (TCP). In this step, when the system calls the kernel function, the eBPF program is triggered to execute and perform traffic processing, and the virtual machine collects five-tuple information of traffic received by the virtual machine in real time through the eBPF program, that is, traffic five-tuple information. Specifically, the eBPF program filters the traffic received by the kernel, extracts the five-tuple information of the traffic, and the process of filtering the traffic received by the kernel through the eBPF program is not described in detail in the embodiment of the application.

[0122] Step 202: filtering the acquired traffic five-tuple information of the virtual machine according to a security policy through the eBPF program, and identifying abnormal traffic;

[0123] The security policy is generated by the first device according to the traffic five-tuple information of the virtual machine, or the security policy is preconfigured by the first device. The traffic five-tuple information of the virtual machine is sent by the agent module of the virtual machine to the second device and sent by the second device to the first device. The security policy is sent by the first device to the second device and sent by the second device to the agent module of the virtual machine.

[0124] It should be noted that the first device is a micro-isolation management module, and the second device is a converged forwarding module newly added in the management VM.

[0125] In this step, in the initial traffic learning stage, the first device has not downloaded the security policy, and all traffic is released, that is, forwarded according to the destination address. That is, the virtual machine sends the traffic five-tuple information to the second device through the agent, and the second device reports the received traffic five-tuple information to the first device. Alternatively, the agent can periodically send the traffic five-tuple information to the second device, and the second device also periodically sends the traffic five-tuple information to the first device. Alternatively, the first device can periodically actively acquire the traffic five-tuple information from the second device.

[0126] The first device learns according to the flow five-tuple information, generates a security policy, or, when the operation and maintenance personnel already have the access relationship between network elements, that is, if it is known which virtual machines are included in the first VNF currently connected to the first device and the flow interaction between each virtual machine and other virtual machines, the security policy can also be set in advance, the first device sends the security policy to the second device, the second device forwards the security policy to the agent, and the virtual machine filters the obtained flow five-tuple information of the virtual machine according to the security policy, identifies abnormal flow, and performs security monitoring. Specifically, the virtual machine checks whether there is abnormal flow according to the received flow five-tuple information according to the security policy. The checking method can be to check whether all the extracted flow five-tuple information conforms to the security policy, such as whether it is in the access control list (Access Control Lists, ACL). If not, it is abnormal flow.

[0127] It should be noted that the agent is responsible for creating a Map (Map is used for exchanging information between the kernel space and the user space) and managing the eBPF program, such as loading the eBPF program into the kernel, monitoring the running state of the eBPF program, etc., and is responsible for reading the flow five-tuple information written by the eBPF program from the Map. Therefore, in an optional embodiment of the present application, the flow five-tuple information of the virtual machine is obtained by the extended Berkeley Packet Filter eBPF program of the virtual machine, comprising: when the system calls the kernel function, the eBPF program is triggered to execute when performing flow processing, the flow five-tuple information is collected by the eBPF program, and the flow five-tuple information is sent to the Map. The agent reads the flow five-tuple information from the Map, and the agent pre-processes the flow five-tuple information, that is, integrates the coincident flow five-tuple information.

[0128] In an optional embodiment of the present application, when the agent sends the flow five-tuple information to the first device, the agent of the virtual machine sends first information including the identity of the first VNF (VNF id), the identity of the VM in the first VNF (VM id), and the flow five-tuple information to the second device. The flow five-tuple information can be pre-processed flow five-tuple information. After the second device receives the first information, the second device sends the VNF id, the VM id, and the flow five-tuple information in the first information to the first device. For example, the agent can periodically send the first information to the second device, and the second device also periodically sends the first information to the first device. The first device can also actively obtain the first information from the second device. As shown in Figure 3 The first VNF includes VNF1 and VNF2, VNF1 includes a management VM, a service VM1, and a service VM2, and the VM in VNF2 is not shown.

[0129] In addition, the agent is also used to store the security policy into a Map associated with the agent, the Map is a data structure managed by the kernel, stores data in the form of key-value pairs, can be used to store data from the eBPF program, store the security policy required by the agent to execute the eBPF program, and support the eBPF program and the agent to read the related data stored in the Map respectively, in an optional embodiment of the present application, the method further comprises: the first device sends the security policy to the second device, and carries the corresponding VNF id and VM id, the second device sends the security policy to the agent of the virtual machine according to the VNF id and the VM id, sends the security policy to the Map of the virtual machine through the agent, and the agent sends a security policy update notification message to the eBPF program, and the eBPF program obtains the security policy from the Map.

[0130] The eBPF program collects traffic quintuple information of received traffic, and filters the received traffic quintuple information according to a security policy, that is, performs security monitoring. In an optional embodiment of the present application, if no exception occurs in the security monitoring according to the security policy, the traffic monitoring is continued. In another optional embodiment, the eBPF program collects traffic quintuple information, and filters the traffic quintuple information according to a security policy to obtain filtered traffic quintuple information. If abnormal traffic is identified in the filtered traffic quintuple information, the packet corresponding to the abnormal traffic is discarded, an abnormal traffic log is generated according to the abnormal traffic, the abnormal traffic log includes traffic quintuple information of the discarded abnormal traffic, a receiving time of the abnormal traffic, a processing action, etc. The eBPF program stores the acquired traffic quintuple information of the abnormal traffic and the abnormal traffic log in a Map. The agent obtains the traffic quintuple information of the abnormal traffic and the abnormal traffic log from the Map. The agent pre-processes the traffic quintuple information of the abnormal traffic and the abnormal traffic log, merges the overlapping traffic quintuple information and abnormal traffic log information (that is, the processed traffic quintuple information of the abnormal traffic and the processed abnormal traffic log), and reports the second information including the processed traffic quintuple information of the abnormal traffic, the processed abnormal traffic log, and a VNF id and a VM id to the second device. The second device sends the second information to the first device. The first device learns according to the processed traffic quintuple information of the abnormal traffic and the processed abnormal traffic log in the second information, obtains an updated security policy or alarm information. If the updated security policy is generated, the first device sends the updated security policy to the second device. The second device sends the updated security policy to the agent. The agent sends the updated security policy to the Map. The eBPF program obtains the updated security policy from the Map, and filters the acquired traffic quintuple information according to the updated security policy, that is, continues the traffic monitoring.

[0131] It should be further noted that when the security policy is normally updated due to business evolution or update, etc. (for example, after a new business system is put into operation, there is traffic interaction between the original VNF and the business system, and the security policy of the existing VNF needs to be updated), the preset security policy can also be used, that is, the updated security policy is pre-configured. The first device sends the updated security policy to the second device, so that the second device sends the agent in the virtual machine. The preset security policy can avoid blocking of new traffic due to non-updated security policy.

[0132] In the case where the eBPF program finds abnormal traffic in the filtered traffic quintuple information, the agent immediately sends the second information to the second device. The legal traffic is forwarded according to the destination address.

[0133] In summary, the agent provided by the embodiment of the present application has an architecture as shown in the figure, wherein the agent at least includes a Map creation module, a traffic and log information acquisition module, a traffic and log information reporting module, a security policy receiving module, a security policy issuing module, and an eBPF management module, which respectively implement the following: creating a Map associated with an eBPF program, acquiring traffic five-tuple information and abnormal traffic information from the Map, and reporting the information to a convergence forwarding module; receiving a security policy from the convergence forwarding module, and storing the security policy to the Map, and notifying the eBPF program of a security policy update. The eBPF program is managed, including loading the eBPF program to a kernel space, mounting to a related kernel function, monitoring a running state of the eBPF program, and the like. Figure 4

[0134] The virtual machine provided by the embodiment of the present application realizes the collection of traffic information in the kernel and the security filtering of the traffic through the eBPF program, and compared with the collection of traffic information and the security filtering in the user state, the efficiency is higher, the performance influence on the network element is smaller, and the compatibility problem of components of different manufacturers does not need to be solved; the convergence forwarding module is introduced, the development of a new interface of the VNF virtual machine is reduced, and the exposure surface of the VNF is reduced.

[0135] As shown in the figure, the embodiment of the present application further provides a security protection method, applied to a first device, and the method includes the following steps. Figure 5 Step 501: sending a security policy to a second device;

[0136] Wherein, the security policy is generated by the first device according to traffic five-tuple information of a virtual machine, or the security policy is preconfigured by the first device, the traffic five-tuple information of the virtual machine is sent by the virtual machine to the second device through a proxy module, and is sent by the second device to the first device; and the security policy is sent by the first device to the second device, and is sent by the second device to the proxy module of the virtual machine.

[0137] It should be noted that the first device provided by the embodiment of the present application is a micro-isolation management module as shown in the figure, and the second device is a convergence forwarding module. As shown in the figure, the micro-isolation management module includes asset management, security policy management, security monitoring, traffic visualization, etc., and can be independently deployed or be part of a network management OMC of a network element. The agent in all virtual machines of the VNF can communicate between the convergence forwarding module and the micro-isolation management module in the management virtual machine, including traffic information, abnormal traffic log reporting, security policy issuing, etc.

[0138] Figure 3 Figure 3

[0139] ​​​​The first device is responsible for learning according to traffic quintuple information reported by the aggregation forwarding module in the management VM, generating a security policy, or forming a security policy through pre-configuration, and supports issuing the security policy to the aggregation management module. The first device (i.e., the micro management module) can be independently deployed, or can be part of the network element operation and maintenance center (OMC). In this scenario, the communication between the micro isolation management module and the management VM can be extended based on the interface between the OMC and the management VM, without developing a new interface.

[0140] In this step, the first device receives the traffic quintuple information of the virtual machine sent by the second device, learns according to the traffic quintuple information of the virtual machine, generates a security policy, or, when the operation and maintenance personnel already have the access relationship between network elements, i.e., know which VMs are included in the VNF, and which VMs have traffic interaction with each other, the first device pre-configures the security policy, and the first device sends the security policy to the second device. The second device is used to send the security policy to the agent of the virtual machine, so that the eBPF program of the virtual machine filters the acquired traffic quintuple information of the corresponding virtual machine according to the security policy.

[0141] It should be further pointed out that the security policy can be set for a group of VMs to form a security policy group, and VMid and VNF id are used instead of IP to identify the VM. Thus, when the VM is expanded, the VM identifier can be used to automatically join the security policy group, so that the security policy automatically takes effect.

[0142] In an optional embodiment of the present application, when the first device sends the security policy to the second device, the identity of the corresponding first VNF (VNF id) and the identity of the virtual machine in the first VNF (VM id) are also carried, i.e., the first device sends third information including the security policy, VNF id and VM id to the second device, so that the second device sends the security policy to the corresponding virtual agent according to the VNF id and the VM id.

[0143] In an optional embodiment of the present application, when the traffic quintuple information is sent to the first device through the agent, the first information including the identity of the first VNF (VNF id), the identity of the VM in the first VNF (VM id) and the traffic quintuple information is sent to the second device through the agent of the virtual machine. The traffic quintuple information can be pre-processed traffic quintuple information. After receiving the first information, the second device sends the VNF id, VM id and traffic quintuple information in the first information to the first device.

[0144] Further, the first device learns, according to traffic five-tuple information in the first information, using an artificial intelligence (AI) technology, to generate network topology information, wherein the network topology information at least includes first VNFs in the network, identity of each first VNF (VNF id), VMs contained in each VNF and identity of the VMs (VM id), connection relationship between the VMs, and connection relationship between the first VNFs.

[0145] In an optional embodiment of the present application, after the agent of the virtual machine receives the corresponding security policy and filters the acquired traffic five-tuple information of the virtual machine according to the security policy through the eBPF program, the virtual machine sends the filtered traffic five-tuple information to the second device through the agent, the second device aggregates the filtered traffic five-tuple information and sends the filtered traffic five-tuple information to the first device, the first device learns according to the filtered traffic five-tuple information to obtain a learning result, and if the learning result indicates that the filtered traffic five-tuple information is consistent with the network topology information and the security policy, it is determined that the virtual machine continues to be monitored, that is, the filtered traffic five-tuple information is continuously sent to the second device, and the first device determines to continuously receive the filtered traffic five-tuple information sent by the second device.

[0146] Specifically, please refer to Figure 6 , the flow of security monitoring without exception is as follows:

[0147] Step 1: The eBPF program in the VNF virtual machine collects traffic five-tuple information from the received traffic and filters the traffic according to the security policy to obtain filtered traffic five-tuple information.

[0148] Step 2: The eBPF program stores the captured filtered traffic five-tuple information to the Map in the virtual machine.

[0149] Step 3: The agent in the virtual machine reads the filtered traffic five-tuple information from the Map.

[0150] Step 4: The agent pre-processes the filtered traffic five-tuple information.

[0151] Step 5: The agent periodically reports the pre-processed filtered traffic five-tuple information to the second device.

[0152] Step 6: The agent aggregates the received filtered traffic five-tuple information and reports to the first device.

[0153] Step 7: The first device learns according to the filtered traffic five-tuple information, confirms that it is consistent with the current network topology information and the security policy, and continues to monitor.

[0154] In another optional embodiment of the present application, the agent of the virtual machine receives the corresponding security policy, and filters the obtained traffic five tuple information of the virtual machine according to the security policy through the eBPF program, obtains the filtered traffic five tuple information, and if abnormal traffic is identified according to the filtered traffic five tuple information, discards the packet corresponding to the abnormal traffic, generates an abnormal traffic log according to the abnormal traffic, the abnormal traffic log includes the traffic five tuple information of the discarded abnormal traffic, the receiving time of the abnormal traffic, the processing action, etc., the eBPF program stores the obtained traffic five tuple information of the abnormal traffic and the abnormal traffic log to the Map, the agent obtains the traffic five tuple information of the abnormal traffic and the abnormal traffic log from the Map, the agent preprocesses the traffic five tuple information of the abnormal traffic and the abnormal traffic log, merges the overlapping traffic five tuple information and abnormal traffic log information (i.e. the processed traffic five tuple information of the abnormal traffic and the processed abnormal traffic log), the agent reports the second information including the processed traffic five tuple information of the abnormal traffic, the processed abnormal traffic log, and the VNF id and the VM id to the second device, the second device sends the second information to the first device, the first device learns according to the processed traffic five tuple information of the abnormal traffic and the processed abnormal traffic log in the second information, obtains the updated security policy or the alarm information, if the updated security policy is generated, the first device sends the updated security policy to the second device, the second device sends the updated security policy to the agent, the agent sends the updated security policy to the Map, the eBPF program obtains the updated security policy from the Map, and filters the obtained traffic five tuple information according to the updated security policy, that is, continues to monitor the traffic.

[0155] It also needs to be explained that when the security policy is normally updated due to business evolution or update, etc. (such as after a new business system is put into operation, the original VNF has traffic interaction with the business system, and the security policy of the existing VNF needs to be updated), the preset security policy mode can also be used, that is, the updated security policy is preconfigured, and the first device sends the updated security policy to the second device, so that the second device sends it to the agent in the virtual machine, wherein the preset security policy mode can avoid that the new traffic is blocked because the security policy is not updated.

[0156] Further, the first device acquires from the OMC or the Network Functions Virtualisation Orchestrator (NFVO) whether there is a new VNF and corresponding VM instantiation, if yes, that is, in the case that there is a second VNF connected with the first device after the first VNF and the VM in the second VNF includes a newly accessed VM, it is indicated that the abnormal traffic is generated by the legal new VNF (second VNF) and the corresponding VM, then the updated security policy is generated according to the traffic five tuple information of the abnormal traffic and the processed abnormal traffic log, and the network topology information is updated according to the traffic five tuple information of the abnormal traffic and the processed abnormal traffic log. If no, that is, in the case that there is no second VNF connected with the first device after the first VNF, or the traffic generated by the VM in the second VNF is different from the abnormal traffic (that is, the VM in the second VNF is not the generator of the abnormal traffic), alarm information is generated according to the traffic five tuple information of the abnormal traffic and the processed abnormal traffic log, and is disposed by the administrator.

[0157] Specifically, please refer to Figure 7 , the abnormal flow of security monitoring is as follows:

[0158] Step 1, the eBPF program in the virtual machine of the VNF collects the traffic five tuple information of the received traffic, and filters the traffic according to the security policy, finds the abnormal traffic, discards the packet, and records the abnormal traffic log. The abnormal traffic log includes the traffic five tuple information of the discarded packet, and the receiving time, processing action, etc.

[0159] Step 2, the eBPF program stores the acquired traffic five tuple information of the abnormal traffic and the abnormal traffic log to the Map;

[0160] Step 3, the agent acquires the traffic five tuple and the abnormal traffic log information from the Map;

[0161] Step 4, the agent pre-processes the traffic five tuple information of the abnormal traffic and the abnormal traffic log, and merges the overlapping traffic five tuple information of the abnormal traffic and the abnormal traffic log information;

[0162] Step 5, the agent reports the pre-processed traffic five tuple information of the abnormal traffic, the abnormal traffic log, and the VNF id and VM id to the second device;

[0163] Step 6, the second device reports the received traffic five tuple information of the abnormal traffic, the abnormal traffic log, and the VNF id and VM id to the first device, and the Map configures the traffic and port whitelist on the virtualized network element through the eBPF program;

[0164] Step 7, the first device learns according to the flow five tuple information of the abnormal flow and the abnormal flow log, checks whether the abnormal flow is generated by the VM in the newly added legal VNF (the second VNF), if yes, generates the updated network topology information, and generates the updated security policy, and delivers the updated security policy to the second device, otherwise, generates the alarm information, and the administrator handles it;

[0165] Step 8, the first device delivers the updated security policy to the second device;

[0166] Step 9, the second device delivers the updated security policy to the corresponding agent;

[0167] Step 10, stores the updated security policy to the Map;

[0168] Step 11, the agent sends the security policy update notification to the eBPF program;

[0169] Step 12, the eBPF program obtains the updated security policy from the Map;

[0170] Step 13, collects the flow five tuple information of the collected flow, and filters the flow according to the updated security policy.

[0171] As shown in Figure 8 the embodiment of the application further provides a security protection method, applied to a second device, and the method comprises the following steps:

[0172] Step 801: receiving the security policy sent by a first device; the security policy is generated by the first device according to the flow five tuple information of a virtual machine or the security policy is preconfigured by the first device; the flow five tuple information of the virtual machine is obtained by the virtual machine through an extended Berkeley Packet Filter (eBPF) program, sent to the second device through a proxy module of the virtual machine, and sent to the first device by the second device.

[0173] It should be noted that the first device is a micro-isolation management module, and the second device is a converged forwarding module newly added in the management VM.

[0174] Step 802: sending the security policy to the proxy module of the virtual machine.

[0175] In the embodiment, the converged forwarding module is deployed in the management virtual machine of the VNF, receives the flow five tuple information of the agent in all virtual machines of the VNF, and periodically reports to the micro-isolation management module; receives the security policy delivered from the micro-isolation management module, and forwards the security policy to the corresponding agent in the virtual machine of the VNF.

[0176] In an optional embodiment of the present application, when the security policy is generated by the first device according to the traffic five-tuple information of the virtual machine, the method further comprises:

[0177] receiving first information sent by the virtual machine through the proxy module, the first information comprising an identity of a first virtual network function (VNF), an identity of the virtual machine, and the traffic five-tuple information;

[0178] The first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0179] In an optional embodiment of the present application, the receiving of the security policy sent by the first device comprises:

[0180] receiving third information sent by the first device;

[0181] The third information comprises the security policy, an identity of a first VNF, and an identity of the virtual machine.

[0182] The first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0183] In an optional embodiment of the present application, the sending of the security policy to the proxy module of the virtual machine comprises:

[0184] sending the security policy to the proxy module of the virtual machine according to the identity of the first VNF and the identity of the virtual machine in the third information;

[0185] The third information comprises the security policy, an identity of a first VNF, and an identity of the virtual machine.

[0186] The first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0187] In an optional embodiment of the present application, the method further comprises:

[0188] receiving filtered traffic five-tuple information sent by the virtual machine through the proxy module;

[0189] sending the filtered traffic five-tuple information to the second device;

[0190] The filtered traffic five-tuple information is obtained by filtering, by the virtual machine through an eBPF program, the traffic five-tuple information of the virtual machine according to the security policy.

[0191] In an optional embodiment of the present application, the method further comprises:

[0192] In a case where the virtual machine determines, through the eBPF program, that the filtered traffic five tuple information indicates that there is abnormal traffic, second information sent by the agent module is received, the second information including processed traffic five tuple information of the abnormal traffic, processed abnormal traffic log, identity of the first VNF, and identity of the virtual machine; the first VNF including the virtual machine, the first VNF being a VNF connected with the first device; the processed traffic five tuple information of the abnormal traffic and the processed abnormal traffic log being obtained by the virtual machine through the agent module by preprocessing traffic five tuple information of the abnormal traffic and abnormal traffic log; the abnormal traffic log being generated by the virtual machine through the eBPF program according to the abnormal traffic;

[0193] An updated security policy is sent to the agent module, the updated security policy being generated by the first device according to the traffic five tuple information of the abnormal traffic and the processed abnormal traffic log sent by the second device.

[0194] The specific flow of the security protection provided by the embodiment of the application will be described in detail below. Figure 9

[0195] Step 1: An agent in a VNF virtual machine creates a Map, which is used for exchanging information between a kernel space and a user space.

[0196] Step 2: The agent in the virtual machine loads an eBPF program to a kernel and successfully mounts on a kernel function.

[0197] Step 3: When the VM of the VNF receives traffic and calls the kernel function on which the eBPF program is mounted to process the traffic, the eBPF program is triggered to execute, and the eBPF program in the virtual machine captures traffic five tuple information and stores the traffic five tuple information to the Map.

[0198] Step 4: The agent reads the traffic five tuple information in the Map.

[0199] Step 5: The traffic five tuple information is preprocessed to obtain processed traffic five tuple information.

[0200] Step 6: The agent periodically reports the processed traffic five tuple information, VNF id, and VM id to a second device.

[0201] Step 7: The second device aggregates the received traffic five tuple information, VNF id, and VM id and reports to a first device.

[0202] ​Step 8, the first device learns according to the flow five tuple information, generates network topology information, and learns according to the flow five tuple information, generates a security policy or a preset security policy;

[0203] Step 9, the first device issues the security policy to the second device;

[0204] Step 10, the second device issues the security policy to the corresponding agent;

[0205] Step 11, the agent stores the security policy to the Map;

[0206] Step 12, the agent sends a security policy update notification to the eBPF program

[0207] Step 13, the eBPF program acquires the security policy from the Map;

[0208] Step 14, the eBPF program collects flow five tuple information of received traffic, and filters the traffic according to the security policy.

[0209] The security protection method provided by the embodiment of the application is a micro-isolation mechanism based on an eBPF program, and the eBPF program is used to realize collection and reporting of network element flow information and execution of a security policy; the network element flow information is reported and converged, and then unified reporting is performed, so that the VNF all VMs and the micro-isolation management function are prevented from being connected. In this way, efficient data collection and traffic monitoring and VNF security are realized.

[0210] The embodiment of the application avoids compatibility problems caused by installation of third-party plug-ins, and the endogenous plug-in operation and maintenance is more efficient, and the problem of difficult multi-manufacturer positioning does not occur; the eBPF is used to collect and filter flow information in the kernel state, so that data is prevented from being copied back and forth between the kernel and the user space, the efficiency is higher, the influence on the network element performance is small, the converged forwarding module of the management VM interacts with the micro-isolation management module, new interfaces between other business VMs and the micro-isolation management module are prevented from being connected, and the exposure of the VNF is reduced.

[0211] As shown in Figure 10 The embodiment of the application also provides a security protection device applied to a virtual machine, and the device comprises:

[0212] A first acquisition module 1001 is configured to acquire flow five tuple information of the virtual machine through an extended Berkeley Packet Filter eBPF program of the virtual machine;

[0213] A first filtering module 1002 is configured to filter the acquired flow five tuple information of the virtual machine according to a security policy through the eBPF program, and identify abnormal traffic;

[0214] The security policy is generated by the first device according to traffic five tuple information of the virtual machine, or the security policy is preconfigured by the first device; the traffic five tuple information of the virtual machine is sent by the virtual machine to a second device through a proxy module, and is sent by the second device to the first device; and the security policy is sent by the first device to the second device, and is sent by the second device to the proxy module of the virtual machine.

[0215] Optionally, the first obtaining module 1001 comprises:

[0216] The first obtaining unit is configured to obtain the traffic five tuple information of the virtual machine through the eBPF program.

[0217] The first sending unit is configured to send the traffic five tuple information to a storage and data retrieval module of the virtual machine through the eBPF program.

[0218] The second obtaining unit is configured to obtain the traffic five tuple information of the virtual machine from the storage and data retrieval module through the proxy module.

[0219] Optionally, the apparatus further comprises a first information sending module.

[0220] The first information sending module is configured to send first information to a second device through the proxy module in a case where the security policy is generated by the first device according to the traffic five tuple information of the virtual machine, the first information comprising an identity of a first virtual network function (VNF), an identity of the virtual machine, and the traffic five tuple information.

[0221] The first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0222] Optionally, the apparatus further comprises:

[0223] The first storage module is configured to store the security policy to a storage and data retrieval module of the virtual machine through the proxy module.

[0224] The second obtaining module is configured to obtain the security policy from the storage and data retrieval module through the eBPF program.

[0225] Optionally, the apparatus further comprises:

[0226] The first processing module is configured to generate an abnormal traffic log according to the abnormal traffic in a case where the abnormal traffic is identified.

[0227] The second storage module is configured to store the traffic five-tuple information of the abnormal traffic and the abnormal traffic log to a storage and data retrieval module of the virtual machine through the eBPF program.

[0228] The second processing module is configured to preprocess the traffic five-tuple information of the abnormal traffic and the abnormal traffic log through the proxy module to obtain processed traffic five-tuple information of the abnormal traffic and processed abnormal traffic log.

[0229] The second information sending module is configured to send second information to the second device through the proxy module, wherein the second information comprises the processed traffic five-tuple information of the abnormal traffic, the processed abnormal traffic log, an identity of the first VNF and an identity of the virtual machine.

[0230] The first policy receiving module is configured to receive an updated security policy sent by the first device through the proxy module.

[0231] The third obtaining module is configured to obtain the updated security policy from the storage and data retrieval module through the eBPF program.

[0232] The second filtering module is configured to filter the obtained traffic five-tuple information of the virtual machine according to the updated security policy through the eBPF program.

[0233] It should be noted that the security protection device applied to the virtual machine provided by the embodiments of the present application is a device capable of executing the security protection method applied to the virtual machine described above.

[0234] As shown in Figure 11 The present application also provides a security protection device applied to a first device, which comprises:

[0235] The first sending module 1101 is configured to send a security policy to a second device.

[0236] The security policy is generated by the first device according to traffic five-tuple information of the virtual machine, or the security policy is preconfigured by the first device, the traffic five-tuple information of the virtual machine is sent by the virtual machine to the second device through a proxy module, and the second device sends the traffic five-tuple information of the virtual machine to the first device; and the security policy is sent by the first device to the second device, and the second device sends the security policy to the proxy module of the virtual machine.

[0237] Optionally, the first sending module 1101 comprises:

[0238] The third sending unit is configured to send third information to the second device, the third information comprising the security policy, an identity of a first virtual network function (VNF), and an identity of the virtual machine.

[0239] The first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0240] Optionally, the apparatus further comprises a first information receiving module.

[0241] The first information receiving module is configured to, in a case where the security policy is generated by the first device according to traffic five-tuple information of the virtual machine, receive first information sent by the second device, the first information comprising an identity of a first VNF, an identity of a virtual machine, and the traffic five-tuple information of the virtual machine.

[0242] The first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0243] Optionally, the apparatus further comprises:

[0244] The first learning module is configured to learn according to the first information to obtain network topology information, the network topology information comprising: a first VNF, an identity of the first VNF, virtual machines in the first VNF, an identity of each of the virtual machines, a connection relationship between the first VNFs, and a connection relationship between the virtual machines.

[0245] The first VNF is a VNF connected to the first device.

[0246] Optionally, the apparatus further comprises:

[0247] The second information receiving module is configured to receive filtered traffic five-tuple information sent by the second device; the filtered traffic five-tuple information is sent by the virtual machine to the second device through the proxy module, and the filtered traffic five-tuple information is obtained by filtering, by the virtual machine, traffic five-tuple information of the virtual machine according to the security policy through an extended Berkeley Packet Filter (eBPF) program of the virtual machine;

[0248] The second learning module is configured to learn the filtered traffic five-tuple information to obtain a learning result.

[0249] The first determining module is configured to determine to continue receiving the filtered traffic five-tuple information sent by the second device in a case where the learning result indicates that the filtered traffic five-tuple information meets the network topology information and the security policy.

[0250] Optionally, the apparatus further includes:

[0251] The third information receiving module is configured to receive second information sent by the second device in a case where the virtual machine identifies abnormal traffic by filtering, by the eBPF program, traffic five-tuple information of the virtual machine according to the security policy; the second information includes processed traffic five-tuple information of abnormal traffic, processed abnormal traffic logs, an identity of a first VNF, and an identity of the virtual machine; the first VNF includes the virtual machine; the first VNF is a VNF connected to the first device; the processed traffic five-tuple information of abnormal traffic and the processed abnormal traffic logs are obtained by the virtual machine by preprocessing, by the proxy module, traffic five-tuple information of abnormal traffic and abnormal traffic logs; and the abnormal traffic logs are generated by the virtual machine according to the abnormal traffic through the eBPF program.

[0252] The third processing module is configured to generate updated security policy according to the traffic five-tuple information of abnormal traffic and the processed abnormal traffic logs, or generate alarm information according to the traffic five-tuple information of abnormal traffic and the processed abnormal traffic logs.

[0253] The first policy sending module is configured to send the updated security policy to the second device in a case where the updated security policy is generated according to the traffic five-tuple information of abnormal traffic and the processed abnormal traffic logs.

[0254] Optionally, the third processing module includes:

[0255] The first processing unit is configured to generate the updated security policy according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic log when the second VNF exists and the second VNF comprises a virtual machine; the second VNF is a VNF connected to the first device after the first VNF;

[0256] The second processing unit is configured to update network topology information according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic log.

[0257] Optionally, the third processing module comprises:

[0258] The third processing unit is configured to generate the alarm information according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic log when the second VNF does not exist or when the traffic generated by the VM in the second VNF is different from the abnormal traffic.

[0259] The second VNF is a VNF connected to the first device after the first VNF.

[0260] It should be noted that the security protection device applied to the first device provided by the embodiments of the present application is a device capable of executing the security protection method applied to the first device described above, and all the embodiments of the security protection method applied to the first device described above are applicable to the device and can achieve the same or similar technical effects.

[0261] As shown in Figure 12 The present application also provides a security protection device applied to a second device, which comprises:

[0262] The first receiving module 1201 is configured to receive the security policy sent by the first device; the security policy is generated by the first device according to the traffic five-tuple information of the virtual machine or the security policy is pre-configured by the first device; the traffic five-tuple information of the virtual machine is obtained by the virtual machine through an extended Berkeley Packet Filter (eBPF) program, sent to the second device through the proxy module of the virtual machine, and sent to the first device by the second device;

[0263] The second sending module 1202 is configured to send the security policy to the proxy module of the virtual machine.

[0264] Optionally, the device further comprises a fourth information receiving module.

[0265] The fourth information receiving module is configured to receive first information sent by the virtual machine through the proxy module, in a case where the security policy is generated by the first device according to traffic five-tuple information of the virtual machine, the first information including identity of a first virtual network function (VNF), identity of the virtual machine, and the traffic five-tuple information.

[0266] The first VNF includes the virtual machine, and the first VNF is a VNF connected with the first device.

[0267] Optionally, the first receiving module 1201 includes:

[0268] The first receiving unit is configured to receive third information sent by the first device.

[0269] The third information includes the security policy, identity of the first VNF, and identity of the virtual machine.

[0270] The first VNF includes the virtual machine, and the first VNF is a VNF connected with the first device.

[0271] Optionally, the second sending module 1202 includes:

[0272] The fourth sending unit is configured to send the security policy to a proxy module of the virtual machine according to identity of the first VNF and identity of the virtual machine in the third information.

[0273] The third information includes the security policy, identity of the first VNF, and identity of the virtual machine.

[0274] The first VNF includes the virtual machine, and the first VNF is a VNF connected with the first device.

[0275] Optionally, the apparatus further includes:

[0276] The fifth information receiving module is configured to receive filtered traffic five-tuple information sent by the virtual machine through the proxy module.

[0277] The third information sending module is configured to send the filtered traffic five-tuple information to the second device.

[0278] The filtered traffic five-tuple information is obtained by the virtual machine through an eBPF program, by filtering traffic five-tuple information of the virtual machine acquired according to the security policy.

[0279] Optionally, the apparatus further includes:

[0280] The sixth information receiving module is configured to receive second information sent by the agent module in a case where the virtual machine identifies abnormal traffic by filtering the acquired traffic five-tuple information of the virtual machine according to the security policy through an eBPF program, wherein the second information includes processed traffic five-tuple information of the abnormal traffic, processed abnormal traffic logs, an identity of the first VNF, and an identity of the virtual machine; the first VNF includes the virtual machine, and the first VNF is a VNF connected with the first device; the processed traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs are obtained by preprocessing traffic five-tuple information of abnormal traffic and abnormal traffic logs of the virtual machine through the agent module; and the abnormal traffic logs are generated by the virtual machine according to the abnormal traffic through the eBPF program.

[0281] The fourth policy sending module is configured to send the updated security policy to the agent module, wherein the updated security policy is generated by the first device according to the traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs sent by the second device.

[0282] It should be noted that the security protection device applied to the second device provided in the embodiments of the present application is a device capable of executing the security protection method applied to the second device described above, and all the embodiments of the security protection method applied to the second device are applicable to the device and can achieve the same or similar technical effects.

[0283] As shown in Figure 13 The present application also provides a virtual machine, which comprises a processor 1301 and a memory 1303 connected with the processor 1301 through a bus interface 1302, wherein the memory 1303 is used for storing programs and data used by the processor 1301 during execution, and the processor 1301 invokes and executes the programs and data stored in the memory 1303.

[0284] The transceiver 1304 is connected with the bus interface 1302 and is used for receiving and sending data under the control of the processor 1301, and specifically, the processor 1301 is used for reading programs in the memory 1303 and executing the following processes:

[0285] The traffic five-tuple information of the virtual machine is acquired through an extended Berkeley Packet Filter eBPF program of the virtual machine;

[0286] The acquired traffic five-tuple information of the virtual machine is filtered according to a security policy through the eBPF program, and abnormal traffic is identified;

[0287] The security policy is generated by the first device according to traffic five tuple information of the virtual machine, or the security policy is preconfigured by the first device; the traffic five tuple information of the virtual machine is sent by the virtual machine to a second device through a proxy module, and is sent by the second device to the first device; and the security policy is sent by the first device to the second device, and is sent by the second device to the proxy module of the virtual machine.

[0288] Optionally, the processor 1301 is configured to:

[0289] The transceiver 1304 is configured to:

[0290] acquire, by the eBPF program, the traffic five tuple information of the virtual machine;

[0291] send, by the eBPF program, the traffic five tuple information to a storage and data retrieval module of the virtual machine;

[0292] acquire, by the proxy module, the traffic five tuple information of the virtual machine from the storage and data retrieval module.

[0293] Optionally, the transceiver 1304 is further configured to:

[0294] in a case where the security policy is generated by the first device according to the traffic five tuple information of the virtual machine, send, by the proxy module, first information to a second device, the first information including an identity of a first virtual network function (VNF), an identity of the virtual machine, and the traffic five tuple information;

[0295] The first VNF includes the virtual machine, and the first VNF is a VNF connected to the first device.

[0296] Optionally, the processor 1301 is further configured to:

[0297] store, by the proxy module, the security policy to a storage and data retrieval module of the virtual machine;

[0298] acquire, by the eBPF program, the security policy from the storage and data retrieval module.

[0299] Optionally, the processor 1301 is further configured to:

[0300] in a case where abnormal traffic is identified, generate an abnormal traffic log according to the abnormal traffic;

[0301] store, by the eBPF program, traffic five tuple information of the abnormal traffic and the abnormal traffic log to a storage and data retrieval module of the virtual machine;

[0302] The proxy module preprocesses the traffic quintuple information of the abnormal traffic and the abnormal traffic log to obtain the processed traffic quintuple information of the abnormal traffic and the processed abnormal traffic log.

[0303] The transceiver 1304 is also used for:

[0304] The proxy module sends second information to the second device. The second information includes the traffic 5-tuple information of the processed abnormal traffic, the processed abnormal traffic log, the identity identifier of the first VNF, and the identity identifier of the virtual machine. The VNF includes the virtual machine. The first VNF ​​is a VNF connected to the first device.

[0305] The proxy module receives the updated security policy sent by the first device; the updated security policy is generated by the first device based on the traffic 5-tuple information of the abnormal traffic in the second information sent by the second device and the processed abnormal traffic log, or the updated security policy is pre-configured by the first device.

[0306] The updated security policy is obtained from the storage and data retrieval module through the eBPF program;

[0307] The processor 1301 is also used for:

[0308] The eBPF program filters the acquired traffic quintuple information of the virtual machine according to the updated security policy.

[0309] Among them, Figure 13 In this context, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 1301) and memory (memory 1303). The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. A bus interface provides a user interface 1305. A transceiver 1304 may be multiple elements, including transmitters and receivers, providing units for communicating with various other devices over a transmission medium. Processor 1301 is responsible for managing the bus architecture and general processing, and memory 1303 may store data used by processor 1301 during operation.

[0310] The embodiment of the present application also provides an electronic device, which is a first device, comprising a processor and a memory connected with the processor through a bus interface, the memory being used for storing programs and data used by the processor when performing operations, and the processor calling and executing the programs and data stored in the memory.

[0311] The transceiver is connected with the bus interface and is used for receiving and sending data under the control of the processor.

[0312] It should be noted that the first device provided by the embodiment of the present application is similar to the structure of the virtual machine shown in the figure, and details are not repeated here. Figure 13 The first device provided by the embodiment of the present application is similar to the structure of the virtual machine shown in the figure, and details are not repeated here.

[0313] Specifically, the processor is used for reading programs in the memory, and the transceiver performs the following processes:

[0314] sending a security policy to a second device;

[0315] The security policy is generated by the first device according to traffic five-tuple information of a virtual machine, or the security policy is preconfigured by the first device, the traffic five-tuple information of the virtual machine is sent by the virtual machine to the second device through a proxy module and is sent by the second device to the first device, and the security policy is sent by the first device to the second device and is sent by the second device to the proxy module of the virtual machine.

[0316] Optionally, the transceiver is configured to:

[0317] send third information to the second device, the third information comprising the security policy, an identity of a first virtual network function (VNF) and an identity of the virtual machine;

[0318] The first VNF comprises the virtual machine, and the first VNF is a VNF connected with the first device.

[0319] Optionally, the transceiver is further configured to:

[0320] In the case that the security policy is generated by the first device according to traffic five-tuple information of a virtual machine, receive first information sent by the second device, the first information comprising an identity of a first VNF, an identity of the virtual machine and the traffic five-tuple information of the virtual machine;

[0321] The first VNF comprises the virtual machine, and the first VNF is a VNF connected with the first device.

[0322] Optionally, the processor is configured to:

[0323] learning according to the first information to obtain network topology information, the network topology information comprising: the first VNF, identity of the first VNF, virtual machines in the first VNF, identity of each of the virtual machines, connection relationship between the first VNFs, and connection relationship between the virtual machines;

[0324] The first VNF is a VNF connected with the first device.

[0325] Optionally, the transceiver is further configured to:

[0326] receive filtered traffic five-tuple information sent by the second device, the filtered traffic five-tuple information being sent by the virtual machine to the second device through the proxy module, the filtered traffic five-tuple information being obtained by filtering, by the virtual machine through an extended Berkeley Packet Filter (eBPF) program of the virtual machine, traffic five-tuple information of the virtual machine according to the security policy;

[0327] The processor is further configured to:

[0328] learn the filtered traffic five-tuple information to obtain a learning result;

[0329] in a case where the learning result indicates that the filtered traffic five-tuple information conforms to the network topology information and the security policy, determine to continue receiving the filtered traffic five-tuple information sent by the second device.

[0330] Optionally, the transceiver is further configured to:

[0331] in a case where the virtual machine identifies abnormal traffic by filtering, by the eBPF program, traffic five-tuple information of the virtual machine according to the security policy, receive second information sent by the second device, the second information comprising: processed traffic five-tuple information of the abnormal traffic, processed abnormal traffic logs, identity of the first VNF, and identity of the virtual machine; the first VNF comprising the virtual machine; the first VNF being a VNF connected with the first device; the processed traffic five-tuple information of the abnormal traffic and the processed abnormal traffic logs being obtained by the virtual machine through the proxy module by preprocessing traffic five-tuple information of the abnormal traffic and abnormal traffic logs; the abnormal traffic logs being generated by the virtual machine according to the abnormal traffic through the eBPF program;

[0332] The processor is further configured to:

[0333] An updated security policy is generated based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log, or an alarm message is generated based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log.

[0334] When an updated security policy is generated based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log, the updated security policy is sent to the second device.

[0335] Optionally, the processor is specifically used for:

[0336] In the presence of a second VNF, and the second VNF includes a virtual machine, the updated security policy is generated based on the traffic 5-tuple information of the abnormal traffic and the processed abnormal traffic log; the second VNF is a VNF connected to the first device after the first VNF.

[0337] The network topology information is updated based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log.

[0338] Optionally, the processor is specifically used for:

[0339] In the absence of a second VNF or in the case where the traffic generated by the VM in the second VNF is different from the abnormal traffic, the alarm information is generated based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log.

[0340] The second VNF is the VNF that is connected to the first device after the first VNF.

[0341] This invention also provides an electronic device, which is a second device, comprising: a processor; and a memory connected to the processor via a bus interface, the memory being used to store programs and data used by the processor during operation, and the processor calling and executing the programs and data stored in the memory.

[0342] The transceiver is connected to the bus interface and is used to receive and send data under the control of the processor.

[0343] It should be noted that the second device provided in this embodiment of the invention is similar to... Figure 13 The virtual machines shown have similar structures, so they will not be described in detail here.

[0344] Specifically, the processor is used to read the program from the memory, and the transceiver performs the following processes:

[0345] receive a security policy sent by a first device; the security policy is generated by the first device according to traffic five-tuple information of a virtual machine or the security policy is preconfigured by the first device; the traffic five-tuple information of the virtual machine is obtained by the virtual machine through an extended Berkeley Packet Filter (eBPF) program, sent by a proxy module of the virtual machine to the second device, and sent by the second device to the first device;

[0346] send the security policy to the proxy module of the virtual machine.

[0347] Optionally, the transceiver is further configured to:

[0348] in a case where the security policy is generated by the first device according to traffic five-tuple information of a virtual machine, receive first information sent by the virtual machine through the proxy module, the first information comprising an identity of a first Virtual Network Function (VNF), an identity of the virtual machine, and the traffic five-tuple information;

[0349] wherein the first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0350] Optionally, the transceiver is further configured to:

[0351] receive third information sent by the first device;

[0352] wherein the third information comprises the security policy, an identity of a first VNF, and an identity of the virtual machine.

[0353] the first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0354] Optionally, the transceiver is further configured to:

[0355] send the security policy to the proxy module of the virtual machine according to the identity of the first VNF and the identity of the virtual machine in the third information;

[0356] wherein the third information comprises the security policy, an identity of a first VNF, and an identity of the virtual machine.

[0357] the first VNF comprises the virtual machine, and the first VNF is a VNF connected to the first device.

[0358] Optionally, the transceiver is further configured to:

[0359] receive filtered traffic five-tuple information sent by the virtual machine through the proxy module;

[0360] send the filtered traffic five tuple information to the second device;

[0361] The filtered traffic five tuple information is filtered by the eBPF program according to the security policy on the traffic five tuple information obtained by the virtual machine.

[0362] Optionally, the transceiver is further configured to:

[0363] In a case where the virtual machine determines, by the eBPF program, that the filtered traffic five tuple information indicates that there is abnormal traffic, receive second information sent by the proxy module, the second information including processed traffic five tuple information of the abnormal traffic, processed abnormal traffic log, identity of the first VNF, and identity of the virtual machine; the first VNF includes the virtual machine, and the first VNF is a VNF connected to the first device; the processed traffic five tuple information of the abnormal traffic and the processed abnormal traffic log are obtained by the virtual machine by preprocessing traffic five tuple information of the abnormal traffic and abnormal traffic log by the proxy module; and the abnormal traffic log is generated by the virtual machine according to the abnormal traffic by the eBPF program.

[0364] Send the updated security policy to the proxy module, the updated security policy being generated by the first device according to the traffic five tuple information of the abnormal traffic and the processed abnormal traffic log sent by the second device.

[0365] In addition, the embodiments of the present application also provide a computer readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the steps in the security protection method applied to a virtual machine as claimed in any one of the above embodiments, or implement the steps in the security protection method applied to a first device as claimed in any one of the above embodiments, or implement the steps in the security protection method applied to a second device as claimed in any one of the above embodiments.

[0366] In several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the above-described device embodiments are only illustrative, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0367] In addition, each function unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically included separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of hardware plus software function unit.

[0368] The integrated unit realized in the form of software function unit can be stored in a computer readable storage medium. The software function unit is stored in a storage medium, and includes a plurality of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute part of steps of the transceiving method according to each embodiment of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various storage medium capable of storing program codes.

[0369] The above describes the preferred embodiments of the present application. It should be noted that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A security protection method, characterized in that, Applied to a virtual machine, the method includes: The traffic quintuple information of the virtual machine is obtained through the extended Berkeley packet filter eBPF program of the virtual machine; The eBPF program filters the acquired virtual machine traffic 5-tuple information according to a security policy to identify abnormal traffic. The security policy is either generated by the first device based on the virtual machine traffic 5-tuple information or pre-configured by the first device. The virtual machine traffic 5-tuple information is sent by the virtual machine to the second device via a proxy module, and the second device also sends it to the first device. The security policy is sent by the first device to the second device, and the second device also sends it to the virtual machine's proxy module. Upon detecting abnormal traffic, an abnormal traffic log is generated based on the abnormal traffic. The eBPF program stores the abnormal traffic quintuple information and the abnormal traffic log to the storage and data retrieval module of the virtual machine. The proxy module preprocesses the traffic quintuple information of the abnormal traffic and the abnormal traffic log to obtain the processed traffic quintuple information of the abnormal traffic and the processed abnormal traffic log. The proxy module sends second information to the second device. The second information includes the traffic 5-tuple information of the processed abnormal traffic, the processed abnormal traffic log, the identity identifier of the first VNF, and the identity identifier of the virtual machine. The VNF includes the virtual machine. The first VNF ​​is a VNF connected to the first device. The proxy module receives the updated security policy sent by the first device; the updated security policy is generated by the first device based on the traffic 5-tuple information of the abnormal traffic in the second information sent by the second device and the processed abnormal traffic log, or the updated security policy is pre-configured by the first device. The updated security policy is obtained from the storage and data retrieval module through the eBPF program; The eBPF program filters the acquired traffic quintuple information of the virtual machine according to the updated security policy.

2. The security protection method according to claim 1, characterized in that, The process of obtaining the traffic 5-tuple information of the virtual machine through the extended Berkeley packet filter eBPF program of the virtual machine includes: The eBPF program obtains the traffic quintuple information of the virtual machine; The eBPF program sends the traffic quintuple information to the virtual machine's storage and data retrieval module. The proxy module obtains the virtual machine's traffic quintuple information from the storage and data retrieval module.

3. The security protection method according to claim 1, characterized in that, When the security policy is generated by the first device based on the traffic 5-tuple information of the virtual machine, the method further includes: The proxy module sends first information to the second device, the first information including the identity identifier of the first virtual network function (VNF), the identity identifier of the virtual machine, and the traffic quintuple information; Wherein, the first VNF ​​includes the virtual machine; the first VNF ​​is a VNF connected to the first device.

4. The security protection method according to claim 1, characterized in that, Before obtaining the traffic 5-tuple information of the virtual machine through the extended Berkeley packet filter eBPF program of the virtual machine, the method further includes: The security policy is stored in the storage and data retrieval module of the virtual machine through the proxy module; The security policy is obtained from the storage and data retrieval module through the eBPF program.

5. A safety protection method, characterized in that, Applied to a first device, the method includes: Send a security policy to the second device; wherein the security policy is generated by the first device based on the traffic 5-tuple information of the virtual machine or the security policy is pre-configured by the first device, the traffic 5-tuple information of the virtual machine is sent by the virtual machine to the second device through the proxy module, and the second device sends it to the first device; the security policy is sent by the first device to the second device, and the second device sends it to the proxy module of the virtual machine; When the virtual machine filters the acquired virtual machine traffic quintuple information according to the security policy through the eBPF program and identifies abnormal traffic, it receives second information sent by the second device. The second information includes the processed abnormal traffic quintuple information, the processed abnormal traffic log, the identity of the first VNF, and the identity of the virtual machine. The first VNF ​​includes the virtual machine. The first VNF ​​is a VNF connected to the first device. The processed abnormal traffic quintuple information and the processed abnormal traffic log are obtained by the virtual machine through the proxy module by preprocessing the abnormal traffic quintuple information and the abnormal traffic log. The abnormal traffic log is generated by the virtual machine through the eBPF program based on the abnormal traffic. An updated security policy is generated based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log, or an alarm message is generated based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log. When an updated security policy is generated based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log, the updated security policy is sent to the second device.

6. The security protection method according to claim 5, characterized in that, Sending the security policy to the second device includes: Send third information to the second device, the third information including the security policy, the identity of the first virtual network function (VNF), and the identity of the virtual machine; The first VNF ​​includes the virtual machine, and the first VNF ​​is a VNF connected to the first device.

7. The safety protection method according to claim 5, characterized in that, When the security policy is generated by the first device based on the traffic 5-tuple information of the virtual machine, the method further includes: Receive first information sent by the second device, the first information including the identity identifier of the first VNF, the identity identifier of the virtual machine, and the traffic quintuple information of the virtual machine; Wherein, the first VNF ​​includes the virtual machine, and the first VNF ​​is a VNF connected to the first device.

8. The security protection method according to claim 7, characterized in that, The method further includes: Based on the first information, network topology information is obtained through learning. The network topology information includes: a first VNF, the identity of the first VNF, the virtual machines in the first VNF, the identity of each virtual machine, the connection relationship between the first VNFs, and the connection relationship between the virtual machines. Wherein, the first VNF ​​is the VNF connected to the first device.

9. The safety protection method according to claim 5, characterized in that, The method further includes: The system receives filtered traffic quintuple information sent by the second device. The filtered traffic quintuple information is sent by the virtual machine to the second device through the proxy module. The filtered traffic quintuple information is obtained by the virtual machine through the virtual machine's extended Berkeley Packet Filter (eBPF) program, which filters the acquired traffic quintuple information of the virtual machine according to the security policy. The filtered traffic quintuple information is learned to obtain the learning result; If the learning result indicates that the filtered traffic quintuple information conforms to the network topology information and the security policy, it is determined to continue receiving the filtered traffic quintuple information sent by the second device.

10. The security protection method according to claim 5, characterized in that, The step of generating an updated security policy based on the traffic 5-tuple information of the abnormal traffic and the processed abnormal traffic log includes: In the presence of a second VNF, and the second VNF includes a virtual machine, the updated security policy is generated based on the traffic 5-tuple information of the abnormal traffic and the processed abnormal traffic log; the second VNF is a VNF connected to the first device after the first VNF. The network topology information is updated based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log.

11. The security protection method according to claim 5, characterized in that, The step of generating alarm information based on the traffic 5-tuple information of the abnormal traffic and the processed abnormal traffic log includes: In the absence of a second VNF or in the case where the traffic generated by the VM in the second VNF is different from the abnormal traffic, the alarm information is generated based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log. The second VNF is the VNF that is connected to the first device after the first VNF.

12. A security protection method, characterized in that, Applied to a second device, the method includes: The system receives a security policy sent by a first device; the security policy is generated by the first device based on the traffic 5-tuple information of the virtual machine or the security policy is pre-configured by the first device; the traffic 5-tuple information of the virtual machine is obtained by the virtual machine through the extended Berkeley packet filter eBPF program, sent to the second device through the proxy module of the virtual machine, and sent from the second device to the first device. Send the security policy to the agent module of the virtual machine; Receive the filtered traffic quintuple information sent by the virtual machine through the proxy module; The filtered traffic quintuple information is sent to the second device; wherein the filtered traffic quintuple information is obtained by the virtual machine through the eBPF program, which filters the acquired traffic quintuple information of the virtual machine according to the security policy; When the virtual machine filters the acquired virtual machine traffic quintuple information according to the security policy through the eBPF program and identifies abnormal traffic, it receives second information sent by the proxy module. The second information includes the processed abnormal traffic quintuple information, the processed abnormal traffic log, the identity identifier of the first VNF, and the identity identifier of the virtual machine. The first VNF ​​includes the virtual machine and is a VNF connected to the first device. The processed abnormal traffic quintuple information and the processed abnormal traffic log are obtained by the virtual machine through preprocessing of the abnormal traffic quintuple information and abnormal traffic log by the proxy module. The abnormal traffic log is generated by the virtual machine based on the abnormal traffic through the eBPF program. The updated security policy is sent to the proxy module. The updated security policy is generated by the first device based on the traffic quintuple information of the abnormal traffic sent by the second device and the processed abnormal traffic log.

13. The security protection method according to claim 12, characterized in that, When the security policy is generated by the first device based on the traffic 5-tuple information of the virtual machine, the method further includes: Receive first information sent by the virtual machine through the proxy module, the first information including the identity identifier of the first virtual network function (VNF), the identity identifier of the virtual machine, and the traffic quintuple information; The first VNF ​​includes the virtual machine, and the first VNF ​​is a VNF connected to the first device.

14. The security protection method according to claim 12, characterized in that, The security policy received from the first device includes: Receive the third information sent by the first device; The third information includes the security policy, the identity identifier of the first VNF, and the identity identifier of the virtual machine; The first VNF ​​includes the virtual machine, and the first VNF ​​is a VNF connected to the first device.

15. The security protection method according to claim 12, characterized in that, Sending the security policy to the agent module of the virtual machine includes: Based on the identity identifier of the first VNF ​​and the identity identifier of the virtual machine in the third information, the security policy is sent to the agent module of the virtual machine; The third information includes the security policy, the identity identifier of the first VNF, and the identity identifier of the virtual machine; The first VNF ​​includes the virtual machine, and the first VNF ​​is a VNF connected to the first device.

16. A safety protection device, characterized in that, Applied to virtual machines, the device includes: The first acquisition module is used to acquire the traffic quintuple information of the virtual machine through the extended Berkeley packet filter eBPF program of the virtual machine; The first filtering module is used to filter the acquired traffic 5-tuple information of the virtual machine according to a security policy through the eBPF program to identify abnormal traffic; wherein, the security policy is generated by the first device based on the traffic 5-tuple information of the virtual machine or the security policy is pre-configured by the first device; the traffic 5-tuple information of the virtual machine is sent by the virtual machine to the second device through the proxy module, and the second device sends it to the first device; the security policy is sent by the first device to the second device, and the second device sends it to the proxy module of the virtual machine; The first processing module is used to generate an abnormal traffic log based on the abnormal traffic when abnormal traffic is detected. The second storage module is used to store the traffic quintuple information of the abnormal traffic and the abnormal traffic log to the storage and data retrieval module of the virtual machine through the eBPF program; The second processing module is used to preprocess the traffic quintuple information of the abnormal traffic and the abnormal traffic log through the proxy module to obtain the processed traffic quintuple information of the abnormal traffic and the processed abnormal traffic log. The second information sending module is used to send second information to the second device through the proxy module. The second information includes the traffic 5-tuple information of the processed abnormal traffic, the processed abnormal traffic log, the identity identifier of the first VNF, and the identity identifier of the virtual machine. The VNF includes the virtual machine. The first VNF ​​is a VNF connected to the first device. The first policy receiving module is used to receive the updated security policy sent by the first device through the proxy module; the updated security policy is generated by the first device based on the traffic 5-tuple information of the abnormal traffic in the second information sent by the second device and the processed abnormal traffic log, or the updated security policy is pre-configured by the first device. The third acquisition module is used to acquire the updated security policy from the storage and data retrieval module through the eBPF program; The second filtering module is used to filter the traffic quintuple information of the virtual machine obtained by the eBPF program according to the updated security policy.

17. A safety protection device, characterized in that, Applied to a first device, the device includes: A first sending module is used to send a security policy to a second device; wherein the security policy is generated by the first device based on the traffic 5-tuple information of the virtual machine or the security policy is pre-configured by the first device, the traffic 5-tuple information of the virtual machine is sent by the virtual machine to the second device through a proxy module, and the second device sends it to the first device; the security policy is sent by the first device to the second device, and the second device sends it to the proxy module of the virtual machine; The third information receiving module is configured to receive second information sent by the second device when the virtual machine filters the acquired virtual machine traffic quintuple information according to the security policy through the eBPF program and identifies abnormal traffic; the second information includes processed abnormal traffic quintuple information, processed abnormal traffic log, identity identifier of the first VNF, and identity identifier of the virtual machine; the first VNF ​​includes the virtual machine; the first VNF ​​is a VNF connected to the first device; the processed abnormal traffic quintuple information and the processed abnormal traffic log are obtained by the virtual machine through the proxy module by preprocessing the abnormal traffic quintuple information and abnormal traffic log; the abnormal traffic log is generated by the virtual machine through the eBPF program based on the abnormal traffic; The third processing module is used to generate an updated security policy based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log, or to generate alarm information based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log. The first policy sending module is used to send the updated security policy to the second device after generating an updated security policy based on the traffic quintuple information of the abnormal traffic and the processed abnormal traffic log.

18. A safety protection device, characterized in that, Applied to a second device, the device includes: The first receiving module is used to receive a security policy sent by the first device; the security policy is generated by the first device based on the traffic 5-tuple information of the virtual machine or the security policy is pre-configured by the first device; the traffic 5-tuple information of the virtual machine is obtained by the virtual machine through the extended Berkeley packet filter eBPF program, sent to the second device through the proxy module of the virtual machine, and sent from the second device to the first device. The second sending module is used to send the security policy to the agent module of the virtual machine; The fifth information receiving module is used to receive the filtered traffic quintuple information sent by the virtual machine through the proxy module; The third information sending module is used to send the filtered traffic quintuple information to the second device; wherein, the filtered traffic quintuple information is obtained by the virtual machine through the eBPF program, which filters the acquired traffic quintuple information of the virtual machine according to the security policy; The sixth information receiving module is configured to receive second information sent by the proxy module when the virtual machine filters the acquired virtual machine traffic quintuple information according to the security policy through the eBPF program and identifies abnormal traffic. The second information includes processed abnormal traffic quintuple information, processed abnormal traffic logs, the identity identifier of the first VNF, and the identity identifier of the virtual machine. The first VNF ​​includes the virtual machine and is a VNF connected to the first device. The processed abnormal traffic quintuple information and the processed abnormal traffic logs are obtained by the virtual machine through preprocessing of the abnormal traffic quintuple information and abnormal traffic logs by the proxy module. The abnormal traffic logs are generated by the virtual machine through the eBPF program based on the abnormal traffic. The fourth policy sending module is used to send an updated security policy to the proxy module. The updated security policy is generated by the first device based on the traffic quintuple information of the abnormal traffic sent by the second device and the processed abnormal traffic log.

19. A virtual machine, comprising: A transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; characterized in that, when the processor executes the program or instructions, it implements the steps of the security protection method as described in any one of claims 1 to 4.

20. An electronic device, wherein the electronic device is a first device, comprising: A transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; characterized in that, when the processor executes the program or instructions, it implements the steps of the security protection method as described in any one of claims 5 to 11.

21. An electronic device, wherein the electronic device is a second device, comprising: A transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; characterized in that, when the processor executes the program or instructions, it implements the steps of the security protection method as described in any one of claims 12 to 15.

22. A readable storage medium having a program or instructions stored thereon, characterized in that, When the program or instructions are executed by the processor, they implement the steps of the security protection method as described in any one of claims 1 to 4, or implement the steps of the security protection method as described in any one of claims 5 to 11, or implement the steps of the security protection method as described in any one of claims 12 to 15.

Images