Virtual machine access control data acquisition method and terminal

Abstract

The invention discloses a virtual machine access control data acquisition method and a terminal, and the method comprises the steps: building a virtual machine cluster, and enabling virtual machines in the virtual machine cluster to store corresponding configuration information through employing a binary tree in advance; acquiring bridging end information by using a tuner, and transmitting the bridging end information to an external network controller, so that the external network controller transmits the bridging end information to a local area controller; the local area controller is used for matching the received bridging end information with the configuration information in the corresponding virtual machine cluster, if matching succeeds, the configuration information is returned to the external network controller, and the external network controller opens and uses the corresponding virtual machine according to the received configuration information and snapshots the use operation. According to the method, the virtual machine with the configuration information consistent with the bridging end information is provided, the virtual attack environment is provided, the requirements of the attacker are met, the operation of the attacker is snapshotted, the data of the attacker is captured, and the system security is protected.

Description

Technical Field

[0001] The present invention relates to the technical field of virtual machines, and in particular to a method and a terminal for acquiring virtual machine access control data. Background Art

[0002] At present, in order to maintain network security, honeypot system technology is generally used to deceive attackers. The honeypot system can capture and analyze the attack behavior by placing some hosts, network services or information as bait, understand the tools and methods used by the attacker, infer the attack intention or motivation, let the defender clearly understand the security threats they face, and enhance the security protection capabilities of the actual system through technical and management means. However, the honeypot system also has shortcomings. It generates mirror capture behavior in a closed environment, cannot flexibly meet the various needs of the attacker, and cannot flexibly record data in chronological order. For example, intruder A invades a computer, and then intruder B also invades the computer. Intruder A and intruder B both leave information, and the honeypot system cannot distinguish the information.

[0003] A virtual machine is a computer software that can simulate a computer system and provide users with an environment that is isolated from physical hardware. In a virtual machine, users can run different operating systems and applications without affecting the host operating system or hardware. Therefore, a method and terminal for acquiring virtual machine access control data are provided, which creates a simulated environment in a virtual machine to attract potential attackers while protecting the real system from attacks. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a method and terminal for acquiring virtual machine access control data, which can provide a virtual attack environment, acquire the data information of the attacker, and protect the system security.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] A method for obtaining virtual machine access control data, comprising the steps of:

[0007] S1. Establish a virtual machine cluster, wherein the virtual machines in the virtual machine cluster store corresponding configuration information in advance using a binary tree;

[0008] S2, using the adapter to obtain the bridge end information, and transmit the bridge end information to the external network controller, so that the external network controller transmits the bridge end information to the local area controller;

[0009] S3. Use the local controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster. If the match is successful, the configuration information is returned to the external network controller. The external network controller opens and uses the corresponding virtual machine according to the received configuration information and takes a snapshot of the use operation.

[0010] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0011] A virtual machine access control data acquisition terminal comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step of the above-mentioned virtual machine access control data acquisition method is implemented.

[0012] The beneficial effects of the present invention are as follows: a method and terminal for acquiring access control data of a virtual machine provided by the present invention, by establishing a virtual machine cluster, meet the needs of the attacker, and use a binary tree to store the configuration information of the virtual machine, optimize the information storage and retrieval process, thereby improving the efficiency of subsequent information comparison; use a dispatcher to acquire bridge end information, and transmit the bridge end information to an external network controller, so that the external network controller transmits the bridge end information to a local area controller, to ensure the continuity and consistency of information transmission; use the local area controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster, if the match is successful, return the configuration information to the external network controller, the external network controller opens and uses the corresponding virtual machine according to the received configuration information, realizes rapid access to a specific virtual machine, improves the efficiency and security of virtual machine connection access, and takes a snapshot of the use operation, captures the operation data of the attacker, so as to analyze the operation of the attacker, thereby maintaining system security. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 A flowchart of a method for acquiring virtual machine access control data according to an embodiment of the present invention;

[0014] Figure 2 A schematic diagram of a virtual machine access control data acquisition terminal according to an embodiment of the present invention;

[0015] Figure 3 This is an overall flow chart of a method for acquiring virtual machine access control data according to an embodiment of the present invention;

[0016] Figure 4 An internal flow chart of a method for acquiring virtual machine access control data according to an embodiment of the present invention;

[0017] Figure 5 A virtual machine configuration diagram of a method for obtaining virtual machine access control data according to an embodiment of the present invention;

[0018] Figure 6 An external flow chart of a method for acquiring virtual machine access control data according to an embodiment of the present invention;

[0019] Description of labels:

[0020] 1. A virtual machine access control data acquisition terminal; 2. A memory; 3. A processor. DETAILED DESCRIPTION

[0021] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in conjunction with the implementation modes and the accompanying drawings.

[0022] Please refer to Figure 1 The embodiment of the present invention provides a method for obtaining virtual machine access control data, comprising the steps of:

[0023] S1. Establish a virtual machine cluster, wherein the virtual machines in the virtual machine cluster store corresponding configuration information in advance using a binary tree;

[0024] S2, using the adapter to obtain the bridge end information, and transmit the bridge end information to the external network controller, so that the external network controller transmits the bridge end information to the local area controller;

[0025] S3. Use the local controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster. If the match is successful, the configuration information is returned to the external network controller. The external network controller opens and uses the corresponding virtual machine according to the received configuration information and takes a snapshot of the use operation.

[0026] From the above description, it can be seen that the beneficial effects of the present invention are: by establishing a virtual machine cluster to meet the needs of the attacker, and using a binary tree to store the configuration information of the virtual machine, the information storage and retrieval process is optimized, thereby improving the efficiency of subsequent information comparison; using a dispatcher to obtain bridge end information, and transmitting the bridge end information to the external network controller, so that the external network controller transmits the bridge end information to the local area controller, ensuring the continuity and consistency of information transmission; using the local area controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster, if the match is successful, the configuration information is returned to the external network controller, and the external network controller opens and uses the corresponding virtual machine according to the received configuration information, thereby achieving rapid access to a specific virtual machine, improving the efficiency and security of virtual machine connection access, and taking snapshots of usage operations, retaining the attacker's operation data, so as to facilitate analysis of the attacker's operations, thereby maintaining system security.

[0027] Furthermore, the establishing of the virtual machine cluster includes:

[0028] At least two different operating systems are configured for each virtual machine in the virtual machine cluster.

[0029] From the above description, it can be seen that by configuring at least two different operating systems for each virtual machine in the virtual machine cluster, the needs of the attacker are met, a suitable operating system environment is provided, and it runs in the virtual machine to provide a safe testing environment, isolate potential security threats, and avoid damage to the host system.

[0030] Further, the using the local area controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster is specifically:

[0031] A search is performed in the corresponding virtual machine cluster according to the bridge end information received by the local controller, and if the received bridge end information is consistent with the preset identifier in the configuration information, it is determined that the match is successful.

[0032] From the above description, it can be seen that according to the preset identifier, the matching judgment is made between the bridge end information received by the local domain controller and the configuration information in the virtual machine cluster, and the virtual machine corresponding to the configuration information that meets the needs of the attacker is quickly and accurately found, ensuring that the network configuration of the virtual machine meets the expected working environment of the attacker and improving data processing efficiency.

[0033] Furthermore, the step S1 further includes:

[0034] The snapshot technology is used to save the original configuration information of each virtual machine in the virtual machine cluster to obtain the original snapshot file.

[0035] From the above description, it can be seen that the original configuration information of each virtual machine in the virtual machine cluster is saved by snapshot technology, and a fault-tolerant system mechanism is established so that the virtual machine can be restored to the original configuration state after any use operation is completed, thereby increasing the reversibility of the operation and improving the system recovery capability.

[0036] Furthermore, the snapshot of the usage operation is specifically as follows:

[0037] When the use of the virtual machine ends, the snapshot technology is used to save the current operation information of the virtual machine, and the original snapshot file is used to restore the virtual machine to the original configuration state.

[0038] From the above description, it can be seen that by using snapshot technology to save the current operation information of the virtual machine, save specific data status, and capture the attacker's operation data, so as to analyze the data later and generate an attack report; use the original snapshot file to restore the virtual machine to the original configuration state, so as to provide a clean system environment, ensure the environmental consistency of data testing, and avoid manual resetting of the system, saving time.

[0039] Please refer to Figure 2 Another embodiment of the present invention provides a virtual machine access control data acquisition terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements each step of the above-mentioned virtual machine access control data acquisition method when executing the computer program.

[0040] The above-mentioned method and terminal for acquiring virtual machine access control data of the present invention are applicable to virtual machine access control, simulating an attack environment, and thus capturing the operation data of the attacker. The following is an explanation through specific implementation methods:

[0041] Embodiment 1

[0042] Please refer to Figure 1 and Figure 5 , a method for obtaining virtual machine access control data, comprising the steps of:

[0043] S1. Establish a virtual machine cluster, wherein the virtual machines in the virtual machine cluster store corresponding configuration information in advance using a binary tree.

[0044] In this embodiment, a virtual machine cluster is established to provide several virtual machine programs, that is, each computer has N virtual machine programs, each virtual machine has configuration members, and the members are composed of various systems. Each virtual configuration in the virtual machine cluster has at least two different operating systems, so as to provide them to multiple attackers for use, meet the needs of the attackers, and provide a suitable operating system environment, that is, the intruder A can always obtain the subsystem or program he needs in the virtual machine cluster. Even if there are two intruders A and B invading at the same time, the technical solution can meet the requirements because they will enter their respective matching virtual machines and run in the virtual machines, providing a safe testing environment, isolating potential security threats, and avoiding damage to the host system. At the same time, the virtual machine operating system category is obtained, and the configuration information of the virtual machine is stored in a binary tree structure. The configuration information includes operating system information and virtual machine IP information, and the information storage and retrieval process is optimized, thereby improving the efficiency of subsequent information comparison.

[0045] In addition, an IP address is configured for each operating system in the virtual machine to generate a VIC configuration. The specific meaning of the VIC configuration is: V: represents the virtual machine name; I: represents the IP address of the operating system in the virtual machine; C: represents the configuration information of the operating system, including system category information, such as Windows OS system, etc., and program information is the program that needs to be matched, such as some systems require certain specific programs.

[0046] Furthermore, in this embodiment, step S1 also includes: using snapshot technology to save the original configuration information of each virtual machine in the virtual machine cluster, obtaining the original snapshot file, and using the characteristics of the virtual machine to establish a system mechanism with snapshot fault tolerance, so that the virtual machine can use the original snapshot data to restore to the original configuration state after any use operation is completed.

[0047] S2. Use the dispatcher to obtain the bridge end information, and transmit the bridge end information to the external network controller, so that the external network controller transmits the bridge end information to the local area controller.

[0048] Please refer to Figure 3 and Figure 6 , Figure 3 is an overall flow chart of a method for obtaining virtual machine access control data according to an embodiment of the present invention. Figure 6 This is an external flow chart of a method for acquiring virtual machine access control data according to an embodiment of the present invention. In this embodiment, the bridge end information is transmitted to the external network controller via the adapter, so that the external network controller transmits the bridge end information to the local controller to ensure the continuity and consistency of information transmission. The local controller is composed of two parts: multiple operating systems configured for each virtual machine and multiple virtual machines.

[0049] S3. Use the local domain controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster, specifically: search in the corresponding virtual machine cluster according to the bridge end information received by the local domain controller, if the received bridge end information is consistent with the preset identifier in the configuration information, it is determined that the match is successful, if the match is successful, the configuration information is returned to the external network controller, and the external network controller opens and uses the corresponding virtual machine according to the received configuration information, and takes a snapshot of the use operation.

[0050] Please refer to Figure 4 , Figure 4 The present invention is an internal flow chart of a method for acquiring access control data for a virtual machine according to an embodiment of the present invention. In this embodiment, a matching judgment is made between the bridge end information received by the local domain controller and the configuration information in the virtual machine cluster according to a preset identifier, so as to quickly and accurately find the virtual machine corresponding to the configuration information that meets the needs of the attacker. Since the intranet IP will be configured with the extranet IP, the intranet IP will have a total extranet IP address, so that the extranet controller can open and use the corresponding virtual machine according to the configuration information. At the same time, the dispatcher helps to allocate resources to achieve rapid access to a specific virtual machine, and operations can be performed in the virtual machine. The data generated by the operation becomes a subsequent analysis resource, thereby improving the efficiency and security of virtual machine connection access and ensuring that the network configuration of the virtual machine meets the expected working environment of the attacker.

[0051] Furthermore, in the present embodiment, the snapshot of the use operation is specifically as follows: when the use of the virtual machine is ended, the snapshot technology is used to save the current operation information of the virtual machine, and the original snapshot file is used to restore the virtual machine to the original configuration state. By using the snapshot technology to save the current operation information of the virtual machine, save the specific data state, capture the attacker's operation data, so as to facilitate the evidence, data testing, data isolation and other operations, thereby analyzing the attacker's operation. For example, snapshot 1 is the original data. After using the virtual machine, a snapshot is taken of the use operation, and the data generated by the operation is saved to obtain snapshot 2, so as to facilitate subsequent analysis operations; the original snapshot file is used to restore the virtual machine to the original configuration state, so as to prevent the virtual machine from being unable to be used again, provide a clean system environment, and ensure the environmental consistency of data testing.

[0052] Embodiment 2

[0053] Please refer to Figure 2 A virtual machine access control data acquisition terminal 1 includes a memory 2, a processor 3, and a computer program stored in the memory 2 and executable on the processor 3. When the processor 3 executes the computer program, each step of a virtual machine access control data acquisition method of embodiment 1 is implemented.

[0054] In summary, the present invention provides a method and terminal for acquiring access control data for a virtual machine. By establishing a virtual machine cluster, at least two different operating systems are configured for each virtual machine in the virtual machine cluster, so as to provide the virtual machines with the access control data for multiple attackers, meet the attackers' needs, and provide a suitable operating system environment. Meanwhile, a binary tree structure is used to store the configuration information of the virtual machines, and the information storage and retrieval process is optimized, so as to improve the efficiency of subsequent information comparison. The snapshot technology is used to save the original configuration information of each virtual machine in the virtual machine cluster, and the characteristics of the virtual machine are used to establish a specific snapshot fault-tolerant system mechanism, so that the virtual machine can use the original snapshot data to restore to the original configuration state after any use operation ends. The bridge end information is obtained by using a dispatcher, and the bridge end information is transmitted to an external network controller, so that the external network controller transmits the bridge end information to a local area controller to ensure the continuity and consistency of information transmission. The local area controller receives the bridge end information according to the preset identifier. The matching judgment is made between the bridge end information and the configuration information in the virtual machine cluster, and the virtual machine corresponding to the configuration information that meets the needs of the attacker is quickly and accurately found, so that the external network controller opens and uses the corresponding virtual machine according to the configuration information, realizes fast access to the specific virtual machine, improves the efficiency and security of virtual machine connection access, and ensures that the network configuration of the virtual machine meets the expected working environment of the attacker. When the use of the virtual machine is finished, the snapshot technology is used to save the current operation information of the virtual machine, save the specific data state, and capture the attacker's operation data to facilitate evidence, data testing, data isolation and other operations, so as to analyze the attacker's operation, and use the original snapshot file to restore the virtual machine to the original configuration state, so that the virtual machine can be used again, and the environmental consistency of the data test is guaranteed; through virtual machine access control, the attack environment is simulated, potential security threats are isolated, and damage to the host system is avoided, thereby maintaining system security.

[0055] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for obtaining virtual machine access control data, characterized in that: Includes steps: S1. Establish a virtual machine cluster, wherein the virtual machines in the virtual machine cluster store corresponding configuration information in advance using a binary tree; S2, using the adapter to obtain the bridge end information, and transmit the bridge end information to the external network controller, so that the external network controller transmits the bridge end information to the local area controller; S3. Use the local controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster. If the match is successful, the configuration information is returned to the external network controller. The external network controller opens and uses the corresponding virtual machine according to the received configuration information and takes a snapshot of the use operation.

2. A method for acquiring virtual machine access control data according to claim 1, characterized in that: The step of establishing a virtual machine cluster includes: At least two different operating systems are configured for each virtual machine in the virtual machine cluster.

3. A method for acquiring virtual machine access control data according to claim 1, characterized in that: The using the local controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster is specifically: A search is performed in the corresponding virtual machine cluster according to the bridge end information received by the local controller, and if the received bridge end information is consistent with the preset identifier in the configuration information, it is determined that the match is successful.

4. A method for acquiring virtual machine access control data according to claim 1, characterized in that: The step S1 further comprises: The snapshot technology is used to save the original configuration information of each virtual machine in the virtual machine cluster to obtain the original snapshot file.

5. A method for acquiring virtual machine access control data according to claim 4, characterized in that: The snapshot of the usage operation is specifically as follows: When the use of the virtual machine ends, the snapshot technology is used to save the current operation information of the virtual machine, and the original snapshot file is used to restore the virtual machine to the original configuration state.

6. A virtual machine access control data acquisition terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the following steps are implemented: S1. Establish a virtual machine cluster, wherein the virtual machines in the virtual machine cluster store corresponding configuration information in advance using a binary tree; S2, using the adapter to obtain the bridge end information, and transmit the bridge end information to the external network controller, so that the external network controller transmits the bridge end information to the local area controller; S3. Use the local controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster. If the match is successful, the configuration information is returned to the external network controller. The external network controller opens and uses the corresponding virtual machine according to the received configuration information and takes a snapshot of the use operation.

7. A virtual machine access control data acquisition terminal according to claim 6, characterized in that: The step of establishing a virtual machine cluster includes: At least two different operating systems are configured for each virtual machine in the virtual machine cluster.

8. A virtual machine access control data acquisition terminal according to claim 6, characterized in that: The using the local controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster is specifically: A search is performed in the corresponding virtual machine cluster according to the bridge end information received by the local controller, and if the received bridge end information is consistent with the preset identifier in the configuration information, it is determined that the match is successful.

9. A virtual machine access control data acquisition terminal according to claim 6, characterized in that: The step S1 further comprises: The snapshot technology is used to save the original configuration information of each virtual machine in the virtual machine cluster to obtain the original snapshot file.

10. A virtual machine access control data acquisition terminal according to claim 9, characterized in that: The snapshot of the usage operation is specifically as follows: When the use of the virtual machine ends, the snapshot technology is used to save the current operation information of the virtual machine, and the original snapshot file is used to restore the virtual machine to the original configuration state.

Images