Virtual machine access control data acquisition method and terminal

Abstract

The application discloses a kind of virtual machine access control data acquisition method and terminal, the method steps include establishing virtual machine cluster, the corresponding configuration information of virtual machine in the virtual machine cluster is stored using binary tree in advance;Bridge information is obtained using dispatcher, and the bridge information is transmitted to external network controller, so that the bridge information is transmitted to local controller by the external network controller;Using the local controller, the configuration information in the corresponding virtual machine cluster is matched with the bridge information received, if matching is successful, the configuration information is returned to external network controller, and the corresponding virtual machine is opened according to the configuration information received by the external network controller, and the operation is snapped.This application provides virtual attack environment by providing the virtual machine with consistent configuration information and bridge information, meets the demand of attack party, and snaps the operation of attack party, captures attack party data, and protects system security.

Description

Technical Field

[0001] This invention relates to the field of virtual machine technology, and in particular to a method and terminal for acquiring virtual machine access control data. Background Technology

[0002] Currently, honeypot systems are commonly used to deceive attackers in order to maintain network security. Honeypot systems deploy decoy hosts, network services, or information to lure attackers into attacking them, allowing for the capture and analysis of attack behavior. This reveals the tools and methods used by the attackers, infers their intent or motives, and enables defenders to clearly understand the security threats they face. This allows them to enhance the security capabilities of their systems through technical and management measures. However, honeypot systems also have limitations. They generate mirrored capture behavior in a closed environment, making it difficult to flexibly meet the diverse needs of attackers or record data chronologically. For example, if intruder A intrudes into a computer, and then intruder B also intrudes into the same computer, both intruders leave information, which the honeypot system cannot distinguish.

[0003] A virtual machine (VM) is a type of computer software that simulates a computer system, providing users with an environment isolated from physical hardware. Within a VM, users can run different operating systems and applications without affecting the host operating system or hardware. Therefore, this paper provides a method and terminal for acquiring VM access control data. By creating a simulated environment within the VM, it attracts potential attackers while protecting the real system from attack. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method and terminal for obtaining virtual machine access control data, which can provide a virtual attack environment, obtain attacker data information, and protect system security.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0006] A method for obtaining virtual machine access control data includes the following steps:

[0007] S1. Establish a virtual machine cluster, wherein the virtual machines in the virtual machine cluster pre-store their corresponding configuration information using a binary tree;

[0008] S2. Use the dispatcher to obtain the bridging terminal information and transmit the bridging terminal information to the external network controller, so that the external network controller transmits the bridging terminal information to the local area controller.

[0009] S3. The local controller uses the received bridge terminal information to match the configuration information in the corresponding virtual machine cluster. If the match is successful, the configuration information is returned to the external network controller. The external network controller opens and uses the corresponding virtual machine according to the received configuration information and takes a snapshot of the usage operation.

[0010] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows:

[0011] A virtual machine access control data acquisition terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the various steps of the virtual machine access control data acquisition method described above.

[0012] The beneficial effects of this invention are as follows: This invention provides a method and terminal for acquiring virtual machine access control data. By establishing a virtual machine cluster to meet the attacker's needs, and using a binary tree to store the virtual machine's configuration information, the information storage and retrieval process is optimized, thereby improving the efficiency of subsequent information comparison. A matcher is used to acquire bridging information and transmit this information to the external network controller, which then transmits the bridging information to the local area controller, ensuring the continuity and consistency of information transmission. The local area controller matches the received bridging information with the configuration information in the corresponding virtual machine cluster. If a match is successful, the configuration information is returned to the external network controller. The external network controller then opens and uses the corresponding virtual machine based on the received configuration information, enabling fast access to specific virtual machines, improving the efficiency and security of virtual machine connection access, and taking snapshots of the usage operations to capture attacker operation data for analysis, thereby maintaining system security. Attached Figure Description

[0013] Figure 1 This is a flowchart of a virtual machine access control data acquisition method according to an embodiment of the present invention;

[0014] Figure 2 This is a schematic diagram of a virtual machine access control data acquisition terminal according to an embodiment of the present invention;

[0015] Figure 3 This is an overall flowchart of a virtual machine access control data acquisition method according to an embodiment of the present invention;

[0016] Figure 4 This is an internal flowchart of a virtual machine access control data acquisition method according to an embodiment of the present invention;

[0017] Figure 5 This is a virtual machine configuration diagram of a virtual machine access control data acquisition method according to an embodiment of the present invention;

[0018] Figure 6 This is an external flowchart of a virtual machine access control data acquisition method according to an embodiment of the present invention;

[0019] Label Explanation:

[0020] 1. A virtual machine access control data acquisition terminal; 2. Memory; 3. Processor. Detailed Implementation

[0021] To explain in detail the technical content, objectives, and effects of the present invention, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0022] Please refer to Figure 1 This invention provides a method for obtaining virtual machine access control data, including the following steps:

[0023] S1. Establish a virtual machine cluster, wherein the virtual machines in the virtual machine cluster pre-store their corresponding configuration information using a binary tree;

[0024] S2. Use the dispatcher to obtain the bridging terminal information and transmit the bridging terminal information to the external network controller, so that the external network controller transmits the bridging terminal information to the local area controller.

[0025] S3. The local controller uses the received bridge terminal information to match the configuration information in the corresponding virtual machine cluster. If the match is successful, the configuration information is returned to the external network controller. The external network controller opens and uses the corresponding virtual machine according to the received configuration information and takes a snapshot of the usage operation.

[0026] As can be seen from the above description, the beneficial effects of the present invention are as follows: by establishing a virtual machine cluster to meet the attacker's needs, and using a binary tree to store the virtual machine configuration information, the information storage and retrieval process is optimized, thereby improving the efficiency of subsequent information comparison; a matchmaker is used to obtain bridging information and transmit the bridging information to the external network controller, so that the external network controller transmits the bridging information to the local area controller, ensuring the continuity and consistency of information transmission; the local area controller uses the received bridging information to match the configuration information in the corresponding virtual machine cluster. If the match is successful, the configuration information is returned to the external network controller, and the external network controller opens and uses the corresponding virtual machine according to the received configuration information, realizing fast access to specific virtual machines, improving the efficiency and security of virtual machine connection access, and taking snapshots of the usage operations to retain the attacker's operation data, so as to facilitate the analysis of the attacker's operations, thereby maintaining system security.

[0027] Furthermore, establishing the virtual machine cluster includes:

[0028] Configure at least two different operating systems for each virtual machine in the virtual machine cluster.

[0029] As described above, by configuring at least two different operating systems for each virtual machine in the virtual machine cluster, the attacker's needs are met, a suitable operating system environment is provided, and the virtual machines are run, providing a secure testing environment, isolating potential security threats, and avoiding damage to the host system.

[0030] Furthermore, the step of using the local controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster specifically involves:

[0031] The local controller searches the corresponding virtual machine cluster based on the bridge information it has received. If the received bridge information matches the preset identifier in the configuration information, the match is considered successful.

[0032] As described above, the system performs a matching judgment on the bridge terminal information received by the local area controller and the configuration information in the virtual machine cluster based on the preset identifier. This allows for the quick and accurate identification of the virtual machine corresponding to the configuration information that meets the attacker's requirements, ensuring that the network configuration of the virtual machine matches the attacker's expected working environment and improving data processing efficiency.

[0033] Furthermore, step S1 also includes:

[0034] The original configuration information of each virtual machine in the virtual machine cluster is saved using snapshot technology to obtain the original snapshot file.

[0035] As described above, snapshot technology is used to save the original configuration information of each virtual machine in the virtual machine cluster, establishing a fault-tolerant system mechanism so that the virtual machine can be restored to its original configuration state after any operation ends, increasing the reversibility of the operation and improving the system recovery capability.

[0036] Furthermore, the snapshotting of the usage operation specifically involves:

[0037] When the virtual machine is no longer in use, snapshot technology is used to save the current operation information of the virtual machine, and the original snapshot file is used to restore the virtual machine to its original configuration state.

[0038] As described above, by using snapshot technology to save the current operation information of the virtual machine, specific data states are saved, and attacker operation data is captured so that subsequent data analysis can be performed to generate an attack report. The original snapshot file is used to restore the virtual machine to its original configuration state, so as to provide a clean system environment, ensure the consistency of the data testing environment, and avoid manually resetting the system, thus saving time.

[0039] Please refer to Figure 2 Another embodiment of the present invention provides a virtual machine access control data acquisition terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the various steps of the virtual machine access control data acquisition method described above.

[0040] The virtual machine access control data acquisition method and terminal described above are applicable to virtual machine access control, simulating an attack environment to capture attacker operation data. The specific implementation methods are described below:

[0041] Example 1

[0042] Please refer to Figure 1 and Figure 5 A method for obtaining virtual machine access control data, comprising the following steps:

[0043] S1. Establish a virtual machine cluster, wherein the virtual machines in the virtual machine cluster pre-store their corresponding configuration information using a binary tree.

[0044] In this embodiment, a virtual machine cluster is established, providing several virtual machine programs, i.e., N virtual machine programs on each computer. Each virtual machine has configuration members, which consist of various systems. Each virtual configuration in the virtual machine cluster has at least two different operating systems to facilitate use by multiple attackers, meet their needs, and provide a suitable operating system environment. That is, intruder A can always obtain the subsystem or program he / she needs in the virtual machine cluster. Even if two intruders A and B invade at the same time, this technical solution can still meet their needs because they will enter their respective matched virtual machines and run in the virtual machines, providing a secure testing environment, isolating potential security threats, and avoiding damage to the host system. At the same time, the virtual machine operating system category is obtained, and the configuration information of the virtual machines is stored in a binary tree structure. The configuration information includes operating system information and virtual machine IP information, optimizing the information storage and retrieval process, thereby improving the efficiency of subsequent information comparison.

[0045] In addition, an IP address is configured for each operating system in the virtual machine, generating a VIC configuration. The specific meaning of the VIC configuration is as follows: V: represents the name of the virtual machine; I: represents the IP address of the operating system in the virtual machine; C: represents the configuration information of the operating system, including system category information, such as Windows OS, and program information, which is the program that needs to be matched, such as some systems requiring certain specific programs.

[0046] Furthermore, in this embodiment, step S1 further includes: using snapshot technology to save the original configuration information of each virtual machine in the virtual machine cluster to obtain the original snapshot file, and using the characteristics of virtual machines to establish a system mechanism with snapshot fault tolerance, so that the virtual machine can be restored to the original configuration state using the original snapshot data after any use operation ends.

[0047] S2. Use the dispatcher to obtain the bridging information and transmit the bridging information to the external network controller, so that the external network controller transmits the bridging information to the local area controller.

[0048] Please refer to Figure 3 and Figure 6 , Figure 3 This is an overall flowchart of a virtual machine access control data acquisition method according to an embodiment of the present invention. Figure 6 This is an external flowchart of a virtual machine access control data acquisition method according to an embodiment of the present invention. In this embodiment, bridging information is transmitted to the external network controller via a dispatcher, so that the external network controller transmits the bridging information to the local area controller, ensuring the continuity and consistency of information transmission. The local area controller consists of two parts: the various operating systems configured for each virtual machine and the multiple virtual machines themselves.

[0049] S3. The local area controller is used to match the received bridging information with the configuration information in the corresponding virtual machine cluster. Specifically, the local area controller searches the corresponding virtual machine cluster based on the bridging information received by the local area controller. If the received bridging information matches the preset identifier in the configuration information, the match is considered successful. If the match is successful, the configuration information is returned to the external network controller. The external network controller opens and uses the corresponding virtual machine based on the received configuration information and takes a snapshot of the usage operation.

[0050] Please refer to Figure 4 , Figure 4 This is an internal flowchart of a virtual machine access control data acquisition method according to an embodiment of the present invention. In this embodiment, the bridging information received by the local area controller and the configuration information in the virtual machine cluster are matched according to a preset identifier to quickly and accurately find the virtual machine corresponding to the configuration information that meets the attacker's requirements. Since the internal network IP is configured with an external network IP, the internal network IP will have a total external network IP address, so that the external network controller can open and use the corresponding virtual machine according to the configuration information. At the same time, the dispatcher helps to allocate resources to achieve fast access to specific virtual machines, enabling operations to be performed in the virtual machine. The data generated by the operation becomes a resource for subsequent analysis, improving the efficiency and security of virtual machine connection access, and ensuring that the network configuration of the virtual machine meets the attacker's expected working environment.

[0051] Furthermore, in this embodiment, the snapshotting of the usage operation specifically involves: when the virtual machine is no longer in use, using snapshot technology to save the current operation information of the virtual machine, and using the original snapshot file to restore the virtual machine to its original configuration state. By using snapshot technology to save the current operation information of the virtual machine, specific data states are saved, and attacker operation data is captured to facilitate operations such as evidence presentation, data testing, and data isolation, thereby analyzing the attacker's operations. For example, snapshot 1 is the original data. After using the virtual machine, a snapshot of the usage operation is taken to save the data generated by the operation, resulting in snapshot 2, which is used for subsequent analysis operations. Using the original snapshot file to restore the virtual machine to its original configuration state prevents the virtual machine from becoming unusable again, provides a clean system environment, and ensures the consistency of the data testing environment.

[0052] Example 2

[0053] Please refer to Figure 2 A virtual machine access control data acquisition terminal 1 includes a memory 2, a processor 3, and a computer program stored on the memory 2 and executable on the processor 3. When the processor 3 executes the computer program, it implements the various steps of a virtual machine access control data acquisition method according to Embodiment 1.

[0054] In summary, the present invention provides a virtual machine access control data acquisition method and terminal. By establishing a virtual machine cluster and configuring at least two different operating systems for each virtual machine in the cluster, it can be used by multiple attackers, meeting their needs and providing a suitable operating system environment. Simultaneously, a binary tree structure is used to store the virtual machine configuration information, optimizing the information storage and retrieval process, thereby improving the efficiency of subsequent information comparison. Snapshot technology is used to save the original configuration information of each virtual machine in the cluster. Leveraging the characteristics of virtual machines, a specific snapshot fault-tolerant system mechanism is established so that the virtual machine can be restored to its original configuration state using the original snapshot data after any operation. A dispatcher is used to acquire bridging information and transmit this bridging information to the external network controller, so that the external network controller transmits the bridging information to the local area controller, ensuring the continuity and consistency of information transmission. Based on a preset identifier, the local area controller receives the data... The system matches bridged interface information with configuration information in the virtual machine cluster to quickly and accurately identify the virtual machine corresponding to the configuration information that meets the attacker's requirements. This allows the external network controller to open and use the corresponding virtual machine based on the configuration information, enabling rapid access to specific virtual machines, improving the efficiency and security of virtual machine connection access, and ensuring that the network configuration of the virtual machine matches the attacker's expected working environment. When the virtual machine is no longer in use, snapshot technology is used to save the current operation information of the virtual machine, saving specific data states and capturing the attacker's operation data for evidence collection, data testing, data isolation, and other operations. This allows for analysis of the attacker's operations, and the original snapshot file is used to restore the virtual machine to its original configuration state so that the virtual machine can be used again, ensuring the consistency of the data testing environment. Through virtual machine access control, the system simulates the attack environment, isolates potential security threats, avoids damage to the host system, and thus maintains system security.

[0055] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for acquiring virtual machine access control data, characterized in that, Including the following steps: S1. Establish a virtual machine cluster, wherein the virtual machines in the virtual machine cluster pre-store their corresponding configuration information using a binary tree; configure at least two different operating systems for each virtual machine in the virtual machine cluster; S2. Use the dispatcher to obtain the bridging terminal information and transmit the bridging terminal information to the external network controller, so that the external network controller transmits the bridging terminal information to the local area controller. S3. Based on the bridge terminal information received by the local controller, a search is performed in the corresponding virtual machine cluster. If the received bridge terminal information matches the preset identifier in the configuration information, the match is considered successful. If a match is successful, the configuration information is returned to the external network controller. The external network controller then opens and uses the corresponding virtual machine based on the received configuration information and takes a snapshot of the usage operation.

2. The method for acquiring virtual machine access control data according to claim 1, characterized in that, Step S1 further includes: The original configuration information of each virtual machine in the virtual machine cluster is saved using snapshot technology to obtain the original snapshot file.

3. The method for acquiring virtual machine access control data according to claim 2, characterized in that, The snapshotting of the usage operation specifically involves: When the virtual machine is no longer in use, snapshot technology is used to save the current operation information of the virtual machine, and the original snapshot file is used to restore the virtual machine to its original configuration state.

4. A virtual machine access control data acquisition terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it performs the following steps: S1. Establish a virtual machine cluster, wherein the virtual machines in the virtual machine cluster pre-store their corresponding configuration information using a binary tree; S2. Use the dispatcher to obtain the bridging terminal information and transmit the bridging terminal information to the external network controller, so that the external network controller transmits the bridging terminal information to the local area controller. S3. The local controller uses the received bridging information to match the configuration information in the corresponding virtual machine cluster. If the match is successful, the configuration information is returned to the external controller. The external controller opens and uses the corresponding virtual machine according to the received configuration information and takes a snapshot of the usage operation.

5. A virtual machine access control data acquisition terminal according to claim 4, characterized in that, The establishment of the virtual machine cluster includes: Configure at least two different operating systems for each virtual machine in the virtual machine cluster.

6. A virtual machine access control data acquisition terminal according to claim 4, characterized in that, The step of using the local controller to match the received bridge end information with the configuration information in the corresponding virtual machine cluster specifically involves: The local controller searches the corresponding virtual machine cluster based on the bridge information it has received. If the received bridge information matches the preset identifier in the configuration information, the match is considered successful.

7. A virtual machine access control data acquisition terminal according to claim 4, characterized in that, Step S1 further includes: The original configuration information of each virtual machine in the virtual machine cluster is saved using snapshot technology to obtain the original snapshot file.

8. A virtual machine access control data acquisition terminal according to claim 7, characterized in that, The snapshotting of the usage operation specifically involves: When the virtual machine is no longer in use, snapshot technology is used to save the current operation information of the virtual machine, and the original snapshot file is used to restore the virtual machine to its original configuration state.

Images