Message processing method, device and system, medium, equipment and product

Abstract

The invention discloses a message processing method, device and system, a medium, equipment and a product, relates to the technical field of communication, and is used for reducing message transmission delay. The method is applied to a server, and the server is in communication connection with a to-be-protected virtual machine and a security virtual machine. The method comprises the steps of sending a bypass message corresponding to a transmission message to a security virtual machine when it is detected that the virtual machine to be protected receives the transmission message; the bypass message is a message obtained by copying the transmission message; receiving a message detection result from the secure virtual machine, wherein the message detection result is used for indicating whether the transmitted message is abnormal or not; and in response to the fact that the message detection result is used for indicating that the transmission message is an abnormal message, disconnecting the connection between the to-be-protected virtual machine and the transmitting end of the transmission message.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular, to a message processing method, apparatus, system, medium, equipment and product. Background Art

[0002] When the first virtual machine sends a message to the second virtual machine, the message needs to be sent to the security virtual machine, which uses the network protection engine to detect the message and sends the message to the second virtual machine if there is no abnormality in the message. The security virtual machine uses the network protection engine to detect the message, which increases the transmission time and increases the message transmission delay between virtual machines. Summary of the invention

[0003] The present application provides a message processing method, apparatus, system, medium, equipment and product for reducing message transmission delay.

[0004] In order to achieve the above objectives, this application adopts the following technical solutions:

[0005] In a first aspect, a message processing method is provided, which is applied to a server, and the server is respectively connected to a virtual machine to be protected and a secure virtual machine in communication; the method comprises: when it is detected that the virtual machine to be protected receives a transmission message, sending a bypass message corresponding to the transmission message to the secure virtual machine; the bypass message is a message obtained by copying the transmission message; receiving a message detection result from the secure virtual machine, the message detection result is used to indicate whether the transmission message is abnormal; in response to the message detection result indicating that the transmission message is an abnormal message, disconnecting the connection between the virtual machine to be protected and the sender of the transmission message.

[0006] Optionally, before sending a bypass message corresponding to the transmission message to the secure virtual machine, the method further includes: determining port information of the virtual machine to be protected; based on the port information, copying the transmission message received by the virtual machine to be protected to obtain a bypass message.

[0007] Optionally, based on the port information, the message of the port of the virtual machine to be protected is copied to obtain a bypass message, including: based on the port information, configuring port mirroring of the port so that the source port of the port mirroring is the port of the virtual machine to be protected; using port mirroring to copy the message of the port of the virtual machine to be protected to obtain a bypass message.

[0008] Optionally, disconnecting the connection between the virtual machine to be protected and the sender of the transmission message includes: sending a first indication message to the virtual machine to be protected; the first indication message is used to instruct the virtual machine to be protected to disconnect the transmission control protocol TCP connection with the sender.

[0009] Optionally, when the bypass message meets the first preset condition, the message detection result is used to indicate that the bypass message is an abnormal message; when the bypass message does not meet the first preset condition, the message detection result is used to indicate that the bypass message is not an abnormal message; the first preset condition includes at least one of the following: the bypass message has structured query language SQL injection, the bypass message has abnormal code, and the source Internet Protocol IP address of the bypass message is an IP address in the blacklist.

[0010] Based on the technical solution provided in the present application, by determining the bypass message corresponding to the transmission message received by the virtual machine to be protected, the bypass message is detected using the security virtual machine, that is, through bypass detection, it is possible to determine whether the transmission message is abnormal without sending the transmission message to the security virtual machine, and disconnect the connection between the sending end and the virtual machine to be protected when the transmission message is abnormal. This can not only improve the security of message transmission, but also reduce the transmission path length of the transmission message, thereby reducing the transmission time of the transmission message and reducing the message transmission delay between virtual machines.

[0011] In a second aspect, a message processing method is provided, which is applied to a secure virtual machine, which is communicatively connected to a server; the server is also communicatively connected to a virtual machine to be protected; the method comprises: receiving a bypass message corresponding to a transmission message from the server; the bypass message is sent by the server when it detects that the virtual machine to be protected has received a transmission message, and the bypass message is a message obtained by copying the transmission message; sending a message detection result to the server, the message detection result is used to indicate whether the bypass message is an abnormal message, so that the server disconnects the connection between the virtual machine to be protected and the sending end of the transmission message when the message detection result is used to indicate that the bypass message is an abnormal message.

[0012] Optionally, before sending the message detection result to the server, the method also includes: determining whether the bypass message meets a first preset condition; the first preset condition includes at least one of the following: the bypass message has structured query language SQL injection, the bypass message has abnormal code, and the source Internet Protocol IP address of the bypass message is an IP address in the blacklist; determining the message detection result according to whether the bypass message meets the first preset condition; when the bypass message meets the first preset condition, the message detection result is used to indicate that the bypass message is an abnormal message; when the bypass message does not meet the first preset condition, the message detection result is used to indicate that the bypass message is not an abnormal message.

[0013] According to a third aspect, a message processing device is provided, which is applied to a server, and the server is respectively communicated with a virtual machine to be protected and a secure virtual machine; the device includes: a sending unit, a receiving unit and a processing unit; the sending unit is used to send a bypass message corresponding to the transmission message to the secure virtual machine when it detects that the virtual machine to be protected has received a transmission message; the bypass message is a message obtained by copying the transmission message; the receiving unit is used to receive a message detection result from the secure virtual machine, and the message detection result is used to indicate whether the bypass message is an abnormal message; the processing unit is used to disconnect the connection between the virtual machine to be protected and the sending end of the transmission message in response to the message detection result indicating that the bypass message is an abnormal message.

[0014] Optionally, before sending a bypass message corresponding to the transmission message to the secure virtual machine, the processing unit is also used to determine the port information of the virtual machine to be protected; the processing unit is also used to copy the transmission message received by the virtual machine to be protected based on the port information to obtain a bypass message.

[0015] Optionally, the processing unit is specifically used to: configure port mirroring of the port based on the port information so that the source port of the port mirroring is the port of the virtual machine to be protected; use port mirroring to copy the message of the port of the virtual machine to be protected to obtain a bypass message.

[0016] Optionally, the processing unit is specifically used to: send a first indication message to the virtual machine to be protected; the first indication message is used to instruct the virtual machine to be protected to disconnect the Transmission Control Protocol TCP connection with the sending end.

[0017] Optionally, when the bypass message meets the first preset condition, the message detection result is used to indicate that the bypass message is an abnormal message; when the bypass message does not meet the first preset condition, the message detection result is used to indicate that the bypass message is not an abnormal message; the first preset condition includes at least one of the following: the bypass message has structured query language SQL injection, the bypass message has abnormal code, and the source Internet Protocol IP address of the bypass message is an IP address in the blacklist.

[0018] In a fourth aspect, a message processing device is provided, which is applied to a secure virtual machine, and the secure virtual machine is communicatively connected to a server; the server is also communicatively connected to a virtual machine to be protected; the device includes: a receiving unit and a sending unit; the receiving unit is used to receive a bypass message corresponding to a transmission message from the server; the bypass message is sent by the server when it detects that the virtual machine to be protected has received a transmission message, and the bypass message is a message obtained by copying the transmission message; the sending unit is used to send a message detection result to the server, and the message detection result is used to indicate whether the bypass message is an abnormal message, so that the server disconnects the connection between the virtual machine to be protected and the sending end of the transmission message when the message detection result indicates that the bypass message is an abnormal message.

[0019] Optionally, the device also includes a determination unit, which is used to determine whether the bypass message meets a first preset condition before sending the message detection result to the server; the first preset condition includes at least one of the following: the bypass message has structured query language SQL injection, the bypass message has abnormal code, and the source Internet Protocol IP address of the bypass message is an IP address in the blacklist; the determination unit is also used to determine the message detection result based on whether the bypass message meets the first preset condition; when the bypass message meets the first preset condition, the message detection result is used to indicate that the bypass message is an abnormal message; when the bypass message does not meet the first preset condition, the message detection result is used to indicate that the bypass message is not an abnormal message.

[0020] In a fifth aspect, a message processing device is provided, which can implement the functions performed by the message processing device in the above-mentioned aspects or possible designs. The functions can be implemented through hardware, such as: in one possible design, the message processing device may include: a processor and a communication interface, and the processor can be used to support the message processing device to implement the functions involved in the above-mentioned first aspect or any possible design of the first aspect.

[0021] In another possible design, the message processing device may further include a memory, the memory being used to store computer-executable instructions and data necessary for the message processing device. When the message processing device is running, the processor executes the computer-executable instructions stored in the memory, so that the message processing device performs the first aspect or any possible message processing method of the first aspect.

[0022] In the sixth aspect, a computer-readable storage medium is provided, which may be a readable non-volatile storage medium, and which stores computer instructions or programs. When the computer-readable storage medium is run on a computer, the computer can execute the first aspect or any possible message processing method of the above aspects.

[0023] In a seventh aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the message processing method of the first aspect or any possible design of the above aspects.

[0024] In an eighth aspect, an electronic device is provided, the electronic device comprising one or more processors and one or more memories. The one or more memories are coupled to the one or more processors, the one or more memories are used to store computer program codes, the computer program codes include computer instructions, and when the one or more processors execute the computer instructions, the electronic device executes the message processing method as described in the first aspect or any possible design of the first aspect.

[0025] In a ninth aspect, a chip system is provided, the chip system including a processor and a communication interface, the chip system can be used to implement the functions performed by the message processing device in the first aspect or any possible design of the first aspect. In one possible design, the chip system also includes a memory, the memory is used to store program instructions and / or data. The chip system can be composed of a chip, or it can include a chip and other discrete devices, without limitation. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A schematic diagram of the structure of a message processing system provided in an embodiment of the present application;

[0027] Figure 2 A structural diagram of another message processing system provided in an embodiment of the present application;

[0028] Figure 3 A schematic diagram of the structure of a message processing device provided in an embodiment of the present application;

[0029] Figure 4 A flowchart of a message processing method provided in an embodiment of the present application;

[0030] Figure 5 A flowchart of another message processing method provided in an embodiment of the present application;

[0031] Figure 6 A schematic diagram of the structure of another message processing device provided in an embodiment of the present application;

[0032] Figure 7 A schematic diagram of the structure of another message processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0035] It should also be understood that the term “comprising” indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements and / or components.

[0036] The technical terms involved in this application are explained below.

[0037] 1. ESXi: A virtualization operating system developed by VMware for virtualized servers.

[0038] 2. Vsocket: A mechanism based on VMCI that allows communication between the host and virtual machines.

[0039] 3. Vswitch / DVswitch: A virtual switch / distributed virtual switch in a VMware virtualization environment, used to manage communications between virtual machines and between virtual machines and external networks.

[0040] 4. PKTCAP: A self-developed packet capture tool based on ESXi limited API, which supports full-stack packet capture in Vswitch / DVswitch communications.

[0041] 5. Sensor: A terminal perception component that can perform network protection related actions on the terminal.

[0042] 6. NSengine: A network protection engine that can detect attacks and take corresponding actions based on network packet information.

[0043] With the development of VMware virtualization technology, the security of physical server hosts and virtual machines has become increasingly important, especially the network security of VMware platform virtual machines and host machines.

[0044] In related technologies, network protection of network virtualization platforms (such as NSX-V, NSX-T, etc.) requires complex configuration. In addition, all traffic needs to be serially imported into the security virtual machine network card, and then the packets are captured and handed over to the network protection engine (such as NSengine) for attack analysis, and then returned to the network card or discarded according to the results, which has a significant delay effect on network transmission performance.

[0045] In addition, when network anomalies occur, the resolution process depends on VMware NSX market support. Since VMware vsphere is a non-open source commercial virtual environment and its ESXi system is a virtualization service, platform development is greatly limited. VMware network management includes standard virtual switches, distributed virtual switches, NSX-T management and other modes. There are differences in the configuration of network protection in different modes.

[0046] Figure 1 A schematic diagram of the structure of a message processing system is shown in FIG. Figure 1 As shown, the message processing system includes a secure virtual machine (SVM), multiple guest virtual machines (GVMs), and a virtualization platform.

[0047] Among them, multiple client virtual machines are used to transmit messages through the virtualization platform.

[0048] The virtualization platform is used to send the message to the client virtual machine at the receiving end when receiving the message from the client virtual machine at the sending end. The virtualization platform may include a virtual switch / distributed virtual switch (Vswitch / DVswitch) of NSX-V / NSX-T.

[0049] The security virtual machine includes a network protection engine (such as NSengine). When the first client virtual machine transmits a message to the second client virtual machine, the security virtual machine captures the message from the virtualization platform to the network protection engine, so that the network protection engine determines whether it is an abnormal message, and discards the message if the message is an abnormal message. If the message is a normal message, the message is sent to the virtualization platform.

[0050] In this way, when transmitting messages between virtual machines, the messages need to be forwarded to the secure virtual machine, which uses the network protection engine to detect the messages and sends the data packet to the second virtual machine if there is no abnormality in the messages. The secure virtual machine uses the network protection engine to detect the messages, which increases the transmission time and increases the message transmission delay between virtual machines.

[0051] In view of this, an embodiment of the present application provides a message processing method, which is applied to a server in a message processing system, and the message processing system also includes a sending end device, a virtual machine to be protected, and a security virtual machine; the sending end device is used to send a transmission message to the virtual machine to be protected directly through a switch; the method includes: copying the transmission message of the port of the virtual machine to be protected to obtain a bypass message of the transmission message; sending the bypass message to the security virtual machine; the security virtual machine is used to determine whether the bypass message is an abnormal bypass message, and when the bypass message is an abnormal bypass message, sending the message information of the bypass message to the server; in response to receiving the message information of the bypass message from the security virtual machine, intercepting the transmission message.

[0052] The method provided in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0053] It should be noted that the network system described in the embodiment of the present application is to more clearly illustrate the technical solution of the embodiment of the present application, and does not constitute a limitation on the technical solution provided in the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of network systems and the emergence of other network systems, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems.

[0054] Figure 2 FIG. 1 is a schematic diagram of the structure of a message processing system 10 provided in an embodiment of the present application. Figure 2 As shown, the message processing system 10 may include: an SVM 11 and multiple GVMs 12 (such as GVM1 and GVM2), and a server 13 (such as a virtualization platform server, ESXi vsphere).

[0055] The SVM 11 is connected to a plurality of GVMs 12 (such as GVM 1 and GVM 2) and a server 13. For example, the connection may be made wirelessly or by wire.

[0056] In one example, the SVM 11 and multiple GVMs 12 and the server 13 may be connected via a preset communication channel (vsocket).

[0057] For example, SVM11 may be connected to server 13 via a first preset communication channel (such as veocket0). GVM1 in GVM12 may be connected to server 13 via a second preset communication channel (such as veocket1). GVM2 in GVM12 may be connected to server 13 via a third preset communication channel (such as veocket2).

[0058] Among them, the SVM 11 involved in the embodiment of the present application is used to determine whether the bypass message is an abnormal bypass message, and if the bypass message is an abnormal bypass message, send the message information of the bypass message to the server 13. For example, it can include a network protection engine and an Internet service provider client (Interface Segregation Principle, ISPclient).

[0059] The GVM 12 involved in the embodiment of the present application is used to send messages to other GVMs. For example, the GVM 12 may include an ISP client and a sensor.

[0060] The server 13 involved in the embodiment of the present application is used to copy the transmission message of the port of the virtual machine to be protected, and obtain the bypass message of the transmission message; send the bypass message to the security virtual machine; the security virtual machine is used to determine whether the bypass message is an abnormal bypass message, and when the bypass message is an abnormal bypass message, send the message information of the bypass message to the server; in response to receiving the message information of the bypass message from the security virtual machine, intercept the transmission message. For example, it can include an Internet Service Provider Server (ISP Server), a packet capture tool (such as PKTCAP), and a virtualized switch (such as Vswitch). The virtualized switch includes multiple ports. For example, it can include port 1 and port 2. Port 1 and port 2 are used to connect different GVMs. For example, port 1 can be used to connect GVM1. Port 2 is used to connect GVM2.

[0061] It should be noted that the hardware resources of GVM12 are provided by a host machine, which may refer to a physical host that provides hardware resources for a virtual machine.

[0062] Figure 2 This is just an exemplary framework diagram. Figure 2 The names of the individual devices included in the Figure 2 In addition to the functional nodes shown, other nodes may also be included, which is not limited in the embodiments of the present application.

[0063] When implementing it specifically, Figure 2 Each device in the Figure 3 The structure shown, or including Figure 3 Parts shown. Figure 3 The structure diagram of a message processing device 200 provided in an embodiment of the present application is shown in FIG. 2 . The message processing device 200 may be a network device, or the message processing device 200 may be a chip or a system on a chip in a network device. Figure 3 As shown, the message processing device 200 includes a processor 201 , a communication interface 202 and a communication line 203 .

[0064] Furthermore, the message processing device 200 may further include a memory 204. The processor 201, the memory 204 and the communication interface 202 may be connected via a communication line 203.

[0065] The processor 201 is a CPU, a general processor, a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 201 may also be other devices with processing functions, such as circuits, devices, or software modules, without limitation.

[0066] The communication interface 202 is used to communicate with other devices or other communication networks. The communication interface 202 can be a module, a circuit, a communication interface or any device capable of implementing communication.

[0067] The communication line 203 is used to transmit information between the components included in the message processing device 200.

[0068] The memory 204 is used to store instructions, where the instructions may be computer programs.

[0069] The memory 204 may be a read-only memory (ROM) or other types of static storage devices that can store static information and / or instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and / or instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage media or other magnetic storage devices, etc., without limitation.

[0070] It should be noted that the memory 204 can exist independently of the processor 201, or can be integrated with the processor 201. The memory 204 can be used to store instructions or program codes or some data, etc. The memory 204 can be located in the message processing device 200, or can be located outside the message processing device 200, without limitation. The processor 201 is used to execute the instructions stored in the memory 204 to implement the message processing method provided in the following embodiments of the present application.

[0071] In one example, the processor 201 may include one or more CPUs, for example, Figure 3 CPU0 and CPU1 in.

[0072] As an optional implementation, the message processing device 200 includes multiple processors, for example, Figure 3 In addition to the processor 201, a processor 205 may also be included.

[0073] It should be pointed out that Figure 3 The composition shown in the Figure 2 The limitations of each device in Figure 3 In addition to the parts shown, Figure 2 The individual devices in the Figure 3 More or fewer components, or combinations of certain components, or different arrangements of components.

[0074] In the embodiment of the present application, the chip system may be composed of a chip, or may include a chip and other discrete devices.

[0075] In addition, the actions, terms, etc. involved in the various embodiments of the present application can refer to each other without limitation. The message name or parameter name in the message exchanged between the various devices in the embodiments of the present application is only an example, and other names can also be used in the specific implementation without limitation.

[0076] In order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference.

[0077] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0078] In the present application, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0079] Combine the following Figure 2 The message processing system shown describes the message processing method provided in the embodiment of the present application.

[0080] Figure 4 A message processing method is provided for the embodiment of the present application, such as Figure 4 As shown, the method includes the following S301-S303:

[0081] S301: When the server detects that the virtual machine to be protected receives a transmission message, the server sends a bypass message corresponding to the transmission message to the security virtual machine. Correspondingly, the security virtual machine receives the bypass message from the server.

[0082] The server may be a server corresponding to the esxi service program. The secure virtual machine is used to detect the bypass message, obtain the message detection result, and send the message detection result to the server. The message detection result is used to indicate whether the bypass message is an abnormal bypass message.

[0083] Among them, the structure of the transmission message may include: message header, command / response field, data field, and checksum. The message header contains key information such as the type, length, and identifier of the message, which is used to indicate the nature and content of the message. The command / response field is used to identify whether the message is a command message or a response message, so that the receiving device performs the corresponding operation or sends a response. The data field includes the actual data content, such as configuration parameters, status information, control instructions, etc. The checksum is used to ensure the integrity and correctness of the message.

[0084] As a possible implementation manner, when the server detects that the virtual machine to be protected receives the transmission message, the server can send a bypass message to the secure virtual machine through a preset communication channel.

[0085] The preset communication channel can be set as needed, for example, a veocket channel.

[0086] Combination Figure 2 , the server 13 can send a bypass message to the security virtual machine SVM11 through the first preset communication channel.

[0087] In the embodiment of the present application, the server can detect whether the virtual machine to be protected receives the transmission message by monitoring the port of the virtual machine to be protected.

[0088] The port of the virtual machine to be protected may include an uplink transmission message flowing to the port of the virtual machine to be protected, or may refer to a downlink transmission message flowing out of the port of the virtual machine to be protected.

[0089] It should be noted that the server can determine that the protected virtual machine has received a transmission message when it is detected that the port of the protected virtual machine has an uplink transmission message flowing to the port of the protected virtual machine. It is determined that the protected virtual machine has not received a transmission message when it is detected that the port of the protected virtual machine has a downlink transmission message flowing out of the port of the protected virtual machine, or when there is no transmission message.

[0090] In one example, the server can determine that the port of the virtual machine to be protected includes an uplink transmission message flowing to the port of the virtual machine to be protected when the destination address of the transmission message is the address corresponding to the virtual machine to be protected; and determine that the port of the virtual machine to be protected includes a downlink transmission message flowing out of the port of the virtual machine to be protected when the destination address of the transmission message is not the address corresponding to the virtual machine to be protected.

[0091] S302: The security virtual machine sends a message detection result to the server. Correspondingly, the server receives the message detection result from the bypass message.

[0092] The message detection result may include a first message detection result and a second message detection result. The first message detection result is used to indicate that the bypass message is an abnormal message, and the second detection result is used to indicate that the bypass message is not an abnormal message.

[0093] As a possible implementation manner, the security virtual machine may send the message detection result to the server when the message detection result is the first message detection result or the second message detection result.

[0094] As a possible implementation manner, the security virtual machine may send the message detection result to the server when the message detection result is the first message detection result.

[0095] When the message detection result is the second message detection result, the message detection result is no longer sent to the server.

[0096] It should be noted that the security virtual machine is configured with a network protection engine (also referred to as a traffic analysis engine), and the security virtual machine can determine the message detection result of the bypass message through the traffic analysis engine.

[0097] Exemplarily, when the bypass message meets the first preset condition, the message detection result is used to indicate that the bypass message is an abnormal message; when the bypass message does not meet the first preset condition, the message detection result is used to indicate that the bypass message is not an abnormal message; the first preset condition includes at least one of the following: the bypass message has structured query language SQL injection, the bypass message has abnormal code, and the source Internet Protocol IP address of the bypass message is an IP address in the blacklist.

[0098] In one example, the security virtual machine can determine whether there is structured query language (SQL) injection in the bypass message through the traffic analysis engine. In the case that there is SQL injection in the bypass message, the message detection result is determined to be the first message detection result; in the case that there is no SQL injection in the bypass message, the message detection result is determined to be the second message detection result.

[0099] In another example, the security virtual machine can determine the source IP address or source port of the bypass message through the traffic analysis engine. When the source IP address of the bypass message is in the preset IP blacklist or the source port is in the preset port blacklist, the message detection result of the bypass message is determined to be the first message detection result. When the source IP address of the bypass message is not in the preset IP blacklist and the source port is not in the preset port blacklist, the message detection result of the bypass message is determined to be the second message detection result.

[0100] In another example, the security virtual machine may determine that the message detection result of the bypass message is a first message detection result when the source IP address of the bypass message is in a preset IP blacklist or the source port is in a preset port blacklist. When the source IP address of the bypass message is not in the preset IP blacklist and the source port is not in the preset port blacklist, determine whether the bypass message has structured query language (SQL) injection. When SQL injection exists in the bypass message, determine that the message detection result of the bypass message is a first message detection result. When SQL injection does not exist in the bypass message, determine that the message detection result of the bypass message is a second message detection result.

[0101] It should be noted that the preset IP blacklist includes multiple IP addresses marked as abnormal. The preset port blacklist includes multiple port addresses marked as abnormal.

[0102] It can be understood that sending the message detection result to the server only when the bypass message is an abnormal message reduces the received message detection results, can reduce the computing resources of the server for parsing the message detection results, and improve the processing speed of abnormal messages.

[0103] In some embodiments, the message detection result may include message information of the bypass message. The message information may include the address of the sending end device (such as MAC address, IP address, etc.).

[0104] In practical applications, the message information may include five-tuple information of the transmitted message.

[0105] S303: In response to the message detection result indicating that the bypass message is an abnormal message, the server disconnects the connection between the virtual machine to be protected and the sender of the transmission message.

[0106] As a possible implementation manner, the server may send a first indication message to the virtual machine to be protected to disconnect the connection between the virtual machine to be protected and the sender of the transmission message.

[0107] In one example, the server may mark the sending end device as an abnormal device in response to the message detection result indicating that the bypass message is an abnormal message. Further, a first indication message is sent to the virtual machine to be protected to disconnect the connection between the virtual machine to be protected and the sender of the transmission message.

[0108] It should be noted that the first indication message is used to instruct the virtual machine to be protected to disconnect the Transmission Control Protocol (TCP) connection with the abnormal device. For example, the first indication message may include the IP address of the abnormal device, a TCP disconnection instruction (also referred to as a protection rule), and the like.

[0109] For example, the server may send the first indication message to the virtual machine to be protected based on a preset program. For example, the preset program may be an esxi program.

[0110] Correspondingly, after receiving the first indication message, the virtual machine to be protected can use a preset protection program (such as sensor) to disconnect the TCP connection with the abnormal device.

[0111] In one example, the virtual machine to be protected can use a preset protection program to send a result message to the abnormal device to disconnect the TCP connection between the virtual machine to be protected and the abnormal device.

[0112] In one example, combining Figure 2, the server 13 may send a first indication message to the ISP client of GVM1 through the second preset communication channel. Correspondingly, GVM1 may receive the first indication message through the ISP client and forward the first indication message to the protection program.

[0113] In some embodiments, the server is further provided with an IP blacklist. When the sending end device is determined as an abnormal device, the server may add the IP address of the sending end device to the IP blacklist.

[0114] Based on the technical solution provided in the present application, by determining the bypass message corresponding to the transmission message received by the virtual machine to be protected, the bypass message is detected using the security virtual machine, that is, through bypass detection, it is possible to determine whether the transmission message is abnormal without sending the transmission message to the security virtual machine, and disconnect the connection between the sending end and the virtual machine to be protected when the transmission message is abnormal. This can not only improve the security of message transmission, but also reduce the transmission path length of the transmission message, thereby reducing the transmission time of the transmission message and reducing the message transmission delay between virtual machines.

[0115] In a possible implementation manner, before sending a bypass message corresponding to a transmission message to a secure virtual machine, the present application may include the following S401-S402.

[0116] S401. The server determines the port information of the virtual machine to be protected.

[0117] The port information of the virtual machine to be protected may be the port ID of the virtual machine to be protected.

[0118] As a possible implementation manner, the server may obtain a media access control address (MAC) of the virtual machine to be protected, and determine the port information of the virtual machine to be protected according to the MAC address and the first mapping relationship.

[0119] It should be noted that the first mapping relationship includes the correspondence between different MAC addresses and different port information.

[0120] In one example, the gateway device can call the vcenter interface to obtain the virtual machine list in the server, and send the virtual machine list to the server through the security virtual machine. Correspondingly, the server receives the virtual machine list and determines the port information of the virtual machine to be protected based on the virtual machine port information in the virtual machine list.

[0121] The virtual machine list includes multiple virtual machines in operation and corresponding virtual machine information. The virtual machine information may include at least one of the following: port information, MAC address, universally unique identifier (Universally Unique Identifier, UUID), etc.

[0122] S402: The server copies the message of the port of the virtual machine to be protected based on the port information to obtain a bypass message.

[0123] As a possible implementation method, the server can determine the port corresponding to the port information as the target port based on the port information, and use a preset packet capture tool to copy the message of the port of the virtual machine to be protected at the target port to obtain a bypass message.

[0124] It should be noted that the preset packet capture tool can be set as needed, for example, it can be PKTCAP.

[0125] As another possible implementation method, the server can configure port mirroring of the port based on the port information so that the source port of the port mirroring is the port of the virtual machine to be protected; and use port mirroring to copy the message of the port of the virtual machine to be protected to obtain a bypass message.

[0126] In one example, the server can set the source port of the port mirroring to the port of the virtual machine to be protected according to the port information, copy the message of the port of the virtual machine to be protected, and obtain the bypass message.

[0127] In some embodiments, the server may perform a splitting operation on the transmission message of the port of the virtual machine to be protected to obtain a bypass message of the transmission message.

[0128] In a possible implementation manner, before sending the message detection result to the server, the present application may further include the following S501-S502.

[0129] S501. The security virtual machine determines whether a bypass message meets a first preset condition.

[0130] The first preset condition may refer to the description of S301 and will not be elaborated here.

[0131] As a possible implementation, the security virtual machine can extract the grammatical semantic features of the SQL statement in the bypass message, and match the grammatical semantic features with the preset SQL attack features. Further, when the grammatical semantic features match the preset SQL attack features, it is determined that the bypass message has SQL injection, and the bypass message meets the first preset condition. When the grammatical semantic features do not match the preset SQL attack features, it is determined that the bypass message does not have SQL injection. The bypass message does not meet the first preset condition.

[0132] It should be noted that some SQL injection attacks usually perform some risky operations, so their corresponding SQL statements have some features that can be distinguished from risk-free operations, called SQL attack features. Therefore, this application can summarize and use these SQL attack features in advance as conditions for determining SQL injection attacks.

[0133] In one example, the security virtual machine may input the grammatical semantic features and the preset SQL attack features into a preset matching model, and determine the matching of the grammatical semantic features and the preset SQL attack features according to the output result of the preset matching model.

[0134] The preset matching model can be set as needed, for example, a vector machine model, a random forest model, or a neural network model.

[0135] As a possible implementation method, the security virtual machine can use a detection tool to detect whether there is an abnormal code in the bypass message. When it is detected that the bypass message has an abnormal code, it is determined that the bypass message meets the first preset condition. When it is detected that the bypass message does not have an abnormal code, it is determined that the bypass message does not meet the first preset condition.

[0136] The detection tool may be set as required, for example, anti-virus software.

[0137] As a possible implementation, the security virtual machine can determine whether the source IP address of the bypass message is an IP address in a pre-stored blacklist, and if the source IP address is an IP address in the pre-stored blacklist, determine that the bypass message meets the first preset condition. If the source IP address is not an IP address in the pre-stored blacklist, determine that the bypass message does not meet the first preset condition.

[0138] S502: The security virtual machine determines a message detection result according to whether the bypass message meets a first preset condition.

[0139] The security virtual machine can determine whether there is Structured Query Language (SQL) injection in the bypass message through the traffic analysis engine. When the bypass message meets the first preset condition, the message detection result is determined to be the first message detection result; when the bypass message does not meet the first preset condition, the message detection result is determined to be the second message detection result.

[0140] Figure 5 Another message processing method provided in the embodiment of the present application is as follows: Figure 5 As shown, the method includes the following S601-S606:

[0141] S601. The server determines the port information of the virtual machine to be protected.

[0142] The specific process of this step may refer to the description of S401 above, which will not be described in detail here.

[0143] S602: The server copies the transmission message received by the virtual machine to be protected based on the port information to obtain a bypass message.

[0144] The specific process of this step may refer to the description of S402 above, which will not be described in detail here.

[0145] S603: The server sends a bypass message to the secure virtual machine.

[0146] S604: The security virtual machine determines a message detection result of the bypass message.

[0147] The specific process of this step can refer to the description of S501-S502 above, which will not be repeated here.

[0148] S605: The security virtual machine sends a message detection result to the server.

[0149] The specific process of this step may refer to the description of S302 above, which will not be described in detail here.

[0150] S606: In response to the message detection result indicating that the bypass message is an abnormal message, the security virtual machine sends a first indication message to the virtual machine to be protected.

[0151] The specific process of this step may refer to the description of S303 above, which will not be described in detail here.

[0152] The various solutions in the above embodiments of the present application can be combined without contradiction.

[0153] The embodiment of the present application can divide the message processing device into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic, which is only a logical function division. There may be other division methods in actual implementation.

[0154] In the case of dividing each functional module into corresponding functional modules, Figure 6A structural schematic diagram of a message processing device 700 is shown. The message processing device can be a server in a message processing system, and the server is communicated with the virtual machine to be protected and the secure virtual machine respectively; the message processing device 700 can be used to execute the functions of the message processing device involved in the above embodiments. Figure 6 The message processing device 700 shown may include: a sending unit 701, a receiving unit 702 and a processing unit 703; the sending unit 701 is used to send a bypass message corresponding to the transmission message to the security virtual machine when it is detected that the virtual machine to be protected has received the transmission message; the bypass message is a message obtained by copying the transmission message; the receiving unit 702 is used to receive the message detection result from the security virtual machine, and the message detection result is used to indicate whether the bypass message is an abnormal message; the processing unit 703 is used to disconnect the connection between the virtual machine to be protected and the sending end of the transmission message in response to the message detection result indicating that the bypass message is an abnormal message.

[0155] Optionally, before sending a bypass message corresponding to the transmission message to the secure virtual machine, processing unit 703 is also used to determine the port information of the virtual machine to be protected; processing unit 703 is also used to copy the transmission message received by the virtual machine to be protected based on the port information to obtain a bypass message.

[0156] Optionally, the processing unit 703 is specifically used to: configure port mirroring of the port based on the port information so that the source port of the port mirroring is the port of the virtual machine to be protected; use the port mirroring to copy the message of the port of the virtual machine to be protected to obtain a bypass message.

[0157] Optionally, the processing unit 703 is specifically used to: send a first indication message to the virtual machine to be protected; the first indication message is used to instruct the virtual machine to be protected to disconnect the transmission control protocol TCP connection with the sending end.

[0158] Optionally, optionally, when the bypass message meets the first preset condition, the message detection result is used to indicate that the bypass message is an abnormal message; when the bypass message does not meet the first preset condition, the message detection result is used to indicate that the bypass message is not an abnormal message; the first preset condition includes at least one of the following: the bypass message has structured query language SQL injection, the bypass message has abnormal code, and the source Internet Protocol IP address of the bypass message is an IP address in the blacklist.

[0159] Figure 7A structural schematic diagram of another message processing device 800 is shown. The message processing device can be a secure virtual machine in a message processing system. The message processing device 800 can be used to perform the functions of the message processing device involved in the above embodiment. The secure virtual machine is connected to the server in communication; the server is also connected to the virtual machine to be protected in communication; the device includes: a receiving unit 801 and a sending unit 802; the receiving unit 801 is used to receive a bypass message corresponding to a transmission message from the server; the bypass message is sent by the server when it detects that the virtual machine to be protected receives a transmission message, and the bypass message is a message obtained by copying the transmission message; the sending unit 802 is used to send a message detection result to the server, and the message detection result is used to indicate whether the bypass message is an abnormal message, so that the server disconnects the connection between the virtual machine to be protected and the sending end of the transmission message when the message detection result indicates that the bypass message is an abnormal message.

[0160] Optionally, the device also includes a determination unit 803, which is used to determine whether the bypass message meets a first preset condition before sending the message detection result to the server; the first preset condition includes at least one of the following: the bypass message has structured query language SQL injection, the bypass message has an abnormal code, and the source Internet Protocol IP address of the bypass message is an IP address in the blacklist; the determination unit 803 is also used to determine the message detection result according to whether the bypass message meets the first preset condition; when the bypass message meets the first preset condition, the message detection result is used to indicate that the bypass message is an abnormal message; when the bypass message does not meet the first preset condition, the message detection result is used to indicate that the bypass message is not an abnormal message.

[0161] The embodiment of the present application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be completed by a computer program to instruct the relevant hardware, and the program can be stored in the above computer-readable storage medium. When the program is executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be an internal storage unit of the message processing device (including the data sending end and / or the data receiving end) of any of the above embodiments, such as a hard disk or memory of the message processing device. The above computer-readable storage medium can also be an external storage device of the above terminal device, such as a plug-in hard disk equipped on the above terminal device, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. Further, the above computer-readable storage medium can also include both the internal storage unit of the above message processing device and an external storage device. The above computer-readable storage medium is used to store the above computer program and other programs and data required by the above message processing device. The above computer-readable storage medium can also be used to temporarily store data that has been output or is to be output.

[0162] It should be noted that the terms "first" and "second" in the specification, claims and drawings of the present application are used to distinguish different objects rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0163] It should be understood that in the present application, "at least one (item)" means one or more, "more than one" means two or more, "at least two (items)" means two or three and more than three, and "and / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0164] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0165] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0166] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0167] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0168] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks or optical disks.

[0169] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A message processing method, characterized in that: Applied to a server, the server is respectively connected to the virtual machine to be protected and the secure virtual machine in communication; the method comprises: When it is detected that the virtual machine to be protected receives a transmission message, a bypass message corresponding to the transmission message is sent to the secure virtual machine; the bypass message is a message obtained by copying the transmission message; Receiving a message detection result from the security virtual machine, wherein the message detection result is used to indicate whether the bypass message is an abnormal message; In response to the message detection result indicating that the bypass message is the abnormal message, the connection between the virtual machine to be protected and the sender of the transmission message is disconnected.

2. The method according to claim 1, characterized in that Before sending the bypass message corresponding to the transmission message to the secure virtual machine, the method further includes: Determine the port information of the virtual machine to be protected; Based on the port information, the transmission message received by the virtual machine to be protected is copied to obtain the bypass message.

3. The method according to claim 2, characterized in that The step of copying the message of the port of the virtual machine to be protected based on the port information to obtain the bypass message includes: Based on the port information, configure the port mirroring of the port so that the source port of the port mirroring is the port of the virtual machine to be protected; The port mirror is used to copy the message of the port of the virtual machine to be protected to obtain the bypass message.

4. The method according to any one of claims 1 to 3, characterized in that The disconnecting the connection between the virtual machine to be protected and the sending end of the transmission message includes: A first indication message is sent to the virtual machine to be protected; the first indication message is used to instruct the virtual machine to be protected to disconnect the Transmission Control Protocol TCP connection with the sending end.

5. The method according to claim 1, characterized in that In the case where the bypass message meets the first preset condition, the message detection result is used to indicate that the bypass message is an abnormal message; When the bypass message does not meet the first preset condition, the message detection result is used to indicate that the bypass message is not the abnormal message; the first preset condition includes at least one of the following: the bypass message has structured query language SQL injection, the bypass message has abnormal code, and the source Internet Protocol IP address of the bypass message is an IP address in the blacklist.

6. A message processing method, characterized in that: Applied to a security virtual machine, the security virtual machine is connected to a server in communication; the server is also connected to a virtual machine to be protected in communication; the method includes: receiving a bypass message corresponding to the transmission message from the server; the bypass message is sent by the server when it detects that the virtual machine to be protected has received the transmission message, and the bypass message is a message obtained by copying the transmission message; A message detection result is sent to the server, where the message detection result is used to indicate whether the bypass message is an abnormal message, so that the server disconnects the connection between the virtual machine to be protected and the sender of the transmission message when the message detection result is used to indicate that the bypass message is the abnormal message.

7. The method according to claim 6, characterized in that Before sending the message detection result to the server, the method further includes: Determine whether the bypass message meets a first preset condition; the first preset condition includes at least one of the following: the bypass message has a structured query language SQL injection, the bypass message has an abnormal code, and the source Internet Protocol IP address of the bypass message is an IP address in the blacklist; The message detection result is determined according to whether the bypass message satisfies the first preset condition; when the bypass message satisfies the first preset condition, the message detection result is used to indicate that the bypass message is an abnormal message; when the bypass message does not satisfy the first preset condition, the message detection result is used to indicate that the bypass message is not the abnormal message.

8. A message processing device, characterized in that: Applied to a server, the server is respectively connected to the virtual machine to be protected and the secure virtual machine in communication; the device comprises: a sending unit, a receiving unit and a processing unit; The sending unit is used to send a bypass message corresponding to the transmission message to the secure virtual machine when detecting that the virtual machine to be protected receives the transmission message; the bypass message is a message obtained by copying the transmission message; The receiving unit is used to receive a message detection result from the security virtual machine, where the message detection result is used to indicate whether the bypass message is an abnormal message; The processing unit is used to disconnect the connection between the virtual machine to be protected and the sending end of the transmission message in response to the message detection result indicating that the bypass message is the abnormal message.

9. A message processing device, characterized in that: Applied to a security virtual machine, the security virtual machine is connected to a server for communication; the server is also connected to a virtual machine to be protected for communication; the device comprises: a receiving unit and a sending unit; The receiving unit is used to receive a bypass message corresponding to the transmission message from the server; the bypass message is sent by the server when it detects that the virtual machine to be protected has received the transmission message, and the bypass message is a message obtained by copying the transmission message; The sending unit is used to send a message detection result to the server, and the message detection result is used to indicate whether the bypass message is an abnormal message, so that the server disconnects the connection between the virtual machine to be protected and the sending end of the transmission message when the message detection result is used to indicate that the bypass message is the abnormal message.

10. A message processing system, comprising a server and a secure virtual machine; the server is used to execute the method according to any one of claims 1 to 5; the secure virtual machine is used to execute the method according to claim 6 or 7.

11. A computer-readable storage medium, characterized in that: The readable storage medium stores instructions, and when the instructions are executed, the method according to any one of claims 1 to 5 or claim 6 or 7 is implemented.

12. An electronic device, characterized in that: include: A processor, a memory and a communication interface; wherein the communication interface is used for the electronic device to communicate with other devices or networks; The memory is used to store one or more programs, which include computer-executable instructions. When the electronic device is running, the processor executes the computer-executable instructions stored in the memory to enable the electronic device to execute any one of claims 1-5 or the method according to claim 6 or 7.

13. A computer program product, comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 5 or claim 6 or 7 is implemented.

Images