Method and device for limiting mutual access of virtual machine and Internet

Abstract

The embodiment of the invention provides a method for limiting mutual access between a virtual machine and the Internet. The method comprises the following steps: associating a shared virtual firewall with cloud desktop virtual machines of a plurality of common tenants; and the access between the cloud desktop virtual machines of the plurality of common tenants and the Internet is limited through the shared virtual firewall. By means of the method and device, the problem that the efficiency of the mode of limiting the access between the cloud desktop virtual machine and the Internet under a plurality of common tenants is low is solved, and then the effect of efficiently limiting the access between the cloud desktop virtual machine and the Internet is achieved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communications, and in particular to a method and device for limiting mutual access between a virtual machine and the Internet. Background Art

[0002] In modern networks, firewalls are key devices to ensure network security. In large enterprises or cloud service providers, it is often necessary to manage a large amount of network traffic and ensure network security among many tenants, so effective firewall management is required.

[0003] In the prior art, physical firewalls or virtualized firewalls are usually used. The physical firewall method is to assign a real physical device to each tenant, but this method is very difficult to manage, not flexible enough, and not easy to batch specify policies such as security groups and firewalls. It also requires more equipment and resources. The virtualized firewall method is to use virtualization technology to borrow some host resources to create a virtual machine and deploy it as a virtual firewall device. Each tenant can be assigned one or more virtual machines as needed. However, this method also has certain disadvantages. With the improvement of virtualization technology and the performance of central processing units, memory, etc., the number of users that a single virtualized firewall can carry is increasing rapidly. Assigning an independent firewall to tenants with fewer users may result in a waste of some computing power. Summary of the invention

[0004] The embodiments of the present invention provide a method and device for limiting mutual access between a virtual machine and the Internet, so as to at least solve the problem of low efficiency in limiting access between cloud desktop virtual machines under multiple common tenants and the Internet.

[0005] According to one embodiment of the present invention, a method for limiting mutual access between virtual machines and the Internet is provided, comprising: associating a shared virtual firewall with cloud desktop virtual machines of multiple common tenants; and limiting access between the cloud desktop virtual machines of the multiple common tenants and the Internet through the shared virtual firewall.

[0006] In an exemplary embodiment, associating a shared virtual firewall with cloud desktop virtual machines of multiple common tenants includes: pointing the gateway Internet Protocol (IP) of each of the common tenant's cloud desktop virtual machines to the corresponding network interface IP of the shared virtual firewall.

[0007] According to another embodiment of the present invention, a device for limiting mutual access between virtual machines and the Internet is provided, including: an association module for associating a shared virtual firewall with cloud desktop virtual machines of multiple common tenants; a restriction module for limiting access between the cloud desktop virtual machines of the multiple common tenants and the Internet through the shared virtual firewall.

[0008] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when run.

[0009] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0010] Through the present invention, since the shared firewall is associated with the cloud desktop virtual machines under multiple common tenants, there is no need for each common tenant to correspond to a virtual firewall. When the cloud desktop virtual machines under multiple common tenants access the Internet or the Internet accesses the cloud desktop virtual machines, the cloud desktop virtual machines under the associated multiple tenants are restricted by a shared virtual firewall, which can solve the problem of low efficiency in the access restriction method between the cloud desktop virtual machines under multiple common tenants and the Internet, thereby achieving the effect of efficiently restricting the access between the cloud desktop virtual machines and the Internet and facilitating the management of multiple common tenants. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 is a hardware structure block diagram of a computer terminal according to a method for limiting mutual access between a virtual machine and the Internet according to an embodiment of the present invention;

[0012] Figure 2 is a flow chart of a method for limiting mutual access between a virtual machine and the Internet according to an embodiment of the present invention;

[0013] Figure 3 is a structural block diagram of a device for limiting mutual access between a virtual machine and the Internet according to an embodiment of the present invention;

[0014] Figure 4 is a structural block diagram of a device for limiting mutual access between a virtual machine and the Internet according to yet another embodiment of the present invention;

[0015] Figure 5 This is a schematic diagram of different tenants having their own firewalls;

[0016] Figure 6is a flow chart of a method for limiting mutual access between a virtual machine and the Internet according to yet another embodiment of the present invention;

[0017] Figure 7 is a schematic diagram of a multi-tenant shared virtual firewall according to an embodiment of the present invention;

[0018] Figure 8 It is a schematic diagram of the process of multi-tenant sharing of a virtual firewall according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

[0020] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0021] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a computer terminal as an example, Figure 1 1 is a hardware structure block diagram of a computer terminal for limiting mutual access between a virtual machine and the Internet according to an embodiment of the present invention. Figure 1 As shown, the computer terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned computer terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above-mentioned computer terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0022] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for limiting mutual access between a virtual machine and the Internet in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0023] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of a computer terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0024] Figure 2 is a flow chart of limiting mutual access between a virtual machine and the Internet according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0025] Step S202, associating a shared virtual firewall with cloud desktop virtual machines of multiple common tenants;

[0026] Associating multiple common tenants with a shared virtual firewall can reduce the number and cost of network devices, thereby reducing network operating costs and improving the economic benefits of the network.

[0027] In step S202, the gateway Internet Protocol IP of each common tenant's cloud desktop virtual machine is pointed to the corresponding network interface IP of the shared virtual firewall.

[0028] By pointing the gateway IP of each common tenant's cloud desktop virtual machine to the corresponding shared virtual firewall's network interface IP, multiple tenants can share network resources while ensuring data isolation. With a certain degree of flexibility, multiple network interfaces can be set for the shared virtual firewall.

[0029] Before step S202, the method further includes: creating a public network service tenant and the plurality of common tenants; and creating the shared virtual firewall and the external network under the public network service tenant.

[0030] Step S204: restricting access between the cloud desktop virtual machines of the plurality of common tenants and the Internet through the shared virtual firewall.

[0031] In step S204, the shared virtual firewall receives traffic from the cloud desktop virtual machines of the multiple common tenants accessing the Internet, restricts the traffic, and sends the traffic to the Internet.

[0032] In step S204, the shared virtual firewall receives the traffic of the Internet accessing a designated cloud desktop virtual machine among the cloud desktop virtual machines of the multiple common tenants, restricts the traffic, and sends the traffic to the designated cloud desktop virtual machine.

[0033] In an exemplary embodiment, sending the traffic to the Internet includes: the shared virtual firewall converts the IP address of the cloud desktop virtual machine into an external network IP address according to a pre-set source address conversion rule, and sends the traffic to the Internet according to the external network IP address.

[0034] In an exemplary embodiment, sending the traffic to the designated cloud desktop virtual machine includes, the shared virtual firewall converting the external network IP address into the IP address of the cloud desktop virtual machine according to a preset destination address conversion rule, and sending the traffic to the designated cloud desktop virtual machine.

[0035] In an exemplary embodiment, limiting the traffic includes, the shared virtual firewall limiting the traffic according to a pre-set restriction policy, wherein the restriction policy includes at least one of the following: a virtual private network policy, an antivirus policy, a quality of service policy, a speed limit policy, and a monitoring policy.

[0036] Traffic is restricted through a variety of restriction strategies, ensuring the stability and security of the shared firewall among multiple tenants.

[0037] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0038] In this embodiment, a device for limiting mutual access between a virtual machine and the Internet is also provided, and the device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0039] Figure 3 is a structural block diagram of a device for limiting mutual access between a virtual machine and the Internet according to an embodiment of the present invention, such as Figure 3 As shown, the device includes an association module 10 and a restriction module 20.

[0040] An association module 10, used to associate a shared virtual firewall with cloud desktop virtual machines of multiple common tenants;

[0041] The restriction module 20 is used to restrict the access between the cloud desktop virtual machines of the multiple common tenants and the Internet through the shared virtual firewall.

[0042] Figure 4 is a structural block diagram of a device for limiting mutual access between a virtual machine and the Internet according to yet another embodiment of the present invention. Figure 4 As shown, the device includes Figure 3 In addition to all the modules shown, the limiting module 20 further includes: a first sending unit 21 and a second sending unit 22 .

[0043] A first sending unit 21 is used for the shared virtual firewall to receive traffic from the cloud desktop virtual machines of the multiple common tenants accessing the Internet, restrict the traffic, and send the traffic to the Internet;

[0044] The second sending unit 22 is used for the shared virtual firewall to receive the traffic of the Internet accessing the designated cloud desktop virtual machine among the cloud desktop virtual machines of the multiple common tenants, limit the traffic, and send the traffic to the designated cloud desktop virtual machine.

[0045] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0046] To facilitate the understanding of the technical solution provided by the present invention, a detailed description will be given below in conjunction with embodiments of specific scenarios.

[0047] Figure 5 This is a schematic diagram of different tenants having their own firewalls, such as Figure 5 As shown in the figure, in general, each tenant has its own virtual firewall to restrict the cloud desktops under the tenant from accessing the Internet. Due to the improvement of virtualization technology and the performance of central storage and memory, the number of users that can be supported by a single virtual firewall has increased rapidly. Assigning an independent firewall to tenants with fewer users may result in a waste of some computing power.

[0048] Figure 6 is a flow chart of a method for limiting mutual access between a virtual machine and the Internet according to yet another embodiment of the present invention. Figure 6 As shown, the process includes the following steps:

[0049] S602, creating a public network service tenant;

[0050] Specifically, the public network service tenant only provides firewall services for common tenants.

[0051] S604, create a common tenant;

[0052] Specifically, since ordinary tenants cannot create their own firewalls, they must associate and select a public network service tenant when creating a new one. Multiple ordinary tenants can be associated with the same public network service tenant.

[0053] S606, creating a private network with a virtual local area network (VLAN) under a common tenant, and creating an external network that can access the Internet under a public network service tenant;

[0054] S608, create a shared virtual firewall under the public network service tenant.

[0055] Specifically, the shared virtual firewall can support simultaneous online access of 2,000 cloud desktops, has excellent performance, and is the cornerstone for sharing. Configure the corresponding virtual private network (VPN), antivirus, quality of service (QoS), speed limit, monitoring and other strategies for the shared virtual firewall to limit traffic. Add the private network gateway under the ordinary network to the interface of the shared virtual firewall, and create source address translation (SNAT) and destination address translation (DNAT) rules. For each interface added to the shared virtual firewall, it is necessary to add a blocking policy with the source address as the shared network segment of other ordinary tenants under the firewall and the destination address as the interface segment. The purpose is to block the network interconnection of ordinary tenants under the firewall, thereby achieving network isolation.

[0056] Figure 7 is a schematic diagram of a multi-tenant shared virtual firewall according to an embodiment of the present invention, such as Figure 7 As shown in the figure, virtual machines A1…An are ordinary tenant A virtual machines, and virtual machines B1…Bn are ordinary tenant B virtual machines. Each ordinary tenant has its own VLAN, and the networks under different ordinary tenants are isolated from each other through VLAN. The shared virtual firewall is configured with corresponding VPN, antivirus, QoS, speed limit, monitoring and other policies to limit traffic. The private network gateway under the ordinary network is added to the interface of the shared virtual firewall. The virtual machines under ordinary tenants need to use SNAT and DNAT rules to access the Internet through the shared virtual firewall.

[0057] Figure 8 is a schematic diagram of the process of multi-tenant sharing of a virtual firewall according to an embodiment of the present invention, such as Figure 8As shown in the figure, the network under each common tenant allocates an interface IP to the shared virtual firewall, and allocates IP addresses to the network cards of the cloud desktop virtual machines of each tenant. The gateway IP of the cloud desktop virtual machine points to the network interface IP of each tenant on the shared virtual machine firewall. The shared virtual firewall is configured with an external network IP to communicate with the external Internet. When the cloud desktop virtual machine accesses the Internet, the traffic will first be converged to the shared virtual firewall according to the gateway of the cloud desktop virtual machine. The firewall will first limit the traffic according to its own VPN, antivirus, QoS, speed limit, monitoring and other policies. Then the shared virtual firewall will translate the virtual machine IP into the external network IP according to its own SNAT rules, and then send the traffic to the Internet. When the external Internet accesses the cloud desktop virtual machine, the traffic will first be sent to the external network IP of the virtual firewall. The firewall will also first limit the traffic according to its own VPN, antivirus, QoS, speed limit, monitoring and other policies. Then the shared virtual firewall will translate the external network IP into the IP of the cloud desktop virtual machine according to its own DNAT rules, and send the traffic to the specified cloud desktop virtual machine.

[0058] The multi-tenant shared firewall in the embodiment of the present invention can be applied to cloud computing, data centers and other scenarios to achieve multi-tenant network isolation and intercommunication. The following are potential application scenarios of the multi-tenant shared firewall:

[0059] Cloud computing: In cloud computing platforms, multi-tenant shared firewalls can achieve network isolation and intercommunication between different users to protect the security and privacy of user data. At the same time, it can improve the flexibility and scalability of cloud computing platforms, allowing the platform to better adapt to the needs of different users.

[0060] Data center: In large data centers, multi-tenant shared firewalls can achieve network isolation and intercommunication between different departments to protect the security and privacy of important data. At the same time, since some tenants have a small number of people, multi-tenant shared firewalls can also save network equipment and management costs in the data center and improve the operating efficiency and reliability of the data center.

[0061] Enterprise network: In an enterprise network, a multi-tenant shared firewall can achieve network isolation and intercommunication between different departments or branches to protect the security and privacy of enterprise data. At the same time, it can also improve the flexibility and scalability of the enterprise network, allowing the enterprise to better adapt to different business needs.

[0062] Telecom operators: In telecom operators, multi-tenant shared firewalls can achieve network isolation and intercommunication between different customers to protect the security and privacy of customer data. At the same time, it can also save telecom operators' network equipment and management costs and improve operational efficiency and service quality.

[0063] The specific implementation methods of the multi-tenant shared firewall in the above scenario will not be described in detail. You can refer to the above embodiments of the present invention. The use of a multi-tenant shared firewall can improve the flexibility and scalability of the network, while also saving network equipment and management costs. It has broad application prospects and can play an important role in different fields, improving the security, flexibility and scalability of the network.

[0064] The embodiments of the present invention can achieve the following technical effects: reduce network costs: multi-tenant shared firewalls can reduce the number and cost of network devices, thereby reducing the operating cost of the network and improving the economic benefits of the network; improve network flexibility and scalability: multi-tenant shared firewalls can support multiple tenants to share network devices in the same network, thereby reducing the number and cost of network devices and improving network flexibility and scalability; achieve multi-tenant isolation and intercommunication: multi-tenant shared firewalls can isolate and restrict network traffic between different tenants, thereby protecting the security and privacy of user data. At the same time, it can also achieve network intercommunication between different tenants, facilitating data exchange and communication between users; improve network management efficiency: multi-tenant shared firewalls can isolate networks of different tenants through virtualization technology, thereby facilitating network management and monitoring and improving network management efficiency.

[0065] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0066] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0067] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0068] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0069] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0070] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0071] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for limiting mutual access between a virtual machine and the Internet, characterized in that: include: Associate a shared virtual firewall with multiple common tenants' cloud desktop VMs; Access between the cloud desktop virtual machines of the multiple common tenants and the Internet is restricted through the shared virtual firewall.

2. The method according to claim 1, characterized in that Associate a shared virtual firewall with multiple common tenants' cloud desktop VMs, including: The gateway Internet Protocol IP of each common tenant's cloud desktop virtual machine is pointed to the corresponding network interface IP of the shared virtual firewall.

3. The method according to claim 1, characterized in that Restricting access between the cloud desktop virtual machines of the plurality of common tenants and the Internet through the shared virtual firewall includes: The shared virtual firewall receives traffic from the cloud desktop virtual machines of the multiple common tenants accessing the Internet, restricts the traffic, and sends the traffic to the Internet.

4. The method according to claim 3, characterized in that: Sending the traffic to the Internet, including: The shared virtual firewall converts the IP address of the cloud desktop virtual machine into an external network IP address according to a preset source address conversion rule, and sends the traffic to the Internet according to the external network IP address.

5. The method according to claim 1, characterized in that Restricting access between the cloud desktop virtual machines of the plurality of common tenants and the Internet through the shared virtual firewall includes: The shared virtual firewall receives traffic from the Internet accessing a designated cloud desktop virtual machine among the cloud desktop virtual machines of the multiple common tenants, restricts the traffic, and sends the traffic to the designated cloud desktop virtual machine.

6. The method according to claim 5, characterized in that Sending the traffic to the designated cloud desktop virtual machine includes: The shared virtual firewall converts the external network IP address into the IP address of the cloud desktop virtual machine according to the preset destination address conversion rule, and sends the traffic to the designated cloud desktop virtual machine.

7. The method according to any one of claims 3 to 5, characterized in that: Limiting the traffic includes: The shared virtual firewall limits the traffic according to a preset restriction policy, wherein the restriction policy includes at least one of the following: a virtual private network policy, an antivirus policy, a quality of service policy, a speed limit policy, and a monitoring policy.

8. The method according to claim 1, characterized in that Before associating a shared virtual firewall with multiple common tenants' cloud desktop VMs, also include: Creating a public network service tenant and the plurality of common tenants; The shared virtual firewall and external network are created under the public network service tenant.

9. A device for limiting mutual access between a virtual machine and the Internet, characterized in that: include: An association module, used to associate a shared virtual firewall with cloud desktop virtual machines of multiple common tenants; A restriction module is used to restrict the access between the cloud desktop virtual machines of the multiple common tenants and the Internet through the shared virtual firewall.

10. The device according to claim 9, characterized in that The restriction module also includes: The first sending unit is used for the shared virtual firewall to receive traffic from the cloud desktop virtual machines of the multiple common tenants accessing the Internet, restrict the traffic, and send the traffic to the Internet.

11. The device according to claim 9, characterized in that The restriction module also includes: The second sending unit is used for the shared virtual firewall to receive the traffic of the Internet accessing the designated cloud desktop virtual machine among the cloud desktop virtual machines of the multiple common tenants, limit the traffic, and send the traffic to the designated cloud desktop virtual machine.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 6 and 8 when executed by a processor.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 6 and 8 are implemented.

Images