Data protection method, device and equipment based on VDI virtual machine

Abstract

The invention discloses a data protection method, device and equipment based on a VDI virtual machine, and relates to the field of data protection, and the method comprises the steps that a preset security virtualization unified management platform creates the VDI virtual machine and corresponding login information based on an operation and maintenance application request containing a resource name in a cloud to be operated and maintained, and configures a security policy for the VDI virtual machine; creating an operation and maintenance channel from the VDI virtual machine to the resource in the to-be-operated and maintained cloud corresponding to the name of the resource in the to-be-operated and maintained cloud, and configuring an access control strategy for the operation and maintenance channel; the login information is returned, so that after the user equipment logs in the VDI virtual machine based on the login information, data in the resources in the cloud to be operated and maintained is protected through the VDI virtual machine by using the access control strategy and the operation and maintenance channel and based on the security strategy. Unified management of operation and maintenance operation is realized through the security virtualization unified management platform, and data in resources in the to-be-operated and to-be-maintained cloud is protected through the security policy, so that data leakage is avoided.

Description

Technical Field

[0001] The present invention relates to the field of data protection, and in particular to a data protection method, device and equipment based on a VDI virtual machine. Background Art

[0002] With the rapid advancement of digital industrialization, data has become the core competitiveness in the era of digital transformation. Currently, data leakage incidents occur from time to time, which has a great impact on the business of enterprises. Therefore, it is particularly important for enterprises to protect data from leakage. Among all protection scenarios, the operation and maintenance scenario has attracted much attention because it involves a wide range of permissions and affects a wide range of data.

[0003] A common operation and maintenance solution is for operation and maintenance personnel to log in to the bastion host through terminal software on a BYOD (Bring Your Own Device) device, and then access the host or database containing sensitive data. Although high-risk commands can be controlled through the bastion host, data cannot be controlled from being leaked after landing on the BYOD device. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a data protection method, device and equipment based on VDI virtual machines, which can realize the automatic creation of VDI virtual machines and operation and maintenance channels and the automatic configuration of access policies through a secure virtualization unified management platform, realize the unified management of operation and maintenance operations, and protect the data in the resources in the cloud to be operated and maintained through security policies to avoid data leakage. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a data protection method based on a VDI virtual machine, which is applied to a preset secure virtualization unified management platform, wherein the preset secure virtualization unified management platform is used to run a cloud desktop service and a cloud infrastructure service, and the method includes:

[0006] Based on the operation and maintenance application request, the cloud desktop service creates a VDI virtual machine and corresponding login information in the target network, and configures a security policy for the VDI virtual machine; the operation and maintenance application request includes the name of the resource in the cloud to be operated and maintained; the VDI virtual machine is a cloud desktop virtual machine based on the VDI architecture;

[0007] An operation and maintenance channel is created from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained through the cloud infrastructure service, and an access control policy is configured for the operation and maintenance channel; there is a corresponding relationship between the cloud desktop service, the cloud infrastructure service and the target network;

[0008] The login information is sent to the user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, the access control policy and the operation and maintenance channel are used to protect the data in the resources in the cloud to be operated and maintained based on the security policy.

[0009] Optionally, the step of creating a VDI virtual machine and corresponding login information in a target network based on an operation and maintenance application request through the cloud desktop service, and configuring a security policy for the VDI virtual machine includes:

[0010] Obtaining an operation and maintenance application request, and creating a VDI virtual machine and login information in a target network based on the operation and maintenance application request through the cloud desktop service, and establishing an association relationship between the VDI virtual machine and the login information;

[0011] The cloud desktop service is used to configure a security policy for the VDI virtual machine, and the validity period of the login information is set based on the usage duration in the operation and maintenance application request; the security policy includes a data non-export policy and / or a watermark adding policy;

[0012] A target IP address is allocated to the VDI virtual machine through the cloud infrastructure service and based on a preset VDI virtual machine network segment.

[0013] Optionally, the method further includes:

[0014] Monitor whether the current operation and maintenance status meets the preset termination condition, and if so, destroy the VDI virtual machine and the login information through the cloud desktop service, and clear the access control policy through the cloud infrastructure service;

[0015] The preset termination condition includes monitoring that the validity period has expired and / or monitoring that the maintenance of the cloud resources to be maintained has ended.

[0016] Optionally, before creating a VDI virtual machine and corresponding login information in a target network based on the operation and maintenance application request through the cloud desktop service, the method further includes:

[0017] Connecting to the cloud infrastructure service, connecting to the cloud desktop service corresponding to the cloud infrastructure service, and initializing the target network corresponding to the cloud infrastructure service;

[0018] Obtain resource assets within the cloud through the cloud infrastructure service.

[0019] Optionally, the acquiring of cloud resource assets through the cloud infrastructure service includes:

[0020] Acquire the in-cloud resource assets through the asset synchronization interface in the cloud infrastructure service; the in-cloud resource assets include in-cloud virtual machine assets and / or in-cloud database assets;

[0021] If the in-cloud resource assets include the in-cloud virtual machine assets, the internal processes of the in-cloud virtual machine are scanned by a database identification agent built into the in-cloud virtual machine to obtain the self-built database assets.

[0022] Optionally, the connecting to the cloud infrastructure service, connecting to the cloud desktop service corresponding to the cloud infrastructure service, and initializing the target network corresponding to the cloud infrastructure service includes:

[0023] If the cloud infrastructure service is a hyper-converged platform, connect to the hyper-converged platform, connect to the cloud desktop management and control platform corresponding to the hyper-converged platform, and initialize the classic network corresponding to the hyper-converged platform;

[0024] If the cloud infrastructure service is a cloud management platform, the cloud management platform is connected, the desktop as a service platform corresponding to the cloud management platform is connected, and the proprietary network corresponding to the cloud management platform is initialized.

[0025] Optionally, the initializing a classic network corresponding to the hyper-converged platform includes:

[0026] Creating a virtual router in the classic network, and assigning a first IP address to the virtual router based on a first preset VDI virtual machine network segment;

[0027] Connecting the virtual router to a physical network port for communicating with an external network, and allocating a second IP address in the same network segment as the physical network port to the virtual router;

[0028] The virtual router is configured based on a first default access control policy; the first default access control policy is a policy that prohibits the virtual router from accessing external network resources.

[0029] Optionally, the initializing a proprietary network corresponding to the cloud management platform includes:

[0030] In the private network, a VDI virtual machine subnet is created based on a second preset VDI virtual machine network segment, and the VDI virtual machine subnet is configured based on a second default access control policy; the second default access control policy is a policy that prohibits the VDI virtual machine subnet from accessing other subnets; the VDI virtual machine is located in the VDI virtual machine subnet.

[0031] Optionally, the step of creating, through the cloud infrastructure service, an operation and maintenance channel from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained, and configuring an access control policy for the operation and maintenance channel includes:

[0032] A first operation and maintenance channel is created through the cloud infrastructure service from the VDI virtual machine to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained, and a first access control policy is configured for the first operation and maintenance channel; the resources in the cloud to be operated and maintained include virtual machines in the cloud to be operated and maintained and / or databases in the cloud to be operated and maintained.

[0033] Optionally, the step of creating, through the cloud infrastructure service, a first operation and maintenance channel from the VDI virtual machine to a resource in the cloud to be operated and maintained corresponding to the name of the resource in the cloud to be operated and maintained, and configuring a first access control policy for the first operation and maintenance channel includes:

[0034] If the cloud infrastructure service is a hyper-converged platform, the VDI virtual machine is connected to the resources in the cloud to be operated and maintained through the hyper-converged platform in a classic network by using a pre-created virtual router to obtain the first operation and maintenance channel; the VDI virtual machine and the resources in the cloud to be operated and maintained are located in the same cluster;

[0035] A first access control policy is configured for the first operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to resources in the cloud to be operated and maintained based on a first default policy prohibiting mutual access, and to control the virtual router to allow the VDI virtual machine to access resources in the cloud to be operated and maintained.

[0036] Optionally, the step of creating, through the cloud infrastructure service, a first operation and maintenance channel from the VDI virtual machine to a resource in the cloud to be operated and maintained corresponding to the name of the resource in the cloud to be operated and maintained, and configuring a first access control policy for the first operation and maintenance channel includes:

[0037] If the cloud infrastructure service is a cloud management platform, the VDI virtual machine is connected to the resources in the cloud to be operated and maintained by using a private network through the cloud management platform to obtain the first operation and maintenance channel; the VDI virtual machine and the resources in the cloud to be operated and maintained are located in the same private network;

[0038] A first access control policy is configured for the first operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to resources in the cloud to be operated and maintained based on a first default policy prohibiting mutual access, and to control the private network to allow the VDI virtual machine to access resources in the cloud to be operated and maintained.

[0039] Optionally, the protecting data in the resources in the cloud to be operated and maintained by using the access control policy and the operation and maintenance channel based on the security policy includes:

[0040] The terminal operation and maintenance software on the VDI virtual machine uses the first access control policy and the first operation and maintenance channel to operate and maintain the resources in the cloud to be operated and maintained, and protects the data in the resources in the cloud to be operated and maintained based on the security policy.

[0041] Optionally, the step of creating, through the cloud infrastructure service, an operation and maintenance channel from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained, and configuring an access control policy for the operation and maintenance channel includes:

[0042] A second operation and maintenance channel is created through the cloud infrastructure service from the VDI virtual machine via the bastion host to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained, and a second access control policy is configured for the second operation and maintenance channel; the resources in the cloud to be operated and maintained include virtual machines in the cloud to be operated and maintained and / or databases in the cloud to be operated and maintained.

[0043] Optionally, the step of creating, through the cloud infrastructure service, a second operation and maintenance channel from the VDI virtual machine via the bastion host to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained, and configuring a second access control policy for the second operation and maintenance channel includes:

[0044] If the cloud infrastructure service is a hyper-converged platform, the VDI virtual machine is connected to the bastion host and the bastion host is connected to the resources in the cloud to be operated and maintained by using a pre-created virtual router through the hyper-converged platform in a classic network to obtain the second operation and maintenance channel; the VDI virtual machine and the resources in the cloud to be operated and maintained are located in the same cluster;

[0045] A second access control policy is configured for the second operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the bastion host based on the first default policy of prohibiting mutual access, and to control the virtual router to allow the VDI virtual machine to access the bastion host and the bastion host to access the resources in the cloud to be operated and maintained.

[0046] Optionally, the step of creating, through the cloud infrastructure service, a second operation and maintenance channel from the VDI virtual machine via the bastion host to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained, and configuring a second access control policy for the second operation and maintenance channel includes:

[0047] If the cloud infrastructure service is a cloud management platform, the VDI virtual machine is connected to the bastion host and the bastion host is connected to the resources in the cloud to be operated and maintained by using a private network through the cloud management platform to obtain the second operation and maintenance channel; the VDI virtual machine and the resources in the cloud to be operated and maintained are located in the same private network;

[0048] A second access control policy is configured for the second operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the bastion host based on the first default policy prohibiting mutual access, and to control the private network to allow the VDI virtual machine to access the bastion host and the bastion host to access the resources in the cloud to be operated and maintained.

[0049] Optionally, after creating, through the cloud infrastructure service, a second operation and maintenance channel from the VDI virtual machine via the bastion host to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained, the method further includes:

[0050] Based on the IP address of the cloud resource to be operated and maintained corresponding to the name of the cloud resource to be operated and maintained, the cloud resource assets to be operated and maintained are added to the bastion host, and the login information is authorized to complete the access to the cloud resource assets to be operated and maintained in the bastion host.

[0051] Optionally, the protecting data in the resources in the cloud to be operated and maintained by using the access control policy and the operation and maintenance channel based on the security policy includes:

[0052] The terminal operation and maintenance software on the VDI virtual machine uses the second access control policy and the second operation and maintenance channel to log in to the bastion host, and operates and maintains the resources in the cloud to be operated and maintained through the bastion host, and protects the data in the resources in the cloud to be operated and maintained based on the security policy.

[0053] Optionally, the step of creating, through the cloud infrastructure service, an operation and maintenance channel from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained, and configuring an access control policy for the operation and maintenance channel includes:

[0054] A target operation and maintenance channel is created from the VDI virtual machine to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained based on the database dynamic desensitization system through the cloud infrastructure service, and a target access control policy is configured for the target operation and maintenance channel; the resources in the cloud to be operated and maintained include the database in the cloud to be operated and maintained.

[0055] Optionally, before creating a VDI virtual machine and corresponding login information in a target network based on the operation and maintenance application request through the cloud desktop service, the method further includes:

[0056] Deploy the database dynamic desensitization system to the target network, and assign an IP address in the same network segment as the VDI virtual machine to the database dynamic desensitization system;

[0057] Connecting the database dynamic desensitization system, and connecting the database dynamic desensitization system with each cloud database through the cloud infrastructure service;

[0058] Add the assets of each in-cloud database to the database dynamic desensitization system based on the IP address of each in-cloud database through the interface of the database dynamic desensitization system, and configure a proxy address for each in-cloud database respectively;

[0059] A second default mutual access prohibition policy is configured for a second distributed firewall associated with the database dynamic desensitization system through the cloud infrastructure service.

[0060] Optionally, connecting the database dynamic desensitization system with each in-cloud database through the cloud infrastructure service includes:

[0061] If the cloud infrastructure service is a hyper-converged platform, the database dynamic desensitization system is connected to each of the in-cloud databases through the hyper-converged platform in a classic network by using a pre-created virtual router;

[0062] If the cloud infrastructure service is a cloud management platform, the database dynamic desensitization system is connected to each of the cloud databases via a proprietary network through the cloud management platform.

[0063] Optionally, before creating a target operation and maintenance channel from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained based on the database dynamic desensitization system through the cloud infrastructure service, the method further includes:

[0064] Create a desensitized login account through the interface of the database dynamic desensitization system and return an access token corresponding to the desensitized login account;

[0065] The target desensitization strategy is determined based on the desensitization level in the operation and maintenance application request through the interface of the database dynamic desensitization system, and the target desensitization strategy is configured for the desensitized login account.

[0066] Optionally, the step of creating a target operation and maintenance channel from the VDI virtual machine to the resource in the cloud to be operated and maintained corresponding to the name of the resource in the cloud to be operated and maintained based on the database dynamic desensitization system through the cloud infrastructure service, and configuring a target access control policy for the target operation and maintenance channel includes:

[0067] A third operation and maintenance channel is created through the cloud infrastructure service from the VDI virtual machine through the database dynamic desensitization system to the database in the cloud to be operated and maintained, and a third access control policy is configured for the third operation and maintenance channel; the database in the cloud to be operated and maintained is a database in each of the cloud databases that corresponds to the name of the resource in the cloud to be operated and maintained.

[0068] Optionally, the step of creating, through the cloud infrastructure service, a third operation and maintenance channel from the VDI virtual machine through the database dynamic desensitization system to the database in the cloud to be operated and maintained, and configuring a third access control policy for the third operation and maintenance channel includes:

[0069] If the cloud infrastructure service is a hyper-converged platform, the VDI virtual machine is connected to the virtual router and the VDI virtual machine is connected to the database dynamic desensitization system through the hyper-converged platform under the classic network based on the pre-connected database dynamic desensitization system and the in-cloud database to be operated and maintained, so as to obtain the third operation and maintenance channel; the database dynamic desensitization system, the VDI virtual machine and the in-cloud database to be operated and maintained are located in the same cluster;

[0070] A third access control policy is configured for the third operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the database dynamic desensitization system based on the first default policy of prohibiting mutual access, and to control the second distributed firewall associated with the database dynamic desensitization system to allow access by the VDI virtual machine and access to the database in the cloud to be operated and maintained, and to control the virtual router to allow access by the database dynamic desensitization system to the database in the cloud to be operated and maintained.

[0071] Optionally, the step of creating, through the cloud infrastructure service, a third operation and maintenance channel from the VDI virtual machine through the database dynamic desensitization system to the database in the cloud to be operated and maintained, and configuring a third access control policy for the third operation and maintenance channel includes:

[0072] If the cloud infrastructure service is a cloud management platform, the VDI virtual machine is connected to the database dynamic desensitization system through the cloud management platform under the proprietary network based on the pre-connected database dynamic desensitization system and the database in the cloud to be operated and maintained, so as to obtain the third operation and maintenance channel; the database dynamic desensitization system, the VDI virtual machine and the database in the cloud to be operated and maintained are located in the same proprietary network;

[0073] A third access control policy is configured for the third operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the database dynamic desensitization system based on the first default policy of prohibiting mutual access, and to control the second distributed firewall associated with the database dynamic desensitization system to allow access by the VDI virtual machine and access to the database in the cloud to be operated and maintained, and to control the private network to allow access by the database dynamic desensitization system to the database in the cloud to be operated and maintained.

[0074] Optionally, the protecting data in the resources in the cloud to be operated and maintained by using the access control policy and the operation and maintenance channel based on the security policy includes:

[0075] Using the third access control policy and the third operation and maintenance channel through the terminal operation and maintenance software on the VDI virtual machine, and logging into the database dynamic desensitization system based on the desensitized login account and the access token;

[0076] The database dynamic desensitization system utilizes the target desensitization strategy and based on the target proxy address of the database in the cloud to be operated and maintained, operates and maintains the database in the cloud to be operated and maintained, and protects the data in the database in the cloud to be operated and maintained based on the security policy.

[0077] Optionally, the step of creating a target operation and maintenance channel from the VDI virtual machine to the resource in the cloud to be operated and maintained corresponding to the name of the resource in the cloud to be operated and maintained based on the database dynamic desensitization system through the cloud infrastructure service, and configuring a target access control policy for the target operation and maintenance channel includes:

[0078] A fourth operation and maintenance channel is created through the cloud infrastructure service from the VDI virtual machine via the bastion host and the database dynamic desensitization system to the database in the cloud to be operated and maintained, and a fourth access control policy is configured for the fourth operation and maintenance channel; the database in the cloud to be operated and maintained is a database in each of the cloud databases that corresponds to the name of the resource in the cloud to be operated and maintained.

[0079] Optionally, the step of creating, through the cloud infrastructure service, a fourth operation and maintenance channel from the VDI virtual machine via the bastion host and the database dynamic desensitization system to the database in the cloud to be operated and maintained, and configuring a fourth access control policy for the fourth operation and maintenance channel includes:

[0080] If the cloud infrastructure service is a hyper-converged platform, the VDI virtual machine is connected to the bastion host and the bastion host is connected to the database dynamic desensitization system through the hyper-converged platform based on the pre-connected database dynamic desensitization system and the database in the cloud to be operated and maintained under the classic network, and the fourth operation and maintenance channel is obtained by using the virtual router; the database dynamic desensitization system, the VDI virtual machine and the database in the cloud to be operated and maintained are located in the same cluster;

[0081] A fourth access control policy is configured for the fourth operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the bastion host based on the first default policy prohibiting mutual access, and to control the second distributed firewall associated with the database dynamic desensitization system to allow access by the bastion host and access to the database in the cloud to be operated and maintained, and to control the virtual router to allow the VDI virtual machine to access the bastion host, the bastion host to access the database dynamic desensitization system, and the database dynamic desensitization system to access the database in the cloud to be operated and maintained.

[0082] Optionally, the step of creating, through the cloud infrastructure service, a fourth operation and maintenance channel from the VDI virtual machine via the bastion host and the database dynamic desensitization system to the database in the cloud to be operated and maintained, and configuring a fourth access control policy for the fourth operation and maintenance channel includes:

[0083] If the cloud infrastructure service is a cloud management platform, the VDI virtual machine is connected to the bastion host and the bastion host is connected to the database dynamic desensitization system through the cloud management platform based on the pre-connected database dynamic desensitization system and the database in the cloud to be operated and maintained, using the proprietary network to obtain the fourth operation and maintenance channel; the database dynamic desensitization system, the VDI virtual machine and the database in the cloud to be operated and maintained are located in the same proprietary network;

[0084] A fourth access control policy is configured for the fourth operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the bastion host based on the first default policy prohibiting mutual access, and to control the second distributed firewall associated with the database dynamic desensitization system to allow access by the bastion host and access to the database in the cloud to be operated and maintained, and to control the private network to allow access by the VDI virtual machine to the bastion host, access by the bastion host to the database dynamic desensitization system, and access by the database dynamic desensitization system to the database in the cloud to be operated and maintained.

[0085] Optionally, after creating, through the cloud infrastructure service, a fourth operation and maintenance channel from the VDI virtual machine via the bastion host and the database dynamic desensitization system to the database in the cloud to be operated and maintained, the method further includes:

[0086] Based on the target proxy address of the database in the cloud to be operated and maintained, the assets of the database in the cloud to be operated and maintained in the database dynamic desensitization system are added to the bastion host, and the login information is authorized to complete the access to the assets of the database in the cloud to be operated and maintained in the bastion host.

[0087] Optionally, the protecting data in the resources in the cloud to be operated and maintained by using the access control policy and the operation and maintenance channel based on the security policy includes:

[0088] Log in to the bastion machine by using the fourth access control policy and the fourth operation and maintenance channel through the terminal operation and maintenance software on the VDI virtual machine, and log in to the database dynamic desensitization system through the bastion machine based on the desensitized login account and the access token;

[0089] The database dynamic desensitization system utilizes the target desensitization strategy and based on the target proxy address of the database in the cloud to be operated and maintained, operates and maintains the database in the cloud to be operated and maintained, and protects the data in the resources in the cloud to be operated and maintained based on the security policy.

[0090] In a second aspect, the present application provides a data protection device based on a VDI virtual machine, which is applied to a preset secure virtualization unified management platform, wherein the preset secure virtualization unified management platform is used to run a cloud desktop service and a cloud infrastructure service, and the device includes:

[0091] A virtual machine creation module, used to create a VDI virtual machine and corresponding login information in a target network based on an operation and maintenance application request through the cloud desktop service, and configure a security policy for the VDI virtual machine; the operation and maintenance application request includes a name of a resource in the cloud to be operated and maintained; the VDI virtual machine is a cloud desktop virtual machine based on a VDI architecture;

[0092] An operation and maintenance channel creation module is used to create an operation and maintenance channel from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained through the cloud infrastructure service, and configure an access control policy for the operation and maintenance channel; there is a corresponding relationship between the cloud desktop service, the cloud infrastructure service and the target network;

[0093] The data protection module is used to send the login information to the user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, the access control policy and the operation and maintenance channel are used to protect the data in the resources in the cloud to be operated and maintained based on the security policy.

[0094] In a third aspect, the present application provides an electronic device, including:

[0095] Memory, used to store computer programs;

[0096] A processor is used to execute the computer program to implement the aforementioned data protection method based on the VDI virtual machine.

[0097] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned VDI virtual machine-based data protection method when executed by a processor.

[0098] In the present application, a preset secure virtualization unified management platform creates a VDI virtual machine and corresponding login information under a target network based on an operation and maintenance application request through a cloud desktop service, and configures a security policy for the VDI virtual machine; the operation and maintenance application request includes the name of the cloud resource to be operated and maintained; the VDI virtual machine is a cloud desktop virtual machine based on the VDI architecture; an operation and maintenance channel from the VDI virtual machine to the cloud resource to be operated and maintained corresponding to the name of the cloud resource to be operated and maintained is created through a cloud infrastructure service, and an access control policy is configured for the operation and maintenance channel; there is a corresponding relationship between the cloud desktop service, the cloud infrastructure service and the target network; the login information is sent to a user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, the data in the cloud resource to be operated and maintained is protected through the VDI virtual machine using the access control policy and the operation and maintenance channel and based on the security policy. It can be seen that the present application realizes the automatic creation of VDI virtual machines, the automatic creation of operation and maintenance channels, and the automatic configuration of access control policies through a secure virtualization unified management platform, thereby uniformly managing the operation and maintenance operations through a secure virtualization platform, which is convenient for users to use; and, the present application creates a VDI virtual machine and a corresponding operation and maintenance channel upon receiving an operation and maintenance application request, which can avoid the resource occupation problem caused by maintaining the VDI virtual machine and the operation and maintenance channel; in addition, the present application configures security policies for VDI virtual machines, so that in the process of operating and maintaining cloud resources through VDI virtual machines, data in cloud resources are protected based on security policies to avoid the risk of data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0099] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0100] Figure 1 A flow chart of a data protection method based on a VDI virtual machine disclosed in this application;

[0101] Figure 2 A flowchart of a specific data protection method based on a VDI virtual machine disclosed in this application;

[0102] Figure 3 A first operation and maintenance channel creation and resource operation and maintenance flow chart disclosed in this application;

[0103] Figure 4 This is a flowchart of operation and maintenance channel creation and resource operation and maintenance in a classic network disclosed in this application;

[0104] Figure 5 A flowchart of operation and maintenance channel creation and resource operation and maintenance under a proprietary network disclosed in this application;

[0105] Figure 6 This is another specific flow chart of a data protection method based on a VDI virtual machine disclosed in this application;

[0106] Figure 7 A second operation and maintenance channel creation and resource operation and maintenance flow chart disclosed in this application;

[0107] Figure 8 Another flow chart of operation and maintenance channel creation and resource operation and maintenance under a proprietary network disclosed in this application;

[0108] Fig. 9 A flowchart of another specific data protection method based on a VDI virtual machine disclosed in this application;

[0109] Fig.10 A third operation and maintenance channel creation and resource operation and maintenance flow chart disclosed in this application;

[0110] Fig.11 This is another flow chart of operation and maintenance channel creation and resource operation and maintenance in a classic network disclosed in this application;

[0111] Fig.12 This is another flowchart of operation and maintenance channel creation and resource operation and maintenance in a proprietary network disclosed in this application;

[0112] Fig.13This is another specific flow chart of a data protection method based on a VDI virtual machine disclosed in this application;

[0113] Fig.14 A fourth operation and maintenance channel creation and resource operation and maintenance flow chart disclosed in this application;

[0114] Fig.15 This is another flowchart of creating an operation and maintenance channel and resource operation and maintenance in a proprietary network disclosed in this application;

[0115] Fig.16 A schematic diagram of the structure of a data protection device based on a VDI virtual machine disclosed in this application;

[0116] Fig.17 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0117] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0118] Protecting data from leakage is particularly important for enterprises. Among all protection scenarios, operation and maintenance scenarios have attracted much attention because they involve a wide range of permissions and affect a wide range of data. Although common operation and maintenance solutions can control high-risk commands through bastion hosts, they cannot control data leakage after it is implemented on BYOD devices. To this end, the present application provides a data protection method based on VDI virtual machines, which realizes automatic creation of VDI virtual machines and operation and maintenance channels and automatic configuration of access policies through a secure virtualization unified management platform, realizes unified management of operation and maintenance operations, and protects data in resources in the cloud to be operated and maintained through security policies to avoid data leakage.

[0119] See also Figure 1 As shown, an embodiment of the present invention discloses a data protection method based on a VDI virtual machine, which is applied to a preset secure virtualization unified management platform, wherein the preset secure virtualization unified management platform is used to run a cloud desktop service and a cloud infrastructure service, and the method includes:

[0120] Step S11: Based on the operation and maintenance application request, a VDI virtual machine and corresponding login information are created in the target network through the cloud desktop service, and a security policy is configured for the VDI virtual machine; the operation and maintenance application request includes the name of the resource in the cloud to be operated and maintained.

[0121] In this embodiment, the preset secure virtualization unified management platform is mainly used for unified management of operation and maintenance operations, and for running cloud desktop services and cloud infrastructure services, and can provide built-in security solutions. For example, the preset secure virtualization unified management platform can use the aSEC (a-security, secure virtualization) system. The VDI virtual machine is a cloud desktop virtual machine based on the VDI (Virtual Desktop Infrastructure, virtual desktop infrastructure) architecture; wherein the cloud desktop is a remote desktop service that provides computing and storage capabilities in the cloud; the VDI architecture is an implementation architecture of the cloud desktop, which can centralize all client data operations on the server side for management, and the client desktop only receives the operating system environment.

[0122] In this embodiment, before creating a VDI virtual machine based on an operation and maintenance application request, the preset secure virtualization unified management platform needs to first connect to the cloud infrastructure service and initialize the cloud infrastructure service, including but not limited to synchronization of basic data, etc.; then connect to the cloud desktop service corresponding to the cloud infrastructure service and initialize the cloud desktop service, including but not limited to configuration of default policies, default roles, and default resource groups, etc.; at the same time, initialize the target network corresponding to the cloud infrastructure service, and then obtain the cloud resource assets through the cloud infrastructure service, so as to subsequently operate and maintain the cloud resources. It should be noted that there is a corresponding relationship between the cloud desktop service, the cloud infrastructure service, and the target network.

[0123] If the cloud infrastructure service is a hyper-converged platform, connect to the hyper-converged platform, connect to the cloud desktop management and control platform corresponding to the hyper-converged platform, and initialize the classic network corresponding to the hyper-converged platform. For example, the hyper-converged platform can use the HCI (Hyper Converged Infrastructure) platform, where the hyper-converged platform is a platform that provides a unified virtualization solution for computing, storage, network, and security; the cloud desktop management and control platform corresponding to the hyper-converged platform can use the VDC (Virtual Desktop Controller) platform, where the cloud desktop management and control platform is mainly used to provide interfaces to derive VDI virtual machines and authentication when logging into VDI virtual machines; the classic network can be a network plane shared by virtual machines in the cloud and hosts.

[0124] For initializing the classic network corresponding to the hyper-converged platform, first configure the first preset VDI virtual machine network segment in the classic network, create a virtual router (VR), and allocate a first IP (Internet Protocol) address to the virtual router based on the first preset VDI virtual machine network segment; at the same time, the virtual router is directly connected to the physical network port used for communicating with the external network to connect the virtual router and the physical network port, and then allocate a second IP address in the same network segment as the physical network port to the virtual router; the access control policy of the virtual router is set by default to a policy that prohibits the virtual router from visiting external network resources.

[0125] If the cloud infrastructure service is a cloud management platform, then connect to the cloud management platform, connect to the desktop as a service platform corresponding to the cloud management platform, and initialize the private network corresponding to the cloud management platform. For example, the cloud management platform can use the self-developed SCP cloud computing platform, where the cloud management platform is a management platform that provides multi-tenant support based on HCI; the desktop as a service platform corresponding to the cloud management platform can use the DaaS (Desktop as a Service) platform, which can provide a service catalog of cloud desktop products on the cloud management platform and support multi-tenant and multi-cluster; the private network is also known as the VPC (Virtual Private Cloud) network, which provides a completely independent network plane, supports multi-tenant scenarios, and each user can have multiple private networks.

[0126] For initializing the private network corresponding to the cloud management platform, first configure the second preset VDI virtual machine network segment in the private network, and create a VDI virtual machine subnet based on the second preset VDI virtual machine network segment, and then set the access control policy of the VDI virtual machine subnet by default to a policy that prohibits the VDI virtual machine subnet from visiting other subnets.

[0127] Furthermore, for obtaining cloud resource assets through cloud infrastructure services, first obtain cloud resource assets through the asset synchronization interface in the cloud infrastructure service; wherein, cloud resource assets include cloud virtual machine assets and / or cloud database assets; if cloud resource assets include cloud virtual machine assets, then scan the internal processes of the cloud virtual machine through the database identification agent built into the cloud virtual machine to identify the self-built database assets. It should be noted that, depending on the different strictness of different users' operation and maintenance requirements, cloud resource assets can be obtained only through the asset synchronization interface, or cloud resource assets can be obtained through the asset synchronization interface and self-built database assets can be scanned through the database identification agent built into the cloud virtual machine.

[0128] In this embodiment, after the preset secure virtualization unified management platform connects to the cloud infrastructure service and the corresponding cloud desktop service, and initializes the target network corresponding to the cloud infrastructure service, if the preset secure virtualization unified management platform obtains the operation and maintenance application request initiated by the operation and maintenance personnel, a VDI virtual machine is created under the target network based on the operation and maintenance application request through the interface of the cloud desktop service, and resource configuration and security policy configuration are performed for the VDI virtual machine; wherein the resource configuration includes the configuration of the number of CPUs (Central Processing Units), memory size, and running location; the security policy includes a data non-export policy and / or a watermark adding policy; the data non-export policy includes policies such as disabling USB (Universal Serial Bus) access, disabling the clipboard, and prohibiting external network connection; the watermark adding policy is used to attach identification to data such as text, pictures, and videos, which is divided into clear watermarks and dark watermarks, and can achieve data leakage prevention, deterrence, tracing, and other purposes. At the same time, the login information is created based on the identity information of the operation and maintenance personnel included in the operation and maintenance application request through the interface of the cloud desktop service, and the authentication policy is configured for the login information, and the validity period of the login information is set based on the usage time included in the operation and maintenance application request; the identity information includes name, mobile phone number, email address, etc.; the login information includes login account and login password, etc.; the authentication policy includes the policy of using account and password for authentication, etc. After the VDI virtual machine and login information are created, the association relationship between the VDI virtual machine and the login information is established so that the operation and maintenance personnel can log in to the VDI virtual machine based on the login information.

[0129] After the VDI virtual machine and the corresponding login information are created, the target IP address is assigned to the VDI virtual machine through the interface of the cloud infrastructure service and based on the preset VDI virtual machine network segment. Specifically, if the cloud infrastructure service is a hyper-converged platform, a line is pulled from the VDI virtual machine to the virtual router to connect the VDI virtual machine and the virtual router, and the target IP address is assigned to the VDI virtual machine based on the first preset VDI virtual machine network segment; if the cloud infrastructure service is a cloud management platform, the target IP address is assigned to the VDI virtual machine based on the second preset VDI virtual machine network segment; it should be noted that the VDI virtual machine is located in the VDI virtual machine subnet.

[0130] Step S12: Create an operation and maintenance channel from the VDI virtual machine to the cloud resource to be operated and maintained corresponding to the name of the cloud resource to be operated and maintained through the cloud infrastructure service, and configure an access control policy for the operation and maintenance channel.

[0131] In this embodiment, an operation and maintenance channel is created from the VDI virtual machine to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained through the interface of the cloud infrastructure service, and an access control policy is configured for the operation and maintenance channel to enable the VDI virtual machine to access the resources in the cloud to be operated and maintained. Specifically, if the cloud infrastructure service is a hyper-converged platform, an operation and maintenance channel is created from the VDI virtual machine to the resources in the cloud to be operated and maintained based on a virtual router; if the cloud infrastructure service is a cloud management platform, an operation and maintenance channel is created from the VDI virtual machine to the resources in the cloud to be operated and maintained based on a private network.

[0132] It should be noted that the operation and maintenance channels from the VDI virtual machine to the resources in the cloud to be operated and maintained include the first operation and maintenance channel from the VDI virtual machine directly to the resources in the cloud to be operated and maintained, the second operation and maintenance channel from the VDI virtual machine via the bastion host to the resources in the cloud to be operated and maintained, the third operation and maintenance channel from the VDI virtual machine via the database dynamic desensitization system to the resources in the cloud to be operated and maintained, and the fourth operation and maintenance channel from the VDI virtual machine via the bastion host and the database dynamic desensitization system to the resources in the cloud to be operated and maintained. Among them, in a specific network environment, in order to protect the network and data from intrusion and destruction from external and / or internal users, the bastion host can use various technical means to monitor and record the operation behavior of operation and maintenance personnel on servers, network equipment, security equipment, databases and other equipment in the network, so as to centrally alarm, promptly handle and audit and determine responsibilities; the database dynamic desensitization system is connected in series to the front of the database access path in the form of an agent, which is used for access control and desensitization to the database to prevent leakage. For example, the database dynamic desensitization system can use the DAC (Database Access Controller) system; among them, desensitization is a data processing technology for data extraction, data bleaching and dynamic masking (for example: obscuring, masking, deformation, tokenization, etc.) for sensitive data. Data desensitization can reduce the confidentiality of data. Even if the desensitized data is leaked, the impact on stakeholders will be reduced.

[0133] Step S13: Send the login information to the user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, it uses the access control policy and the operation and maintenance channel and protects the data in the resources in the cloud to be operated and maintained based on the security policy.

[0134] In this embodiment, the login information is sent to the user's own device of the operation and maintenance personnel based on the contact information included in the operation and maintenance application request to notify the operation and maintenance personnel that the operation and maintenance channel has been opened. For example, the login information is sent to the user's own device of the operation and maintenance personnel in the form of a text message based on the mobile phone number included in the operation and maintenance application request; the login information is sent to the user's own device of the operation and maintenance personnel in the form of an email based on the email address included in the operation and maintenance application request.

[0135] After the operation and maintenance personnel obtain the login information, the user's own device obtains the login information entered by the operation and maintenance personnel, and after logging in to the VDI virtual machine based on the login information, the VDI virtual machine after logging in uses the access control policy and operation and maintenance channel and protects the data in the resources in the operation and maintenance cloud based on the security policy. Among them, the user's own device includes computers, mobile phones, tablets, etc. The user's own device can install the corresponding software and support use in office scenarios.

[0136] Specifically, the user's own device obtains the login information entered by the operation and maintenance personnel based on the cloud desktop client, and transmits the login information to the cloud desktop service through the cloud desktop client to authenticate the login information through the cloud desktop service. If the cloud desktop service authenticates the login information, it logs in to the VDI virtual machine; then the terminal operation and maintenance software on the VDI virtual machine uses the access control policy and operation and maintenance channel to operate and maintain the resources in the operation and maintenance cloud, and protects the data in the resources in the operation and maintenance cloud based on the security policy, that is, prohibiting the data from landing on the user's own device and adding a watermark to the data. Correspondingly, if the cloud desktop service fails to authenticate the login information, it is prohibited to log in to the VDI virtual machine, and the corresponding prompt information can be returned to the user's own device.

[0137] Furthermore, the preset secure virtualization unified management platform can automatically monitor whether the current operation and maintenance status meets the preset termination conditions. If so, the operation and maintenance channel is destroyed, that is, the VDI virtual machine and the corresponding login information are destroyed through the interface of the cloud desktop service, and the access control policy is cleared through the interface of the cloud infrastructure service. The preset termination conditions include monitoring that the validity period of the login information has expired and / or monitoring that the operation and maintenance of the resources in the cloud to be operated and maintained has ended.

[0138] It can be seen that the present application realizes the automatic creation of VDI virtual machines, the automatic creation of operation and maintenance channels, and the automatic configuration of access control policies through a secure virtualization unified management platform, thereby uniformly managing the operation and maintenance operations through a secure virtualization platform, which is convenient for users to use; and, the present application creates a VDI virtual machine and a corresponding operation and maintenance channel upon receiving an operation and maintenance application request, and destroys the VDI virtual machine and the corresponding operation and maintenance channel after the operation and maintenance is completed or the validity period expires, thereby avoiding the resource occupation problem caused by maintaining the VDI virtual machine and the operation and maintenance channel; in addition, the present application configures security policies for VDI virtual machines, so that in the process of operating and maintaining cloud resources through VDI virtual machines, data in cloud resources are protected based on security policies, such as prohibiting data from being landed on users' own devices and adding watermarks to the data, thereby avoiding the risk of data leakage.

[0139] Based on any of the above embodiments, this embodiment will describe how to create a first operation and maintenance channel and perform operation and maintenance on resources in the operation and maintenance cloud based on the first operation and maintenance channel. Figure 2 As shown, an embodiment of the present invention discloses a data protection method based on a VDI virtual machine, which is applied to a preset secure virtualization unified management platform, including:

[0140] Step S21: Based on the operation and maintenance application request, a VDI virtual machine and corresponding login information are created in the target network through the cloud desktop service, and a security policy is configured for the VDI virtual machine; the operation and maintenance application request includes the name of the resource in the cloud to be operated and maintained.

[0141] In this embodiment, Figure 3 As shown, before the preset secure virtualization unified management platform receives the operation and maintenance application request, the technical administrator needs to deploy and start the preset secure virtualization unified management platform so that the preset secure virtualization unified management platform after startup connects to the cloud infrastructure service and the cloud desktop service corresponding to the cloud infrastructure service, and initializes the target network corresponding to the cloud infrastructure service, and obtains and identifies the virtual machine assets and / or database assets in the cloud through the cloud infrastructure service. After completing the above preparations, the operation and maintenance personnel initiate an operation and maintenance application request to the preset secure virtualization unified management platform through the technical administrator to apply for an operation and maintenance channel; wherein the operation and maintenance application request includes information such as name, mobile phone number, email address, name of the cloud resource to be operated and maintained, and usage time. Accordingly, after receiving the operation and maintenance application request, the preset secure virtualization unified management platform creates a VDI virtual machine and corresponding login information under the target network based on the operation and maintenance application request through the interface of the cloud desktop service, wherein the login information includes a login account and a login password, and configures a security policy for the VDI virtual machine.

[0142] Combination Figure 4 and Figure 5 As shown, if the cloud infrastructure service is a hyper-converged platform HCI, the secure virtualization unified management platform aSEC is preset to link the cloud desktop control platform VDC to derive VDI virtual machines; if the cloud infrastructure service is a cloud management platform SCP, the secure virtualization unified management platform aSEC is preset to link the desktop as a service platform DaaS to derive VDI virtual machines.

[0143] Step S22: Create a first operation and maintenance channel from the VDI virtual machine to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained through the cloud infrastructure service, and configure a first access control policy for the first operation and maintenance channel; the resources in the cloud to be operated and maintained include the virtual machines in the cloud to be operated and maintained and / or the database in the cloud to be operated and maintained.

[0144] In this embodiment, Figure 3As shown, the cloud resource to be operated and maintained corresponding to the name of the cloud resource to be operated and maintained is determined through the interface of the cloud infrastructure service, and a first operation and maintenance channel from the VDI virtual machine to the cloud resource to be operated and maintained is created, and a first access control policy is configured for the first operation and maintenance channel to allow the VDI virtual machine to access the cloud resource to be operated and maintained. It should be noted that the cloud resource to be operated and maintained can be either a virtual machine in the cloud to be operated and maintained or a database in the cloud to be operated and maintained.

[0145] Specifically, Figure 4 As shown, if the cloud infrastructure service is a hyper-converged platform, then in the classic network, through the interface of the hyper-converged platform, the pre-created virtual router (VDI-VR) is used to connect the VDI virtual machine 1 and the resources VM in the cloud to be operated and maintained, that is, to connect the VDI virtual machine 1 and the virtual router, and the virtual router and the resources VM in the cloud to be operated and maintained, so as to obtain the first operation and maintenance channel; wherein, the VDI virtual machine 1 and the resources VM in the cloud to be operated and maintained are located in the same cluster, and all VDI virtual machines are located in a separate network segment, that is, the pre-configured VDI virtual machine network segment. Then, the first access control policy is configured for the first operation and maintenance channel to control the first distributed firewall (DFW, Distributed Firewall) associated with the VDI virtual machine to allow access to the resources in the cloud to be operated and maintained based on the first default policy of prohibiting mutual access, and to control the virtual router to allow the VDI virtual machine to access the resources in the cloud to be operated and maintained; that is, the access path can be recorded as VDI virtual machine-virtual router→resources in the cloud to be operated and maintained. It should be noted that Figure 4 The two virtual routers (VDI-VR) in the figure represent the same virtual router. To show the connection relationship more clearly, two virtual routers are drawn in the figure. Figure 4 The DVS (Distributed Virtual Switch) in the figure represents a distributed virtual switch. All virtual machines are on the same DVS. In addition, each virtual machine is associated with a distributed firewall to control resource access. For the first default policy of prohibiting mutual access, the first distributed firewall associated with the VDI virtual machine is configured by default to prohibit mutual access with external resources.

[0146] Further, such as Figure 4 As shown, for connecting the VDI virtual machine with the resources VM in the cloud to be operated and maintained by using the pre-created virtual router (VDI-VR), the resources in each cloud to be operated and maintained can be connected through the same virtual router. Specifically, there are the following four different connection scenarios.

[0147] In the first connection scenario, the resources in the cloud to be operated and the VDI virtual machines are located in the same cluster but different hosts, and the resources in the cloud to be operated and maintained are directly connected to the physical network port. At this time, the IP address of the resources in the cloud to be operated and maintained and the physical network port are in the same network segment. Then, a line is pulled from the virtual router to the physical network port through the interface of the cloud infrastructure service to connect the virtual router and the physical network port, and an IP address in the same network segment as the physical network port is assigned to the connection network port of the virtual router. At the same time, a line is pulled from the physical network port to the resources in the cloud to be operated and maintained to connect the physical network port and the resources in the cloud to be operated and maintained, thereby realizing the access control of the VDI virtual machine to the resources in the cloud to be operated and maintained through the virtual router.

[0148] In the second connection scenario, the resources in the cloud to be operated and maintained and the VDI virtual machines are located in the same cluster and the same host, and the resources in the cloud to be operated and maintained are directly connected to the physical network port. At this time, the IP address of the resources in the cloud to be operated and maintained and the physical network port are in the same network segment. Then, a line is pulled from the virtual router to the distributed virtual switch through the interface of the cloud infrastructure service, and an IP address is manually or automatically assigned to the connection network port of the virtual router. Among them, the automatic assignment of the IP address can be automatically assigned after the ping network segment is idle; at the same time, a line is pulled from the distributed virtual switch to the resources in the cloud to be operated and maintained, so as to realize the access control of the VDI virtual machine to the resources in the cloud to be operated and maintained through the virtual router; it should be noted that if the distributed virtual switch has multiple network ports, you can manually select a network port or automatically select a network port for connecting with the virtual router.

[0149] In the third connection scenario, the resources in the cloud to be operated and the VDI virtual machines are located in the same cluster but different hosts, and the resources in the cloud to be operated and maintained are connected to the physical network port through one or more virtual routers. At this time, the IP address of the resources in the cloud to be operated and maintained and the physical network port are not in the same network segment, and at the same time, there is no conflict between the network segment where the resources in the cloud to be operated and maintained and the network segment of the VDI virtual machine connected to the virtual router. Then, a line is pulled from the virtual router to the distributed virtual switch through the interface of the cloud infrastructure service, and an IP address is assigned to the connection network port of the virtual router. At the same time, a line is pulled from the distributed virtual switch to the resources in the cloud to be operated and maintained, thereby realizing the access control of the VDI virtual machine to the resources in the cloud to be operated and maintained through the virtual router.

[0150] In the fourth connection scenario, the resources in the cloud to be operated and the VDI virtual machine are located in different hosts in the same cluster, and the resources in the cloud to be operated are connected to the physical network port through one or more virtual routers. At this time, the IP address of the resources in the cloud to be operated and the physical network port are not in the same network segment, and at the same time, the network segment where the resources in the cloud to be operated are located conflicts with the network segment of the VDI virtual machine connected to the virtual router. Then, through the interface of the cloud infrastructure service, a line is pulled from the virtual router (VDI-VR) connected to the VDI virtual machine to a virtual router (VR) manually selected by the user. Among them, the virtual router (VR) manually selected by the user is configured with NAT (Network Address Translation) of the resources in the cloud to be operated. At this time, the converted NAT network segment does not conflict with the network segment of the VDI virtual machine connected to the VDI-VR, and an IP address is allocated to the connection network port of the VDI-VR based on the NAT network segment; at the same time, a line is pulled from the virtual router (VR) manually selected by the user to the distributed virtual switch and from the distributed virtual switch to the resources in the cloud to be operated, so as to realize the access control of the VDI virtual machine to the resources in the cloud to be operated through the virtual router (VDI-VR).

[0151] It should be noted that since the connection between the virtual router (VDI-VR) connected to the VDI virtual machine and the resources in the cloud to be operated and maintained can be maintained for a long time or for a period of time, by configuring the access control policy for the virtual router (VDI-VR) to allow access to the corresponding resources in the cloud to be operated and maintained, the VDI virtual machine can be operated and maintained through the virtual router (VDI-VR) to the resources in the cloud to be operated and maintained. At the same time, it can also solve the problem of long configuration time caused by complex connection scenarios, facilitate the subsequent rapid establishment of operation and maintenance channels, and prevent the expansion of exposure to resources in the cloud at the virtual router.

[0152] Specifically, Figure 5As shown, if the cloud infrastructure service is a cloud management platform, the VDI virtual machine is connected to the resource VM in the cloud to be operated and maintained through the cloud management platform using the private network VPC to obtain the first operation and maintenance channel; wherein, the VDI virtual machine and the resource in the cloud to be operated and maintained are located in the same private network, and all VDI virtual machines are located in a separate network segment, namely, the VDI virtual machine subnet. Then, the first access control policy is configured for the first operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the resource in the cloud to be operated and maintained based on the first default prohibition of mutual access policy, and control the private network to allow the VDI virtual machine to access the resource in the cloud to be operated and maintained; namely, the access path can be recorded as VDI virtual machine-VPC private network→resource in the cloud to be operated and maintained. It should be noted that when the VDI virtual machine is connected to the resource in the cloud to be operated and maintained, since the VDI virtual machine and the resource in the cloud to be operated and maintained are located in different network segments, it is necessary to configure the access control policy on the VPC private network to control the private network to allow the VDI virtual machine to access the resource in the cloud to be operated and maintained.

[0153] Step S23: Send the login information to the user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, the terminal operation and maintenance software on the VDI virtual machine uses the first access control policy and the first operation and maintenance channel to operate and maintain the resources in the cloud to be operated and maintained, and protects the data in the resources in the cloud to be operated and maintained based on the security policy.

[0154] In this embodiment, Figure 3 As shown, after the first operation and maintenance channel is created and the first access control policy is configured, the login information including the login account and login password is sent to the user's own device of the operation and maintenance personnel based on the contact information included in the operation and maintenance application request, so that the user's own device BYOD transmits the login information entered by the operation and maintenance personnel to the cloud desktop service through the cloud desktop client, so as to authenticate the login information through the cloud desktop service. If the login information is authenticated, the user logs in to the VDI virtual machine. Then, the terminal operation and maintenance software on the VDI virtual machine uses the first access control policy and the first operation and maintenance channel to operate and maintain the resources in the operation and maintenance cloud, and protects the data in the resources in the operation and maintenance cloud based on the security policy. When the preset secure virtualization unified management platform automatically detects that the validity period of the login information has expired or the operation and maintenance of the resources in the operation and maintenance cloud has ended, the VDI virtual machine and the corresponding login information are destroyed through the interface of the cloud desktop service, and the access control policy is cleared through the interface of the cloud infrastructure service.

[0155] Specifically, Figure 4As shown, if the cloud infrastructure service is a hyper-converged platform HCI, the user's own device transmits the login information entered by the operation and maintenance personnel through the physical network port to the cloud desktop control platform VDC based on the cloud desktop client, so as to authenticate the login information through the cloud desktop control platform VDC; if the login information is authenticated, the user logs in to the VDI virtual machine 1 through the pre-connected physical network port and virtual router, and the virtual router and VDI virtual machine 1, and operates and maintains the resources in the operation and maintenance cloud through the virtual router using the first access control policy through the VDI virtual machine 1, and protects the data in the resources in the operation and maintenance cloud based on the security policy. It should be noted that although the VDI virtual machine 1 is prohibited from visiting external resources by default, the operation and maintenance personnel can log in to the VDI virtual machine based on the cloud desktop communication protocol and relying on the underlying support of the hyper-converged platform HCI.

[0156] Specifically, Figure 5 As shown, if the cloud infrastructure service is a cloud management platform SCP, the user's own device transmits the login information entered by the operation and maintenance personnel to the desktop as a service platform DaaS based on the cloud desktop client, so as to authenticate the login information through the desktop as a service platform DaaS; if the login information authentication is passed, the user logs in to the VDI virtual machine through the VPC private network, and uses the first access control policy through the VDI virtual machine to operate and maintain the resources in the operation and maintenance cloud via the VPC private network, and at the same time protects the data in the resources in the operation and maintenance cloud based on the security policy.

[0157] It can be seen that the present application integrates the automatic creation of VDI virtual machines, the automatic creation of operation and maintenance channels, and the automatic configuration of access control policies through a secure virtualization unified management platform, thereby uniformly managing operation and maintenance operations through a secure virtualization platform, avoiding cross-platform operations, and facilitating user use; and, after logging in to the VDI virtual machine, the present application directly operates and maintains the resources in the operation and maintenance cloud through the VDI virtual machine, and the channel is simple and convenient for operation and maintenance; secondly, the present application creates a VDI virtual machine and an operation and maintenance channel upon receiving an operation and maintenance application request, and destroys the VDI virtual machine and the operation and maintenance channel after use, thereby avoiding the resource occupation problem caused by maintaining the VDI virtual machine and the operation and maintenance channel; in addition, the present application configures security policies for VDI virtual machines, so that in the process of operating and maintaining cloud resources through VDI virtual machines, data in cloud resources are protected based on security policies to avoid the risk of data leakage.

[0158] Based on any of the above embodiments, this embodiment will describe how to create a second operation and maintenance channel and perform operation and maintenance on resources in the operation and maintenance cloud based on the second operation and maintenance channel. Figure 6As shown, an embodiment of the present invention discloses a data protection method based on a VDI virtual machine, which is applied to a preset secure virtualization unified management platform, including:

[0159] Step S31, based on the operation and maintenance application request, create a VDI virtual machine and corresponding login information in the target network through the cloud desktop service, and configure a security policy for the VDI virtual machine; the operation and maintenance application request includes the name of the resource in the cloud to be operated and maintained.

[0160] In this embodiment, combined with Figure 7 , Figure 4 and Figure 8 As shown, before the preset secure virtualization unified management platform creates a VDI virtual machine based on an operation and maintenance application request, the technical administrator needs to deploy and start the preset secure virtualization unified management platform so that the started preset secure virtualization unified management platform connects to the cloud infrastructure service and the cloud desktop service corresponding to the cloud infrastructure service, and initializes the target network corresponding to the cloud infrastructure service, and obtains and identifies the virtual machine assets and / or database assets in the cloud through the cloud infrastructure service; wherein, there is a corresponding relationship between the cloud desktop service, the cloud infrastructure service and the target network. After completing the above preparations, the operation and maintenance personnel initiate an operation and maintenance application request to the preset secure virtualization unified management platform through the technical administrator to apply for an operation and maintenance channel. Correspondingly, after receiving the operation and maintenance application request, if the cloud infrastructure service is a hyper-converged platform HCI, the preset secure virtualization unified management platform aSEC will link the cloud desktop control platform VDC to derive a VDI virtual machine under the classic network, and create login information corresponding to the VDI virtual machine, and configure security policies for the VDI virtual machine; if the cloud infrastructure service is a cloud management platform SCP, the preset secure virtualization unified management platform aSEC will link the desktop as a service platform DaaS to derive a VDI virtual machine under the private network, and create login information corresponding to the VDI virtual machine, and configure security policies for the VDI virtual machine.

[0161] Step S32, create a second operation and maintenance channel from the VDI virtual machine via the bastion host to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained through the cloud infrastructure service, and configure a second access control policy for the second operation and maintenance channel; the resources in the cloud to be operated and maintained include the virtual machines in the cloud to be operated and maintained and / or the database in the cloud to be operated and maintained.

[0162] In this embodiment, Figure 7As shown, the cloud resources to be operated and maintained corresponding to the names of the cloud resources to be operated and maintained are determined through the interface of the cloud infrastructure service, and a second operation and maintenance channel is created from the VDI virtual machine to the cloud resources to be operated and maintained via the bastion host, and a second access control policy is configured for the second operation and maintenance channel to allow the VDI virtual machine to access the bastion host and the bastion host to access the cloud resources to be operated and maintained. It should be noted that the cloud resources to be operated and maintained can be either virtual machines in the cloud to be operated and maintained or databases in the cloud to be operated and maintained.

[0163] Further, such as Figure 7 As shown, after the second operation and maintenance channel is created, it is necessary to add the resource assets in the cloud to be operated and maintained to the bastion host based on the IP address of the resource in the cloud to be operated and maintained corresponding to the name of the resource in the cloud to be operated and maintained, and authorize the login information corresponding to the VDI virtual machine to complete the access to the resource assets in the cloud to be operated and maintained in the bastion host. That is, after logging in to the VDI virtual machine based on the login information, the VDI virtual machine can access the resource assets in the cloud to be operated and maintained in the bastion host.

[0164] Specifically, Figure 4 As shown, if the cloud infrastructure service is a hyper-converged platform, then in the classic network, through the interface of the hyper-converged platform, the pre-created virtual router (VDI-VR) is used to connect the VDI virtual machine 2 with the bastion host and the bastion host with the resources VM in the cloud to be operated and maintained, that is, the virtual router is connected with the VDI virtual machine 2, the virtual router is connected with the bastion host, and the virtual router is connected with the resources VM in the cloud to be operated and maintained, so as to obtain the second operation and maintenance channel; wherein, the VDI virtual machine and the resources in the cloud to be operated and maintained are located in the same cluster, and the location of the bastion host is not limited here, for example, it can be located outside the cluster. Then, a second access control policy is configured for the second operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the bastion host based on the first default prohibition of mutual access policy, and control the virtual router to allow access to the VDI virtual machine to the bastion host and the bastion host to the resources in the cloud to be operated and maintained, that is, the VDI virtual machine can access the bastion host through the virtual router, and the bastion host can access the resources in the cloud to be operated and maintained through the virtual router; the access path can be recorded as VDI virtual machine-virtual router→bastion host-virtual router→resources in the cloud to be operated and maintained. It should be noted that the virtual router can access the bastion host because the virtual router is pre-connected to the physical network port, and the external routes through which the bastion host outside the cluster passes have been pre-configured. At this time, you only need to automatically configure the access control policy of the virtual router to allow the virtual router to access the bastion host, so that the VDI virtual machine can access the bastion host and the bastion host can access the resources in the operation and maintenance cloud.

[0165] Specifically, Figure 8As shown, if the cloud infrastructure service is a cloud management platform, the VDI virtual machine and the bastion host, as well as the bastion host and the resources VM in the cloud to be operated and maintained are connected through the cloud management platform using the VPC private network to obtain the second operation and maintenance channel; wherein, the VDI virtual machine and the resources in the cloud to be operated and maintained are located in the same private network. Then, a second access control policy is configured for the second operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to release access to the bastion host based on the first default mutual access prohibition policy, and control the private network to release the VDI virtual machine's access to the bastion host and the bastion host's access to the resources in the cloud to be operated and maintained, that is, the VDI virtual machine can access the bastion host through the VPC private network, and the bastion host can access the resources in the cloud to be operated and maintained through the VPC private network; that is, the access path can be recorded as VDI virtual machine-VPC private network→bastion host-VPC private network→resources in the cloud to be operated and maintained. It should be noted that since the VPC private network provides elastic IP, it can support VDI virtual machines to access external bastion hosts, and support external bastion hosts to access virtual machines / databases in the cloud.

[0166] Step S33, sending the login information to the user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, the user's own device logs in to the bastion host through the terminal operation and maintenance software on the VDI virtual machine using the second access control policy and the second operation and maintenance channel, and operates and maintains the resources in the cloud to be operated and maintained through the bastion host, and protects the data in the resources in the cloud to be operated and maintained based on the security policy.

[0167] In this embodiment, Figure 7As shown, after the second operation and maintenance channel is created and the second access control policy is configured, the login information is sent to the user's own device of the operation and maintenance personnel, so that the user's own device BYOD transmits the login information entered by the operation and maintenance personnel to the cloud desktop service through the cloud desktop client, so that the login information is authenticated by the cloud desktop service. If the login information is authenticated, the user logs in to the VDI virtual machine. Then, the terminal operation and maintenance software on the VDI virtual machine uses the second access control policy and the second operation and maintenance channel to log in to the bastion host. Since the login information corresponding to the VDI virtual machine has been authorized in advance, the resources and assets in the cloud to be operated and maintained added in the bastion host can be accessed through the VDI virtual machine, so that the resources in the cloud to be operated and maintained can be further operated and maintained through the bastion host, and the data in the resources in the cloud to be operated and maintained can be protected based on the security policy. When the preset secure virtualization unified management platform automatically detects that the validity period of the login information has expired and / or the resources in the cloud to be operated and maintained have been completed, the VDI virtual machine and the corresponding login information are destroyed through the interface of the cloud desktop service, and the access control policy is cleared through the interface of the cloud infrastructure service. At the same time, the resource assets in the cloud to be operated and maintained added to the bastion host are deleted, and the authorization for the login information corresponding to the VDI virtual machine is deleted.

[0168] Specifically, Figure 4 As shown, if the cloud infrastructure service is a hyper-converged platform HCI, the user's own device transmits the login information entered by the operation and maintenance personnel to the cloud desktop management and control platform VDC through the physical network port based on the cloud desktop client installed by the user, so as to authenticate the login information through the cloud desktop management and control platform VDC; if the cloud desktop management and control platform VDC authenticates the login information, it logs in to VDI virtual machine 2 through the pre-connected physical network port and virtual router, and virtual router and VDI virtual machine 2, and logs in to the bastion host through the virtual router through VDI virtual machine 2 using the second access control policy, so as to operate and maintain the resources in the operation and maintenance cloud through the bastion host through the virtual router, and at the same time protect the data in the resources in the operation and maintenance cloud based on the security policy.

[0169] Specifically, Figure 8 As shown, if the cloud infrastructure service is a cloud management platform SCP, the user's own device transmits the login information entered by the operation and maintenance personnel to the desktop as a service platform DaaS based on the cloud desktop client installed by the user, so as to authenticate the login information through the desktop as a service platform DaaS; if the login information authentication is passed, the user logs in to the VDI virtual machine through the VPC private network, and logs in to the external bastion host through the VPC private network through the VDI virtual machine using the second access control policy, and then operates and maintains the resources in the operation and maintenance cloud through the bastion host through the VPC private network, and at the same time protects the data in the resources in the operation and maintenance cloud based on the security policy.

[0170] It can be seen that the present application realizes the automatic creation of VDI virtual machines, the automatic creation of operation and maintenance channels, and the automatic configuration of access control policies through the secure virtualization unified management platform, so as to uniformly manage the operation and maintenance operations through the secure virtualization platform, which is convenient for users to use; and, after logging in to the VDI virtual machine, the present application performs operation and maintenance on the resources in the operation and maintenance cloud through the bastion host, and can realize command-line-level access control and audit responsibility for the resources in the operation and maintenance cloud; secondly, the present application creates a VDI virtual machine and a corresponding operation and maintenance channel upon receiving an operation and maintenance application request, and destroys the VDI virtual machine and the corresponding operation and maintenance channel when the operation and maintenance termination conditions are met, so as to avoid maintaining the VDI virtual machine and the operation and maintenance channel all the time and improve resource utilization; in addition, the present application configures security policies for VDI virtual machines, so as to protect the data in the cloud resources based on the security policies in the process of operating and maintaining the resources in the cloud through the VDI virtual machine via the bastion host, so as to solve the problem of data leakage.

[0171] Based on any of the above embodiments, this embodiment will describe how to create a third operation and maintenance channel and perform operation and maintenance on resources in the operation and maintenance cloud based on the third operation and maintenance channel. Fig. 9 As shown, an embodiment of the present invention discloses a data protection method based on a VDI virtual machine, which is applied to a preset secure virtualization unified management platform, including:

[0172] Step S41: Based on the operation and maintenance application request, a VDI virtual machine and corresponding login information are created in the target network through the cloud desktop service, and a security policy is configured for the VDI virtual machine; the operation and maintenance application request includes the name of the resource in the cloud to be operated and maintained.

[0173] In this embodiment, Fig.10 As shown, before the preset secure virtualization unified management platform creates a VDI virtual machine based on an operation and maintenance application request, the technical administrator needs to deploy and start the preset secure virtualization unified management platform so that the started preset secure virtualization unified management platform connects to the cloud infrastructure service and the cloud desktop service corresponding to the cloud infrastructure service, and initializes the target network corresponding to the cloud infrastructure service, and obtains and identifies the database assets and / or virtual machine assets in the cloud through the cloud infrastructure service; wherein, there is a corresponding relationship between the cloud desktop service, the cloud infrastructure service and the target network.

[0174] Considering that this embodiment needs to use the database dynamic desensitization system to create an operation and maintenance channel, it is necessary to deploy and configure the database dynamic desensitization system first. Specifically, deploy the database dynamic desensitization system to the target network, and assign an IP address in the same network segment as the VDI virtual machine to the database dynamic desensitization system; wherein the database dynamic desensitization system is a system created by a virtual machine or container based on NFV (Network Functions Virtualization). Then connect to the database dynamic desensitization system and initialize the database dynamic desensitization system, including but not limited to the configuration of the default user group and default policy.

[0175] After initializing the database dynamic desensitization system, the database dynamic desensitization system is connected to each pre-identified in-cloud database through the interface of the cloud infrastructure service, and the assets of each in-cloud database are added to the database dynamic desensitization system based on the IP address of each in-cloud database through the interface of the database dynamic desensitization system, and the proxy address and other information are configured for each in-cloud database; then, the second default prohibition of mutual access policy is configured for the second distributed firewall associated with the database dynamic desensitization system through the interface of the cloud infrastructure service; wherein, the second default prohibition of mutual access policy is a policy that prohibits the database dynamic desensitization system from mutual access with external resources.

[0176] Specifically, for connecting the database dynamic desensitization system with each pre-identified in-cloud database through the interface of the cloud infrastructure service, in a specific implementation, Fig.11 As shown, if the cloud infrastructure service is a hyper-converged platform, the database dynamic desensitization system is connected to each cloud database through the interface of the hyper-converged platform in the classic network using a pre-created virtual router (VDI-VR), that is, the database dynamic desensitization system is connected to the distributed virtual switch, the distributed virtual switch to the virtual router, and the virtual router to each cloud database. In another specific implementation, as Fig.12 As shown, if the cloud infrastructure service is a cloud management platform, the database dynamic desensitization system is connected to each database in the cloud through the interface of the cloud management platform using the VPC private network.

[0177] Further, after completing the preparation of the preset security virtualization unified management platform and the deployment and configuration operation of the database dynamic desensitization system, the operation and maintenance personnel initiate an operation and maintenance application request to the preset security virtualization unified management platform through the technical administrator to apply for an operation and maintenance channel. Correspondingly, after receiving the operation and maintenance application request, the preset security virtualization unified management platform creates a VDI virtual machine and corresponding login information under the target network based on the operation and maintenance application request through the interface of the cloud desktop service, and configures a security policy for the VDI virtual machine. Then, a desensitized login account is created through the interface of the database dynamic desensitization system and an access token corresponding to the desensitized login account is returned; at the same time, the corresponding target desensitization strategy is determined based on the desensitization level contained in the operation and maintenance application request, and the target desensitization strategy is configured for the desensitized login account; wherein, the target desensitization strategy includes but is not limited to desensitization of all fields, desensitization of different templates based on field name matching, data desensitization of different dimensions (database level, data table level, data row level) based on field name matching, etc., and different desensitization levels correspond to different desensitization strategies.

[0178] Step S42: Create a third operation and maintenance channel from the VDI virtual machine through the database dynamic desensitizing system to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained through the cloud infrastructure service, and configure a third access control policy for the third operation and maintenance channel; the resources in the cloud to be operated and maintained include the database in the cloud to be operated and maintained.

[0179] In this embodiment, Fig.10 As shown, the cloud resources to be operated and maintained corresponding to the names of the cloud resources to be operated and maintained are determined through the interface of the cloud infrastructure service, and a third operation and maintenance channel is created from the VDI virtual machine through the database dynamic desensitization system to the cloud resources to be operated and maintained, and at the same time, a third access control policy is configured for the third operation and maintenance channel to allow the VDI virtual machine to access the database dynamic desensitization system and the database dynamic desensitization system to access the cloud resources to be operated and maintained. It should be noted that the cloud resources to be operated and maintained include the cloud database to be operated and maintained, wherein the cloud database to be operated and maintained is the database corresponding to the name of the cloud resource to be operated and maintained among the cloud databases connected to the database dynamic desensitization system.

[0180] Specifically, Fig.11As shown, if the cloud infrastructure service is a hyper-converged platform, then in the classic network, through the interface of the hyper-converged platform, based on the pre-connected database dynamic desensitization system DAC and the database DB in the cloud to be operated and maintained, the VDI virtual machine 1 and the virtual router, as well as the VDI virtual machine 1 and the database dynamic desensitization system DAC are connected to obtain a third operation and maintenance channel; wherein, the database dynamic desensitization system, the VDI virtual machine and the database in the cloud to be operated and maintained are located in the same cluster, and the database dynamic desensitization system and the VDI virtual machine are located in the same network segment. It should be noted that since the database dynamic desensitization system and the VDI virtual machine are located in the same network segment, the VDI virtual machine and the database dynamic desensitization system can be directly connected. After the third operation and maintenance channel is created, the third access control policy is configured for the third operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the database dynamic desensitization system based on the first default mutual access prohibition policy, and control the second distributed firewall associated with the database dynamic desensitization system to allow access to the VDI virtual machine and the database in the operation and maintenance cloud, and control the virtual router to allow the database dynamic desensitization system to access the database in the operation and maintenance cloud; that is, the access path can be recorded as VDI virtual machine → database dynamic desensitization system-virtual router → database in the operation and maintenance cloud. It should be noted that since the database dynamic desensitization system is connected in series to the front of the database access path in the form of a proxy, after the database dynamic desensitization system connects to the database in the cloud through the virtual router, it is naturally necessary to maintain the connection relationship. Therefore, at the network level, it is only necessary to configure the access control policies of the virtual router and the distributed firewall, so as to avoid expanding the exposure of the database in the cloud at the virtual router and the distributed firewall.

[0181] Specifically, Fig.12As shown, if the cloud infrastructure service is a cloud management platform, then through the interface of the cloud management platform under the private network, based on the pre-connected database dynamic desensitization system and the database in the cloud to be operated and maintained, the VDI virtual machine and the database dynamic desensitization system are connected to obtain a third operation and maintenance channel; wherein, the database dynamic desensitization system, the VDI virtual machine and the database in the cloud to be operated and maintained are located in the same private network, and the database dynamic desensitization system and the VDI virtual machine are located in the same network segment, so the VDI virtual machine and the database dynamic desensitization system can be directly connected. Further, a third access control policy is configured for the third operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the database dynamic desensitization system based on the first default prohibition of mutual access policy, and to control the second distributed firewall associated with the database dynamic desensitization system to allow access to the VDI virtual machine and the database in the cloud to be operated and maintained, and to control the VPC private network to allow access to the database dynamic desensitization system to the database in the cloud to be operated and maintained; that is, the access path can be recorded as VDI virtual machine → database dynamic desensitization system-VPC private network → database in the cloud to be operated and maintained.

[0182] Step S43: Send the login information to the user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, the third access control policy and the third operation and maintenance channel are used to operate and maintain the database in the cloud to be operated and maintained through the VDI virtual machine, and the data in the database in the cloud to be operated and maintained is protected based on the security policy.

[0183] In this embodiment, Fig.10 As shown, the login information, desensitized login account and access token are sent to the user's own device of the operation and maintenance personnel, so that the user's BYOD device can transmit the login information entered by the operation and maintenance personnel to the cloud desktop service through the cloud desktop client installed by the user, so as to authenticate the login information through the cloud desktop service. If the login information is authenticated, the user logs in to the VDI virtual machine. Then, based on the third access control policy and the third operation and maintenance channel, the terminal operation and maintenance software on the VDI virtual machine logs in to the database dynamic desensitization system based on the desensitized login account and access token, and the database in the cloud to be operated and maintained is operated and maintained by the database dynamic desensitization system using the target desensitization policy and based on the target proxy address of the database in the cloud to be operated and maintained, and the data in the database in the cloud to be operated and maintained is protected based on the security policy. When the preset secure virtualization unified management platform automatically detects that the validity period of the login information has expired and / or the database in the cloud to be operated and maintained has been operated and maintained, the VDI virtual machine and the corresponding login information are destroyed through the interface of the cloud desktop service, and the access control policy is cleared through the interface of the cloud infrastructure service, and the desensitized login account is destroyed through the interface of the database dynamic desensitization system.

[0184] Specifically, for operating and maintaining the database in the cloud to be operated and maintained by using the target desensitization strategy through the database dynamic desensitization system and based on the target proxy address of the database in the cloud to be operated and maintained, in one specific implementation, the database operation and maintenance instructions are desensitized by using the target desensitization strategy through the database dynamic desensitization system, and the desensitized database operation and maintenance instructions are forwarded to the database in the cloud to be operated and maintained based on the target proxy address of the database in the cloud to be operated and maintained, so as to operate and maintain the database in the cloud to be operated and maintained. In another specific implementation, the database operation and maintenance instructions are forwarded to the database in the cloud to be operated and maintained based on the target proxy address of the database in the cloud to be operated and maintained by using the database dynamic desensitization system, so as to operate and maintain the database in the cloud to be operated and maintained using the target desensitization strategy.

[0185] Specific, combined Fig.11 and Fig.12 As shown in the figure, if the cloud infrastructure service is a hyper-converged platform HCI, after logging in to the database dynamic desensitization system, the database in the maintenance cloud is operated and maintained through the virtual router. If the cloud infrastructure service is a cloud management platform SCP, after logging in to the database dynamic desensitization system, the database in the maintenance cloud is operated and maintained through the VPC private network.

[0186] It can be seen that the present application integrates the automatic creation of VDI virtual machines, the automatic creation of operation and maintenance channels, and the automatic configuration of access control policies through a secure virtualization unified management platform, thereby uniformly managing the operation and maintenance operations through a secure virtualization platform, which is convenient for users to use; and, after logging into the VDI virtual machine, the present application operates and maintains the database in the operation and maintenance cloud through the database dynamic desensitization system, which can not only provide more fine-grained desensitization strategies to improve data security, but also provide desensitization strategies of corresponding levels according to the needs of operation and maintenance personnel to meet the personalized needs of operation and maintenance personnel; secondly, the present application creates a VDI virtual machine and a corresponding operation and maintenance channel upon receiving an operation and maintenance application request, and destroys the VDI virtual machine and the corresponding operation and maintenance channel after the operation and maintenance is completed or the validity period expires, which can avoid the resource occupation problem caused by maintaining the VDI virtual machine and the operation and maintenance channel; in addition, the present application configures a security policy for the VDI virtual machine, so that in the process of operating and maintaining the database in the cloud through the VDI virtual machine through the database dynamic desensitization system, the data in the cloud database is protected based on the security policy, thereby further avoiding the risk of data leakage.

[0187] Based on any of the above embodiments, this embodiment will describe how to create a fourth operation and maintenance channel and perform operation and maintenance on resources in the operation and maintenance cloud based on the fourth operation and maintenance channel. Fig.13 As shown, an embodiment of the present invention discloses a data protection method based on a VDI virtual machine, which is applied to a preset secure virtualization unified management platform, including:

[0188] Step S51: Based on the operation and maintenance application request, a VDI virtual machine and corresponding login information are created in the target network through the cloud desktop service, and a security policy is configured for the VDI virtual machine; the operation and maintenance application request includes the name of the resource in the cloud to be operated and maintained.

[0189] In this embodiment, Fig.14 As shown, before the preset secure virtualization unified management platform creates a VDI virtual machine based on the operation and maintenance application request, it is necessary to first deploy and start the preset secure virtualization unified management platform, configure the preset secure virtualization unified management platform, and deploy and configure the database dynamic desensitization system. After completing the above preparations, the operation and maintenance personnel initiate an operation and maintenance application request to the preset secure virtualization unified management platform through the technical administrator to apply for an operation and maintenance channel. Correspondingly, after receiving the operation and maintenance application request, the preset secure virtualization unified management platform needs to create a VDI virtual machine and corresponding login information under the target network based on the operation and maintenance application request through the interface of the cloud desktop service, and configure security policies for the VDI virtual machine. At the same time, a desensitized login account is created through the interface of the database dynamic desensitization system and the access token corresponding to the desensitized login account is returned, and the corresponding target desensitization policy is configured for the desensitized login account based on the desensitization level contained in the operation and maintenance application request.

[0190] Step S52: Create a fourth operation and maintenance channel from the VDI virtual machine through the bastion host and the database dynamic desensitization system to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained through the cloud infrastructure service, and configure a fourth access control policy for the fourth operation and maintenance channel; the resources in the cloud to be operated and maintained include the database in the cloud to be operated and maintained.

[0191] In this embodiment, Fig.14 As shown, the cloud resources to be operated and maintained corresponding to the names of the cloud resources to be operated and maintained are determined through the interface of the cloud infrastructure service, and a fourth operation and maintenance channel is created from the VDI virtual machine through the bastion host and the database dynamic desensitization system to the cloud resources to be operated and maintained, and at the same time, a fourth access control policy is configured for the fourth operation and maintenance channel to allow the VDI virtual machine to access the bastion host, the bastion host to access the database dynamic desensitization system, and the database dynamic desensitization system to access the cloud resources to be operated and maintained. It should be noted that the cloud resources to be operated and maintained include the cloud database to be operated and maintained, wherein the cloud database to be operated and maintained is the database corresponding to the name of the cloud resource to be operated and maintained among the cloud databases connected to the database dynamic desensitization system.

[0192] In this embodiment, Fig.14As shown, after the fourth operation and maintenance channel is created, since the assets of each cloud database have been added to the database dynamic desensitizing system in advance, the assets of the cloud database to be operated and maintained in the database dynamic desensitizing system can be added to the bastion host based on the target proxy address of the cloud database to be operated and maintained, and the login information corresponding to the VDI virtual machine is authorized to complete the access to the assets of the cloud database to be operated and maintained in the bastion host, that is, after logging in to the VDI virtual machine based on the login information, the VDI virtual machine can access the assets of the cloud database to be operated and maintained added in the bastion host.

[0193] Specifically, Fig.11 As shown, if the cloud infrastructure service is a hyper-converged platform, then under the classic network, the database dynamic desensitization system DAC and the database DB in the cloud to be operated and maintained, which are pre-connected through a virtual router (VDI-VR), are connected through the interface of the hyper-converged platform. The virtual router is used to connect the VDI virtual machine 2 with the bastion host and the bastion host with the database dynamic desensitization system. That is, the VDI virtual machine 2 is connected to the virtual router, the virtual router is connected to the bastion host, and the virtual router is connected to the database dynamic desensitization system to obtain a fourth operation and maintenance channel; wherein, the database dynamic desensitization system, the VDI virtual machine and the database in the cloud to be operated and maintained are located in the same cluster, and the database dynamic desensitization system and the VDI virtual machine are located in the same network segment, and the location of the bastion host is not limited here, for example, it can be located outside the cluster. After the fourth operation and maintenance channel is created, the fourth access control policy is configured for the fourth operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the bastion host based on the first default policy of prohibiting mutual access, and control the second distributed firewall associated with the database dynamic desensitization system to allow access to the bastion host and access to the database in the operation and maintenance cloud, and control the virtual router to allow access to the VDI virtual machine to the bastion host, the bastion host to the database dynamic desensitization system, and the database dynamic desensitization system to the database in the operation and maintenance cloud; that is, the access path can be recorded as VDI virtual machine-virtual router→bastion host-virtual router→database dynamic desensitization system-virtual router→database in the operation and maintenance cloud.

[0194] Specifically, Fig.15As shown, if the cloud infrastructure service is a cloud management platform, the database dynamic desensitization system and the database in the cloud to be operated and maintained are connected in advance through the VPC private network through the interface of the cloud management platform, and the VPC private network is used to connect the VDI virtual machine with the bastion host and the bastion host with the database dynamic desensitization system to obtain a fourth operation and maintenance channel; wherein, the database dynamic desensitization system, the VDI virtual machine and the database in the cloud to be operated and maintained are located in the same private network, and the database dynamic desensitization system and the VDI virtual machine are located in the same network segment. Furthermore, a fourth access control policy is configured for the fourth operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the bastion host based on the first default policy of prohibiting mutual access, and to control the second distributed firewall associated with the database dynamic desensitization system to allow access to the bastion host and access to the database in the operation and maintenance cloud, and to control the private network to allow access by the VDI virtual machine to the bastion host, the bastion host to the database dynamic desensitization system, and the database dynamic desensitization system to the database in the operation and maintenance cloud; that is, the access path can be recorded as VDI virtual machine-VPC private network→bastion host-VPC private network→database dynamic desensitization system-VPC private network→database in the operation and maintenance cloud.

[0195] Step S53: Send the login information to the user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, the fourth access control policy and the fourth operation and maintenance channel are used to operate and maintain the database in the cloud to be operated and maintained through the VDI virtual machine, and the data in the database in the cloud to be operated and maintained is protected based on the security policy.

[0196] In this embodiment, Fig.14 As shown, the login information, desensitized login account and access token are sent to the user's own device of the operation and maintenance personnel, so that the user's BYOD device can transmit the login information entered by the operation and maintenance personnel to the cloud desktop service through the cloud desktop client installed by the user, so as to authenticate the login information through the cloud desktop service. If the login information is authenticated, the user logs in to the VDI virtual machine. Then, based on the fourth access control strategy and the fourth operation and maintenance channel, the terminal operation and maintenance software on the VDI virtual machine is used to log in to the bastion host, and the bastion host is used to log in to the database dynamic desensitization system based on the desensitized login account and access token; then, the database in the cloud to be operated and maintained is operated and maintained through the database dynamic desensitization system using the target desensitization strategy and based on the target proxy address of the database in the cloud to be operated and maintained, and the data in the database in the cloud to be operated and maintained is protected based on the security policy.

[0197] In this embodiment, Fig.14As shown, when the preset secure virtualization unified management platform automatically detects that the validity period of the login information has expired and / or the maintenance of the database in the cloud to be operated and maintained has ended, the VDI virtual machine and the corresponding login information are destroyed through the interface of the cloud desktop service, and the access control policy is cleared through the interface of the cloud infrastructure service. At the same time, the desensitized login account is destroyed through the interface of the database dynamic desensitization system, and the assets of the database in the cloud to be operated and maintained added in the bastion host are deleted, and the authorization for the login information corresponding to the VDI virtual machine is deleted.

[0198] It can be seen that the present application realizes the automatic creation of VDI virtual machines, the automatic creation of operation and maintenance channels, and the automatic configuration of access control policies through the secure virtualization unified management platform, so as to uniformly manage the operation and maintenance operations through the secure virtualization platform, which is convenient for users to use; and, after logging in to the VDI virtual machine, the present application operates and maintains the database in the operation and maintenance cloud through the bastion host and the database dynamic desensitization system, which can not only realize the command line-level access control and audit responsibility for the operation and maintenance of the database in the cloud, but also can provide more fine-grained desensitization strategies to realize desensitized operation and maintenance of data and improve data security; secondly, the present application creates a VDI virtual machine and the corresponding operation and maintenance channel upon receiving the operation and maintenance application request, which can avoid the resource occupation problem caused by maintaining the VDI virtual machine and the operation and maintenance channel; in addition, the present application configures security policies for the VDI virtual machine, so that in the process of operating and maintaining the database in the cloud through the VDI virtual machine via the bastion host and the database dynamic desensitization system, the data in the cloud database is protected based on the security policy, so as to further prevent data leakage and ensure data security.

[0199] See also Fig.16 As shown, an embodiment of the present invention discloses a data protection device based on a VDI virtual machine, which is applied to a preset secure virtualization unified management platform, wherein the preset secure virtualization unified management platform is used to run a cloud desktop service and a cloud infrastructure service, and the device includes:

[0200] The virtual machine creation module 11 is used to create a VDI virtual machine and corresponding login information in the target network based on the operation and maintenance application request through the cloud desktop service, and configure a security policy for the VDI virtual machine; the operation and maintenance application request includes the name of the resource in the cloud to be operated and maintained; the VDI virtual machine is a cloud desktop virtual machine based on the VDI architecture;

[0201] The operation and maintenance channel creation module 12 is used to create an operation and maintenance channel from the VDI virtual machine to the cloud resource to be operated and maintained corresponding to the name of the cloud resource to be operated and maintained through the cloud infrastructure service, and configure an access control policy for the operation and maintenance channel; there is a corresponding relationship between the cloud desktop service, the cloud infrastructure service and the target network;

[0202] The data protection module 13 is used to send the login information to the user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, it uses the access control policy and the operation and maintenance channel and protects the data in the resources in the cloud to be operated and maintained based on the security policy.

[0203] It can be seen that the present application realizes the automatic creation of VDI virtual machines, the automatic creation of operation and maintenance channels, and the automatic configuration of access control policies through a secure virtualization unified management platform, thereby uniformly managing the operation and maintenance operations through a secure virtualization platform, which is convenient for users to use; and, the present application creates a VDI virtual machine and a corresponding operation and maintenance channel upon receiving an operation and maintenance application request, which can avoid the resource occupation problem caused by maintaining the VDI virtual machine and the operation and maintenance channel; in addition, the present application configures security policies for VDI virtual machines, so that in the process of operating and maintaining cloud resources through VDI virtual machines, data in cloud resources are protected based on security policies to avoid the risk of data leakage.

[0204] In some specific embodiments, the virtual machine creation module 11 includes:

[0205] A virtual machine creation unit, configured to obtain an operation and maintenance application request, and create a VDI virtual machine and login information in a target network based on the operation and maintenance application request through the cloud desktop service, and establish an association relationship between the VDI virtual machine and the login information;

[0206] A security policy configuration unit, configured to configure a security policy for the VDI virtual machine through the cloud desktop service, and to set the validity period of the login information based on the usage duration in the operation and maintenance application request; the security policy includes a data non-export policy and / or a watermark addition policy;

[0207] The address allocation unit is used to allocate a target IP address to the VDI virtual machine through the cloud infrastructure service and based on a preset VDI virtual machine network segment.

[0208] In some specific embodiments, the VDI virtual machine-based data protection device further includes:

[0209] a clearing unit, configured to monitor whether the current operation and maintenance status satisfies a preset termination condition, and if so, to destroy the VDI virtual machine and the login information through the cloud desktop service, and to clear the access control policy through the cloud infrastructure service;

[0210] The preset termination condition includes monitoring that the validity period has expired and / or monitoring that the maintenance of the cloud resources to be maintained has ended.

[0211] In some specific embodiments, the VDI virtual machine-based data protection device further includes:

[0212] A connection module, configured to connect to the cloud infrastructure service, connect to the cloud desktop service corresponding to the cloud infrastructure service, and initialize the target network corresponding to the cloud infrastructure service;

[0213] The asset acquisition module is used to acquire resource assets in the cloud through the cloud infrastructure service.

[0214] In some specific embodiments, the asset acquisition module includes:

[0215] A first asset acquisition unit, configured to acquire the cloud resource assets through an asset synchronization interface in the cloud infrastructure service; the cloud resource assets include cloud virtual machine assets and / or cloud database assets;

[0216] The second asset acquisition unit is used to scan the internal process of the in-cloud virtual machine through the database identification agent built into the in-cloud virtual machine to obtain the self-built database asset if the in-cloud resource assets include the in-cloud virtual machine asset.

[0217] In some specific embodiments, the connection module includes:

[0218] A first connection submodule is used for connecting to the hyper-converged platform if the cloud infrastructure service is a hyper-converged platform, connecting to a cloud desktop management and control platform corresponding to the hyper-converged platform, and initializing a classic network corresponding to the hyper-converged platform;

[0219] The second connection submodule is used to connect to the cloud management platform if the cloud infrastructure service is a cloud management platform, connect to the desktop as a service platform corresponding to the cloud management platform, and initialize the proprietary network corresponding to the cloud management platform.

[0220] In some specific embodiments, the first connection submodule includes:

[0221] A router creation unit, configured to create a virtual router in the classic network and assign a first IP address to the virtual router based on a first preset VDI virtual machine network segment;

[0222] A physical network port connecting unit, used to connect the virtual router and the physical network port used to communicate with the external network, and to allocate a second IP address in the same network segment as the physical network port to the virtual router;

[0223] The router configuration unit is used to configure the virtual router based on a first default access control policy; the first default access control policy is a policy that prohibits the virtual router from accessing external network resources.

[0224] In some specific embodiments, the second connection submodule includes:

[0225] A subnet creation unit is used to create a VDI virtual machine subnet in the private network based on a second preset VDI virtual machine network segment, and configure the VDI virtual machine subnet based on a second default access control policy; the second default access control policy is a policy that prohibits the VDI virtual machine subnet from visiting other subnets; the VDI virtual machine is located in the VDI virtual machine subnet.

[0226] In some specific embodiments, the operation and maintenance channel creation module 12 includes:

[0227] The first channel creation submodule is used to create a first operation and maintenance channel from the VDI virtual machine to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained through the cloud infrastructure service, and configure a first access control policy for the first operation and maintenance channel; the resources in the cloud to be operated and maintained include virtual machines in the cloud to be operated and maintained and / or databases in the cloud to be operated and maintained.

[0228] In some specific embodiments, the first channel creation submodule includes:

[0229] A first channel creation unit is configured to connect the VDI virtual machine with the in-cloud resource to be operated and maintained by using a pre-created virtual router through the hyper-converged platform in a classic network to obtain the first operation and maintenance channel if the cloud infrastructure service is a hyper-converged platform; the VDI virtual machine and the in-cloud resource to be operated and maintained are located in the same cluster;

[0230] A first access control unit is used to configure a first access control policy for the first operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to resources in the cloud to be operated and maintained based on a first default policy of prohibiting mutual access, and to control the virtual router to allow the VDI virtual machine to access resources in the cloud to be operated and maintained.

[0231] In some specific embodiments, the operation and maintenance channel creation module 12 includes:

[0232] The second channel creation submodule is used to create a second operation and maintenance channel from the VDI virtual machine via the bastion host to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained through the cloud infrastructure service, and configure a second access control policy for the second operation and maintenance channel; the resources in the cloud to be operated and maintained include virtual machines in the cloud to be operated and maintained and / or databases in the cloud to be operated and maintained.

[0233] In some specific embodiments, the second channel creation submodule includes:

[0234] A second channel creation unit is used for, if the cloud infrastructure service is a hyper-converged platform, connecting the VDI virtual machine with the bastion host and the bastion host with the cloud resources to be operated and maintained through the hyper-converged platform in a classic network by using a pre-created virtual router to obtain the second operation and maintenance channel; the VDI virtual machine and the cloud resources to be operated and maintained are located in the same cluster;

[0235] A second access control unit is used to configure a second access control policy for the second operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the bastion host based on a first default policy prohibiting mutual access, and to control the virtual router to allow the VDI virtual machine to access the bastion host and the bastion host to access the resources in the cloud to be operated and maintained.

[0236] In some specific embodiments, the operation and maintenance channel creation module 12 includes:

[0237] A target channel creation module is used to create a target operation and maintenance channel from the VDI virtual machine to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained based on the database dynamic desensitization system through the cloud infrastructure service, and configure a target access control policy for the target operation and maintenance channel; the resources in the cloud to be operated and maintained include the database in the cloud to be operated and maintained.

[0238] In some specific embodiments, the VDI virtual machine-based data protection device further includes:

[0239] A desensitization system deployment unit, used to deploy the database dynamic desensitization system to the target network, and allocate an IP address in the same network segment as the VDI virtual machine to the database dynamic desensitization system;

[0240] A database connection module, used to connect the database dynamic desensitization system and connect the database dynamic desensitization system with each cloud database through the cloud infrastructure service;

[0241] An asset adding unit, used to add the assets of each in-cloud database to the database dynamic desensitization system based on the IP address of each in-cloud database through the interface of the database dynamic desensitization system, and configure a proxy address for each in-cloud database respectively;

[0242] A mutual access policy configuration unit is used to configure a second default mutual access prohibition policy for a second distributed firewall associated with the database dynamic desensitization system through the cloud infrastructure service.

[0243] Furthermore, the present application also discloses an electronic device. Fig.17 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be considered as any limitation on the scope of use of the present application.

[0244] Fig.17 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the data protection method based on the VDI virtual machine disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0245] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0246] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0247] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the data protection method based on the VDI virtual machine executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0248] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned VDI virtual machine-based data protection method is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0249] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0250] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0251] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0252] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0253] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data protection method based on a VDI virtual machine, characterized in that: Applied to a preset secure virtualization unified management platform, the preset secure virtualization unified management platform is used to run cloud desktop services and cloud infrastructure services, the method includes: Based on the operation and maintenance application request, the cloud desktop service creates a VDI virtual machine and corresponding login information in the target network, and configures a security policy for the VDI virtual machine; the operation and maintenance application request includes the name of the resource in the cloud to be operated and maintained; the VDI virtual machine is a cloud desktop virtual machine based on the VDI architecture; An operation and maintenance channel is created from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained through the cloud infrastructure service, and an access control policy is configured for the operation and maintenance channel; there is a corresponding relationship between the cloud desktop service, the cloud infrastructure service and the target network; The login information is sent to the user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, the access control policy and the operation and maintenance channel are used to protect the data in the resources in the cloud to be operated and maintained based on the security policy.

2. The data protection method based on VDI virtual machine according to claim 1 is characterized in that: The step of creating a VDI virtual machine and corresponding login information in a target network based on an operation and maintenance application request through the cloud desktop service, and configuring a security policy for the VDI virtual machine includes: Obtaining an operation and maintenance application request, and creating a VDI virtual machine and login information in a target network based on the operation and maintenance application request through the cloud desktop service, and establishing an association relationship between the VDI virtual machine and the login information; The cloud desktop service is used to configure a security policy for the VDI virtual machine, and the validity period of the login information is set based on the usage duration in the operation and maintenance application request; the security policy includes a data non-export policy and / or a watermark adding policy; A target IP address is allocated to the VDI virtual machine through the cloud infrastructure service and based on a preset VDI virtual machine network segment.

3. The data protection method based on VDI virtual machine according to claim 2 is characterized in that: Also includes: Monitor whether the current operation and maintenance status meets the preset termination condition, and if so, destroy the VDI virtual machine and the login information through the cloud desktop service, and clear the access control policy through the cloud infrastructure service; The preset termination condition includes monitoring that the validity period has expired and / or monitoring that the maintenance of the cloud resources to be maintained has ended.

4. The data protection method based on VDI virtual machine according to claim 1, characterized in that: Before creating a VDI virtual machine and corresponding login information in a target network based on an operation and maintenance application request through the cloud desktop service, the method further includes: Connecting to the cloud infrastructure service, connecting to the cloud desktop service corresponding to the cloud infrastructure service, and initializing the target network corresponding to the cloud infrastructure service; Obtain resource assets within the cloud through the cloud infrastructure service.

5. The data protection method based on VDI virtual machine according to claim 4 is characterized in that: The obtaining of cloud resource assets through the cloud infrastructure service includes: Acquire the in-cloud resource assets through the asset synchronization interface in the cloud infrastructure service; the in-cloud resource assets include in-cloud virtual machine assets and / or in-cloud database assets; If the in-cloud resource assets include the in-cloud virtual machine assets, the internal processes of the in-cloud virtual machine are scanned by a database identification agent built into the in-cloud virtual machine to obtain the self-built database assets.

6. The data protection method based on VDI virtual machine according to claim 4 is characterized in that: The connecting to the cloud infrastructure service, connecting to the cloud desktop service corresponding to the cloud infrastructure service, and initializing the target network corresponding to the cloud infrastructure service includes: If the cloud infrastructure service is a hyper-converged platform, connect to the hyper-converged platform, connect to the cloud desktop management and control platform corresponding to the hyper-converged platform, and initialize the classic network corresponding to the hyper-converged platform; If the cloud infrastructure service is a cloud management platform, the cloud management platform is connected, the desktop as a service platform corresponding to the cloud management platform is connected, and the proprietary network corresponding to the cloud management platform is initialized.

7. The data protection method based on VDI virtual machine according to claim 6 is characterized in that: Initializing a classic network corresponding to the hyper-converged platform includes: Creating a virtual router in the classic network, and assigning a first IP address to the virtual router based on a first preset VDI virtual machine network segment; Connecting the virtual router to a physical network port for communicating with an external network, and allocating a second IP address in the same network segment as the physical network port to the virtual router; The virtual router is configured based on a first default access control policy; the first default access control policy is a policy that prohibits the virtual router from accessing external network resources.

8. The data protection method based on VDI virtual machine according to claim 6, characterized in that: The initializing a dedicated network corresponding to the cloud management platform includes: In the private network, a VDI virtual machine subnet is created based on a second preset VDI virtual machine network segment, and the VDI virtual machine subnet is configured based on a second default access control policy; the second default access control policy is a policy that prohibits the VDI virtual machine subnet from accessing other subnets; the VDI virtual machine is located in the VDI virtual machine subnet.

9. The data protection method based on VDI virtual machine according to any one of claims 1 to 8, characterized in that: The step of creating an operation and maintenance channel from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained through the cloud infrastructure service, and configuring an access control policy for the operation and maintenance channel includes: A first operation and maintenance channel is created through the cloud infrastructure service from the VDI virtual machine to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained, and a first access control policy is configured for the first operation and maintenance channel; the resources in the cloud to be operated and maintained include virtual machines in the cloud to be operated and maintained and / or databases in the cloud to be operated and maintained.

10. The data protection method based on VDI virtual machine according to claim 9, characterized in that: The step of creating a first operation and maintenance channel from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained through the cloud infrastructure service, and configuring a first access control policy for the first operation and maintenance channel includes: If the cloud infrastructure service is a hyper-converged platform, the VDI virtual machine is connected to the resources in the cloud to be operated and maintained through the hyper-converged platform in a classic network by using a pre-created virtual router to obtain the first operation and maintenance channel; the VDI virtual machine and the resources in the cloud to be operated and maintained are located in the same cluster; A first access control policy is configured for the first operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to resources in the cloud to be operated and maintained based on a first default policy prohibiting mutual access, and to control the virtual router to allow the VDI virtual machine to access resources in the cloud to be operated and maintained.

11. The data protection method based on VDI virtual machine according to any one of claims 1 to 8, characterized in that: The step of creating an operation and maintenance channel from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained through the cloud infrastructure service, and configuring an access control policy for the operation and maintenance channel includes: A second operation and maintenance channel is created through the cloud infrastructure service from the VDI virtual machine via the bastion host to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained, and a second access control policy is configured for the second operation and maintenance channel; the resources in the cloud to be operated and maintained include virtual machines in the cloud to be operated and maintained and / or databases in the cloud to be operated and maintained.

12. The data protection method based on VDI virtual machine according to claim 11, characterized in that: The step of creating a second operation and maintenance channel from the VDI virtual machine via the bastion host to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained through the cloud infrastructure service, and configuring a second access control policy for the second operation and maintenance channel includes: If the cloud infrastructure service is a hyper-converged platform, the VDI virtual machine is connected to the bastion host and the bastion host is connected to the resources in the cloud to be operated and maintained by using a pre-created virtual router through the hyper-converged platform in a classic network to obtain the second operation and maintenance channel; the VDI virtual machine and the resources in the cloud to be operated and maintained are located in the same cluster; A second access control policy is configured for the second operation and maintenance channel to control the first distributed firewall associated with the VDI virtual machine to allow access to the bastion host based on the first default policy of prohibiting mutual access, and to control the virtual router to allow the VDI virtual machine to access the bastion host and the bastion host to access the resources in the cloud to be operated and maintained.

13. The data protection method based on VDI virtual machine according to any one of claims 1 to 8, characterized in that: The step of creating an operation and maintenance channel from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained through the cloud infrastructure service, and configuring an access control policy for the operation and maintenance channel includes: A target operation and maintenance channel is created from the VDI virtual machine to the resources in the cloud to be operated and maintained corresponding to the name of the resources in the cloud to be operated and maintained based on the database dynamic desensitization system through the cloud infrastructure service, and a target access control policy is configured for the target operation and maintenance channel; the resources in the cloud to be operated and maintained include the database in the cloud to be operated and maintained.

14. The data protection method based on VDI virtual machine according to claim 13, characterized in that: Before creating a VDI virtual machine and corresponding login information in a target network based on an operation and maintenance application request through the cloud desktop service, the method further includes: Deploy the database dynamic desensitization system to the target network, and assign an IP address in the same network segment as the VDI virtual machine to the database dynamic desensitization system; Connecting the database dynamic desensitization system, and connecting the database dynamic desensitization system with each cloud database through the cloud infrastructure service; Add the assets of each in-cloud database to the database dynamic desensitization system based on the IP address of each in-cloud database through the interface of the database dynamic desensitization system, and configure a proxy address for each in-cloud database respectively; A second default mutual access prohibition policy is configured for a second distributed firewall associated with the database dynamic desensitization system through the cloud infrastructure service.

15. A data protection device based on a VDI virtual machine, characterized in that: Applied to a preset secure virtualization unified management platform, the preset secure virtualization unified management platform is used to run cloud desktop services and cloud infrastructure services, the device includes: A virtual machine creation module, used to create a VDI virtual machine and corresponding login information in a target network based on an operation and maintenance application request through the cloud desktop service, and configure a security policy for the VDI virtual machine; the operation and maintenance application request includes a name of a resource in the cloud to be operated and maintained; the VDI virtual machine is a cloud desktop virtual machine based on a VDI architecture; An operation and maintenance channel creation module is used to create an operation and maintenance channel from the VDI virtual machine to the in-cloud resource to be operated and maintained corresponding to the name of the in-cloud resource to be operated and maintained through the cloud infrastructure service, and configure an access control policy for the operation and maintenance channel; there is a corresponding relationship between the cloud desktop service, the cloud infrastructure service and the target network; The data protection module is used to send the login information to the user's own device, so that after the user's own device logs in to the VDI virtual machine based on the login information, the access control policy and the operation and maintenance channel are used to protect the data in the resources in the cloud to be operated and maintained based on the security policy.

16. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the data protection method based on the VDI virtual machine as described in any one of claims 1 to 14.

Images