Security scanning method, related equipment and storage medium for cloud computing

Abstract

The embodiment of the present application provides a security scanning method, related equipment and storage medium for cloud computing. In the embodiment of the present application, the physical storage space of the virtualized instance supports the virtualization manager to perform read and write operations on it in a multi-queue read and write manner. Based on this, in addition to creating storage queues required for the virtualized instance to perform read and write operations on the physical storage space, the virtualization manager can also create shared queues and shared memory for the security scanning program outside the virtualized instance. Based on the shared queues and shared memory, the data in the physical storage space of the virtualized instance can be provided to the security scanning program outside the virtualized instance for host security scanning. On the one hand, it is not easily interfered by the intrusion of the internal process of the virtualized instance, nor does it occupy the computing resources of the virtualized instance; on the other hand, it can achieve real-time and efficient scanning, can quickly respond to the immediate intrusion behavior, and has high timeliness.

Description

Technical Field

[0001] The present application relates to the technical field of cloud computing, and in particular to a security scanning method, related equipment and storage medium for cloud computing. Background Art

[0002] With the rapid development of cloud computing technology, cloud computing instances in the form of virtual machines (VMs) have become one of the core technologies of modern data centers. With the increase in the number of cloud computing instances, host security has become an important scenario for security confrontation on the cloud. In host security, disk scanning of the host is an important means of collecting information to detect whether the cloud computing instance has any attack on the host, as well as to collect malicious samples and restore the attack path.

[0003] The disk scanning method in the industry mainly includes the in-band agent scanning method, which is to embed the agent program used for disk scanning into the cloud computing instance to complete the disk scanning action, which has the advantage of high scanning efficiency. However, since the agent program used for scanning disks and the processes and kernels of the cloud computing instance run in the same computing environment, it is easily affected by intrusion behaviors on the one hand, and on the other hand, it will also occupy the computing resources of the original cloud computing instance. Summary of the invention

[0004] Multiple aspects of the present application provide a security scanning method, related equipment and storage medium for cloud computing, so that the security scanning program is not easily interfered by the intrusion of the internal process of the virtualization instance, and will not occupy the computing resources of the virtualization instance.

[0005] An embodiment of the present application provides a host device, on which a virtualization manager and a first virtualization instance managed by the virtualization manager are deployed, the first virtualization instance having a target physical storage space, and the target physical storage space supports the virtualization manager to perform read and write operations on it in a multi-queue read and write manner; the virtualization manager is further used to create a shared queue and a shared memory for a security scanning program located outside the first virtualization instance when it is determined that the first virtualization instance uses a security scanning service; based on the shared queue and the shared memory, target data in the target physical storage space is provided to the security scanning program, so that the security scanning program performs a security scan on the host device according to the target data; wherein the first virtualization instance performs read and write operations on the target physical storage space through at least one storage queue, and the shared queue is different from the at least one storage queue.

[0006] An embodiment of the present application also provides a security scanning method for cloud computing, which is applied to a virtualization manager on a host device, and the virtualization manager manages a first virtualization instance on the host device. The method includes: when the first virtualization instance uses a security scanning service, creating a shared queue and a shared memory for a security scanning program located outside the first virtualization instance; the first virtualization instance has a target physical storage space, and the target physical storage space supports the virtualization manager to perform read and write operations on it in a multi-queue read and write manner; based on the shared queue and shared memory, providing target data in the target physical storage space to the security scanning program, so that the security scanning program performs a security scan on the host device according to the target data; wherein, the first virtualization instance performs read and write operations on the target physical storage space through at least one storage queue, and the shared queue is different from the at least one storage queue.

[0007] An embodiment of the present application also provides a security scanning method for cloud computing, which applies a security scanning program outside a first virtualization instance. The method includes: when a virtualization manager corresponding to the first virtualization instance creates a shared queue and shared memory for the security scanning program, writing a read request to the shared queue so that the virtualization manager can read target data from a target physical storage space of the first virtualization instance based on the read request and write the target data to the shared memory; reading the target data from the shared memory, and performing a security scan based on the target data; wherein the target physical storage space supports the virtualization manager to perform read and write operations on it in a multi-queue read and write manner, and the first virtualization instance performs read and write operations on the target physical storage space through at least one storage queue, and the shared queue is different from the at least one storage queue.

[0008] An embodiment of the present application also provides a virtualization management device, which can be implemented as a virtualization manager in a host device and is used to manage a first virtualization instance. The device includes: a creation module and a provision module; the creation module is used to create a shared queue and a shared memory for a security scanning program located outside the first virtualization instance when the first virtualization instance uses a security scanning service; the first virtualization instance has a target physical storage space, and the target physical storage space supports the virtualization manager to perform read and write operations on it in a multi-queue read and write manner; the provision module is used to provide target data in the target physical storage space to the security scanning program based on the shared queue and shared memory, so that the security scanning program can perform a security scan on the host device according to the target data; wherein, the first virtualization instance performs read and write operations on the target physical storage space through at least one storage queue, and the shared queue is different from the at least one storage queue.

[0009] An embodiment of the present application also provides a host device, including a memory and a processor, wherein the memory stores a security scanning program, and the processor is coupled to the memory and is used to execute the security scanning program to implement the steps in the security scanning method for cloud computing provided in the embodiment of the present application.

[0010] The embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor implements each step of the security scanning method for cloud computing provided in the embodiment of the present application.

[0011] In an embodiment of the present application, the physical storage space of the virtualized instance supports the virtualization manager to perform read and write operations on it in a multi-queue read and write manner. Based on this, by expanding the functions of the virtualization manager, in addition to creating the storage queues required for the virtualized instance to perform read and write operations on the physical storage space, the virtualization manager can also create shared queues and shared memory for the security scanner located outside the virtualized instance, and then based on the shared queues and shared memory, the data in the physical storage space can be provided to the security scanner, so that the security scanner can perform host security scans based on the data in the physical storage space of the virtualized instance. Since the security scanner is located outside the virtualized instance, it is not easily interfered by the intrusion of the internal process of the virtualized instance, and it will not occupy the computing resources of the virtualized instance. In addition, the host security scan based on the data in the physical storage space of the virtualized instance can achieve real-time and efficient scanning, and can quickly respond to the intrusion behavior that occurs immediately. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0013] Figure 1a A schematic diagram of the structure of a host device provided for an exemplary embodiment of the present application;

[0014] Figure 1b A schematic diagram of the structure of a host device and other devices provided for an exemplary embodiment of the present application;

[0015] Figure 2 A schematic diagram of the structure of another host device and a security scanning program provided for an exemplary embodiment of the present application;

[0016] Figure 3 A schematic diagram of the internal structure of another host device and a security scanning program provided for an exemplary embodiment of the present application;

[0017] Figure 4A flowchart of a security scanning method for cloud computing provided by an exemplary embodiment of the present application;

[0018] Figure 5 A flowchart of another security scanning method for cloud computing provided by an exemplary embodiment of the present application;

[0019] Figure 6 A schematic diagram of the structure of a virtualization management device provided for an exemplary embodiment of the present application;

[0020] Figure 7 A schematic diagram of the structure of a host device provided for an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0022] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0023] In response to the problems existing in the prior art, an embodiment of the present application provides a security scanning solution for cloud computing, which combines the multi-queue design when reading and writing physical storage (such as a disk), and utilizes the design of virtualization memory sharing and physical storage (such as a disk) protocols to share the data in the physical storage space of the virtualized instance through virtualization to the security scanning program outside the virtualized instance for security scanning.

[0024] Specifically, in an embodiment of the present application, the physical storage space of the virtualized instance supports the virtualization manager to perform read and write operations on it in a multi-queue read and write manner. Based on this, by expanding the functions of the virtualization manager, in addition to creating the storage queues required for the virtualized instance to perform read and write operations on the physical storage space, the virtualization manager can also create shared queues and shared memory for the security scanner located outside the virtualized instance, and then based on the shared queues and shared memory, the data in the physical storage space can be provided to the security scanner outside the virtualized instance to perform host security scanning. Since the security scanner is located outside the virtualized instance, it is not easily interfered by the intrusion of the internal process of the virtualized instance, has good concealment, and does not occupy the computing resources of the virtualized instance. In addition, the host security scan based on the data in the physical storage space of the virtualized instance can achieve real-time and efficient scanning, can quickly respond to the immediate intrusion behavior, and has high timeliness.

[0025] A solution provided by an embodiment of the present application is described in detail below in conjunction with the accompanying drawings.

[0026] Figure 1a The schematic diagram of the structure of the host device provided by the exemplary embodiment of the present application is shown in FIG. Figure 1a As shown, a virtualization manager 102 and a virtualization instance 103 managed by the virtualization manager 102 are deployed on the host device 101 .

[0027] In this embodiment, the host device 101 can be any physical device that can provide hardware resources, such as a mobile phone, a notebook, a storage device, a traditional server, or a cloud device with hardware resources such as a cloud server or a cloud host. In this embodiment, the host device 101 is responsible for providing the virtualization manager 102 and the hardware resources required for the operation of the virtualization instance, such as but not limited to: a processor (Central Processing Unit, CPU), a memory (such as memory), a network card, a persistent memory, and an input and output device.

[0028] The host device 101 not only has hardware resources, but also includes an operating system (OS) on the hardware resources, and a virtualization manager 102 runs on the operating system. The virtualization manager 102 is used to create an isolated operating environment on the host device where it is located, and to start or create and manage virtualized instances in the isolated operating environment. The virtualization manager 102 can be any software program, component or module that can create an isolated operating environment based on virtualization technology on the host device where it is located, and start or create and manage virtualized instances in the isolated operating environment. The virtualization manager 102 can also provide independent resource allocation, access control and support for different operating systems for the virtualized instance. This is not limited. Optionally, the virtualization manager 102 can be a virtual machine monitor (Virtual Machine Monitor, VMM), which can also be called a Hypervisor. Optionally, the Hypervisor or VMM can be specifically implemented as a virtual operating system simulator (QuickEMUlator, QEMU) or Vmware, but is not limited to this. The virtualization instance may be implemented as a cloud host, an elastic computing service (ECS), a virtual machine (VM), or a container. A virtualization manager 102 may manage one or more virtualization instances, and each virtualization instance is managed by a virtualization manager 102. Figure 1a In the figure, one virtualization manager corresponds to one virtualization instance as an example, but the present invention is not limited thereto.

[0029] In this embodiment, each virtualization manager 102 manages the virtualization instance in the same or similar manner and process. In the following embodiment, any one of the virtualization instances is used as an example for description. For the sake of distinction and description, the any one of the virtualization instances is referred to as the first virtualization instance 103.

[0030] In this embodiment, the first virtualization instance provides an isolated operating environment, in which user space programs can be deployed. User space programs can also be called applications. In addition, the first virtualization instance has a target physical storage space for storing the operating system, user space programs and various data generated by the first virtualization instance 103. The target physical storage space is the storage space allocated by the virtualization manager to the first virtualization instance from the physical storage space of the host device. The physical storage space of the host device can use various persistent storage media, such as disks, flash memory, etc. In subsequent embodiments, the physical storage space of the host device is described by taking a disk as an example, but it is not limited to this; accordingly, the target physical storage space allocated to the first virtualization instance can also be referred to as the disk space of the first virtualization instance.

[0031] In this embodiment, the first virtualization instance carries a user space program, such as a social user space program, a shopping user space program, or a game user space program, etc.; data is generated in the process of running the user space program, and the generated data needs to be written into the target physical storage space for storage. Of course, data also needs to be read from the target physical storage space during the startup or operation of the user space program, which involves read and write operations on the target physical storage control. In order to implement read and write operations on the target physical storage space, the virtualization manager creates a storage device for the target physical storage space, and creates at least one storage queue for the user space program in the first virtualization instance, wherein the storage queue can be created by the boot program during the process of starting the first virtualization instance. Among them, the virtualization manager can perform read and write operations on the target physical storage space in a multi-queue read and write manner based on the storage device and at least one storage queue according to the read and write request of the user space program, that is, the target physical storage space supports the virtualization manager to perform read and write operations on the target physical storage space in a multi-queue read and write manner. Among them, the storage device (for example, a disk device) can be a virtual device or a physical storage device. The user space program in the first virtualization instance writes the read and write instructions for the target physical storage space into an idle storage queue in at least one storage queue. The function of the at least one storage queue is to receive and store the read and write instructions from the user space program. One of the functions of the storage device is to read the read and write instructions from the at least one storage queue, read the data required by the user space program from the target physical storage space according to the read read instructions, and return the read data to the user space program; and read relevant data from the memory space of the first virtualization instance according to the memory address in the read write instruction, and write the read data to the target physical storage space.

[0032] Combine the following Figure 2 The disk read and write architecture shown in the figure introduces the workflow of disk read and write in a multi-queue manner in cloud computing scenarios. Figure 2The disk read and write architecture shown involves three parts: user space program, target physical storage space of the first virtualization instance (taking disk space as an example) and kernel driver corresponding to the target physical storage space (referred to as disk kernel driver for short). Among them, the disk kernel driver belongs to the operating system of the first virtualization instance. The disk read and write process mainly involves three steps: ① The user space program interacts with the kernel driver of the disk, writes read and write instructions to the storage queue in the virtualization manager through the kernel driver of the disk, and interacts with the disk device (an example of storage device); ② The kernel driver of the disk further includes a core protocol module and a peripheral component interconnect standard (PCI) bus module. The core protocol module writes read and write instructions to the storage queue through the PCI bus module and is responsible for interacting with the disk device; ③ The disk device simulated by the virtual machine manager provides the ability to access the target physical storage space of the first virtualization instance. The specific process is as follows:

[0033] 1) The user space program accesses the file system based on the operating system call of the first virtualized instance, and the file system forwards the read and write request for the target physical storage space to the kernel driver, and the kernel driver and the disk device interact to realize the reading and writing of the target physical storage space;

[0034] 2) The PCI bus module controls the target physical storage space through the disk device IO, the core protocol module allocates memory space, creates a data interaction module to send protocol commands and collect execution results, and finally completes the data transmission to the target physical storage space.

[0035] 3) To improve the efficiency of IO data interaction, the data interaction module is usually in the form of multiple queues. For example, the data interaction module includes multiple storage queues. The PCI bus module submits read and write requests to any idle storage queue and processes any storage queue that returns a message notification, thereby improving IO efficiency through concurrency.

[0036] 4) The disk device submits a command to read the specified address on the target physical storage space through the storage queue. The disk device parses the corresponding command, writes the data at the specified address on the target physical storage space to the memory space specified by the storage queue, and sends a message to notify the PCI bus module to read the corresponding data.

[0037] With the rapid development of cloud computing technology, cloud computing instances in the form of virtual machines (VMs) have become one of the core technologies of modern data centers. With the increase in the number of cloud computing instances, host security has become an important scenario for security confrontation on the cloud. Host security is a security method that detects risk vulnerabilities and intrusion behaviors on the host based on the collection and analysis of information such as memory or disk of virtualized instances. In host security, disk scanning of the host is an important means of collecting information to detect whether the virtualized instance has any attack on the host, as well as to collect malicious samples and restore the attack path.

[0038] In this embodiment, an innovative security scanning program is provided outside the virtualization, and the functions of the virtualization manager are expanded by means of a multi-queue design when reading and writing the target physical storage space. This allows the virtualization manager to cooperate with the security scanning program outside the first virtualization instance to perform a host security scan on the data in the target physical storage space of the first virtualization instance, thereby ensuring the security of the host device.

[0039] The security scanning program 104 is mainly used to perform a security scan on the target physical storage space of the first virtualization instance 103. For example, when the first virtualization instance is implemented as a virtual machine, the security scanning program is implemented as a secure VM Supervisor.

[0040] Among them, the security scanner belongs to agentless scanning, which is a technical branch of virtual machine host security detection technology. Through the interface provided by virtualization technology, agentless scanning can collect and analyze the running status of the virtualized instance without installing any agent software in the scanned virtualized instance. Agentless scanning can avoid denial of service attacks (DoS) and tampering attacks on the agent within the virtualized instance, and is not affected by network connection requirements or the performance of the virtualized instance itself. It does not need to consider the increasingly complex intrusion defense measures, and has high data credibility and service stability.

[0041] Among them, the deployment method of the security scanner is not limited. The security scanner can be deployed on the host device where the first virtualization instance is located, and can be deployed on other devices that are communicatively connected to the host device. Optionally, the security scanner is implemented as a second virtualization instance deployed on the host device, and further, the security scanner is implemented as a user space program in the second virtualization instance deployed on the host device. The second virtualization instance and the first virtualization instance can be managed by the same virtualization simulator or by different virtualization managers. Alternatively, the security scanner is implemented as a second virtualization instance on other devices, and further implemented as a user space program in the second virtualization instance on other devices. Of course, the security scanner can also be deployed as a user space program directly on the host device where the first virtualization instance is located, or on other devices. Figure 1a as well as Figure 2-3 The example of deploying a security scanner on a host device is used as an example, but it is not limited to this. Figure 1b The example in which the security scanner is deployed on other devices that are connected to the host device for communication is used for illustration, but the invention is not limited thereto.

[0042] In this embodiment, when the virtualization manager 102 reads and writes the target storage space in a multi-queue manner, in addition to creating at least one storage queue for the first virtualization instance 103, it also creates a shared queue and shared memory for the security scanning program located outside the first virtualization instance. Based on the shared queue and shared memory, the data in the target physical storage space is provided to the security scanning program in the same manner as a normal user space program reads the target physical storage space, so that the security scanning program can perform a host security scan based on the data in the target physical storage space of the first virtualization instance without the perception of the operating system and user space program of the first virtualization instance, thereby ensuring the security of the host device and the first virtualization instance. Since the security scanning program is located outside the virtualization instance, it is not easily interfered by the intrusion of the internal process of the first virtualization instance, and it will not occupy the computing resources of the first virtualization instance.

[0043] Among them, the function of the shared queue is different from the function of at least one storage queue. The shared queue mainly shares the data in the target physical storage space with the security scanner, so that the security scanner can perform host security scans based on the data in the target physical storage space of the first virtualization instance without the perception of the operating system and user space program of the first virtualization instance, thereby ensuring the security of the host device and the first virtualization instance. The storage queue is mainly for the user space program on the first virtualization instance to read and write data in the target physical storage space.

[0044] Among them, in this embodiment, without modifying any upper-level components of the virtualization instance (for example, the operating system of the first virtualization instance, and the disk driver, user space program, etc. above the operating system), the data communication of the target physical storage space of the virtualization instance is intercepted in the virtual machine manager and forwarded to the security scanning program to complete the disk scanning of the virtualization instance.

[0045] In addition, the host security scan is performed based on the data in the target physical storage space of the first virtualization instance, so that real-time and efficient scanning can be achieved and a quick response can be made to the immediate intrusion behavior.

[0046] In addition, based on the shared queue and shared memory, the data in the target physical storage space is provided to the security scanning program. There is no need to take snapshots of the storage of the first virtualization instance or retain disk images, and there is no need to provide storage space for these disk images or snapshots, which saves storage space and ensures the efficiency of the host security scan.

[0047] Furthermore, by utilizing the characteristics of cloud computing virtualization, there is good out-of-band control over the operating system, user space program operations and storage devices on the first virtualization instance, which can effectively resist in-band intrusion attack interference, and at the same time has good concealment for possible attack behaviors, helping security personnel to better conduct targeted detection and analysis of intrusion behaviors.

[0048] Furthermore, the characteristics of cloud computing virtualization are deeply utilized, and the security scanner can be encapsulated in an independent virtualization instance (such as VM). The disk scanning of other virtualization instances can be realized through a special kernel driver. The cloud computing virtual machine manager is used to control the resources of the virtualization instance where the security scanner is deployed, limit the computing resource consumption of the security scanner, and use the resource sharing capability of cloud computing to realize a one-to-many scanning framework for scanning objects of multiple virtualization instances of a single security scanner, which has strong scalability.

[0049] In this embodiment, the implementation method of the virtualization manager 102 creating a shared queue for the security scanner is not limited, and mainly includes a direct method and an indirect method. The direct method refers to the virtualization manager 102 creating a shared queue for the security scanner after the first virtualization instance is started by the boot program, and the indirect method refers to the virtualization manager 102 controlling the boot program to create a shared queue for the security scanner during the startup of the first virtualization instance. The boot program in the embodiment of the present application includes but is not limited to: Basic Input Output System (BIOS) or Unified Extensible Firmware Interface (UEFI).

[0050] In an optional embodiment, direct method: after the virtualization manager 102 starts the first virtualization instance, in the case of creating a shared queue for the security scanner, the virtualization manager 102 uses the IO virtualization protocol to create a shared queue for the security scanner, wherein the IO virtualization protocol is an IO virtualization technology for the virtualization platform, which provides a standardized interface to implement high-performance, low-overhead IO communication between the virtualization instance and the host machine, and supports multiple queues, so that it can process multiple I / O requests simultaneously. The disk read and write method based on the IO virtualization protocol can realize the sharing of disk read and write by mapping the disk data of the first virtualization instance to the security scanner outside the first virtualization instance through the shared queue through the virtual machine manager, thereby realizing the scanning of the disk space of the first virtualization instance by the security scanner. Specifically, when the virtualization manager 102 adopts the IO virtualization protocol, the first boot program corresponding to the first virtualization instance is executed to start the first virtualization instance. The first boot program is the boot program required to start the virtualization instance. In the process of starting the first virtualization instance 103 based on the first boot program, no shared queue is created. After starting the first virtualization instance, the virtualization manager 102 creates a shared queue for the security scanner. Optionally, the IO virtualization protocol can be implemented as the Virtio protocol. The Virtio protocol is an IO virtualization technology for a virtualization platform and belongs to a management method for the disk by the virtualization manager 102. Virtio provides a standardized interface to realize high-performance, low-overhead IO communication between virtualization instances and host devices. Virtio supports multiple queues and processes multiple I / O requests at the same time. In Virtio, each queue has its own independent control structure and buffer, which can be associated with different processor cores or threads to achieve concurrent processing.

[0051] In another optional embodiment, indirect method: the virtualization manager 102 controls the boot program to create a shared queue for the security scanner during the startup of the first virtualization instance. The direct non-volatile memory express (NVMe) protocol is a protocol for disk device communication, which can meet the high demand for read and write efficiency. The NVMe protocol has multiple queues and is designed for the high-speed serial computer expansion bus standard (PCI-express, PCIe). It is a more preferred protocol for today's fast block devices, especially solid-state hard disk devices to give full play to their performance. Devices that support the NVMe protocol are called NVMe devices. The NVMe protocol is an inherent property of the disk and requires the cooperation of the virtualization manager to perform multi-queue read and write operations or control on the disk. The disk read and write method based on the device-direct NVMe protocol can create multiple storage queues through the multi-queue disk protocol supported by the target physical storage space, and map the disk data of the first virtualization instance to the security scanner outside the first virtualization instance through the shared queue to achieve the same effect. Specifically, when using the NVMe protocol based on device direct M In the case of the e protocol, the boot program for starting the first virtualized instance is improved so that the improved second boot program can create a shared queue in the process of starting the first virtualized instance; wherein the first boot program is different from the second boot program, the virtualization manager executes the second boot program corresponding to the first virtualized instance to start the first virtualized instance, and during the startup process, the second boot program creates a shared queue for the security scanner, and after creating the shared queue, the second boot program returns the control of the first virtualized instance to the operating system of the first virtualized instance. The second boot program is an independent software independent of the operating system and user space program of the first virtualized instance. In the cloud computing scenario, the second boot program is controlled by the cloud vendor, and the operating system and user space program of the first virtualized instance are not aware of it.

[0052] It is explained here that both the first boot program and the second boot program can be regarded as a part of the virtualization manager.

[0053] In an optional embodiment, regardless of which of the above-mentioned implementation methods of creating a shared queue is used, the implementation method of the virtualization manager to create shared memory can be implemented as follows: allocating target memory for the security scanner from the memory of the first virtualization instance, and setting the target memory as a shared attribute for the security scanner to obtain shared memory.

[0054] In an optional embodiment, the implementation method of the virtualization manager providing the target data in the target physical storage space to the security scanning program based on the shared queue and the shared memory is not limited. A specific implementation method is provided below: when a security scan is required, the security scanning program sends a read request to the virtualization manager based on the shared queue, for example, writes the read request in the shared queue. Correspondingly, the virtualization manager receives the read request sent by the security scanning program based on the shared queue, and reads the target data from the target physical storage space according to the read request. For example, the read request includes: the address information and data length of the target physical storage space of the first virtualization instance, and the address information is a logical address. The disk device parses the read request, converts the logical address in the read request into a physical address, and reads the target data from the target storage space according to the physical address; the target data is written into the shared memory, so that the security scanning program can read the target data from the shared memory. For example, an interrupt re-forwarding mechanism is adopted, and after the target data is written into the shared memory, an interrupt is generated, and the notification information is no longer sent to the user space program, but the notification information is sent to the security scanning program to notify the security scanning program to read the target data from the shared memory for security scanning.

[0055] In this embodiment, the first virtualized instance may use the security scanning service or not, and the implementation method of using the security scanning service is not limited. In an optional embodiment, a human-computer interaction interface is provided to the user, and the user can choose whether the virtualized instance he purchased uses the security scanning service on the human-computer interaction interface. For the first virtualized instance, when the user determines that the first virtualized instance uses the security scanning service, the virtualization manager can obtain configuration information of the first virtualized instance, and the configuration information includes: indication information that the first virtualized instance uses the security scanning service, and determines that the first virtualized instance uses the security scanning service based on the indication information. Accordingly, the virtualization manager creates a shared queue and shared memory for the first virtualized instance. In another optional embodiment, a security scanning service binding relationship is pre-established between the security scanning program and the first virtualization instance. The security scanning program continuously detects the virtualization instance in the startup state, and sends a command instructing the creation of a shared queue and a shared memory to the virtualization manager corresponding to the virtualization instance in the startup state and with which the security scanning service binding relationship is established; the virtualization manager receives the command instructing the creation of a shared queue and a shared memory, and upon receiving the command, determines that the first virtualization instance uses the security scanning service, and creates a shared queue for the security scanning program through the second boot program during the process of starting the virtualization instance, or, after executing the first boot program to start the first virtualization instance, the virtualization manager creates a shared queue for the security scanning program.

[0056] In an optional embodiment, the internal structure of the virtualization manager is not limited. The following exemplary internal structure of the virtualization manager is provided as follows: Figure 3 As shown, the virtualization manager 102 includes: a creation module 102a, a first communication module 102b, and a storage device 102c allocated to the first virtualization instance, wherein the storage device corresponds to a disk device.

[0057] When the first virtualization instance uses the security scanning service, the creation module 102a creates a shared queue and a shared memory for a security scanning program outside the first virtualization instance, and provides address information of the shared queue and the shared memory to the first communication module 102b.

[0058] The first communication module 102b is responsible for communicating with the security scanning program, receiving the read request sent by the security scanning program, and writing the read request into the shared queue so that the storage device 102c can read the read request from the shared queue; the storage device 102c reads the read request from the shared queue, reads the target data from the target physical storage space according to the read request, and writes the target data into the shared memory. Further, the first communication module 102b reads the target data from the shared memory and sends the target data to the security scanning program so that the security scanning program can perform a security scan on the host device according to the target data.

[0059] It is explained here that in addition to reading a read request from a shared queue, reading target data from a target physical storage space according to the read request, and writing the target data into a shared memory, the storage device 102c can also perform read and write operations on the target physical storage space according to a read and write request from a user space program in the first virtualization instance in at least one storage queue. The storage device 102c can periodically poll or obtain a read request or a write request from a user space program from a corresponding storage queue according to an interrupt signal. For a read request from a user space program, the storage device 102c obtains the first data required to be read by the user space program from the target physical storage space, writes the first data into the memory space (non-shared memory) of the first virtualization instance, and notifies the kernel driver through the storage queue to read the first data and send the first data to the user space program; for a write request from a user space program, the storage device 102c obtains the second data required to be written by the user space program from the memory space of the first virtualization instance, writes the second data into the target physical storage space, and notifies the kernel driver through the storage queue that the writing is completed, and the kernel driver notifies the user space program that the second data has been written into the target physical storage space. Among them, the shared queue is different from the at least one storage queue.

[0060] Accordingly, this embodiment also provides an exemplary internal structure of a security scanning program 104, such as Figure 3As shown, the security scanning program 104 includes: a second communication module 104a, a scanning module 104b and a data analysis module 104c.

[0061] The data analysis module 104c responds to the security scan instruction or event to determine the disk address information and data length of the first virtualized instance. A real-time scan can be set to generate a security scan instruction in real time, or a scan cycle can be set to scan and generate a security scan instruction when the scan cycle arrives; the specific event is not limited, for example, it can be a write event detected in the target physical storage space. A read request is generated based on this information and provided to the scanning module 104b; the scanning module 104b provides the read request to the second communication module 104a; the second communication module 104a sends the read request to the first communication module 102b; the first communication module 102b receives the read request sent by the security scanning program and writes the read request into a shared queue so that the storage device 102c can read the read request from the shared queue; the storage device 102c reads the read request from the shared queue, reads the target data from the target physical storage space according to the read request, and writes the target data into the shared memory; the first communication module 102b reads the target data from the shared memory and sends the target data to the second communication module 104a; the second communication module 104a provides the target data to the scanning module 104b, and the scanning module 104b provides the target data to the data analysis module 104c. The data analysis module 104c detects whether a host intrusion occurs based on the target data, and warns the user if a host intrusion occurs. Methods for monitoring whether host intrusion occurs based on target data include but are not limited to: determining whether there is data in the virus library or risk library in the target data, determining whether the log information contained in the target data has been cleared, determining whether the target data contains abnormal process traffic, determining whether there are abnormally logged-in accounts in the target data, etc.

[0062] The security scanning solution proposed in this solution can achieve the following technical effects:

[0063] Strong timeliness: By interacting with the shared queue within the virtualization instance, the security scanner obtains and scans the target data in the same way that a user space program normally reads files. It reads the data that needs to be scanned in the virtualization instance in real time and in a targeted manner without saving the image or snapshot data of the entire virtualization instance before scanning. Therefore, it can quickly locate risky files and trace attack behaviors.

[0064] Resource isolation:Taking advantage of the characteristics of cloud computing virtualization, all scanning-related high IO and computing load components in this solution run outside the virtualization instance and use independent special virtualization instances to run. For example, the security scanning program is independent of the first virtualization instance and can run on the same host device as the first virtualization instance, or on a different host device from the first virtualization instance. After the user purchases a virtualization instance, the operation of the in-band scanning agent (the security scanning program deployed inside the virtualization instance) will not affect the use of the purchased computing resources, nor will there be obvious IO fluctuations due to the scanning behavior of the agent, and the service resources can be well isolated and protected.

[0065] User Data Control: Compared with the out-of-band scanning method using images / snapshots, this solution does not use additional storage resources to save disk images or snapshots of virtualized instances. On the one hand, it can save the storage resources that cloud vendors pay for saving user data. On the other hand, it can also avoid copying and data leakage of user data, protecting user data from leaving the original computing area.

[0066] Virtualized instances are not aware of: In this embodiment, since the transformation is all done at the virtualization manager layer under the virtualization instance, the solution can achieve hiding of the operating system of the virtualization instance and its upper-layer applications, and the operating system and its upper-layer kernel modules and user space processes are not aware of it. At the same time, since the performance overhead is in the virtualization manager of the virtualization instance, it will not directly affect the performance of the code running in the virtualization instance; it does not occupy the IO queue of the operating system of the virtualization instance, and has little impact on IO performance, further reducing the possibility of judging the existence of the agent through performance analysis.

[0067] In addition to providing a host device embodiment, the embodiment of the present application also provides a security scanning method for cloud computing. The process of the security scanning method for cloud computing provided by the embodiment of the present application is described below.

[0068] Figure 4 A schematic diagram of a security scanning method for cloud computing provided by an exemplary embodiment of the present application is provided. The method is applied to a virtualization manager on a host device. The virtualization manager manages a first virtualization instance on the host device, such as Figure 4 As shown, the method includes:

[0069] 401. When the first virtualization instance uses a security scanning service, a shared queue and a shared memory are created for a security scanning program located outside the first virtualization instance; the first virtualization instance has a target physical storage space, and the target physical storage space supports a virtualization manager to perform read and write operations on the target physical storage space in a multi-queue read and write manner;

[0070] 402. Based on the shared queue and the shared memory, the target data in the target physical storage space is provided to the security scanning program, so that the security scanning program performs a security scan on the host device according to the target data; wherein the first virtualization instance performs read and write operations on the target physical storage space through at least one storage queue.

[0071] In an optional embodiment, target data in a target physical storage space is provided to a security scanner based on a shared queue and a shared memory, including: receiving a read request sent by the security scanner based on the shared queue, and reading the target data from the target physical storage space according to the read request; and writing the target data into the shared memory so that the security scanner can read the target data from the shared memory.

[0072] In an optional embodiment, the method provided by the embodiment of the present application also includes: obtaining configuration information of the first virtualization instance, the configuration information including indication information of the first virtualization instance using the security scanning service, and determining that the first virtualization instance uses the security scanning service according to the indication information; or receiving a command sent by the security scanning program to instruct the creation of a shared queue and shared memory, and upon receiving the command, determining that the first virtualization instance uses the security scanning service, the command is sent when the security scanning program establishes a security scanning service binding relationship with the first virtualization instance.

[0073] In an optional embodiment, a shared queue is created for a security scanner located outside the first virtualization instance, including: when an IO virtualization protocol (such as the Virtio protocol) is adopted, a first boot program corresponding to the first virtualization instance is executed to start the first virtualization instance, and after the first virtualization instance is started, a shared queue is created for the security scanner; or when an NVMe protocol based on device pass-through is adopted, a second boot program corresponding to the first virtualization instance is executed to start the first virtualization instance, and during the startup process, the second boot program creates a shared queue for the security scanner.

[0074] Figure 5 Another security scanning method for cloud computing provided by an exemplary embodiment of the present application uses a security scanning program outside the first virtualization instance, such as Figure 5 As shown, the method includes:

[0075] 501. When the virtualization manager corresponding to the first virtualization instance creates a shared queue and a shared memory for the security scanner, write a read request to the shared queue, so that the virtualization manager reads target data from a target physical storage space of the first virtualization instance based on the read request and writes the target data to the shared memory;

[0076] 502. Read target data from the shared memory and perform a security scan based on the target data; wherein the target physical storage space supports the virtualization manager to perform read and write operations on it in a multi-queue read and write manner, and the first virtualization instance performs read and write operations on the target physical storage space through at least one storage queue.

[0077] In an optional embodiment, the method provided by the present application also includes: sending a command to the virtualization manager to instruct the creation of a shared queue and shared memory, so that the virtualization manager, upon receiving the command, determines that the first virtualization instance uses a security scanning service, and the command is sent when the security scanning program establishes a security scanning service binding relationship with the first virtualization instance.

[0078] Regarding the embodiments of the present application Figure 4-5 The detailed implementation and beneficial effects of each step in the method have been described in detail in the aforementioned embodiments and will not be elaborated here.

[0079] It should be noted that the execution subject of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution subject of step 501 to step 502 can be device A; for another example, the execution subject of step 501 can be device A, and the execution subject of step 502 can be device B; and so on.

[0080] In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel, and the sequence numbers of the operations, such as 501, 502, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0081] Figure 6 A schematic diagram of the structure of a virtualization management device provided by an exemplary embodiment of the present application, the device can be implemented as a virtualization manager in a host device, and is used to manage a first virtualization instance, such as Figure 6 As shown, the device includes: a creating module 61 and a providing module 62.

[0082] A creation module 61 is used to create a shared queue and a shared memory for a security scanning program located outside the first virtualization instance when the first virtualization instance uses a security scanning service; the first virtualization instance has a target physical storage space, and the target physical storage space supports a virtualization manager to perform read and write operations on the target physical storage space in a multi-queue read and write manner;

[0083] A module 62 is provided, which is used to provide target data in the target physical storage space to the security scanning program based on the shared queue and shared memory, so that the security scanning program can perform a security scan on the host device according to the target data; wherein the first virtualization instance performs read and write operations on the target physical storage space through at least one storage queue, and the shared queue is different from at least one storage queue.

[0084] In an optional embodiment, the providing module 62 is specifically used to: receive a read request sent by the security scanning program based on a shared queue, and read the target data from the target physical storage space according to the read request; write the target data into the shared memory so that the security scanning program can read the target data from the shared memory.

[0085] In an optional embodiment, the virtualization management device provided by the embodiment of the present application also includes: an acquisition module, a determination module and a receiving module; the acquisition module is used to acquire configuration information of the first virtualization instance, the configuration information includes indication information that the first virtualization instance uses the security scanning service, and the determination module is used to determine that the first virtualization instance uses the security scanning service according to the indication information; or the receiving module is used to receive a command sent by the security scanning program to instruct the creation of a shared queue and shared memory, and the determination module is used to determine that the first virtualization instance uses the security scanning service when the command is received, and the command is sent when the security scanning program establishes a security scanning service binding relationship with the first virtualization instance.

[0086] In an optional embodiment, a module is created, which is specifically used to: when an IO virtualization protocol (such as the virtio protocol) is adopted, execute a first boot program corresponding to the first virtualization instance to start the first virtualization instance, and after starting the first virtualization instance, create a shared queue for the security scanner; or when an NVMe protocol based on device pass-through is adopted, execute a second boot program corresponding to the first virtualization instance to start the first virtualization instance, and during the startup process, the second boot program creates a shared queue for the security scanner.

[0087] Regarding the embodiments of the present application Figure 6 The detailed implementation and beneficial effects of each step in the illustrated device have been described in detail in the aforementioned embodiments and will not be elaborated on here.

[0088] Figure 7A schematic diagram of the structure of another host device provided by an exemplary embodiment of the present application, such as Figure 7 As shown, the device includes: a memory 74 and a processor 75.

[0089] The memory 74 is used to store the security scanning program and can be configured to store various other data to support operations on the host device. Examples of these data include instructions for any application or method operating on the host device.

[0090] The processor 75 is coupled to the memory 74 and is used to execute the security scanning program in the memory 74, so as to: write a read request to the shared queue when the virtualization manager corresponding to the first virtualization instance creates a shared queue and a shared memory for the security scanning program, so that the virtualization manager can read the target data from the target physical storage space of the first virtualization instance based on the read request and write the target data to the shared memory; read the target data from the shared memory, and perform a security scan on the host device according to the target data; wherein the target physical storage space supports the virtualization manager to perform read and write operations on it in a multi-queue read and write manner, the first virtualization instance performs read and write operations on the target physical storage space through at least one storage queue, and the shared queue is different from the at least one storage queue.

[0091] In an optional embodiment, the processor 75 is also used to send a command to the virtualization manager to instruct the creation of a shared queue and shared memory, so that the virtualization manager can determine that the first virtualization instance uses the security scanning service when receiving the command. The command is sent when the security scanning program establishes a security scanning service binding relationship with the first virtualization instance.

[0092] In an optional embodiment, the security scanning program is a user space program deployed in a second virtualization instance on the host device or other devices, or the security scanning program is a user space program deployed directly on the host device or other devices.

[0093] Regarding the embodiments of the present application Figure 7 The detailed implementation and beneficial effects of each step in the illustrated device have been described in detail in the aforementioned embodiments and will not be elaborated on here.

[0094] Further, if Figure 7 As shown, the host device also includes other components such as a communication component 76 and a power component 78. Figure 7 Only some components are shown schematically, which does not mean that the host device only includes Figure 7 The host device of this embodiment is implemented as a cloud server.

[0095] The detailed implementation and beneficial effects of the host device provided in the embodiments of the present application have been described in detail in the aforementioned embodiments and will not be elaborated here.

[0096] Accordingly, the embodiment of the present application further provides a computer-readable storage medium storing a computer program, which can achieve the above-mentioned Figure 4-5 The steps in the method shown.

[0097] The above-mentioned memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0098] The above-mentioned communication component is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G / LTE, 5G and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be based on Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology and other technologies.

[0099] The above-mentioned display includes a screen, and the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0100] The power supply assembly provides power to various components of the device where the power supply assembly is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device where the power supply assembly is located.

[0101] The above-mentioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (Microphone, MIC), and when the device where the audio component is located is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting an audio signal.

[0102] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-readable storage media (including but not limited to disk storage, compact disc read-only memory (Compact Disc Read-Only Memory, CD-ROM), optical storage, etc.) containing computer-usable program code.

[0103] The present application is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0104] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0105] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0106] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interface, network interface and memory.

[0107] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0108] Computer readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0109] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0110] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A host device, characterized in that: A virtualization manager and a first virtualization instance managed by the virtualization manager are deployed on the host device, the first virtualization instance has a target physical storage space, and the target physical storage space supports the virtualization manager to perform read and write operations on the target physical storage space in a multi-queue read and write manner; The virtualization manager is further configured to, when determining that the first virtualization instance uses a security scanning service, create a shared queue and a shared memory for a security scanning program located outside the first virtualization instance; based on the shared queue and the shared memory, provide the target data in the target physical storage space to the security scanning program, so that the security scanning program performs a security scan on the host device according to the target data; The first virtualized instance performs read and write operations on the target physical storage space through at least one storage queue.

2. The host device according to claim 1, characterized in that: When the virtualization manager provides the target data in the target physical storage space to the security scanning program based on the shared queue and the shared memory, the virtualization manager is specifically used to: receiving a read request sent by the security scanning program based on the shared queue, and reading target data from the target physical storage space according to the read request; The target data is written into the shared memory, so that the security scanning program can read the target data from the shared memory.

3. The host device according to claim 1, characterized in that: The virtualization manager is also used to: Acquire configuration information of the first virtualized instance, wherein the configuration information includes indication information that the first virtualized instance uses a security scanning service, and determine that the first virtualized instance uses a security scanning service according to the indication information; or Receive a command sent by the security scanner to instruct the creation of a shared queue and a shared memory, and upon receiving the command, determine that the first virtualization instance uses a security scanning service, wherein the command is sent when the security scanner establishes a security scanning service binding relationship with the first virtualization instance.

4. The host device according to claim 1, characterized in that: When the virtualization manager creates a shared queue for a security scanner located outside the first virtualization instance, the virtualization manager is specifically configured to: In the case of adopting the IO virtualization protocol, executing a first boot program corresponding to the first virtualization instance to start the first virtualization instance, and after starting the first virtualization instance, creating a shared queue for the security scanning program; or When using the non-volatile memory express channel NVMe protocol based on device direct access, the second boot program corresponding to the first virtualization instance is executed to start the first virtualization instance, and during the startup process, the second boot program creates a shared queue for the security scanning program.

5. The host device according to any one of claims 1 to 4, characterized in that: The virtualization manager includes: A creation module, configured to create a shared queue and a shared memory for a security scanning program located outside the first virtualization instance when the first virtualization instance uses a security scanning service; a communication module, configured to receive a read request sent by the security scanning program, write the read request into the shared queue; and read the target data from the shared memory and send the target data to the security scanning program, so that the security scanning program performs a security scan on the host device according to the target data; The storage device allocated to the first virtualization instance is used to read the read request from the shared queue, read the target data from the target physical storage space according to the read request, and write the target data into the shared memory; and perform read and write operations on the target physical storage space according to the read and write requests from the user space program in the first virtualization instance in the at least one storage queue.

6. The host device according to any one of claims 1 to 4, characterized in that: The security scanner is a second virtualized instance deployed on the host device or other device.

7. A security scanning method for cloud computing, characterized in that: A virtualization manager applied to a host device, the virtualization manager managing a first virtualization instance on the host device, the method comprising: In the case where the first virtualized instance uses a security scanning service, a shared queue and a shared memory are created for a security scanning program located outside the first virtualized instance; the first virtualized instance has a target physical storage space, and the target physical storage space supports the virtualization manager to perform read and write operations on the target physical storage space in a multi-queue read and write manner; Based on the shared queue and the shared memory, providing the target data in the target physical storage space to the security scanning program, so that the security scanning program performs a security scan on the host device according to the target data; The first virtualized instance performs read and write operations on the target physical storage space through at least one storage queue.

8. The method according to claim 7, characterized in that include: Providing target data in the target physical storage space to the security scanning program based on the shared queue and the shared memory includes: receiving a read request sent by the security scanning program based on the shared queue, and reading target data from the target physical storage space according to the read request; The target data is written into the shared memory, so that the security scanning program can read the target data from the shared memory.

9. The method according to claim 7, characterized in that: Creating a shared queue for a security scanner external to the first virtualized instance includes: In the case of adopting the IO virtualization protocol, executing a first boot program corresponding to the first virtualization instance to start the first virtualization instance, and after starting the first virtualization instance, creating a shared queue for the security scanning program; or In the case of adopting the NVMe protocol based on device direct access, the second boot program corresponding to the first virtualization instance is executed to start the first virtualization instance, and during the startup process, the second boot program creates a shared queue for the security scanning program.

10. A security scanning method for cloud computing, characterized in that: Applying a security scanning program external to the first virtualized instance, the method comprises: When the virtualization manager corresponding to the first virtualization instance creates a shared queue and a shared memory for the security scanner, a read request is written to the shared queue, so that the virtualization manager reads target data from a target physical storage space of the first virtualization instance based on the read request, and writes the target data into the shared memory; Reading the target data from the shared memory, and performing a security scan according to the target data; The target physical storage space supports the virtualization manager to perform read and write operations on it in a multi-queue read and write manner, and the first virtualization instance performs read and write operations on the target physical storage space through at least one storage queue.

11. A virtualization management device, characterized in that: The apparatus may be implemented as a virtualization manager in a host device, and is used to manage a first virtualization instance in the host device, the apparatus comprising: a creation module and a provision module; The creation module is used to create a shared queue and a shared memory for a security scanning program located outside the first virtualization instance when the first virtualization instance uses a security scanning service; the first virtualization instance has a target physical storage space, and the target physical storage space supports the virtualization manager to perform read and write operations on the target physical storage space in a multi-queue read and write manner; The providing module is used to provide the target data in the target physical storage space to the security scanning program based on the shared queue and the shared memory, so that the security scanning program can perform a security scan on the host device according to the target data; wherein, the first virtualization instance performs read and write operations on the target physical storage space through at least one storage queue.

12. A host device, characterized in that: It comprises a memory and a processor, wherein the memory stores a security scanning program, and the processor, coupled to the memory, is used to execute the security scanning program to implement the steps in any one of the methods described in claim 10.

13. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the processor is caused to implement the steps in the method according to any one of claims 7 to 10.

Images