Multi-cloud hybrid management platform implementation method based on mimicry defense

Abstract

The invention relates to a multi-cloud hybrid management platform implementation method based on mimicry defense, which is characterized in that a mimicry decision framework is introduced for an isomerized distributed key value storage library, a controller management component completes resource information synchronization through each client component, and the controller management component transmits a control signal to a cloud base; the cloud base monitors the resources in the distributed key value storage library; the cloud base sends an input data stream to a distributed key value storage library and monitors the input data stream; when the controller management assembly monitors that the resources change through the cloud base, feedback callback of the cloud base is triggered, the cloud base carries out comparison, and the controller operates the corresponding resources according to operation information transmitted by the cloud base and synchronously transmits the resource configuration needing to be updated to the cloud base; and after the cloud base confirms that the controller successfully operates the resources, the resource configuration transmitted by the controller is stored in a distributed key value storage library. The problem that the risk of targeted utilization exists in a cloud platform management mechanism is solved, and the endogenous safety of the platform is enhanced.

Description

Technical Field

[0001] The present invention relates to a cyberspace security technology, and in particular to a method for implementing a multi-cloud hybrid management platform based on mimicry defense. Background Art

[0002] As the development trend of AI, large models, and high computing power is highly concerned at home and abroad, cloud platforms are widely used as computing resource scheduling service portals. Cloud platforms provide management of cloud services, unified deployment capabilities of business core computing capabilities, unified management of application lifecycles, and control management of personnel security access. It can be seen that in the intelligent era, cloud platforms play an indispensable and important role.

[0003] In the current cloud platform security architecture system, most mainstream cloud platforms use traditional security defense. Since traditional security defense methods are based on the accumulation of prior knowledge, they cannot effectively defend against a wide variety of unknown security threats in cyberspace. In April 2022, 360's advanced threat hunting honeypot system discovered that 92,000 cloud server IPs around the world performed network scanning, vulnerability attacks, and spread malware. These included cloud service asset IPs belonging to 39 domestic units, which involved multiple industries such as government, medical care, construction, and military industry. In December 2023, Italian cloud service provider Westpole suffered a Lockbit3.0 ransomware attack, the financial cloud was ransomed, and about 60 credit unions had their services interrupted.

[0004] Mimetic space defense technology is a new type of defense technology. It constructs a mimetic endogenous security defense environment based on endogenous security theory and dynamic heterogeneous redundant structure DHR design inside the target object, controls differential mode vulnerability backdoors, virus Trojans and attackers who use them as attack resources, and controls malicious attacks within a given threshold range.

[0005] Since mimic defense is dynamic, heterogeneous, diversified, and randomized, it can take defensive measures before an attack occurs, improve system security, increase the difficulty for attackers, and effectively respond to unknown attacks. The dynamic and random characteristics of redundant executors can improve the system's inherent security level and increase the uncertainty of actions involving multiple parties with consistency or coordination requirements. The multi-executor arbitration link also increases the difficulty of coordinated attacks under non-cooperative conditions in terms of principle and architecture.

[0006] In the cloud platform management mechanism, when the component is initialized, a client component with a local cache and index mechanism that can be registered will be established. This component is an adapter that specifies resources in the distributed key-value repository and obtains synchronization information. It is used to synchronously observe resource changes in the distributed key-value repository and trigger user-registered processing callbacks and provide an interface for updating resources in the distributed key-value repository.

[0007] In the cloud service component management mechanism, only by monitoring the changes of resources in the components, the status of the corresponding resources is synchronized to achieve the consistency of the final state. In the synchronization process, only the synchronization of component transmission information and cloud services is considered, and the security of the transmission process is not guaranteed, resulting in the risk of targeted exploitation in this link, which is easy to be tampered or destroyed by attackers. Summary of the invention

[0008] Aiming at the risk of targeted exploitation in the cloud platform management mechanism, a multi-cloud hybrid management platform implementation method based on mimicry defense was proposed.

[0009] The technical solution of the present invention is:

[0010] A method for implementing a multi-cloud hybrid management platform based on mimicry defense is provided. In the process of cloud base monitoring resources in a distributed key-value storage library, a mimicry arbitration framework is introduced for the heterogeneous distributed key-value storage library. The method for implementing the multi-cloud hybrid management platform is as follows:

[0011] Step 1: The controller management component completes resource information synchronization through various client components, and transmits control signals to the cloud base, which then monitors the resources in the distributed key-value storage library;

[0012] Step 2: The cloud base sends the input data stream InputStream to the distributed key-value storage library, and waits for the distributed key-value storage library to give feedback to the output data stream OutputStream. The output data stream with a fixed format will indicate the resource changes of the distributed key-value storage library. According to the above process, the cloud base can complete the monitoring of the distributed key-value storage library;

[0013] Step 3: When the controller management component monitors the resource changes in the distributed key-value storage library through the output stream Outstream T received by the cloud base, it will trigger the feedback callback of the cloud base;

[0014] Step 4: The cloud base records the feedback results of the changes, compares them internally, and then sends the operation information after comparison and confirmation to the controller management component, requiring the controller to operate the corresponding resources;

[0015] Step 5: The controller operates the corresponding resources according to the operation information transmitted by the cloud base, and transmits the feedback information of the operation completion to the cloud base. At the same time, the controller will synchronously transmit the resource configuration to be updated to the cloud base;

[0016] Step 6: After the cloud base confirms that the controller successfully operates the resource, it stores the resource configuration passed by the controller in the distributed key-value storage library.

[0017] Further, the specific steps are as follows:

[0018] Step 1: The controller management component completes resource information synchronization through various client components, and transmits control signals to the cloud base, which then monitors the resources in the distributed key-value storage library;

[0019] Step 1-1: Build a heterogeneous software and hardware platform based on the characteristics of the cloud platform;

[0020] Step 1-2: Perform heterogeneous transformation on distributed key-value storage libraries based on software and hardware platforms with different architectures, and establish N distributed key-value storage libraries with the same functions but different architectures or underlying instruction sets; after the construction is completed, ensure that the resources in each distributed key-value storage library are consistent;

[0021] Step 2: The cloud base sends the input data stream InputStream to the distributed key-value storage library, and waits for the distributed key-value storage library to give feedback to the output data stream OutputStream. The output data stream with a fixed format will indicate the resource changes of the distributed key-value storage library. According to the above process, the cloud base can complete the monitoring of the distributed key-value storage library;

[0022] Step 2-1: The cloud base monitoring request is sent to the distributed key-value storage library in the form of a data stream InputStream. The input agent in the mimic adjudication framework will intercept the data stream and distribute it to generate N monitoring request data streams with the same structure and content. At the same time, during the distribution process, the input agent will sequence the data streams respectively, corresponding to 1-N sequence numbers;

[0023] Step 2-2: The listening request data stream marked by the input agent will be sent by the input agent to the distributed key-value storage library with the corresponding sequence number. After receiving the corresponding requests, the distributed key-value storage libraries with different sequence numbers will generate feedback information and send it uniformly to the output agent in the mimic arbitration framework;

[0024] Step 2-3: The output agent makes a unified decision on each distributed key-value storage repository. The decision is made in a voting mode, and the majority of the same results are regarded as the true results. That is, when the output data streams OutStream1, OutStream2...OutStreamN come to the output agent, if more than 66% of the output data streams have the same data content Outstream T, the data content of Outstream T is confirmed as the true result and executed normally to enter step 2-4, while the minority of data contents inconsistent with Outstream T are marked as abnormal results and thrown into step 2-5;

[0025] Step 2-4: The output agent feeds back the output data stream OutStream T obtained in step 2-3 as the real result to the cloud base, and then goes to step 3;

[0026] Step 2-5: The output agent reports the distributed key-value storage library sequence number of the output stream Outstream as the abnormal result to the feedback control scheduler in the mimicry arbitration framework, and the feedback control scheduler rotates or cleans the abnormal distributed key-value storage library;

[0027] Step 3: When the controller management component monitors the resource changes in the distributed key-value storage library through the output stream Outstream T received by the cloud base, it will trigger the feedback callback of the cloud base;

[0028] Step 4: The cloud base records the feedback results of the changes, compares them internally, and then sends the operation information after comparison and confirmation to the controller management component, requiring the controller to operate the corresponding resources;

[0029] Step 5: The controller operates the corresponding resources according to the operation information transmitted by the cloud base, and transmits the feedback information of the operation completion to the cloud base. At the same time, the controller will synchronously transmit the resource configuration to be updated to the cloud base;

[0030] Step 6: After the cloud base confirms that the controller has successfully operated on the resource, it stores the resource configuration passed by the controller in the distributed key-value storage library;

[0031] Step 6-1: At this time, the cloud base update request data stream InputStream will be intercepted and split by the input proxy to generate N identical update request data streams, which are marked with numbers 1-N respectively;

[0032] Step 6-2: The update request data stream marked by the input agent will be passed by the input agent to the distributed key-value storage library of the corresponding sequence number. After receiving the corresponding request, the distributed key-value storage library will uniformly execute the resource configuration update storage.

[0033] Furthermore, in step 1-1, when applying the mimicking framework, it is necessary to first build a heterogeneous hardware and software platform and deploy the corresponding hardware and software environment based on the characteristics of the cloud platform, such as arm and x86.

[0034] Furthermore, in step 2-5, rotation refers to scheduling a standby distributed key-value storage repository to replace the existing abnormal distributed key-value storage repository, and cleaning refers to initializing the abnormal distributed key-value storage repository.

[0035] The beneficial effects of the present invention are:

[0036] The traditional defenses used by existing cloud security are based on prior knowledge, which requires a huge virus library, vulnerability library and feature library, and cannot cover the vulnerabilities that do not exist in the library. Figure 2 As shown in the figure, the cloud platform management mechanism using the technology in this article strengthens the intrinsic security of the platform. The heterogeneous characteristics make the platform security dynamic, diversified, and random, and it can also defend against unknown risks with a high degree of confidence. At the same time, the cleaning and recovery function of the mimetic component ensures that the cloud platform can be recovered seamlessly when an abnormality occurs. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is the overall structure diagram of the controller of the present invention;

[0038] Figure 2 A schematic diagram of a mimic arbitration framework introduced into the controller of the present invention;

[0039] Figure 3 It is a working sequence diagram of the mimicry arbitration framework of the present invention;

[0040] Figure 4 This is a flow chart of the cloud base monitoring the distributed key-value storage library of the present invention. DETAILED DESCRIPTION

[0041] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0042] The controller management component monitors the changes of resources in the distributed key-value storage library and synchronizes the configuration of the corresponding resource status to achieve the consistency of the final status. Its overall structure is as follows: Figure 1 .

[0043] After the client component is synchronized to the resource changes, the controller will operate the control logic of the corresponding resource according to the resource changes. For example, when the microservice framework component obtains changes in network governance-related configurations, the virtualization service will operate the microservice framework to create or update the network policy.

[0044] The controller includes package management tools, resource clusters, permission control, applications, virtualization services, etc., which provide specific operations for synchronization of corresponding resources.

[0045] The controller management component operates the distributed key-value storage library resources through the cloud base. The distributed key-value storage library resources serve as the storage middleware of key-value pairs, and store key information such as the status information of the cloud platform and the resource location.

[0046] When applying the mimicry framework, you need to first build a heterogeneous hardware and software platform and deploy the corresponding hardware and software environment based on the characteristics of the cloud platform, such as arm, x86, etc.

[0047] Based on software and hardware platforms with different architectures, the distributed key-value storage library is transformed into a heterogeneous one, and N distributed key-value storage libraries with the same functions but different architectures or underlying instruction sets are established. After the construction is completed, the resources in each distributed key-value storage library are ensured to be consistent.

[0048] In the process of cloud base monitoring resources in distributed key-value storage, a mimic arbitration framework is introduced for heterogeneous distributed key-value storage. Figure 2 .

[0049] The specific steps of a method for implementing a multi-cloud hybrid management platform based on mimicry defense are as follows: Figure 2-4 :

[0050] Step 1: The controller management component completes resource information synchronization through various client components, and transmits control signals to the cloud base, which then monitors the resources in the distributed key-value storage library.

[0051] Step 1-1: Build a heterogeneous software and hardware platform based on the characteristics of the cloud platform, such as arm, x86, etc.

[0052] Step 1-2: Perform heterogeneous transformation of distributed key-value storage libraries based on software and hardware platforms with different architectures, and establish N distributed key-value storage libraries with the same functions but different architectures or underlying instruction sets. After the construction is completed, ensure that the resources in each distributed key-value storage library are consistent.

[0053] Step 2: The cloud base sends the input data stream InputStream to the distributed key-value storage library and waits for the distributed key-value storage library to give feedback on the output data stream OutputStream. The output data stream with a fixed format will indicate the resource changes of the distributed key-value storage library. Based on the above process, the cloud base can complete the monitoring of the distributed key-value storage library.

[0054] Step 2-1: The cloud base listening request is sent to the distributed key-value storage library in the form of a data stream InputStream. The input agent in the mimic arbitration framework will intercept the data stream and distribute it to generate N listening request data streams with the same structure and content. At the same time, during the distribution process, the input agent will sequence the data streams respectively, corresponding to 1-N serial numbers.

[0055] Step 2-2: The monitoring request data stream marked by the input agent will be sent by the input agent to the distributed key-value storage library with the corresponding sequence number (such as data stream 1 corresponds to distributed key-value storage library 1, data stream N corresponds to distributed key-value storage library N). After receiving their respective corresponding requests, the distributed key-value storage libraries with different sequence numbers will generate feedback information and send it to the output agent in the mimicry arbitration framework.

[0056] Step 2-3: The output agent makes a unified decision on each distributed key-value storage repository. The decision is made in a voting mode, and the majority of the same results are regarded as the true results. That is, when the output data streams OutStream1, OutStream2...OutStreamN come to the output agent, if more than 66% of the output data streams have the same data content Outstream T, the data content of Outstream T is confirmed as the true result and executed normally to enter step 2-4, while the minority of data contents inconsistent with Outstream T are marked as abnormal results and thrown into step 2-5.

[0057] Step 2-4: The output agent feeds back the output data stream OutStream T obtained in step 2-3 as the real result to the cloud base and proceeds to step 3.

[0058] Step 2-5: The output agent reports the distributed key-value storage repository sequence number of the output stream Outstream as the abnormal result to the feedback control scheduler in the mimicry arbitration framework, and the feedback control scheduler rotates the abnormal distributed key-value storage repository (scheduling the backup distributed key-value storage repository to replace the existing abnormal distributed key-value storage repository) or cleans (initializes the abnormal distributed key-value storage repository).

[0059] Step 3: When the controller management component monitors the resource changes in the distributed key-value storage library through the output stream Outstream T received by the cloud base, it will trigger the feedback callback of the cloud base.

[0060] Step 4: The cloud base records the feedback results of the changes, compares them internally, and then sends the operation information after comparison and confirmation to the controller management component, requiring the controller to operate the corresponding resources.

[0061] Step 5: The controller operates the corresponding resources according to the operation information transmitted by the cloud base, and transmits the feedback information of the operation completion to the cloud base. At the same time, the controller will synchronously transmit the resource configuration that needs to be updated to the cloud base.

[0062] Step 6: After the cloud base confirms that the controller successfully operates the resource, it stores the resource configuration passed by the controller in the distributed key-value storage library.

[0063] Step 6-1: At this time, the cloud base update request data stream InputStream will be intercepted and diverted by the input agent, generating N identical update request data streams, which are marked with corresponding serial numbers 1-N.

[0064] Step 6-2: The update request data stream marked by the input agent will be passed by the input agent to the distributed key-value storage library of the corresponding sequence number. After receiving the corresponding request, the distributed key-value storage library will uniformly execute the resource configuration update storage.

[0065] The above-mentioned embodiment only expresses one implementation mode of the present invention, and its description is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be based on the attached claims.

Claims

1. A method for implementing a multi-cloud hybrid management platform based on mimicry defense, characterized in that: In the process of the cloud base monitoring the resources in the distributed key-value storage library, a mimic arbitration framework is introduced for the heterogeneous distributed key-value storage library. The implementation method of the multi-cloud hybrid management platform is as follows: Step 1: The controller management component completes resource information synchronization through various client components, and transmits control signals to the cloud base, which then monitors the resources in the distributed key-value storage library; Step 2: The cloud base sends the input data stream InputStream to the distributed key-value storage library, and waits for the distributed key-value storage library to give feedback to the output data stream OutputStream. The output data stream with a fixed format will indicate the resource changes of the distributed key-value storage library. According to the above process, the cloud base can complete the monitoring of the distributed key-value storage library; Step 3: When the controller management component monitors the resource changes in the distributed key-value storage library through the output stream Outstream T received by the cloud base, it will trigger the feedback callback of the cloud base; Step 4: The cloud base records the feedback results of the changes, compares them internally, and then sends the operation information after comparison and confirmation to the controller management component, requiring the controller to operate the corresponding resources; Step 5: The controller operates the corresponding resources according to the operation information transmitted by the cloud base, and transmits the feedback information of the operation completion to the cloud base. At the same time, the controller will synchronously transmit the resource configuration to be updated to the cloud base; Step 6: After the cloud base confirms that the controller successfully operates the resource, it stores the resource configuration passed by the controller in the distributed key-value storage library.

2. The method for implementing a multi-cloud hybrid management platform based on mimicry defense according to claim 1 is characterized in that: The specific steps are as follows: Step 1: The controller management component completes resource information synchronization through various client components, and transmits control signals to the cloud base, which then monitors the resources in the distributed key-value storage library; Step 1-1: Build a heterogeneous software and hardware platform based on the characteristics of the cloud platform; Step 1-2: Perform heterogeneous transformation on distributed key-value storage libraries based on software and hardware platforms with different architectures, and establish N distributed key-value storage libraries with the same functions but different architectures or underlying instruction sets; after the construction is completed, ensure that the resources in each distributed key-value storage library are consistent; Step 2: The cloud base sends the input data stream InputStream to the distributed key-value storage library, and waits for the distributed key-value storage library to give feedback to the output data stream OutputStream. The output data stream with a fixed format will indicate the resource changes of the distributed key-value storage library. According to the above process, the cloud base can complete the monitoring of the distributed key-value storage library; Step 2-1: The cloud base monitoring request is sent to the distributed key-value storage library in the form of a data stream InputStream. The input agent in the mimic adjudication framework will intercept the data stream and distribute it to generate N monitoring request data streams with the same structure and content. At the same time, during the distribution process, the input agent will sequence the data streams respectively, corresponding to 1-N sequence numbers; Step 2-2: The listening request data stream marked by the input agent will be sent by the input agent to the distributed key-value storage library with the corresponding sequence number. After receiving the corresponding requests, the distributed key-value storage libraries with different sequence numbers will generate feedback information and send it uniformly to the output agent in the mimic arbitration framework; Step 2-3: The output agent makes a unified decision on each distributed key-value storage repository. The decision is made in voting mode, and the majority of the same results are regarded as the true results. That is, when the output data streams OutStream1, OutStream2...OutStreamN come to the output agent, if more than 66% of the output data streams have the same data content Outstream T, the data content of Outstream T is confirmed as the true result and the process goes to step 2-4 normally. The minority of data streams that are inconsistent with the data content of Outstream T are marked as abnormal results and thrown into step 2-5. Step 2-4: The output agent feeds back the output data stream OutStream T obtained in step 2-3 as the real result to the cloud base, and then goes to step 3; Step 2-5: The output agent reports the distributed key-value storage library sequence number of the output stream Outstream as the abnormal result to the feedback control scheduler in the mimicry arbitration framework, and the feedback control scheduler rotates or cleans the abnormal distributed key-value storage library; Step 3: When the controller management component monitors the resource changes in the distributed key-value storage library through the output stream Outstream T received by the cloud base, it will trigger the feedback callback of the cloud base; Step 4: The cloud base records the feedback results of the changes, compares them internally, and then sends the operation information after comparison and confirmation to the controller management component, requiring the controller to operate the corresponding resources; Step 5: The controller operates the corresponding resources according to the operation information transmitted by the cloud base, and transmits the feedback information of the operation completion to the cloud base. At the same time, the controller will synchronously transmit the resource configuration to be updated to the cloud base; Step 6: After the cloud base confirms that the controller has successfully operated on the resource, it stores the resource configuration passed by the controller in the distributed key-value storage library; Step 6-1: At this time, the cloud base update request data stream InputStream will be intercepted and split by the input proxy to generate N identical update request data streams, which are marked with numbers 1-N respectively; Step 6-2: The update request data stream marked by the input agent will be passed by the input agent to the distributed key-value storage library of the corresponding sequence number. After receiving the corresponding request, the distributed key-value storage library will uniformly execute the resource configuration update storage.

3. The method for implementing a multi-cloud hybrid management platform based on mimicry defense according to claim 1 is characterized in that: In step 1-1, when applying the mimic framework, you need to first build a heterogeneous hardware and software platform and deploy the corresponding hardware and software environment based on the characteristics of the cloud platform, such as arm and x86.

4. The method for implementing a multi-cloud hybrid management platform based on mimicry defense according to claim 1 is characterized in that: In steps 2-5, rotation refers to scheduling a standby distributed key-value storage repository to replace the existing abnormal distributed key-value storage repository, and cleaning refers to initializing the abnormal distributed key-value storage repository.

Images