Cloud disk file ferry isolation method based on KVM virtualization technology

Abstract

According to the file ferrying method of the cloud disk based on the KVM virtualization technology, data isolation of multi-network users is achieved through the virtualization technology, direct network connection is avoided, and the safety of data transmission is ensured; access and resource allocation of multi-network users can be efficiently managed by utilizing a resource management function of a virtualization technology; through multiple security mechanisms such as encryption transmission, user authentication and intrusion detection, the overall security of the system is ensured, and data leakage and attack are prevented; a third-party cross-network data exchange platform and isolation transmission hardware are omitted; through the cloud disk file ferry technology, rapid data exchange in an isolation environment is realized, the problems of inconvenience and security of traditional network file transmission are solved, and the method is suitable for various high-security demand scenes.

Description

Technical Field

[0001] This invention relates to the field of cloud storage technology, and more specifically to a file transfer method for cloud disks based on KVM virtualization technology. Background Technology

[0002] With the rapid development of the internet and the continuous innovation of information technology, cloud storage has become an important way for individuals and businesses to store, manage, and share data. Cloud storage systems allow users to upload files to cloud servers for access and management anytime, anywhere. However, cloud storage systems have certain security vulnerabilities, particularly regarding data transmission security between users on internal and external networks. Traditional network file transfer typically uses direct network connections for data exchange, such as FTP, SMB, NFS, or HTTP protocols. However, traditional file transfer methods suffer from low data security when transferring large files or large volumes of files.

[0003] like Figure 1 As shown, in traditional cloud storage architectures, users on both internal and external networks typically access the system through public networks, which can lead to security issues such as unauthorized access, data breaches, or malicious attacks. To ensure data security, strict isolation and control of users on internal and external networks are often necessary. However, most existing security access control schemes lack effective isolation measures and cannot provide efficient access management while ensuring data security.

[0004] When file transfer between multiple networks, security domains, and network segments is required, such as in environments with isolated internal and external networks or high security environments (e.g., government, enterprise, finance, and healthcare), directly using transfer protocols like FTP, SMB, or HTTP poses a risk of data leakage and lacks effective protection mechanisms. The industry practice typically involves using cross-network data exchange platforms with specially designed isolated transmission hardware. This approach increases network complexity, and the data exchange process generates corresponding physical files, increasing client storage space consumption. Currently, many application scenarios have similar data security requirements. In industries like healthcare and finance, cross-network data transfer via isolated devices is complex, difficult to operate, and lacks granular permission management and logging for transferred files. Therefore, there is an urgent need for a secure, convenient, and efficient file transfer solution that can achieve data exchange between multiple networks, security domains, and network segments in an isolated environment while ensuring data integrity and security. Summary of the Invention

[0005] In view of this, the present invention provides a file transfer method for cloud disks based on KVM virtualization technology.

[0006] The specific technical solution adopted in this invention is as follows:

[0007] A file transfer method for cloud disks based on KVM virtualization technology includes:

[0008] On the physical server, create multiple virtual machines (VMs) with completely disconnected network layer communication, with different network zones corresponding to different VMs; configure a virtual switch for each VM to connect to the virtual network; set up a host management system to manage the VMs and configure a file exchange cache.

[0009] When a user in a network area uploads a target file to the virtual machine (VM) corresponding to their network area, it is stored in the local cloud disk storage area of ​​the VM after verification; the user in the current network area sends a file transfer command to the target VM through the network between virtual switches; the target file stored in the current VM is stored in the file exchange cache area.

[0010] When the host management system periodically scans the file exchange buffer and detects the target file that needs to be transferred, it stores the target file in the local cloud disk storage area of ​​the target virtual machine (VM).

[0011] Users in the network area where the target virtual machine (VM) is located can obtain the target file from the local cloud disk storage area.

[0012] Ideally, each virtual machine is assigned a virtual network identifier (VLAN ID) and can only access network traffic with the same VLAN ID.

[0013] Preferably, when a user in a network area uploads a target file to the virtual machine (VM) corresponding to their network area, the client calculates the hash value of the target file using the SHA-256 hash algorithm and transmits it along with the target file to the current VM. Upon receiving the target file, the current VM calculates the hash value again and compares it with the value sent by the client. If they match, the target file passes the integrity check. Subsequently, the current VM encrypts the target file using the AES-256 encryption algorithm and stores it in the local cloud disk storage area. The current VM records the basic metadata of the target file, including the filename, file size, upload time, uploader, and a unique identifier within the local cloud disk storage area for subsequent management.

[0014] Preferably, during the transmission process, the current virtual machine (VM) simultaneously transmits the relevant metadata of the target file and the information of the virtual machine to the host management system.

[0015] Preferably, when the host management system periodically scans the file exchange buffer and detects the target file that needs to be transferred, it includes:

[0016] The host system calls the integrated professional antivirus software engine and uses virus signature matching technology to compare the file bytes with the virus signature database. At the same time, it uses heuristic scanning to analyze the file behavior patterns and structural characteristics to determine whether the file is infected. If a virus is detected, the host system immediately marks the file as unsafe in its own management system, prevents it from continuing to circulate, and sends an alert to the administrator.

[0017] Ideally, after completing virus detection and confirming that the file is not infected, the host system performs content review. If the file contains sensitive information that does not comply with security policies, the host system marks the file as violating the rules, blocks its transmission, and notifies the administrator.

[0018] Preferably, for files that have passed virus detection and content review, the host system transmits them to the local cloud disk storage area of ​​the target virtual machine (VM) according to a preset transmission strategy. The transmission process uses the TLS encryption protocol; the host system establishes a TLS encrypted connection with the target VM and sends the target file in encrypted form. After receiving the encrypted file, the target VM decrypts it using a pre-shared key and performs another integrity check to ensure error-free file transmission. The host system tracks and records the entire file transmission process. After the file transmission is complete, the host system updates the file's status in the file exchange buffer to "transmitted" and simultaneously notifies both the source and target VMs to update the file status and related metadata.

[0019] Ideally, there are multiple physical servers, each configured with multiple network ports, used for connecting switches between the multiple physical servers to ensure complete physical isolation of the network.

[0020] The present invention has the following beneficial effects:

[0021] Data isolation: Virtualization technology is used to isolate data from users on multiple networks, avoiding direct network connections and ensuring the security of data transmission.

[0022] High efficiency: Utilizing the resource management capabilities of virtualization technology, it can efficiently manage access and resource allocation for multiple network users.

[0023] Security: The system employs multiple security mechanisms, including encrypted transmission, user authentication, and intrusion detection, to ensure overall security and prevent data leaks and attacks.

[0024] It eliminates the need for third-party cross-network data exchange platforms and isolation transmission hardware.

[0025] Cloud drive file transfer technology enables rapid data exchange in isolated environments, solving the inconvenience and security issues of traditional network file transfer, and is suitable for various high-security scenarios. Attached Figure Description

[0026] Figure 1 A network diagram for the traditional file transfer model;

[0027] Figure 2 This is a diagram of the file transfer architecture of the present invention. Detailed Implementation

[0028] The purpose of this invention is to provide a cloud disk file transfer and isolation system and method based on KVM virtualization technology. This system enables secure file transfer across multiple networks and devices, as well as data exchange between different networks, through cloud disk file transfer. The product integrates the features of network gateways, cloud storage, antivirus firewalls, and data leakage prevention products. It also supports multi-network data exchange, access control, approval processes, document sharing, and external file links, making it an integrated security device that addresses various scenarios including network isolation, data transmission, exchange, sharing, and storage. This method uses a file exchange cache as a bridge to complete file transfer and data exchange between multiple networks and different devices, and uses encryption and other means to ensure data security, improving overall security. It eliminates the need for a cross-network data exchange platform and isolation transmission hardware, while providing file sharing, collaborative work, and access control functions in multi-network environments, reducing network complexity.

[0029] This invention employs KVM virtualization technology combined with a cloud disk file transfer unit to achieve secure file exchange across multiple networks. Through virtualization technology and a file exchange cache, it ensures the security and controllability of data flow, resolving risks such as data leakage and network attacks inherent in traditional file exchange solutions. Figure 2 As shown, the main idea of ​​this invention is as follows:

[0030] The cloud drive is centrally managed, and all network users interact with files through the cloud drive, avoiding direct access to the file server.

[0031] KVM virtualization isolation achieves secure data exchange by starting two or more virtual machines on a physical server and using a file exchange cache.

[0032] IP protocol isolation completely disconnects network layer communication between all virtual machines, making it impossible to directly access each other via TCP / IP.

[0033] Data exchange between virtual machines can only be carried out through a file exchange cache, which ensures data security from an architectural perspective.

[0034] The multi-port communication architecture configures the physical server with multiple network ports (eth0, eth1, eth2, etc.), which are connected to different physical switches to ensure complete physical isolation of the network.

[0035] 1. Setting up and allocating resources for a virtualized environment

[0036] Virtualization technology is used to achieve resource isolation and independent management by dividing physical hardware resources (such as CPU, memory, and storage) into multiple virtual machines. In this invention, KVM virtualization technology serves as the underlying platform, providing powerful virtual machine management capabilities. KVM is a Linux kernel-based virtualization technology that creates multiple virtual machines through hardware virtualization extensions (such as Intel VT-x and AMD-V), enabling each virtual machine to have independent resources and ensuring isolation between virtual machines.

[0037] 2. Physical server configuration

[0038] In this invention, a physical server supporting KVM is required first, which will serve as the foundation for virtualization. The physical server must have sufficient computing power, memory capacity, and storage resources to ensure the normal operation of the virtual machines. A KVM virtualization management program (such as libvirt and QEMU) is installed on the physical server to manage the lifecycle, resource allocation, and scheduling of the virtual machines.

[0039] 3. Virtual Machine Creation and Configuration

[0040] Multiple KVM virtual machines are created using KVM virtualization (such as libvirt). Each virtual machine is allocated a certain amount of CPU, memory, and storage resources, and the resources of the virtual machines are independent and completely isolated from each other. In this implementation, two virtual machines are created: VM1 is used for access by users on the internal network, and VM2 is used for access by users on the external network.

[0041] Each virtual machine is assigned a virtual network interface card (vNIC) and a virtual disk (vDisk). These virtual hardware devices are mapped to physical hardware devices through a virtualization hypervisor.

[0042] 4. Design and Isolation of Virtual Networks

[0043] KVM offers rich virtual network features, allowing for flexible configuration and management of network isolation between virtual machines as needed. This invention utilizes KVM's virtual network capabilities to achieve complete isolation between multiple networks.

[0044] 5. Virtual Switch (vSwitch) and VLAN Configuration

[0045] Each virtual machine is connected to the virtual network via a virtual switch (vSwitch). The internal network virtual machine VM1 and the external network virtual machine VM2 are configured to different virtual switches or VLANs to ensure that their network traffic does not interfere with each other.

[0046] Internal network virtual machine VM1: Connect to the internal network virtual switch and ensure that only internal network users are allowed to access it.

[0047] External virtual machine VM2: Connect to the external virtual switch and ensure that only external users are allowed to access it.

[0048] 6. Network isolation technology

[0049] Virtual networking technology allows for strict control over network access between virtual machines. In this invention, the VLAN function provided by KVM is used to isolate virtual machines from the network. Each virtual machine is assigned a virtual network identifier (VLAN ID) and can only access network traffic with the same VLAN ID. This ensures complete isolation between internal and external network traffic, preventing data leakage or unauthorized access.

[0050] 7. Cloud Drive File Transfer Rules

[0051] Each network user uploads a file to the corresponding VM, and the file is stored in encrypted storage after integrity checks.

[0052] The file transfer processing unit periodically scans each VM, extracts files that need to be exchanged, and performs security analysis, including virus detection and content review.

[0053] Approved files are transferred to the target network VM, and all file transfers are encrypted using TLS.

[0054] Access to the corresponding VM files by target network users must be restricted through multi-factor authentication (MFA) and ACL rules.

[0055] 8. Key Safety Measures

[0056] Storage encryption: Files are stored using AES-256 encryption.

[0057] Network layer isolation: Cloud disks provide independent access control for users on multiple networks to prevent unauthorized access.

[0058] Access control: Implement fine-grained user permission management based on OAuth2.0 and LDAP.

[0059] Operation log auditing: Records all operations such as uploading, downloading, deleting, and file transfer, and supports administrator auditing.

[0060] Example:

[0061] The implementation of this solution requires a physical server as a foundation. On the physical server, a Linux operating system, such as CentOS, is installed. After the operating system installation is complete, the KVM virtualization management program is installed and deployed, mainly including libvirt and QEMU. libvirt manages the entire lifecycle of virtual machines, covering operations such as creation, startup, stopping, and pausing; QEMU simulates hardware devices, enabling interaction between virtual machines and physical hardware devices. Next, the host management system is installed to manage the overall system operations.

[0062] The host management system provides virtual machine management functions, which administrators can operate through the web UI. Users can initiate virtual machine creation requests through the host management system, creating VM1 (cloud disk system) for intranet users and VM2 (cloud disk system) for internet users using pre-stored software images.

[0063] Users configure key virtual machine parameters sequentially in the virtual machine management module, such as the virtual machine name (VM1 or VM2) and the operating system type (selected from the host management system's image library). Then, based on business load and performance requirements, they set resource parameters such as the number of CPU cores and memory size. For VM1 running lightweight applications with low concurrent access, 1-2 CPU cores and 2-4GB of memory can be allocated; for VM2 handling complex business logic, 4 or more CPU cores and 8GB or more of memory are required.

[0064] During storage configuration, users can choose to allocate virtual disks (vDisks) from the host machine's storage pool. They can create entirely new virtual disk files or associate them with existing storage device images within the system, meeting diverse storage needs. After submitting the parameter settings, the host system, in conjunction with the KVM virtualization management program libvirt, extracts the corresponding operating system image from the host machine's image library based on the user's configuration and creates the virtual machine on the physical server. Once created, the virtual machine is tightly coupled with the host machine's management system. Subsequent data generated by the virtual machine, including system file updates and user storage data, will be stored in the storage resources allocated by the host machine for unified management and maintenance.

[0065] Each virtual machine also needs to be allocated a virtual network interface card (vNIC). The network mode of the virtual NIC can be flexibly selected according to actual needs, such as bridged mode, NAT mode, or host-only mode. For VM1, if it is expected to communicate directly with other devices on the internal network, bridged mode can be selected and it should be connected to the internal network virtual switch; for VM2, if it is mainly used for communication with the external network, NAT mode or connecting to the external network through a specific external network virtual switch is more suitable. In addition, to enhance the security of virtual machine data, encryption settings can be enabled for virtual disks, such as using dm-crypt encryption technology.

[0066] 1) File upload and initial storage

[0067] Each network user uploads files to their corresponding VM (internal network users upload to VM1, external network users upload to VM2) via the cloud disk client application or web interface. During the upload process, the client calculates the file's hash value using the SHA-256 hash algorithm and transmits it along with the file to the target VM. The cloud disk server program within the VM receives the file, recalculates the hash value, and compares it with the value sent by the client. If they match, the file passes the integrity check. Subsequently, the cloud disk system within the VM encrypts the file using the AES-256 encryption algorithm and stores it in the VM's local cloud disk storage area. Simultaneously, the cloud disk system within the VM records basic metadata of the file, such as filename, file size, upload time, uploading user, and a unique identifier within the VM's cloud disk, for subsequent management.

[0068] 2) File transfer and cache storage

[0069] Users in each VM region issue file transfer commands to users in other network regions, and the VM's cloud disk system transfers the files to a dedicated file exchange cache on the host system. During the transfer, the VM cloud disk system simultaneously transmits the file's metadata and the VM's ownership information to the host system.

[0070] 3) Host system scanning and processing

[0071] The host system scans the file exchange buffer at preset time intervals. After identifying files in the buffer that need processing, it first performs a virus check. The host system calls upon its integrated professional antivirus software engine, using virus signature matching technology to compare file bytes with a virus signature database. Simultaneously, it employs heuristic scanning to analyze file behavior patterns and structural characteristics to determine if the file is infected. If a virus is detected, the host system immediately marks the file as unsafe in its own management system, preventing its further circulation and sending an alert to the administrator. The administrator can view the virus detection report in the host system management console, including information such as the virus type, the original VM and path of the infected file, and then take measures such as isolating the file or attempting virus removal and repair.

[0072] After a virus scan confirms the file is free of infection, the host system performs a content review. Using built-in content review tools, it analyzes the file content based on the company's customized security policies and compliance requirements. Regular expression matching identifies structured sensitive information such as ID card numbers and bank card numbers, while keyword matching and semantic analysis identify unstructured data such as core business secrets. If a file contains sensitive information that violates security policies, such as unmasked customer ID information, and the file is intended for transmission to the external VM2 network, the host system marks the file as non-compliant, blocks transmission, and notifies the administrator. The administrator can flexibly adjust content review rules within the host system to adapt to new security needs arising from changes in the company's business. For example, when the company launches new business involving new types of sensitive information, the administrator can add corresponding review rules, and the host system will follow these new rules when subsequently scanning and reviewing files.

[0073] 4) Approval of file transfer and updates

[0074] Files that have passed virus detection and content review are transferred by the host system to the target VM's cloud disk storage area according to a preset transmission strategy. The transmission process uses the TLS encryption protocol to ensure data confidentiality and integrity. The host system establishes a TLS encrypted connection with the target VM to send the file in encrypted form. After receiving the encrypted file, the target VM decrypts it using a pre-shared key and performs another integrity check to ensure error-free file transmission. The host system tracks and records the entire file transmission process, including start time, end time, transmission path, and any abnormal situations. After file transmission is complete, the host system updates the file's status in the file exchange buffer to "transmitted," and simultaneously notifies both the source and target VMs to update the file status and related metadata, such as the file's latest storage location, for easy subsequent querying and management.

[0075] The specific embodiments described above only illustrate the design principles of the present invention. The shapes and names of the components in this description may differ and are not limited. Therefore, those skilled in the art can modify or make equivalent substitutions to the technical solutions described in the foregoing embodiments; and these modifications and substitutions do not depart from the inventive spirit and technical solutions of the present invention, and should all fall within the protection scope of the present invention.

Claims

1. A file transfer method for cloud disks based on KVM virtualization technology, characterized in that, include: On the physical server, create multiple virtual machines (VMs) with completely disconnected network layer communication, with different network zones corresponding to different VMs; configure a virtual switch for each VM to connect to the virtual network; set up a host management system to manage the VMs and configure a file exchange cache. When a user in a network area uploads a target file to the virtual machine (VM) corresponding to their network area, it is stored in the local cloud disk storage area of ​​the VM after verification; the user in the current network area sends a file transfer command to the target VM through the network between virtual switches; the target file stored in the current VM is stored in the file exchange cache area. When the host management system periodically scans the file exchange buffer and detects the target file that needs to be transferred, it stores the target file in the local cloud disk storage area of ​​the target virtual machine (VM). Users in the network area where the target virtual machine (VM) is located can obtain the target file from the local cloud disk storage area.

2. The file transfer method for cloud disks based on KVM virtualization technology as described in claim 1, characterized in that, Each virtual machine is assigned a virtual network identifier (VLAN ID) and can only access network traffic with the same VLAN ID.

3. The file transfer method for cloud disks based on KVM virtualization technology as described in claim 1, characterized in that, When a user in a network region uploads a target file to the virtual machine (VM) corresponding to their network region, the client uses the SHA-256 hash algorithm to calculate the hash value of the target file and transmits it to the current VM along with the target file. After receiving the target file, the current VM calculates the hash value again and compares it with the value sent by the client. If they match, the target file passes the integrity check. Subsequently, the current VM encrypts the target file using the AES-256 encryption algorithm and stores it in the local cloud disk storage area. The current virtual machine (VM) records the basic metadata of the target file, including the file name, file size, upload time, upload user, and a unique identifier within the local cloud disk storage area, for subsequent management.

4. The file transfer method for cloud disks based on KVM virtualization technology as described in claim 3, characterized in that, During the transmission process, the current virtual machine (VM) simultaneously transmits the relevant metadata of the target file and the information of the virtual machine to the host management system.

5. The file transfer method for cloud disks based on KVM virtualization technology as described in claim 1, characterized in that, When the host management system periodically scans the file exchange buffer and detects the target file that needs to be transferred, it includes: The host system calls the integrated professional antivirus software engine and uses virus signature matching technology to compare the file bytes with the virus signature database. At the same time, it uses heuristic scanning to analyze the file behavior patterns and structural characteristics to determine whether the file is infected. If a virus is detected, the host system immediately marks the file as unsafe in its own management system, prevents it from continuing to circulate, and sends an alert to the administrator.

6. The file transfer method for cloud disks based on KVM virtualization technology as described in claim 5, characterized in that, After the virus detection is completed and the file is found to be uninfected, the host system performs a content review. If the file contains sensitive information that does not comply with the security policy, the host system marks the file as violating the rules, blocks its transmission, and notifies the administrator.

7. The file transfer method for cloud disks based on KVM virtualization technology as described in claim 6, characterized in that, Files that have passed virus detection and content review are transferred by the host system to the local cloud disk storage area of ​​the target virtual machine (VM) according to a preset transmission strategy. The transmission process uses the TLS encryption protocol; the host system establishes a TLS encrypted connection with the target VM to send the target file in encrypted form. Upon receiving the encrypted file, the target VM decrypts it using a pre-shared key and performs another integrity check to ensure error-free file transmission. The host system tracks and records the entire file transmission process. After the file transmission is complete, the host system updates the file's status in the file exchange buffer to "transmitted" and simultaneously notifies both the source and target VMs to update the file status and related metadata.

8. The file transfer method for cloud disks based on KVM virtualization technology as described in claim 1, characterized in that, There are multiple physical servers, each configured with multiple network ports, used for connecting switches between the multiple physical servers to ensure complete physical isolation of the network.

Images