Virtual desktop sandbox isolation method and system, storage medium and electronic equipment

Abstract

The invention discloses a virtual desktop sandbox isolation method and system, a storage medium and electronic equipment, and relates to the technical field of computers. The method comprises the steps of obtaining a request of a user for creating a virtual desktop; an isolation sandbox environment is constructed based on the request, the isolation sandbox environment comprises an independent process namespace, a file system namespace and a network namespace, and a process tree of the virtual desktop is isolated into the process namespace; and creating a file isolation environment in the file system namespace, and creating a network isolation environment in the network namespace. By implementing the technical scheme provided by the invention, system-level isolation between the virtual desktop and the host system is realized.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a virtual desktop sandbox isolation method, system, storage medium, and electronic device. Background Technology

[0002] With the rapid development of information technology, enterprise office environments are becoming increasingly complex, and the requirements for terminal security are also increasing. Virtual desktop technology, as a new type of terminal solution, can provide users with an independent office environment, effectively reducing the complexity of terminal management, and has been widely used in enterprise office, remote work, and other scenarios.

[0003] Currently, to improve resource utilization efficiency, virtual desktops typically adopt an implementation that shares the operating system kernel with the host. In this approach, virtual desktops can directly access the host's file system and network resources. For example, programs within a virtual desktop can directly access files on the host and use the host's network connection for data transfer. However, this shared implementation makes it difficult to effectively isolate virtual desktops from the host system. Especially in enterprise environments, different business scenarios may need to run in their own independent environments. How to maintain the lightweight and efficient characteristics of virtual desktops while achieving effective isolation from the host system has become a pressing issue. Summary of the Invention

[0004] In view of this, this application provides a virtual desktop sandbox isolation method, system, storage medium, and electronic device.

[0005] In a first aspect, this application provides a virtual desktop sandbox isolation method, the method comprising: Get the user's request to create a virtual desktop; An isolated sandbox environment is constructed based on the request. The isolated sandbox environment includes an independent process namespace, a file system namespace, and a network namespace, and the process tree of the virtual desktop is isolated within the process namespace. Create a file isolation environment in the file system namespace and a network isolation environment in the network namespace.

[0006] By adopting the above technical solution, an isolated sandbox environment containing independent process namespaces, file system namespaces, and network namespaces is constructed based on user requests to create virtual desktops. The process tree of the virtual desktop is isolated within the process namespace. At the same time, a file isolation environment is created in the file system namespace, and a network isolation environment is created in the network namespace. Thus, while maintaining the lightweight and efficient characteristics of the virtual desktop and the physical host sharing the operating system kernel, system-level isolation between the virtual desktop and the host system is achieved. This effectively prevents programs in the virtual desktop from directly accessing the host file system and network resources, significantly improving the security of the virtual desktop environment and meeting the needs of enterprises for independent operating environments in different business scenarios.

[0007] Optionally, creating a file isolation environment in the file system namespace includes: Within the file system namespace, a separate root file system is loaded for the virtual desktop, and an encrypted volume is created for securely storing user data of the virtual desktop. The system directory is bound to the root file system in read-only mode, and a separate temporary directory is created in the root file system. The temporary directory is used to store the temporary running data of the virtual desktop. The encrypted volume is mounted to the user directory, which is used to store the user data of the virtual desktop, forming a file isolation environment.

[0008] Optionally, creating an encrypted volume for securely storing the virtual desktop user data includes: Obtain user authentication information or server authorization information; The user data storage space of the virtual desktop is encrypted based on the user authentication information or server authorization information to form the encrypted volume. The encrypted volume is accessible during the operation of the virtual desktop and is automatically unmounted after the virtual desktop is closed.

[0009] Optionally, creating a network isolation environment in the network namespace includes: The virtual desktop is connected to the network namespace via the system call setns; Create a virtual network device outside the network namespace, and then migrate the virtual network device to the inside of the network namespace; Configure the network environment within the network namespace, including starting a loopback device for internal communication and configuring network routing so that network traffic of the virtual desktop is forwarded through the virtual network device, forming a network isolation environment.

[0010] Optionally, after creating a file isolation environment in the file system namespace and a network isolation environment in the network namespace, the method further includes: Scan the application installation directory in the file isolation environment to obtain the application configuration files and corresponding application icons; Based on the network isolation environment, a connection is established with the policy server through a secure communication channel, and the obtained application configuration file and corresponding application icon are uploaded to the policy server. The system receives control policies for the virtual desktop returned by the policy server. The control policies include at least an application access control list, a network access control policy, a user behavior audit configuration, and a peripheral device usage permission configuration. The virtual desktop is managed and controlled according to the control policy.

[0011] Optionally, the method further includes: Receive a user's request to create multiple virtual desktops, each of which corresponds to an independent workspace; Each virtual desktop is built with an independent, isolated sandbox environment to enable multiple virtual desktops to run simultaneously and to support switching between them in the host environment; Different space login credentials are generated based on user information and space identifiers, wherein the space identifier includes the domain name suffix of the corresponding space; Based on the login credentials, the system obtains control policies for different virtual desktop spaces from the policy server and displays authorized applications in the corresponding workspaces according to the control policies.

[0012] Optionally, the virtual desktop and the physical host's operating system have a parasitic architecture relationship. The virtual desktop runs based on the physical host's operating system kernel, shares the physical host's system call interfaces and hardware resources, and achieves system-level isolation through namespace isolation technology.

[0013] A second aspect of this application provides a virtual desktop sandbox isolation system, characterized in that the system comprises: The request retrieval module is used to retrieve user requests to create virtual desktops; A sandbox building module is used to build an isolated sandbox environment based on the request. The isolated sandbox environment includes an independent process namespace, a file system namespace, and a network namespace, and isolates the process tree of the virtual desktop into the process namespace. An isolation environment creation module is used to create file isolation environments in the file system namespace and network isolation environments in the network namespace.

[0014] A third aspect of this application provides a computer storage medium storing a plurality of instructions adapted for loading by a processor and executing the method steps described above.

[0015] A fourth aspect of this application provides an electronic device, comprising: a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the above-described method steps.

[0016] In summary, one or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: This application constructs an isolated sandbox environment containing independent process namespaces, file system namespaces, and network namespaces based on user requests to create virtual desktops. It isolates the virtual desktop's process tree within the process namespace, while simultaneously creating a file isolation environment in the file system namespace and a network isolation environment in the network namespace. This achieves system-level isolation between the virtual desktop and the host system while maintaining the lightweight and efficient characteristics of sharing the operating system kernel between the virtual desktop and the physical host. It effectively prevents programs in the virtual desktop from directly accessing the host's file system and network resources, significantly improving the security of the virtual desktop environment and meeting the needs of enterprises for independent operating environments in different business scenarios. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a virtual desktop sandbox isolation method provided in an embodiment of this application; Figure 2 This is a schematic diagram of a strategy configuration interface provided in an embodiment of this application; Figure 3 This is a schematic diagram of a user login interface provided in an embodiment of this application; Figure 4 This is a schematic diagram illustrating the operation of a virtual interface provided in an embodiment of this application; Figure 5 This is a schematic diagram of a virtual desktop sandbox isolation system provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0018] Explanation of reference numerals in the attached figures: 600, electronic device; 601, processor; 602, communication bus; 603, user interface; 604, network interface; 605, memory. Detailed Implementation

[0019] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0020] In the description of the embodiments of this application, the words "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design that is described as "for example" or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design options. Rather, the use of the words "for example" or "for instance" is intended to present the relevant concepts in a specific manner.

[0021] In the description of the embodiments of this application, the term "multiple" means two or more. For example, multiple systems means two or more systems, and multiple screen terminals means two or more screen terminals. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the indicated technical features. Thus, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0022] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0023] Please refer to Figure 1 A flowchart illustrating a virtual desktop sandbox isolation method is presented. This method can be implemented using a computer program, a microcontroller, or run on a virtual desktop sandbox isolation system. The computer program can be integrated into a computer device or run as a standalone utility application. Specifically, the method includes steps 10 to 30, as follows: Step 10: Obtain the user's request to create a virtual desktop.

[0024] In this embodiment, a virtual desktop can be understood as a lightweight virtualization environment that runs on the operating system kernel of a physical host. It constructs an independent running space through namespace isolation technology, providing users with an independent application running environment and data storage environment, enabling users to perform office operations in an isolated environment. The virtual desktop and the physical host adopt a parasitic architecture, sharing the system call interface and hardware resources of the physical host.

[0025] Specifically, to achieve system-level isolation of the virtual desktop environment, the system first needs to obtain the user's request to create a virtual desktop. This request can be triggered through a graphical user interface, such as by clicking the "New Virtual Desktop" button in the desktop environment or by using a shortcut key combination (e.g., Alt+Ctrl+N). Upon receiving the request, the system parses the parameters contained within, including the target space identifier (e.g., @basics.com, @medium.com, or @high.com), the desired isolation level, and other configuration options. These parameters will be used to subsequently build the corresponding isolated sandbox environment. While parsing the request parameters, the system also verifies whether the current user has permission to create a new virtual desktop and checks whether system resources meet the requirements for creating a new virtual desktop. In this way, the system can create virtual desktop environments with different security levels tailored to the user's specific needs, laying the foundation for subsequent operations such as process isolation, file system isolation, and network isolation. Furthermore, the system records the virtual desktop creation request information, including the creation time, the creating user, and the space identifier; this information can be used for subsequent auditing and management. This user-request-based virtual desktop creation mechanism not only provides a flexible way to manage the desktop environment, but also ensures the reasonable allocation and use of system resources.

[0026] Step 20: Build an isolated sandbox environment based on the request. The isolated sandbox environment includes independent process namespaces, file system namespaces, and network namespaces, and isolates the process tree of the virtual desktop into the process namespace.

[0027] In this embodiment of the application, the isolated sandbox environment refers to an independent system operating environment built using Linux namespace isolation technology. This environment includes a process namespace for isolating process trees, a file system namespace for isolating file access, and a network namespace for isolating network communication. This environment provides a restricted and relatively independent execution space for virtual desktops on the physical host, and can perform system-level isolation of the process behavior, file access, and network communication of virtual desktops, thereby achieving secure control over the virtual desktop operating environment.

[0028] Specifically, to build a secure and isolated virtual desktop environment, the system constructs an isolated sandbox environment based on user-created requests, comprising independent process namespaces, file system namespaces, and network namespaces. The process namespace completely isolates the process trees between virtual desktop environments, ensuring each virtual desktop has an independent process tree view, preventing processes from enumerating, controlling, or interfering with each other. The file system namespace uses OverlayFS and Bind Mount technologies to build an independent root file system (RootFS) and directory structure for each virtual desktop, achieving file access isolation and effectively preventing data leakage and file tampering. The network namespace assigns an independent network environment to each virtual desktop, including independent IP addresses, routing tables, and DNS configurations, enabling different virtual desktops to run in different network environments. After building the isolated sandbox environment, the system uses the setns system call to migrate the virtual desktop's startup process to the newly created process namespace, making it the first process (PID 1) within that namespace. This ensures that all child processes launched within that virtual desktop environment inherit this process namespace, thus achieving complete process tree isolation. This multi-dimensional isolation mechanism provides system-level security for the virtual desktop environment.

[0029] Step 30: Create a file isolation environment in the file system namespace and a network isolation environment in the network namespace.

[0030] Specifically, to achieve complete isolation of the file system and network environment between virtual desktops, the system needs to build corresponding isolation environments in the existing file system namespace and network namespace. Regarding file system isolation, firstly, the bwrap tool is used to bind the system directories (including / etc, / opt, and / usr) to the isolated sandbox environment in read-only mode, ensuring that system files are not modified. Then, OverlayFS technology is used to create an independent file system layer, with the system directory as a read-only lower layer, and a writable temporary directory created in the upper layer for storing runtime data. Simultaneously, an encrypted storage volume is created in the / home directory using VeraCrypt and mounted to the isolated sandbox environment for secure storage of user data, achieving secure isolation of file access. Regarding network isolation, the system first creates and starts a loopback device (lo) in the network namespace. This lo loopback device is a virtual network interface that allows network communication within the system. In this embodiment, the lo loopback device refers to a local network loopback interface created within the network namespace to support network communication within the virtual desktop environment. Then, a tun virtual network device is created using OpenVPN and added to this namespace, assigning independent IP address ranges (e.g., 192.168.1.0 / 24) to each virtual desktop. Next, an independent routing table is configured to forward all network traffic through the tun device, and an independent DNS server (e.g., 8.8.8.8) is set up to achieve complete isolation of network access. This dual isolation mechanism of file system and network not only ensures secure data isolation between different virtual desktop environments, preventing data leakage and file tampering, but also enables independent control of network access, allowing different virtual desktops to run securely in different network environments.

[0031] As an optional embodiment, the step of creating a file isolation environment in a file system namespace may also include the following steps: Step 101: In the file system namespace, load a separate root file system for the virtual desktop, and create an encrypted volume for securely storing user data for the virtual desktop.

[0032] Specifically, to build a secure and isolated file system environment, the system first loads an independent root file system for the virtual desktop within the file system namespace. This can be achieved by calling the `mount` system call to create a temporary file system based on `tmpfs` as the foundation of the root file system, and then using OverlayFS technology to build a layered file system structure on top of this temporary file system. Simultaneously, the system uses the disk encryption software VeraCrypt to create an encrypted volume for securely storing user data. This encrypted volume employs the AES-256 encryption algorithm and is encrypted with a randomly generated key, ensuring that even if the encrypted volume is copied or extracted, unauthorized users cannot access the data within it. This combination of an independent root file system and an encrypted volume provides a basic file system isolation environment for the virtual desktop, ensuring the security of file access.

[0033] As an optional embodiment, the step of creating an encrypted volume for securely storing user data of virtual desktops may also include the following steps: Step 1011: Obtain user authentication information or server authorization information.

[0034] Specifically, when a user requests to create a virtual desktop, the system prompts the user to enter authentication information, including username and password, through a graphical authentication dialog box; or it sends an authentication request to the authentication server through a secure channel to obtain an authorization token issued by the server. The user authentication information is used to derive a key using the PBKDF2 (Password-Based Key Derivation Function 2) algorithm, generating key material for the encrypted volume; while the server authorization information is received through a TLS secure channel, and the key transmission process is protected using RSA asymmetric encryption. This authentication mechanism ensures that only authorized users or legitimate server requests can create and access the encrypted volume, providing an authentication foundation for subsequent encrypted data storage.

[0035] Step 1012: Encrypt the user data storage space of the virtual desktop based on user authentication information or server authorization information to form an encrypted volume. The encrypted volume is accessible during the operation of the virtual desktop and is automatically unmounted after the virtual desktop is closed.

[0036] Specifically, after obtaining the authentication information, the system uses the disk encryption software VeraCrypt to create an encrypted volume and encrypt the data based on this authentication information. First, based on the key material generated from the user authentication information or server authorization information, a fixed-size (e.g., 10GB) encrypted volume file is created using the AES-256 encryption algorithm. Then, an ext4 file system is created within the encrypted volume to store user data for the virtual desktop. The system monitors the running status of the virtual desktop and automatically mounts the encrypted volume using the corresponding authentication information when the virtual desktop starts, making it accessible in the / home directory. When a virtual desktop shutdown signal is detected, the system automatically performs an umount operation to unmount the encrypted volume and calls the command-line tool veracrypt to close the encrypted volume, ensuring that the encrypted volume cannot be accessed after the virtual desktop is closed. This authentication-based encrypted storage mechanism not only achieves secure storage of user data but also ensures that the encrypted volume is only accessible during the virtual desktop's operation through automatic mounting and unmounting mechanisms, effectively preventing unauthorized access and data leakage. Simultaneously, the system periodically checks the integrity of the encrypted volume to ensure that the data has not been tampered with and promptly notifies the user of any anomalies, providing comprehensive data security protection.

[0037] Step 102: Bind the system directory to the root file system in read-only mode, and create a separate temporary directory in the root file system. The temporary directory is used to store the temporary running data of the virtual desktop.

[0038] Specifically, after establishing the basic file system environment, the system needs to configure the necessary system environment for the virtual desktop. The `bwrap` tool performs a `bind mount` operation, binding critical directories of the host system (such as ` / etc`, ` / opt`, ` / usr`, etc.) to the root file system of the virtual desktop in read-only mode. This ensures that the virtual desktop can use system resources normally while preventing unauthorized modification of system files. Additionally, separate temporary directories ` / tmp` and ` / var / tmp` are created in the root file system. These directories, based on the `tmpfs` file system, are used to store temporary data generated during the virtual desktop's operation, such as application cache files and session data. These temporary directories are cleared when the virtual desktop is shut down, leaving no trace on the physical disk, further enhancing data security.

[0039] Step 103: Mount the encrypted volume to the user directory, which is used to store user data for the virtual desktop, forming a file isolation environment.

[0040] Specifically, after configuring the system and temporary directories, the system mounts the previously created encrypted volume to the / home user directory of the virtual desktop. First, the encrypted volume is mounted using the command-line tool veracrypt provided by the disk encryption software VeraCrypt, mapping the encrypted volume to a block device. Then, the block device is mounted to the / home directory using the mount system call, making it a dedicated space for storing user data within the virtual desktop environment. In this user directory, all file read and write operations are processed through an encryption layer, ensuring that data is always stored in encrypted form. This configuration forms a complete file isolation environment, enabling read-only access to system files, secure storage of temporary data, and encrypted protection of user data, effectively preventing data leakage and file tampering, and providing comprehensive file system security for the virtual desktop.

[0041] As an optional embodiment, the step of creating a network isolation environment in a network namespace may also include the following steps: Step 201: Connect the virtual desktop to the network namespace via the system call setns.

[0042] Specifically, to connect a virtual desktop to an independent network environment, the system first locates and obtains the file descriptor of the process corresponding to the network namespace based on its PID. Then, it switches the virtual desktop process to the target network namespace using the `setns` system call. `setns` is a system call mechanism provided by Linux that allows a process to join an existing namespace. After the namespace switch is complete, the system verifies whether the virtual desktop process has successfully migrated to the new network namespace and confirms that it is completely isolated from the host system's network stack. This network namespace switching mechanism ensures that the virtual desktop can only access its dedicated network devices and protocol stack, thus laying the foundation for subsequent network configuration and isolation management, effectively guaranteeing the independence and security of the virtual desktop's network environment.

[0043] Step 202: Create a virtual network device outside the network namespace and migrate the virtual network device inside the network namespace.

[0044] Specifically, after the virtual desktop is connected to the network namespace, the system needs to configure a dedicated network device for it. First, a virtual network device of type .tun is created on the host system (outside the network namespace) using OpenVPN. This device is used to enable communication between the virtual desktop and the external network. During creation, a virtual network interface is created using the command `ip tuntap add dev tun0 mode tun`, and then started using `ip link set tun0 up`. Subsequently, the system uses `ip link settun0 netns`.<namespace>The command will create a virtual network device and migrate it to the network namespace of the virtual desktop, making it the only external communication interface within the namespace. This creation and migration mechanism of the virtual network device realizes physical isolation of network access, ensuring that the network traffic of the virtual desktop can only be transmitted through the specified virtual device.

[0045] Step 203: Configure the network environment inside the network namespace, including starting the loopback device for internal communication, and configuring network routing to forward the network traffic of the virtual desktop through the virtual network device, forming a network isolation environment.

[0046] Specifically, after completing the configuration of the virtual network device, the system needs to configure the network environment inside the network namespace. First, start the loopback device (lo) inside the network namespace for internal network communication of the virtual desktop; then configure a dedicated IP address segment for the virtual network device. Then configure the network routing table to direct all external communication traffic to the virtual network device and set up network address translation rules. At the same time, configure an independent DNS server to ensure that the virtual desktop can perform domain name resolution normally. This network environment configuration not only realizes complete isolation of virtual desktop network access, but also ensures that all network traffic is forwarded through the virtual network device through routing configuration, thereby achieving precise control and security protection of network access.

[0047] As an optional embodiment, after the step of creating a file isolation environment in the file system namespace and creating a network isolation environment in the network namespace, the following steps can be included: Step 301: Scan the application installation directory in the file isolation environment to obtain the application configuration file and the corresponding application icon.

[0048] Specifically, in order to realize precise control of the applications in the virtual desktop, the system first needs to scan the application information in the file isolation environment. By recursively traversing the / usr / share / applications directory to obtain all *.desktop format application configuration files, the application name, execution path, startup parameters, etc. are parsed from the configuration file; at the same time, the icon files in the / usr / share / icons and / usr / share / pixmaps directories are read, and the mapping relationship between the application configuration information and the corresponding icon files is established. The system uses the os module of Python for file traversal, parses the content of the.desktop file through the configparser module, and uses the PIL library to process the icon file, ensuring that the obtained application information is complete and accurate. This application information collection mechanism provides basic data support for subsequent policy control.

[0049] Step 302: Based on the network isolation environment, establish a connection with the policy server through a secure communication channel, and upload the obtained application configuration file and corresponding application icon to the policy server.

[0050] Specifically, after obtaining the application information, the system needs to securely transmit this information to the policy server. First, create a TLS secure communication channel through OpenSSL, which is an HTTPS encrypted connection established based on the TLS encryption protocol, used to ensure the security of data transmission between the virtual desktop environment and the policy server. Then use RSA-2048 key pairs for identity authentication, and use the AES-256-GCM algorithm to encrypt communication data; then package the collected application configuration file and icon into JSON format, including fields such as application basic information, startup configuration, icon Base64 encoding, etc. The system establishes an encrypted connection with the policy server through the HTTPS protocol (port 443), and uses the POST method to send the data packet to the server's designated interface (such as / api / v1 / desktop / apps). This secure communication mechanism ensures that application information cannot be stolen or tampered with during transmission.

[0051] Step 303: Receive the control policy returned by the policy server for the virtual desktop, which includes at least application access control list, network access control policy, user behavior audit configuration, and peripheral use permission configuration.

[0052] Specifically, after uploading the application information, the system waits for the policy server to return the control policy. Based on the pre-set security rules and user permission configuration, the policy server generates detailed control policies for this virtual desktop, including but not limited to: application access control list (specifying the list of allowed applications and their startup parameters), network access control policy (defining allowed IP address segments, port ranges, domain name white lists, etc.), user behavior audit configuration (setting the type of operations that need to be recorded, log storage location, audit level, etc.), and peripheral use permission configuration (regulating the use permissions of USB devices, printers, cameras, etc. peripherals). The system receives these policy configurations through the previously established secure channel and parses them into a rule set that the system can execute.

[0053] Step 304: Control the virtual desktop according to the control policy.

[0054] Specifically, as an optional implementation, the iptables can be used to configure the network access control rules, and the precise control of the network access can be realized through the -A INPUT and -A OUTPUT rule chains. The AppArmor can also be used to configure the mandatory access control rules, and the application program can only access the file paths and system resources allowed by the policy. Meanwhile, the system can configure the audit rules through the auditd service to record the operation behaviors of the user, including the file access, network connection, program execution and other events; the peripheral access control can be configured through the udev rules, and only the peripherals permitted by the policy can be identified and used. The system can also manage the user sessions through the systemd-logind service to ensure that the virtual desktop is always subject to the policy constraints during the running process. This multi-dimensional control mechanism realizes the precise control of the virtual desktop environment and effectively prevents unauthorized operations and security risks.

[0055] It should be noted that, in order to ensure that the virtual desktop always executes the latest control policy, the system periodically checks the policy update through a background daemon. For example, the system sends a policy version query request to the policy server through the established TLS secure channel every 5 minutes, and the request carries the version number of the current policy; when the policy version number returned by the server is greater than the local version, the system immediately acquires the latest control policy through the HTTPS protocol, and reloads the control rules such as the AppArmor configuration, iptables rules, audit configuration through the systemctl reload command, to ensure that the virtual desktop runs according to the latest policy. This policy dynamic update mechanism guarantees the timeliness and effectiveness of the control policy.

[0056] As an optional embodiment, the virtual desktop sandbox isolation method provided by the embodiment of the application also supports creating multiple spaces, creating an independent isolated environment for each space, and supporting simultaneous startup of multiple spaces. The specific process can include the following steps: Step 401: receiving a request of a user to create multiple virtual desktops, each virtual desktop corresponding to an independent workspace.

[0057] Specifically, in order to meet the needs of users for different security level working environments, the system supports creating multiple virtual desktop spaces with different security levels. The system receives a user's space creation request through a graphical login interface, the user logs in to the system using a unified username, and the system automatically appends different domain name suffixes (such as @basics.com for a basic security level space, @medium.com for a medium security level space, and @high.com for a high security level space) after the username according to different security levels. The system allocates an independent work area ID for each security level space and identifies different security level desktop sessions through the XDG_SESSION_DESKTOP environment variable. This multi-level space creation mechanism provides users with security level differentiated working environments.

[0058] Step 402: Build an independent isolated sandbox environment for each virtual desktop to enable multiple virtual desktops to run simultaneously and support switching in the host environment.

[0059] Specifically, the system needs to build an independent isolated environment for each space. The system creates an independent namespace set for each virtual desktop through the unshare system call to ensure that each virtual desktop runs in a completely isolated environment. For example, for spaces with different security levels, the high security level space (@high.com) has the most stringent isolation characteristics, the medium security level space (@medium.com) has moderate isolation, and the basic security level space (@basics.com) maintains basic isolation protection. The system allocates differentiated resource quotas for spaces with different levels through cgroups v2, and the high security level space obtains priority resource guarantee. Users can quickly switch between spaces with different security levels through shortcut keys (such as Alt+Space). The system ensures the security of the switching process through the D-Bus session bus. This multi-level isolation mechanism achieves strict isolation between spaces with different security levels.

[0060] It should be noted that the technical solutions of the embodiments of the present application support parallel running of multiple virtual desktop spaces on the same physical host. Specifically, the system creates an independent running environment for each virtual desktop through namespace technology: process isolation is achieved through PID namespace, so that processes in different virtual desktops are invisible and cannot access each other; an independent file system view is provided for each virtual desktop through mount namespace, and different user data directories are loaded through VeraCrypt encrypted volumes to ensure data isolation; and an independent network stack and virtual network device are allocated for each virtual desktop through network namespace. This multi-space parallel mechanism allows users to run different scenarios of working environments on the same device simultaneously, such as separating personal and work environments, quickly switching between development and production environments, or running multiple test environments simultaneously, thereby meeting the isolation needs of users in different scenarios. This "one machine, multiple uses" design not only improves hardware resource utilization, but also ensures the secure isolation between different use scenarios.

[0061] Step 403: Generate different space login credentials based on user information and space identifier, wherein the space identifier includes the domain name suffix of the corresponding space.

[0062] Specifically, in order to realize the differentiated management and control of multi-level spaces, the system generates login credentials based on the username and space suffix. The system obtains the basic username of the user, and automatically appends the corresponding domain name suffix according to the selected security level (such as user@basics.com, user@medium.com, user@high.com), and then generates login credentials containing security level information using the HMAC-SHA256 algorithm. The credentials contain user identity, security level identifier, access rights and other information, and are signed using an RSA private key to ensure the authenticity of the credentials. This security level-based credential generation mechanism provides an identity basis for the differentiated management and control of different level spaces.

[0063] Step 404: Obtain control policies for different virtual desktop spaces from the policy server according to the space login credentials, and display authorized application programs in the corresponding work area according to the control policies.

[0064] Specifically, after generating login credentials of different security levels, the system obtains the corresponding control policy from the policy server. The system sends login credentials with different domain suffixes to the policy server through the HTTPS protocol, and the server returns differentiated control policies according to the suffix identifiers (@basics.com, @medium.com, and @high.com): the high-security level space (@high.com) only displays applications that have passed strict security audits and implements the most stringent network access control; the medium-security level space (@medium.com) allows the use of some controlled applications and implements moderate network restrictions; and the basic-security level space (@basics.com) provides basic application access permissions. The system displays only application icons authorized for the corresponding security level in the respective workspace, and ensures that the applications run within the permission range of the corresponding security level through AppArmor mandatory access control. This security level-based differentiated control mechanism realizes precise security management of multiple level spaces.

[0065] Among them, the technical scheme provided by the embodiments of the application supports configuring the application list and resource access policy that can be used in each virtual desktop environment through a centralized server. Specifically, the application white list / black list mechanism is used to control available applications, and the system ensures that only authorized applications can run through AppArmor mandatory access control; differentiated permission policies are dynamically generated according to the role attributes (such as developers, administrators) and use scenarios (such as office, development) of users, or manually defined and set corresponding policies, including but not limited to file access permissions, network access rules, and peripheral use restrictions; the system maintains periodic communication with the policy server through a TLS encrypted channel, obtains policy updates in real time and dynamically applies them, and takes effect without restarting the virtual desktop. This centralized control mechanism based on the server not only ensures the compliance of virtual desktop use, but also provides flexible policy adjustment capabilities, allowing administrators to adjust security control policies at any time according to actual needs.

[0066] See Figure 2 A user interface diagram for policy configuration is provided for the embodiments of the application to realize precise control of different virtual desktop spaces. The interface uses a step-by-step configuration mode, including two main steps: "basic information" and "configuration policy".

[0067] In combination with Figure 2 A. In the basic information configuration step, the organization affiliation of the policy is determined by "department affiliation"; the "policy name" is set to "basic area-control policy", which is used to identify the control policy for the basic security level space; and the "effective period" supports both permanent and time-limited modes to meet different effectiveness requirements; "Policy Templates" allows referencing preset configuration templates to improve configuration efficiency; "Distribution Mode" adopts a self-distribution mechanism, allowing administrators to precisely select target end users; "Workspace" is set as the basic workspace, corresponding to the virtual desktop environment of the @basics.com domain.

[0068] Combination Figure 2 B. After entering the policy configuration step, the system provides a wealth of control options, including screen control, watermark control, media control, and print control, among other dimensions. Watermark control supports the display of various elements such as phone numbers and dates, and allows adjustment of font size, color, and transparency. This refined policy configuration mechanism is deeply integrated with the multi-space virtual desktop solution of this application, enabling administrators to formulate differentiated control policies for virtual desktop spaces with different security levels, achieving comprehensive control from basic security levels to high security levels.

[0069] This policy configuration mechanism is closely integrated with the virtual desktop multi-space solution of this application. Through centralized policy management, it enables differentiated control over spaces with different security levels, ensuring that each virtual desktop environment strictly adheres to the preset security rules. After the policy is configured, the system sends the policy to the terminal in real time via an encrypted channel, and it automatically takes effect in the corresponding virtual desktop space.

[0070] It should be further explained that this application adopts a lightweight "parasitic" architecture design. All virtual desktop environments share the same host operating system kernel, but complete isolation of the user space is achieved through namespace technology. Specifically, the system does not need to simulate the hardware layer or run an independent operating system kernel like traditional virtual machines. Instead, it achieves isolation directly at the user space level through the Linux kernel's namespace and cgroups mechanisms. The virtual desktop environments run in a containerized manner, sharing kernel resources and system calls with the host system, but have independent file system views, process spaces, and network environments. This architecture design significantly reduces system resource overhead, has a fast startup speed, low memory consumption, and supports rapid switching between multiple virtual desktop environments, providing users with a dual-system-like experience, but avoiding the cumbersome reboot process and high resource consumption problems of traditional dual-system solutions.

[0071] To illustrate the specific effects of the embodiments of this application in practical applications, the following examples are provided using the interfaces of system login authentication and virtual desktop operation.

[0072] Please see Figure 3 This diagram illustrates a user login interface provided in an embodiment of this application. When a user needs to access the system, they first need to fill in their personal account information in the account input box and the corresponding authentication password in the password box. Next, the user needs to select a target workspace (including basic, intermediate, and advanced workspaces) from the drop-down menu according to their actual business needs. The system will then directly start the corresponding virtualization runtime environment based on the user's selected workspace using namespace isolation technology.

[0073] Please see Figure 4 This diagram illustrates the operation of a virtual interface according to an embodiment of this application. After successful user login, the system launches a virtual desktop environment with the corresponding security level within an independent namespace. Users can switch between environments of different security levels via the workspace selection menu at the top of the interface; each switch triggers a re-isolation of the namespace. In actual operation, the integrated applications on the right (such as browsers and WPS Office) run within the current namespace, ensuring data security through encrypted storage and guaranteeing that environments of different security levels do not interfere with each other through network isolation strategies. This namespace-based isolation approach effectively ensures the secure isolation and access control of business data at different security levels.

[0074] To better understand the specific applications of the embodiments of this application, several typical scenarios are illustrated below. The embodiments of this application can be applied to various security isolation scenarios. For example, in the scenario of government and enterprise terminal security management, users can create independent virtual desktops for office network and internet access respectively. Namespace isolation and encrypted storage ensure that processes in the two environments are invisible to each other, files are isolated, and networks are completely separated, effectively preventing internal network data leakage and external network security threats.

[0075] In a software development environment, developers can run two virtual desktops simultaneously: a development and testing environment and a production deployment environment. The development environment is configured with a complete development toolchain and allows access to the test network, while the production environment strictly limits access to only necessary deployment operations and the production network, thereby reducing the risk of accidental operation.

[0076] In a corporate office setting, users can create two virtual desktops: a personal data space and a company workspace. The personal space is used to handle private matters and store personal files, while the workspace strictly adheres to corporate security policies and manages company data in a unified manner, achieving a strict separation between personal privacy and work data.

[0077] In security research scenarios, security analysts can create restricted sandbox virtual desktop environments where they can run and analyze suspicious programs. These environments have strict resource limits and network isolation to ensure that even if malicious programs run, they will not affect the security of the host system and other environments.

[0078] These application scenarios can fully utilize the technical features of multi-space isolation, differentiated management and control, and dynamic policy distribution in the embodiments of this application, providing flexible and effective solutions for security isolation needs in different scenarios.

[0079] Please see Figure 5 This is a schematic diagram of a virtual desktop sandbox isolation system provided in an embodiment of this application. The system includes: The request retrieval module is used to retrieve user requests to create virtual desktops; A sandbox building module is used to build an isolated sandbox environment based on the request. The isolated sandbox environment includes an independent process namespace, a file system namespace, and a network namespace, and isolates the process tree of the virtual desktop into the process namespace. An isolation environment creation module is used to create file isolation environments in the file system namespace and network isolation environments in the network namespace.

[0080] Optionally, the isolation environment creation module is also used to load an independent root file system for the virtual desktop in the file system namespace, and to create an encrypted volume for securely storing user data of the virtual desktop; The system directory is bound to the root file system in read-only mode, and a separate temporary directory is created in the root file system. The temporary directory is used to store the temporary running data of the virtual desktop. The encrypted volume is mounted to the user directory, which is used to store the user data of the virtual desktop, forming a file isolation environment.

[0081] Optionally, the isolation environment creation module can also be used to obtain user authentication information or server authorization information; The user data storage space of the virtual desktop is encrypted based on the user authentication information or server authorization information to form the encrypted volume. The encrypted volume is accessible during the operation of the virtual desktop and is automatically unmounted after the virtual desktop is closed.

[0082] Optionally, the isolation environment creation module is also used to connect the virtual desktop to the network namespace via the system call setns; Create a virtual network device outside the network namespace, and then migrate the virtual network device to the inside of the network namespace; Configure the network environment within the network namespace, including starting a loopback device for internal communication and configuring network routing so that network traffic of the virtual desktop is forwarded through the virtual network device, forming a network isolation environment.

[0083] Optionally, a virtual desktop sandbox isolation system further includes a desktop management module, used to scan the application installation directory in the file isolation environment and obtain the application configuration files and corresponding application icons; Based on the network isolation environment, a connection is established with the policy server through a secure communication channel, and the obtained application configuration file and corresponding application icon are uploaded to the policy server. The system receives control policies for the virtual desktop returned by the policy server. The control policies include at least an application access control list, a network access control policy, a user behavior audit configuration, and a peripheral device usage permission configuration. The virtual desktop is managed and controlled according to the control policy.

[0084] Optionally, a virtual desktop sandbox isolation system further includes a multi-desktop management module for receiving user requests to create multiple virtual desktops, each of which corresponds to an independent workspace; Each virtual desktop is built with an independent, isolated sandbox environment to enable multiple virtual desktops to run simultaneously and to support switching between them in the host environment; Different space login credentials are generated based on user information and space identifiers, wherein the space identifier includes the domain name suffix of the corresponding space; Based on the login credentials, the system obtains control policies for different virtual desktop spaces from the policy server and displays authorized applications in the corresponding workspaces according to the control policies.

[0085] It should be noted that the system provided in the above embodiments is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0086] This application also provides a computer storage medium that can store multiple instructions. The instructions are adapted to be loaded and executed by a processor as described in the above embodiments of a virtual desktop sandbox isolation method. For the specific execution process, please refer to the detailed description of the above embodiments, which will not be repeated here.

[0087] Please refer to Figure 6 This application also discloses an electronic device. Figure 6 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application. The electronic device 600 may include: at least one processor 601, at least one network interface 604, a user interface 603, a memory 605, and at least one communication bus 602.

[0088] The communication bus 602 is used to enable communication between these components.

[0089] The user interface 603 may include a display screen and a camera. Optionally, the user interface 603 may also include a standard wired interface and a wireless interface.

[0090] The network interface 604 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0091] The processor 601 may include one or more processing cores. The processor 601 connects to various parts of the server using various interfaces and lines, and performs various server functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 605, and by calling data stored in the memory 605. Optionally, the processor 601 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array. The processor 601 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content required for display; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 601 and may be implemented as a separate chip.

[0092] The memory 605 may include random access memory (RAM) or read-only memory. Optionally, the memory 605 may include a non-transitory computer-readable storage medium. The memory 605 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 605 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 605 may also be at least one storage device located remotely from the aforementioned processor 601. (Refer to...) Figure 6 The memory 605, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an application for a virtual desktop sandbox isolation method.

[0093] exist Figure 6 In the illustrated electronic device 600, the user interface 603 is mainly used to provide an input interface for the user and to acquire user input data; while the processor 601 can be used to call an application stored in the memory 605 for a virtual desktop sandbox isolation method. When executed by one or more processors 601, the electronic device 600 performs one or more of the methods described in the above embodiments. It should be noted that, for the foregoing method embodiments, for the sake of simplicity, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0094] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0095] In the various embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some service interface; the indirect coupling or communication connection between apparatuses or units may be electrical or other forms.

[0096] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0097] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0098] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0099] The above description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Other embodiments of this disclosure will be readily apparent to those skilled in the art upon consideration of the specification and the disclosure of practical truths.

[0100] This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described in this disclosure. The specification and embodiments are to be considered exemplary only, and the scope of this disclosure is defined by the claims.< / namespace>

Claims

1. A virtual desktop sandbox isolation method, characterized in that, The method includes: Get the user's request to create a virtual desktop; An isolated sandbox environment is constructed based on the request. The isolated sandbox environment includes an independent process namespace, a file system namespace, and a network namespace, and the process tree of the virtual desktop is isolated within the process namespace. Create a file isolation environment in the file system namespace and a network isolation environment in the network namespace.

2. The virtual desktop sandbox isolation method according to claim 1, characterized in that, Creating a file isolation environment in the file system namespace includes: Within the file system namespace, a separate root file system is loaded for the virtual desktop, and an encrypted volume is created for securely storing user data of the virtual desktop. The system directory is bound to the root file system in read-only mode, and a separate temporary directory is created in the root file system. The temporary directory is used to store the temporary running data of the virtual desktop. The encrypted volume is mounted to the user directory, which is used to store the user data of the virtual desktop, forming a file isolation environment.

3. The virtual desktop sandbox isolation method according to claim 2, characterized in that, The creation of the encrypted volume for securely storing the virtual desktop user data includes: Obtain user authentication information or server authorization information; The user data storage space of the virtual desktop is encrypted based on the user authentication information or server authorization information to form the encrypted volume. The encrypted volume is accessible during the operation of the virtual desktop and is automatically unmounted after the virtual desktop is closed.

4. The virtual desktop sandbox isolation method according to claim 1, characterized in that, Creating a network isolation environment in the network namespace includes: The virtual desktop is connected to the network namespace via the system call setns; Create a virtual network device outside the network namespace, and then migrate the virtual network device to the inside of the network namespace; Configure the network environment within the network namespace, including starting a loopback device for internal communication and configuring network routing so that network traffic of the virtual desktop is forwarded through the virtual network device, forming a network isolation environment.

5. The virtual desktop sandbox isolation method according to claim 1, characterized in that, After creating a file isolation environment in the file system namespace and a network isolation environment in the network namespace, the method further includes: Scan the application installation directory in the file isolation environment to obtain the application configuration files and corresponding application icons; Based on the network isolation environment, a connection is established with the policy server through a secure communication channel, and the obtained application configuration file and corresponding application icon are uploaded to the policy server. The system receives control policies for the virtual desktop returned by the policy server. The control policies include at least an application access control list, a network access control policy, a user behavior audit configuration, and a peripheral device usage permission configuration. The virtual desktop is managed and controlled according to the control policy.

6. The virtual desktop sandbox isolation method according to claim 1, characterized in that, The method further includes: Receive a user's request to create multiple virtual desktops, each of which corresponds to an independent workspace; Each virtual desktop is built with an independent, isolated sandbox environment to enable multiple virtual desktops to run simultaneously and to support switching between them in the host environment; Different space login credentials are generated based on user information and space identifiers, wherein the space identifier includes the domain name suffix of the corresponding space; Based on the login credentials, the system obtains control policies for different virtual desktop spaces from the policy server and displays authorized applications in the corresponding workspaces according to the control policies.

7. The virtual desktop sandbox isolation method according to claim 1, characterized in that, The virtual desktop and the physical host's operating system have a parasitic architecture relationship. The virtual desktop runs on the operating system kernel of the physical host, shares the physical host's system call interface and hardware resources, and achieves system-level isolation through namespace isolation technology.

8. A virtual desktop sandbox isolation system, characterized in that, The system includes: The request retrieval module is used to retrieve user requests to create virtual desktops; A sandbox building module is used to build an isolated sandbox environment based on the request. The isolated sandbox environment includes an independent process namespace, a file system namespace, and a network namespace, and isolates the process tree of the virtual desktop into the process namespace. An isolation environment creation module is used to create file isolation environments in the file system namespace and network isolation environments in the network namespace.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores multiple instructions suitable for being loaded by a processor and executed as described in any one of claims 1-7.

10. An electronic device, characterized in that, It includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described in any one of claims 1-7.

Images