Host deep security protection method and system

Abstract

The invention provides a host deep security protection method and system, and belongs to the technical field of computer security, the host deep security protection system comprises a host, a virtualization platform running on the host and a plurality of virtual machines deployed on the host, at least part of the virtual machines in the plurality of virtual machines are arranged in the corresponding isolation areas; the host deep security protection system further comprises a security protection module which is used for calling a security interface provided by the virtualization platform and implementing at least one security protection function on the virtual machine in an agency-free mode. Wherein the security protection function comprises at least one of virus protection, access control, intrusion detection or protection and virtual patch protection. According to the system provided by the embodiment of the invention, deep monitoring and protection of the memory, the network flow and the system state of the virtual machine are realized outside the virtual machine and inside the virtualization layer by calling the built-in security interface provided by the virtualization platform, and the resource consumption and occupation are effectively reduced.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, specifically to a method and system for deep host security protection. Background Technology

[0002] With the widespread application of virtualization technology, enterprises can achieve flexible resource allocation and load balancing through virtual machines. However, traditional security protection methods have significant shortcomings. In practical applications, traditional security devices and technologies are mostly focused on setting up protection boundaries at the edge of the physical host, neglecting the security interactions between virtual machines, making attacks between virtual machines a security blind spot. The dynamic starting and stopping of virtual machines creates protection gaps. For example, newly started virtual machines lag significantly behind continuously running servers in terms of security protection, and their antivirus and other security measures fail to keep up, resulting in a disconnect.

[0003] Furthermore, regarding antivirus protection, enterprises typically install antivirus clients on each virtual operating system in a virtualized environment. While this approach meets basic security standards in terms of protection effectiveness, it leads to severe resource consumption and poses serious security risks. Each antivirus client consumes resources on the physical host, especially when clients are simultaneously scanning and updating, exacerbating resource consumption and potentially causing ESXi server crashes, severely impacting normal server operation.

[0004] Existing technologies cannot achieve resource optimization and real-time protection while ensuring security, so there is an urgent need for an innovative security protection solution. Summary of the Invention

[0005] In view of this, the present invention provides a method and system for deep security protection of hosts, which solves the problems of insufficient security protection, high resource consumption and high management costs in virtualized environments.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a host deep security protection system, including a host, a virtualization platform running on the host, and multiple virtual machines deployed on the host, wherein at least some of the multiple virtual machines are set in corresponding isolation zones;

[0008] The host deep security protection system also includes a security protection module, which is used to call the security interface provided by the virtualization platform to implement at least one security protection function on the virtual machine;

[0009] The security protection functions include at least one of virus protection, access control, intrusion detection or protection, and virtual patch protection.

[0010] As one embodiment of the first aspect, the security protection module includes a virus protection module, wherein the virus protection includes:

[0011] The virus protection module enables agentless real-time virus scanning and virus database updates through a virtualization layer interface.

[0012] As one embodiment of the first aspect, the security protection module further includes an access control module, the access control including:

[0013] The access control module controls access between virtual machines and external access based on the status information of network packets and access rules. The status information includes the source logical address IP, the source physical address MAC, the source port, the destination logical address IP, the destination physical address MAC, and multiple protocols.

[0014] As one embodiment of the first aspect, controlling access between the virtual machines based on network packet state information and access rules includes:

[0015] Rules for allowing or denying access are set based on specific virtual machine switch ports to authorize or prohibit access to the virtual machine.

[0016] As one embodiment of the first aspect, the access control module is also used to restrict network traffic between regions to which virtual machines with different security levels belong, based on the security levels between different virtual machines.

[0017] As one embodiment of the first aspect, the security protection module includes a detection module and a patch protection module. The intrusion detection or protection includes: the detection module monitors the internal traffic of the virtual network through the virtualization layer interface, and identifies and intercepts attacks on the virtual machine based on a preset policy; the virtual patch protection includes: the patch protection module performs vulnerability assessment and patching on the virtual machine through the virtualization layer interface before installing official patches.

[0018] As one embodiment of the first aspect, the host deep security protection system also includes an integrity audit module for monitoring the integrity of critical files based on a preset baseline.

[0019] As one embodiment of the first aspect, the host deep security protection system also includes a host hardening module, which includes at least one of asset management, security check, security monitoring, vulnerability risk, intrusion threat and compliance verification functions.

[0020] As one embodiment of the first aspect, the system supports two modes: lightweight agent deployment and agentless deployment; wherein, the lightweight agent deployment installs a lightweight client agent inside the virtual machine, and the agentless deployment implements security functions through the virtualization layer interface.

[0021] Secondly, the present invention provides a host-based deep security protection method applied to an electronic device, wherein the electronic device runs a virtualization platform and multiple virtual machines deployed on the host, wherein each virtual machine is isolated from the others; the method includes: the electronic device detecting the occurrence of an event related to the security status of the virtual machine; in response to the event, calling a virtualization layer interface from the virtualization platform and obtaining the running status data or memory snapshot of the virtual machine, and performing security analysis on the target virtual machine; based on the result of the security analysis, generating and executing corresponding security protection function instructions, wherein the security protection function includes at least one of virus protection, access control, intrusion detection / protection, and virtual patch protection.

[0022] Thirdly, the present invention also discloses an electronic device, comprising: a memory for storing instructions executed by one or more processors of the electronic device, and a processor for performing the method explained in the second aspect of the embodiments.

[0023] Fourthly, the present invention also discloses a computer-readable storage medium storing instructions that, when executed on an electronic device, cause the electronic device to perform the method explained in the second aspect embodiment.

[0024] The above-described technical solution of the present invention has at least one of the following beneficial effects:

[0025] The host-based deep security protection system according to embodiments of the present invention isolates virtual machines and interacts with them through a virtualization layer interface to implement security functions such as virus protection, access control, intrusion detection / protection, and virtual patching protection in an agentless manner, reducing resource consumption and improving the real-time and comprehensiveness of protection. Through multi-mode collaboration, it can achieve comprehensive and continuous security protection while meeting compliance requirements. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the host deep security protection system according to an embodiment of the present invention;

[0027] Figure 2 This is a flowchart of the virtual patch protection of the patch protection module in an embodiment of the present invention;

[0028] Figure 3 This is a flowchart of the audit process of the integrity audit module in an embodiment of the present invention;

[0029] Figure 4 This is a schematic diagram of the host hardening module according to an embodiment of the present invention;

[0030] Figure 5This is a flowchart of the host deep security protection method according to an embodiment of the present invention;

[0031] Figure 6 A block diagram of a SoC on-chip system according to an embodiment of the present invention is shown. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention are within the scope of protection of the present invention.

[0033] To facilitate understanding of the technical solution of the present invention, the technical problems of the present invention will be further explained below.

[0034] As described in the background above, in virtualized environments, traditional firewalls and intrusion detection systems are typically deployed at the physical network boundary, unable to penetrate and monitor network traffic between virtual machines (VMs) within the same physical host and relayed via virtual switches. This creates a security blind spot for lateral movement attacks between VMs, rendering traditional security measures ineffective. For example, communication between VMs via virtual switches, if lacking monitoring, can easily become a channel for attack propagation. Furthermore, installing security agents (such as antivirus clients) within each VM can lead to intense competition for the physical host's CPU, memory, and I / O resources when multiple VMs are simultaneously scanning for viruses or updating signature databases, creating an "antivirus storm" that can cause a sudden drop in ESXi server performance or even crash. Moreover, frequent starting and stopping of VMs prevents real-time synchronization of security policies, resulting in protection gaps.

[0035] To address the aforementioned technical issues, this invention proposes a deep host security protection system. This system includes a host, a virtualization platform running on the host, and multiple virtual machines deployed on the host, each virtual machine being located within a corresponding isolation zone. This system abandons the traditional protection model that relies entirely on internal virtual machine agents. The host can directly interact with the hypervisor through the virtualization layer interface, bypassing the traditional agent approach and achieving deep access to virtual machine memory, network traffic, and system status. This avoids resource consumption while obtaining underlying data for real-time security analysis and protection.

[0036] The host deep security protection system of the present invention will be described in detail below with reference to the accompanying drawings.

[0037] refer to Figure 1 , Figure 1A schematic diagram of the host deep security protection system according to an embodiment of the present invention is shown.

[0038] like Figure 1 As shown, the host-based deep security protection system 100 includes a host 10. A virtualization platform 120 and multiple virtual machines 130 are configured on the host 10. At least some of these virtual machines 130 are located in corresponding isolation zones. Furthermore, the host 10 also includes a security protection module 110, used to call the security interfaces provided by the virtualization platform and obtain the virtual machine's runtime status data or memory snapshots, thereby enabling at least one security protection function to be implemented on the virtual machines in an agentless manner. The isolated virtual machines can be understood as virtual machines with a high level of protection, or virtual machines designated for protection according to actual needs. Because these virtual machines are effectively isolated, unsupervised access to each other can be avoided, preventing the spread of viruses through virtual switches.

[0039] The virtualization platform 120 can provide security interfaces, namely virtualization layer interfaces. These interfaces are a set of high-level interfaces exposed by virtualization platforms such as VMware vSphere, including VMsafe and VMshield. These interfaces allow security modules to run in a trusted manner within the virtualization layer. These interfaces can directly access virtual machine memory without entering the virtual machine's operating system, scanning its memory contents and detecting malicious code. Before network packets are forwarded to the target virtual machine by the virtual switch, interception and deep analysis are performed at the virtualization layer, along with real-time acquisition of key behavioral data such as the virtual machine's process list, file system changes, and registry modifications. Utilizing these interfaces, the security protection modules of this invention can penetrate the isolation boundaries of virtual machines, implementing monitoring and protection from the bottom layer. Furthermore, it can achieve agentless deep inspection of virtual machine traffic and agentless monitoring of system status without installing traditional agent programs in the virtual machine's operating system. This avoids the computational and network resource consumption caused by installing agents on each virtual machine, such as reducing the CPU time and network bandwidth required for agent program operation, fundamentally solving the problems of traditional methods failing to monitor inter-virtual machine traffic and high resource consumption.

[0040] Furthermore, through the virtualization layer interface, operations such as virus protection, access control, intrusion prevention, and virtual patching can be performed, enabling comprehensive and real-time virus detection and protection.

[0041] It should be noted that the host device can be an electronic device or an electronic device. Electronic devices include, but are not limited to, mobile phones, large-screen devices, smart TVs, wearable devices, tablets, desktop computers, desktop computers, wearable devices (e.g., smartwatches, smart glasses, helmets), virtual reality (VR) devices, augmented reality (AR) devices, wireless devices in industrial control, wireless devices in self-driving, wireless devices in smart grids, wireless devices in transportation safety, wireless devices in smart cities, wireless devices in smart homes, servers, etc.

[0042] The security protection functions of the security protection module 110 are described below.

[0043] like Figure 1 As shown, the security protection module 110 includes an access control module, a virus protection module, a detection module, and a patch protection module.

[0044] For VMware virtual systems, the virus protection module can directly scan virtual disk files and memory outside the virtual machine using the VMshield interface. When a virus scan is needed, the module obtains a memory snapshot and file system access rights of the target virtual machine through the VMshield API to perform virus signature matching, without installing any agent programs inside the virtual machine. It achieves agentless real-time virus scanning and virus database updates through the virtualization layer interface. This reduces the impact on the network resources of the entire virtualization environment and ensures timely access to the latest virus protection capabilities without affecting the normal operation of the virtual host.

[0045] The access control module can control access between virtual machines and to external systems based on network packet state information and access rules. For example, a firewall provides fine-grained access control based on stateful inspection. This function can deeply analyze the state information of network packets and make precise access control decisions based on multi-dimensional information such as source IP, source MAC, source port, destination IP, destination MAC, and protocol. For instance, rules can be set to allow or deny access to specific virtual switch ports, effectively preventing unauthorized network access.

[0046] In some embodiments, different security levels can be set for virtual machines, dividing virtual systems with different security levels into different logical zones. Administrators can divide virtual machines with different trust levels into different logical security zones and set inter-zone access policies. For example, virtual machines with lower security levels may require administrator authorization for access. This isolation method restricts network traffic between zones, thereby preventing the spread of viruses between virtual systems. Simultaneously, the access control module's firewall also has the ability to identify and block various flooding attacks, such as SYN floods and UDP floods, protecting the virtual network from malicious traffic.

[0047] The detection module has intrusion detection and protection functions. In traditional technologies, virtual switches do not support port mirroring, making it difficult to monitor traffic between virtual machines. The detection module in this embodiment of the invention utilizes VMware's VMsafe interface, enabling virtual IDS sensors to run on virtual switches or port groups, sensing network traffic on the same virtual segment without the need for port mirroring. This overcomes the limitation of traditional virtual switches not supporting SPAN or port mirroring, which makes network intrusion detection difficult, and achieves effective monitoring of traffic within virtual networks.

[0048] In some embodiments, the detection module also provides policy-based monitoring and analysis tools in the virtual environment. It can perform in-depth analysis of network behavior based on pre-defined enterprise security policies, identifying abnormal or potential threat behaviors. For example, when a virtual machine suddenly initiates a large number of abnormal network connection requests, the system can promptly detect this and take corresponding protective measures according to policies, such as blocking connections and issuing alerts, while consuming fewer host machine hardware resources, ensuring that the performance of the virtual system is not excessively affected.

[0049] In some embodiments, the installation of system security patches in a virtualized environment still follows the traditional method of periodic testing and manual installation. Although virtualized servers have certain state recovery mechanisms, this approach still carries risks. On the one hand, it is difficult to ensure that system changes after testing will not cause anomalies due to patch installation; on the other hand, centralized patch installation processes require significant investment of manpower, resources, and technical support at each stage, resulting in high deployment costs.

[0050] Based on this, the patch protection module of this invention utilizes virtual patching technology to comprehensively evaluate the virtual host system by deeply monitoring and analyzing the virtual machine's network traffic. Before the operating system has installed official patches, it automatically identifies and patches known vulnerabilities, effectively blocking attacks targeting these vulnerabilities.

[0051] refer to Figure 2 , Figure 2 A flowchart illustrating the virtual patch protection of the patch protection module according to an embodiment of the present invention is shown.

[0052] like Figure 2 As shown, the patch protection module deeply monitors the virtual system interface and identifies potential vulnerability attacks in real time.

[0053] When a known vulnerability attack is detected, matching virtual patch rules are obtained to effectively block the known vulnerability. Furthermore, the vulnerability is logged and alerts are issued, such as pop-up notifications.

[0054] If no known vulnerabilities are identified, maintain deep monitoring of the virtual system interface.

[0055] This virtual patching technology effectively prevents attacks exploiting known vulnerabilities, and the deployment of virtual patches does not require system downtime, avoiding the impact on business continuity caused by downtime for patch installation. Simultaneously, it eliminates the need for complex application compatibility testing, reducing the manpower and time costs for enterprises in patch management and rapidly improving system security.

[0056] Continue to refer to Figure 1 ,like Figure 1 As shown, the host 10 may also be equipped with an integrity audit module 140 and a host hardening module 150, as well as further in-depth protection for the host.

[0057] The integrity audit module 140 and the host hardening module 150 are described below with reference to the accompanying drawings.

[0058] refer to Figure 3 , Figure 3 A flowchart illustrating the audit process of the integrity audit module according to an embodiment of the present invention is shown.

[0059] like Figure 3 As shown, the audit process of the integrity audit module 140 includes S310-S360.

[0060] S310, Establish a baseline for key documents.

[0061] Among them, the critical file baseline records the normal status of critical system files, such as system DLLs, executable programs, directories and registry entries, such as establishing a hash value baseline containing critical files required for normal system operation, creation time, etc.

[0062] S320 periodically or in real-time calculates the current hash value of a file. This calculation method is simple and helps improve comparison efficiency.

[0063] S330, Is the current hash value consistent with the baseline?

[0064] Compare the hash value of the current critical file with the hash value of the baseline.

[0065] If the judgment is inconsistent, proceed to step S340 to determine that the critical file has been tampered with, infected, or is incomplete, and proceed to step S350 to alert the administrator.

[0066] If the judgment is consistent, then execute S360, determine that the system status is normal, and do not take any action.

[0067] The integrity audit module 140 periodically or in real-time verifies the integrity of these target files through the virtualization layer interface. Once a critical file is found to have been maliciously tampered with or infected with a virus (i.e., the current hash value does not match the baseline), the system will immediately generate an alarm event and record in detail the file name, path, time, and process ID of the tampered file, ensuring the traceability of the system's integrity and security.

[0068] refer to Figure 4 , Figure 4 A schematic diagram of the host hardening module according to an embodiment of the present invention is shown.

[0069] like Figure 4 As shown, the host hardening module 150 includes an asset management and collection module 151, a security check module 152, a security monitoring module 153, a vulnerability risk module 154, an intrusion threat module 155, a compliance baseline module 156, and a threat intelligence module 157.

[0070] The asset management collection module 151 is used to comprehensively inventory and manage host assets, including hardware configuration information (such as CPU model, memory capacity, etc.), detailed operating system information (such as version number, list of installed patches, etc.), application list (such as name, version, installation path, etc.), service port open status, and account information (such as username, permission level, etc.). Collecting this information enhances security operations personnel's comprehensive understanding of the system and assets, facilitating the discovery of potential security risks, such as unnecessary open ports or account settings with security vulnerabilities.

[0071] The security check module 152 is used to perform a comprehensive security check on the host. Based on built-in security standards and best practices, it assesses the host's security status and discovers potential security vulnerabilities, configuration errors, and other issues.

[0072] The security monitoring module 153 is used to monitor the host's operating status in real time, including key indicators such as CPU usage, memory usage, and network traffic, and to promptly detect abnormal fluctuations or potential security threats. For example, a sudden spike in CPU usage may indicate that a malicious program is running in the background.

[0073] Vulnerability Risk Module 154 is used to identify known vulnerabilities in the host system and assess their risk level, providing a basis for subsequent remediation and protection.

[0074] The Intrusion Threat Module 155 is used to detect and prevent external intrusions and internal malicious activities in a timely manner by monitoring network connections, process behavior, etc. in real time.

[0075] The compliance baseline module 156 is used to ensure that the configuration and operation of the host comply with the company’s internal security policies and relevant regulatory requirements, such as PCI compliance requirements.

[0076] Threat Intelligence Module 157 is used to collect and analyze security threat intelligence from internal and external sources, and to update the system's protection strategies in a timely manner to address emerging security threats. All modules work together, with data exchanged in real time, forming a closed-loop security protection system that comprehensively protects host security.

[0077] In some embodiments of the present invention, the host 10 also includes an asset management module and a log auditing and reporting module.

[0078] The asset management module is the core function of comprehensively and meticulously inventorying and managing host assets. This module automatically collects host hardware information through various technical means, such as using hardware detection tools to obtain detailed information like server hardware model, serial number, disk capacity, and network card configuration. For operating system information, it can accurately identify the operating system type, version number, kernel version, etc., while also tracking operating system updates and installed patches.

[0079] In terms of application management, the asset management module can list the names, version numbers, and installation paths of all applications installed on the host, and analyze the dependencies between applications to better understand the system architecture during security protection and system maintenance. The service port management function can monitor open service ports on the host in real time, including port numbers, protocol types, and service names, promptly identifying abnormally open ports and preventing malicious exploitation. The account management function organizes all accounts on the host, including local and domain accounts, recording usernames, password policies, login history, and other information to help administrators identify potential account security issues, such as weak passwords or accounts that have not been used for a long time. Specifically, in agentless mode, the asset management module can mount virtual machine virtual disk files (such as .vmdk or .qcow2) and directly parse file systems (such as NTFS or EXT4) and registry files, whether offline or online, to extract the list of installed software and system configuration information without running any collection scripts within the virtual machine.

[0080] The log auditing and reporting module provides comprehensive system logging capabilities, recording not only the operational logs of various system modules such as virus protection, firewall, and intrusion detection, but also integrating log information from the virtual host operating system. For example, it records the time and results of antivirus scans, the triggering status of firewall rules, and detected intrusion events. Simultaneously, it collects and manages this log information in a unified manner along with operating system login logs and application runtime logs.

[0081] The log auditing and reporting module also boasts comprehensive report generation capabilities, capable of generating reports compliant with relevant international security standards based on administrator needs. These reports provide a comprehensive overview of the system's security status, including statistical analysis of security incidents (such as attack type distribution and attack frequency trends), compliance status assessments (such as whether specific regulatory requirements are met), and resource usage information (such as CPU time consumed by antivirus scans and network bandwidth usage). By analyzing logs, administrators can effectively track IT infrastructure activities, determine the occurrence of server data breaches (whether they occurred, when they occurred, where they occurred, and how they occurred), and thus take timely preventative and remedial measures.

[0082] In some embodiments, a lightweight client agent of the host deep security protection system can be deployed inside each virtual machine. This agent is a lightweight software component with comprehensive security protection functions, including antivirus, deep packet inspection (virtual patching), firewall, intrusion prevention, integrity monitoring, log auditing, EDR, and host hardening. By installing the agent on each virtual machine, independent and comprehensive security protection can be provided for each virtual machine, adapting to the personalized security needs of different virtual machines.

[0083] This invention also discloses a deep host security protection method, applied to an electronic device or the host 10 of the above embodiments. The electronic device runs a virtualization platform and multiple virtual machines deployed on the host, wherein each virtual machine is isolated from the others.

[0084] refer to Figure 5 , Figure 5 A flowchart of a host-based deep security protection method according to an embodiment of the present invention is shown.

[0085] like Figure 5 As shown, the host deep security protection method includes S510-S530.

[0086] S510: Electronic devices detect events related to the security status of virtual machines.

[0087] Events related to the security status of virtual machines can include detecting the creation and startup of a new virtual machine (VM-New). For example, the event system of a virtualization platform (such as vCenter) might issue a "virtual machine has started" notification. Security service providers can capture this event in real time by subscribing to these event buses or listening to APIs. This ensures that new virtual machines are included in the protection system the moment they are created. Another example is detecting a network connection request from a virtual machine in the development zone (VM-Dev) to a virtual machine in the production database zone (VM-DB). This directly addresses blind spots in inter-virtual machine attacks by monitoring lateral traffic between virtual machines. Yet another example is detecting network traffic destined for a web server virtual machine (VM-Web) containing events suspected of path traversal attacks.

[0088] The S520, in response to events, calls the virtualization layer interface from the virtualization platform and interacts with the virtual machine to perform security analysis on the target virtual machine in an agentless manner.

[0089] For example, the security service provider calls the VMshield interface to request an agentless virus scan of the memory space and system directory files of a new virtual machine VM-New. The stateful firewall engine performs fine-grained access control decision analysis on this connection request, etc. The specific analysis results have been illustrated in the above embodiments and will not be listed here.

[0090] S530, based on the results of the security analysis, generates and executes corresponding security protection function instructions. These security protection functions include at least one of virus protection, access control, intrusion detection / protection, and virtual patching protection. The specific security protection functions and processes have been described in detail in the above embodiments; please refer to the functions implemented by each module in the above embodiments, and they will not be repeated here.

[0091] According to the host deep security protection method of the present invention, by deeply integrating the built-in security interface provided by the virtualization platform, deep monitoring and protection of virtual machine memory, network traffic and system status are realized outside the virtual machine and inside the virtualization layer, thereby constructing a deep security protection system with low resource consumption, no protection blind spots and high real-time performance.

[0092] The present invention also provides an electronic device, comprising:

[0093] A memory for storing instructions to be executed by one or more processors of the device, and a processor for executing the instructions in the above embodiments. Figure 5 The method explained.

[0094] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the actions described in the above embodiments. Figure 5 The method explained.

[0095] The present invention also provides a computer program product containing instructions that, when run on an electronic device, cause a processor to execute the above-described embodiments. Figure 5 The method explained.

[0096] Now for reference Figure 6 The diagram shown is a block diagram of a SoC (System on Chip) 1000 according to an embodiment of the present invention. Figure 6 In the diagram, similar components share the same reference numerals. Additionally, dashed boxes are an optional feature for more advanced SoCs. Figure 6 In this embodiment, SoC 1000 includes: an interconnect unit 1050 coupled to an application processor 1010; a system proxy unit 1080; a bus controller unit 1090; an integrated memory controller unit 1040; a group or one or more coprocessors 1020, which may include integrated graphics logic, an image processor, an audio processor, and a video processor; a static random access memory (SRAM) unit 1030; and a direct memory access (DMA) unit 1060. In one embodiment, the coprocessor 1020 includes a dedicated processor, such as, for example, a network or communication processor, a compression engine, a general-purpose computing on GPU (GPGPU), a high-throughput many integrated core (MIC) processor, or an embedded processor.

[0097] The static random access memory (SRAM) cell 1030 may include one or more computer-readable media for storing data and / or instructions. The computer-readable storage medium may store instructions, specifically, temporary and permanent copies of those instructions. These instructions may include, when executed by at least one unit in the processor, causing the SoC 1000 to perform the processing method according to the above embodiments, as detailed in the above embodiments. Figure 5 The methods explained will not be repeated here.

[0098] Various embodiments of the mechanisms disclosed in this invention can be implemented in hardware, software, firmware, or combinations of these implementations. Embodiments of this invention can be implemented as computer programs or program code executable on a programmable system, the programmable system including at least one processor, a storage system (including volatile and non-volatile memories and / or storage elements), at least one input device, and at least one output device.

[0099] Program code can be applied to input instructions to execute the functions described in this invention and generate output information. The output information can be applied to one or more output devices in a known manner. For the purposes of this invention, the processing system includes any system having a processor such as, for example, a digital signal processor (DSP), a microcontroller, an application-specific integrated circuit (ASIC), or a microprocessor.

[0100] The program code can be implemented using a high-level procedural language or an object-oriented programming language to communicate with the processing system. Assembly language or machine language can also be used when needed. In fact, the mechanisms described in this invention are not limited to any particular programming language. In either case, the language can be a compiled language or an interpreted language.

[0101] In some cases, the disclosed embodiments may be implemented in hardware, firmware, software, or any combination thereof. The disclosed embodiments may also be implemented as instructions carried or stored thereon on one or more temporary or non-temporary machine-readable (e.g., computer-readable) storage media, which may be read and executed by one or more processors. For example, the instructions may be distributed via a network or through other computer-readable media. Therefore, machine-readable media may include any mechanism for storing or transmitting information in a machine-readable (e.g., computer-readable) form, including but not limited to floppy disks, optical disks, CD-ROMs, magneto-optical disks, read-only memory (ROM), random access memory (RAM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic cards or optical cards, flash memory, or tangible machine-readable storage for transmitting information (e.g., carrier waves, infrared signals, digital signals, etc.) using the Internet in the form of electrical, optical, acoustic, or other propagation signals. Therefore, machine-readable media include any type of machine-readable medium suitable for storing or transmitting electronic instructions or information in a machine-readable (e.g., computer-readable) form.

[0102] In the accompanying drawings, some structural or methodological features may be shown in a specific arrangement and / or order. However, it should be understood that such a specific arrangement and / or order may not be necessary. Rather, in some embodiments, these features may be arranged in a manner and / or order different from that shown in the illustrative drawings. Furthermore, the inclusion of structural or methodological features in a particular figure does not imply that such features are required in all embodiments, and in some embodiments, these features may be omitted or may be combined with other features.

[0103] It should be noted that the units / modules mentioned in the various device embodiments of the present invention are all logical units / modules. Physically, a logical unit / module can be a physical unit / module, a part of a physical unit / module, or a combination of multiple physical units / modules. The physical implementation of these logical units / modules themselves is not the most important factor; the combination of functions implemented by these logical units / modules is the key to solving the technical problem proposed by the present invention. Furthermore, to highlight the innovative aspects of the present invention, the above-described device embodiments of the present invention have not introduced units / modules that are not closely related to solving the technical problem proposed by the present invention. This does not mean that the above-described device embodiments do not contain other units / modules.

[0104] It should be noted that in the examples and description of this patent, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0105] Although the invention has been illustrated and described with reference to certain preferred embodiments thereof, those skilled in the art will understand that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.

Claims

1. A host deep security protection system, characterized in that, It includes a host, a virtualization platform running on the host, and multiple virtual machines deployed on the host, wherein at least some of the multiple virtual machines are located in corresponding isolation zones; The host deep security protection system also includes a security protection module, which is used to call the security interface provided by the virtualization platform to implement at least one security protection function on the virtual machine; The security protection functions include at least one of virus protection, access control, intrusion detection or protection, and virtual patch protection.

2. The host deep security protection system according to claim 1, characterized in that, The security protection module includes a virus protection module, and the virus protection includes: The virus protection module enables agentless real-time virus scanning and virus database updates through a virtualization layer interface.

3. The host deep security protection system according to claim 1, characterized in that, The security protection module also includes an access control module, wherein the access control includes: The access control module controls access between virtual machines and external access based on the status information of network packets and access rules. The status information includes the source logical address IP, the source physical address MAC, the source port, the destination logical address IP, the destination physical address MAC, and multiple protocols.

4. The host deep security protection system according to claim 3, characterized in that, The control of access between the virtual machines based on network packet status information and access rules includes: Rules for allowing or denying access are set based on specific virtual machine switch ports to authorize or prohibit access to the virtual machine.

5. The host deep security protection system according to claim 1, characterized in that, The access control module is also used to restrict network traffic between regions to which virtual machines with different security levels belong, based on the security levels between different virtual machines.

6. The host deep security protection system according to claim 1, characterized in that, The security protection module includes a detection module and a patch protection module. The intrusion detection or protection includes: The detection module monitors the internal traffic of the virtual network through the virtualization layer interface, and identifies and intercepts attacks on the virtual machine based on preset policies; The virtual patch protection includes: Before official patches are installed, the patch protection module performs vulnerability assessment and repair on virtual machines through the virtualization layer interface.

7. The host deep security protection system according to claim 1, characterized in that, It also includes an integrity audit module, which is used to monitor the integrity of critical documents based on preset baselines.

8. The host deep security protection system according to claim 1, characterized in that, It also includes a host hardening module, which includes at least one of the following functions: asset management, security check, security monitoring, vulnerability risk assessment, intrusion threat assessment, and compliance verification.

9. The host deep security protection system according to claim 1, characterized in that, The system supports two deployment modes: lightweight agent deployment and agentless deployment. In the lightweight agent deployment, a lightweight client agent is installed inside the virtual machine, while in the agentless deployment, security functions are implemented through the virtualization layer interface.

10. A host-level deep security protection method, applied to electronic devices, characterized in that, The electronic device runs a virtualization platform and multiple virtual machines deployed on the host, wherein each virtual machine is isolated from the others; the method includes: The electronic device detects an event related to the security status of the virtual machine; in response to the event, it calls the virtualization layer interface from the virtualization platform and obtains the virtual machine's runtime status data or memory snapshot to perform security analysis on the target virtual machine; Based on the results of the security analysis, corresponding security protection function instructions are generated and executed, wherein the security protection function includes at least one of virus protection, access control, intrusion detection / protection, and virtual patch protection.

Images