CN105303102A - Secure access method for virtual machine and virtual machine system - Google Patents

Abstract

Embodiments of the invention provide a secure access method for a virtual machine and a virtual machine system, which relate to the field of cloud computing and realize security protection of virtual resources in a cloud computing virtual machine platform. The method comprises the steps that: a cloud computing control node configures corresponding identifier information for the virtual machine and the virtual resources of the virtual machine when the virtual machine is established; the computing node receives a virtual resource access request message; the computing node determines whether the virtual machine has a right of accessing to the virtual resources corresponding to the identifier information of the virtual resources or not according to the identifier information of the virtual machine and the identifier information of the virtual resources required to be accessed; when it is determined that the virtual machine has the right of accessing to the virtual resources corresponding to the identifier information of the virtual resources, the computing node allows the virtual machine to access to the virtual resources corresponding to the identifier information of the virtual resources; and when it is determined that the virtual machine does not have the right of accessing to the virtual resources corresponding to the identifier information of the virtual resources, the computing node prevents the virtual machine from accessing to the virtual resources corresponding to the identifier information of the virtual resources.

Description

A virtual machine security access method and virtual machine system

technical field

The invention relates to the technical field of cloud computing, in particular to a virtual machine security access method and a virtual machine system.

Background technique

Cloud computing brings a new era of service provision and consumption of new technology (IT, Information Technology) in the commercial field. Cloud computing enhances collaboration, agility, scalability, availability, and reduced costs through optimized, more efficient computing. More specifically, the cloud describes the use of services, applications, information, and infrastructure, etc., composed of "resource pools" of computing, networking, information, and storage. Components in cloud computing can be quickly provisioned, deployed, and decommissioned, and can be expanded or reduced sequentially, providing an on-demand distribution and consumption model similar to utility computing.

The reason why cloud computing systems can automatically control and optimize the resource usage of a certain service is because of the use of a certain degree of abstract measurement capabilities. In cloud computing, virtualization technology is one of the important selection technologies for abstracting resources.

In the virtual machine technology, according to different entities to be virtualized, it can be divided into different types of virtualization. System virtualization technology is a widely recognized virtualization technology.

The core idea of system virtualization is that virtualization software virtualizes one or more virtual machines on a physical machine. A virtual machine runs in an isolated environment and is a logical computer system with complete hardware functions, including a guest operating system and applications therein. In the virtual machine system, multiple operating systems can run simultaneously on the same physical machine without affecting each other and reuse physical resources.

Although the virtualization technology has developed rapidly, the security technology of the virtual machine system lags behind seriously. Running various services and ensuring system security on a virtual machine is much more complicated than on a single computer. There are many security threats to virtual machine systems, such as attacks between virtual machines, resource occupation conflicts, and escape threats. Therefore, while using virtual machines to bring convenience to applications and management, more attention should be paid to solving virtual security issues and researching virtual security mechanisms.

Currently, the virtual machine monitoring software (VMM, Virtual Machine Monitor) in the virtualization technology, or Hypervisor, can access all hardware devices on the server. When the server starts and invokes the Hypervisor, it will load the operating systems on all virtual machine clients, and at the same time allocate appropriate physical resources such as network, CPU, disk, and memory to each virtual machine. The hypervisor is responsible for coordinating access to these hardware resources, while also imposing security protections between each virtual machine. In traditional virtualization technologies, monitoring is mostly used to detect and prevent the occurrence of dangers for virtual machine escape. One way of thinking of the monitoring mechanism is to monitor the client virtual machine from the environment where the virtual machine is located through the hypervisor layer provided by the virtual machine environment. This type of mechanism can effectively protect security components from tampering, and at the same time, this method has less impact on the monitoring environment, is convenient for transparent implementation, and has advantages in system compatibility. However, there will be a problem of semantic gap in the above method.

Due to the difference between cloud computing and traditional stand-alone virtualization environment architecture, the control right is transferred from Hypervisor to cloud control node Controller in cloud computing. However, the traditional virtual machine monitoring mechanism is designed in the computing node Hypervisor, and it is difficult to effectively connect with the virtual machine management and control process on the cloud control node. The safety chain will be broken and the security of the entire life cycle of the virtual machine cannot be guaranteed. play a role in cloud computing scenarios.

Contents of the invention

Embodiments of the present invention provide a virtual machine security access method and a virtual machine system, which are used to realize security protection of virtual resources in a cloud computing virtualization platform.

In order to achieve the above object, embodiments of the present invention adopt the following technical solutions:

An embodiment of the present invention provides a virtual machine security access method, which is applied to a virtual machine system. The virtual machine system includes: a computing node, a cloud computing control node, and a virtual machine. The method includes: the cloud computing control node When the virtual machine is established, configure corresponding identification information for the virtual machine and the virtual resource corresponding to the virtual machine; the computing node receives the virtual resource access request message sent by the virtual machine; wherein, the virtual resource access The request message carries the identification information of the virtual machine and the identification information of the virtual resource to be accessed; the computing node determines whether the virtual machine has The right to access the virtual resource corresponding to the identification information of the virtual resource; when it is determined that the virtual machine has the right to access the virtual resource corresponding to the identification information of the virtual resource, the computing node allows the virtual machine to access the A virtual resource corresponding to the identification information of the virtual resource; when it is determined that the virtual machine does not have the right to access the virtual resource corresponding to the identification information of the virtual resource, the computing node prevents the virtual machine from accessing the identification of the virtual resource The virtual resource corresponding to the information.

Further, before the computing node receives the virtual resource access request message sent by the virtual machine, it also includes: the cloud computing control node determines the computing node running the virtual machine according to the benefit information of the user; the cloud computing control node sends the A computing node running a virtual machine sends a message for establishing an operating relationship with the virtual machine; the computing node receives a message for establishing an operating relationship with the virtual machine sent by the cloud computing control node; The message of establishing the running relationship with the virtual machine is provided, the running resource is allocated to the virtual machine, and the running relationship is established with the virtual machine.

Further, before the cloud computing control node determines the computing node running the virtual machine according to the user's interest information, it also includes: the cloud computing control node determines whether to migrate according to the load information of the computing node where the virtual machine is located The virtual machine; the cloud computing control node determining the computing node running the virtual machine according to the user's benefit information includes: when the cloud computing control node determines to migrate the virtual machine, determining to run the virtual machine according to the user's benefit information computing node of the computer.

Further, the cloud computing control node determining the computing node running the virtual machine according to the user's benefit information includes: when the cloud computing control node determines to create a virtual machine, the cloud computing control node determines according to the user's benefit information Compute nodes that run virtual machines.

Further, an embodiment of the present invention provides a virtual machine system, including: a computing node, a cloud computing control node, and a virtual machine; wherein, the cloud computing control node is configured to, when the virtual machine is established, provide The identification information corresponding to the virtual machine and the virtual resource configuration corresponding to the virtual machine; the computing node is configured to receive a virtual resource access request message sent by the virtual machine; wherein, the virtual resource access request message carries the information of the virtual machine Identification information and identification information of the virtual resource to be accessed; the computing node is further configured to determine whether the virtual machine has access to the virtual resource based on the identification information of the virtual machine and the identification information of the virtual resource to be accessed The permission of the virtual resource corresponding to the identification information of the resource; when it is determined that the virtual machine has the permission to access the virtual resource corresponding to the identification information of the virtual resource, allowing the virtual machine to access the virtual resource corresponding to the identification information of the virtual resource resources: when it is determined that the virtual machine does not have the right to access the virtual resource corresponding to the identification information of the virtual resource, prevent the virtual machine from accessing the virtual resource corresponding to the identification information of the virtual resource.

Further, the cloud computing control node is also used to determine the computing node running the virtual machine according to the benefit information of the user; The message of the running relationship between the virtual machines; the computing node is also used to receive the message of establishing the running relationship with the virtual machine sent by the cloud computing control node; information about the running relationship between the virtual machines, allocate running resources for the virtual machines, and establish a running relationship with the virtual machines.

Further, the cloud computing control node is further configured to determine whether to migrate the virtual machine according to the load information of the computing node where the virtual machine is located; the cloud computing control node is specifically configured to determine whether to migrate the virtual machine When , according to the user's interest information, determine the computing node running the virtual machine.

Further, the cloud computing control node is specifically configured to, when determining to create a virtual machine, determine a computing node for running the virtual machine according to user interest information.

Embodiments of the present invention provide a virtual machine security access method and a virtual machine system. The virtual machine system includes a computing node, a cloud computing control node, and a virtual machine. The method includes: when the cloud computing control node is established for the virtual machine, The identification information corresponding to the virtual machine and the virtual resource configuration corresponding to the virtual machine; the computing node receives the virtual resource access request message sent by the virtual machine, wherein the virtual resource access request message carries the identification information of the virtual machine and the information of the virtual resource to be accessed Identification information; the computing node determines whether the virtual machine has the right to access the virtual resource corresponding to the identification information of the virtual resource according to the identification information of the virtual machine and the identification information of the virtual resource to be accessed; When it is determined that the virtual machine does not have the right to access the virtual resource corresponding to the identification information of the virtual resource, the computing node prevents the virtual machine from A virtual resource corresponding to the identification information of the virtual resource is accessed. In this way, after the cloud computing control node configures the corresponding identification information for the virtual machine and the virtual resources corresponding to the virtual machine when the virtual machine is created, when the virtual machine needs to access the virtual resources, the computing node can use the identification information of the virtual machine and its The identification information of the virtual resource to be accessed to determine whether the virtual machine has permission. The virtual machine is allowed to access only when the virtual machine has the permission to access the virtual resources that need to be accessed. Therefore, the probability of a malicious user accessing the virtual resources of other users can be reduced, the protection of the virtual resources is realized, and the security protection of the virtual resources in the cloud computing virtualization platform is realized.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only some of the present invention. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

FIG. 1 is a schematic flowchart of a method for securely accessing a virtual machine provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of another virtual machine security access method provided by an embodiment of the present invention;

FIG. 3 is a schematic flowchart of another virtual machine security access method provided by an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a virtual machine system provided by an embodiment of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

An embodiment of the present invention provides a virtual machine security access method, which is applied to a virtual machine system, and the virtual machine system includes: a computing node, a cloud computing control node, and a virtual machine. Described method, as shown in Figure 1, comprises:

Step 101, the cloud computing control node configures corresponding identification information for the virtual machine and virtual resources corresponding to the virtual machine when the virtual machine is created.

Specifically, when the virtual machine is created, in order to protect the virtual resources, the cloud computing control node needs to configure corresponding identification information for the virtual machine and the virtual resources that the virtual machine can access.

Further, the identification information corresponding to different virtual machines is different.

Furthermore, when a virtual machine is created, the cloud computing control node can determine the virtual resources corresponding to the virtual machine according to the resources required by the virtual machine and its configuration information, and then can provide information for the virtual machine and the virtual machines that the virtual machine can access. The identification information corresponding to the resource configuration.

Further, the cloud computing control node configures the same identification information for the virtual machine and the virtual resources that the virtual machine can access.

Step 102, the computing node receives the virtual resource access request message sent by the virtual machine.

Wherein, the virtual resource access request message carries the identification information of the virtual machine and the identification information of the virtual resource to be accessed.

Specifically, when the virtual machine needs to access the virtual resource, it sends a virtual resource access request message to the computing node. Moreover, the virtual resource access request message carries its own identification information, which is the identification information of the virtual machine and the identification information of the resource to be accessed.

Further, the virtual resource access request message may not carry the identification information of the virtual resource to be accessed. In this case, it needs to carry other information that can indicate the virtual resource to be accessed. In this way, it is convenient for the computing node to indicate the virtual resource to be accessed. other information of the virtual resource to determine the identification information of the virtual resource.

Step 103, the computing node determines whether the virtual machine has the right to access the virtual resource corresponding to the virtual resource identification information according to the identification information of the virtual machine and the identification information of the virtual resource to be accessed.

Specifically, after receiving the virtual resource access request message, the computing node parses out the identification information of the virtual resource and the identification information of the virtual machine carried in it, compares the identification information of the virtual resource with the identification information of the virtual machine, and then It can be determined according to the comparison result whether the virtual machine has access rights to access the virtual resources it needs to access.

Further, if in step 101, the cloud computing control node configures the same identification information for the virtual machine and the virtual resources that the virtual machine can access, the computing node can combine the analyzed identification information of the virtual machine with the identification information of the virtual resources Comparison is performed to detect whether the identification information of the virtual machine is consistent with the identification information of the virtual resource. If they are consistent, it can be determined that the virtual machine has the access right to access the virtual resource corresponding to the identification information of the virtual resource. If not, it can be determined that the virtual machine does not have the access right to access the virtual resource corresponding to the identification information of the virtual resource.

It should be noted that, depending on the determination result of step 103, the following steps are also different. When the computing node determines that the virtual machine has the access right to access the virtual resource corresponding to the identification information of the virtual resource, step 104a is performed. When the computing node determines that the virtual machine does not have the access right to access the virtual resource corresponding to the identification information of the virtual resource, step 104b is performed.

Step 104a, when it is determined that the virtual machine has the right to access the virtual resource corresponding to the identification information of the virtual resource, the computing node allows the virtual machine to access the virtual resource corresponding to the identification information of the virtual resource.

Specifically, when the computing node determines that the virtual machine has the right to access the virtual resource corresponding to the virtual resource identifier, it indicates that the virtual machine is legal and is not a virtual machine controlled by a malicious user. Therefore, the computing node can run the virtual machine to access all The virtual resource corresponding to the identification information of the virtual resource is selected, so that the virtual machine obtains the required information.

Step 104b, when it is determined that the virtual machine does not have the right to access the virtual resource corresponding to the identification information of the virtual resource, the computing node prevents the virtual machine from accessing the virtual resource corresponding to the identification information of the virtual resource.

Specifically, when the computing node determines that the virtual machine does not have the right to access the virtual resource corresponding to the identification information of the virtual resource, it indicates that the virtual machine is illegal and may be a virtual machine controlled by a malicious user, so the computing node prevents the virtual machine from A virtual resource corresponding to the identification information of the virtual resource is accessed. That is, the computing node does not respond to the virtual resource access request message sent by the virtual machine.

In this way, after the cloud computing control node configures the corresponding identification information for the virtual machine and the virtual resources corresponding to the virtual machine when the virtual machine is created, when the virtual machine needs to access the virtual resources, the computing node can use the identification information of the virtual machine and its The identification information of the virtual resource to be accessed to determine whether the virtual machine has permission. The virtual machine is allowed to access only when the virtual machine has the permission to access the virtual resources that need to be accessed. Therefore, the probability of a malicious user accessing the virtual resources of other users can be reduced, the protection of the virtual resources is realized, and the security protection of the virtual resources in the cloud computing virtualization platform is realized.

Further, before step 101, as shown in Figure 2, it also includes:

Step 105, the cloud computing control node determines the computing node running the virtual machine according to the benefit information of the user.

Specifically, when the user creates the virtual machine, the user's interest information is sent to the cloud computing control node. Among them, the user's interest information refers to the information provided by the user on other users who may have an interest relationship with the user. At this time, the cloud computing control node can determine the computing node running the virtual machine according to the obtained user's interest information, so that the computing node running the virtual machine does not run the virtual machine of other users with interests. That is, the cloud computing control node, according to the user's interest information, selects the computing node that does not run the virtual machine of the user who has an interest relationship with the user among all the computing nodes, and uses this computing node as the running computing node of the above virtual machine. node.

It should be noted that if there are at least two selected computing nodes that do not run virtual machines of users that have an interest relationship with this user, then at least two of the above-mentioned computing nodes that do not run virtual machines of users that have an interest relationship with this user Among the computing nodes, a computing node is arbitrarily determined as the running computing node of the virtual machine. Of course, among the above-mentioned at least two computing nodes that do not run virtual machines of users who have an interest relationship with this user, the computing nodes that run virtual machines can be determined according to other rules. The computing node is determined as a computing node running the virtual machine. Certainly, other rules may also be used, and the present invention is not limited thereto.

Exemplarily, there are four computing nodes of computing nodes a, b, c and d in the virtual machine system. The cloud computing control node needs to determine the computing node of the virtual machine 1. At this time, the cloud computing control node may first obtain the stored benefit information of the user corresponding to the virtual machine 1 . That is, the benefit information of the user corresponding to the user who created the virtual machine 1 is obtained. In this way, the cloud computing control node determines that computing nodes a and b among the four computing nodes a, b, c and d are running the virtual virtual machine of the user who has an interest relationship with the user of virtual machine 1 according to the user's interest information. machine, but no virtual machine of a user who has an interest relationship with the user of virtual machine 1 is running in computing nodes c and d. At this time, the cloud computing control node may determine the computing node c with a smaller load as the computing node of the virtual machine 1 .

Step 106, the cloud computing control node sends a message for establishing an operation relationship with the virtual machine to the computing node running the virtual machine. The computing node receives the message of establishing the running relationship with the virtual machine sent by the cloud computing control node.

Specifically, after the cloud computing control node determines the computing node running the virtual machine, it sends a message of establishing an operating relationship with the virtual machine to the computing node, so that the computing node establishes an operating relationship with the virtual machine. The computing node receives the message establishing the running relationship with the virtual machine.

As described in the above example, after the cloud computing node determines that the computing node c is the running computing node of the virtual machine 1, it sends a message for establishing an operating relationship with the virtual machine 1 to the computing node c. The computing node c may receive the message of establishing the running relationship with the virtual machine 1 .

Step 107, the computing node allocates running resources to the virtual machine according to the message of establishing the running relationship with the virtual machine, and establishes the running relationship with the virtual machine.

Specifically, after a computing node receives a message about establishing an operating relationship with a virtual machine, it can parse the message to know which virtual machine it has established an operating relationship with, and then allocate corresponding operating resources to this virtual machine, and then establish an operating relationship with the virtual machine. The running relationship of this virtual machine.

As mentioned in the above example, after receiving the message of establishing the operating relationship with virtual machine 1, the computing node c can parse the message of establishing the operating relationship with virtual machine 1, and know the virtual machine 1 that needs to establish the operating relationship. Therefore, the virtual machine 1 is allocated the running resources it needs, and then the running relationship with the virtual machine 1 is established.

Further, step 105 is executed by the cloud computing control node only when the virtual machine is created or migrated. When the virtual machine is created, it indicates that the user needs to create the virtual machine, and at this time the user can trigger the cloud computing control node to create the virtual machine. When the user triggers the cloud computing control node to create a virtual machine, the user's interest information can be sent to the cloud computing control node.

At this time, the cloud computing control node determines the computing node running the virtual machine according to the user's interest information includes: when the cloud computing control node determines to create a virtual machine, the cloud computing control node determines the computing node running the virtual machine according to the user's interest information .

That is to say, when a user needs to create a virtual machine, a trigger message for creating a virtual machine is sent to the cloud computing control node, and the user's benefit information is sent to the cloud computing control node. At this time, the cloud computing control node can obtain the benefit information of the user after receiving the trigger message to create the virtual machine, and then the cloud computing control node needs to determine the computing node running the virtual machine when creating the virtual machine.

When the virtual machine is being migrated, before step 105, as shown in FIG. 3 , it also includes:

Step 108, the cloud computing control node determines whether to migrate the virtual machine according to the load information of the computing node where the virtual machine is located.

Specifically, the cloud computing control node can obtain various information of each computing node in real time, such as load status, resource utilization rate, and the like. The cloud computing control node can determine whether any computing node needs to migrate a virtual machine according to various information of each computing node.

As mentioned in the above example, the cloud computing control node can obtain various information of the four computing nodes a, b, c, and d. If it is found that the load of computing node a is relatively large, while the load of computing node c is small and the resource utilization rate is low, the cloud computing control node can determine that computing node a needs to migrate the virtual machine, that is, the virtual machine in computing node a can be migrated to The virtual machine identified as the migrated virtual machine.

At this time, step 105, the cloud computing control node determining the computing node running the virtual machine according to the user's benefit information includes: when the cloud computing control node determines to migrate the virtual machine, determining the computing node running the virtual machine according to the user's benefit information .

That is to say, when the cloud computing control node determines to migrate the virtual machine, the cloud computing control node may determine a computing node for running the virtual machine for the virtual machine. At this time, the cloud computing control node can determine the computing node running the virtual machine according to the user's benefit information.

An embodiment of the present invention provides a method for securely accessing a virtual machine. The virtual machine system includes a computing node, a cloud computing control node, and a virtual machine. The method includes: when the cloud computing control node is The identification information corresponding to the virtual resource configuration corresponding to the machine; the computing node receives the virtual resource access request message sent by the virtual machine, wherein the virtual resource access request message carries the identification information of the virtual machine and the identification information of the virtual resource to be accessed; According to the identification information of the virtual machine and the identification information of the virtual resource to be accessed, the node determines whether the virtual machine has the right to access the virtual resource corresponding to the identification information of the virtual resource; When the permission of the resource is specified, the computing node allows the virtual machine to access the virtual resource corresponding to the identification information of the virtual resource; when it is determined that the virtual machine does not have the permission to access the virtual resource corresponding to the identification information of the virtual resource, the computing node prevents the virtual machine from accessing the virtual resource The virtual resource corresponding to the identification information. In this way, after the cloud computing control node configures the corresponding identification information for the virtual machine and the virtual resources corresponding to the virtual machine when the virtual machine is created, when the virtual machine needs to access the virtual resources, the computing node can use the identification information of the virtual machine and its The identification information of the virtual resource to be accessed to determine whether the virtual machine has permission. The virtual machine is allowed to access only when the virtual machine has the permission to access the virtual resources that need to be accessed. Therefore, the probability of a malicious user accessing the virtual resources of other users can be reduced, the protection of the virtual resources is realized, and the security protection of the virtual resources in the cloud computing virtualization platform is realized.

An embodiment of the present invention provides a virtual machine system, as shown in FIG. 4 , including: a computing node 401 , a cloud computing control node 402 , and a virtual machine 403 .

The cloud computing control node 402 is configured to configure corresponding identification information for the virtual machine 403 and virtual resources corresponding to the virtual machine 403 when the virtual machine 403 is established.

The computing node 401 is configured to receive the virtual resource access request message sent by the virtual machine 403 .

Wherein, the virtual resource access request message carries the identification information of the virtual machine and the identification information of the virtual resource to be accessed.

The computing node 401 is further configured to determine, according to the identification information of the virtual machine 403 and the identification information of the virtual resource to be accessed, whether the virtual machine 403 has the right to access the virtual resource corresponding to the identification information of the virtual resource. When it is determined that the virtual machine 403 has the right to access the virtual resource corresponding to the identification information of the virtual resource, the virtual machine 403 is allowed to access the virtual resource corresponding to the identification information of the virtual resource. When it is determined that the virtual machine 403 does not have the right to access the virtual resource corresponding to the identification information of the virtual resource, the virtual machine 403 is prevented from accessing the virtual resource corresponding to the identification information of the virtual resource.

Further, the cloud computing control node 402 is also configured to determine the computing node running the virtual machine according to the benefit information of the user.

The cloud computing control node 402 is further configured to send a message for establishing an operation relationship with the virtual machine 403 to the computing node running the virtual machine 403 .

The computing node 401 is further configured to receive a message for establishing an operation relationship with the virtual machine 403 sent by the cloud computing control node 402 .

The computing node 401 is further configured to allocate running resources to the virtual machine 403 and establish a running relationship with the virtual machine 403 according to the message of establishing the running relationship with the virtual machine 403 .

Further, the cloud computing control node 402 is further configured to determine whether to migrate the virtual machine 403 according to the load information of the computing node where the virtual machine 403 is located.

The cloud computing control node 402 is specifically used to determine the computing node 401 for running the virtual machine 403 according to the benefit information of the user when determining the virtual machine 403 to be migrated.

Alternatively, the cloud computing control node 402 is specifically configured to determine the computing node for running the virtual machine 403 according to the benefit information of the user when determining to create the virtual machine.

An embodiment of the present invention provides a virtual machine system. The virtual machine system includes a computing node, a cloud computing control node, and a virtual machine. The identification information corresponding to the virtual resource configuration; the computing node receives the virtual resource access request message sent by the virtual machine, wherein the virtual resource access request message carries the identification information of the virtual machine and the identification information of the virtual resource to be accessed; The identification information of the virtual machine and the identification information of the virtual resource to be accessed determine whether the virtual machine has the right to access the virtual resource corresponding to the identification information of the virtual resource; after determining that the virtual machine has the right to access the virtual resource corresponding to the identification information of the virtual resource When it is determined that the virtual machine does not have the right to access the virtual resource corresponding to the identification information of the virtual resource, the computing node prevents the virtual machine from accessing the virtual resource corresponding to the identification information of the virtual resource. virtual resources. In this way, after the cloud computing control node configures the corresponding identification information for the virtual machine and the virtual resources corresponding to the virtual machine when the virtual machine is created, when the virtual machine needs to access the virtual resources, the computing node can use the identification information of the virtual machine and its The identification information of the virtual resource to be accessed to determine whether the virtual machine has permission. The virtual machine is allowed to access only when the virtual machine has the permission to access the virtual resources that need to be accessed. Therefore, the probability of a malicious user accessing the virtual resources of other users can be reduced, the protection of the virtual resources is realized, and the security protection of the virtual resources in the cloud computing virtualization platform is realized.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (8)

1. A security access method for a virtual machine, characterized in that it is applied to a virtual machine system, and the virtual machine system includes: a computing node, a cloud computing control node, and a virtual machine, and the method includes: The cloud computing control node configures corresponding identification information for the virtual machine and virtual resources corresponding to the virtual machine when the virtual machine is established; The computing node receives a virtual resource access request message sent by a virtual machine; wherein, the virtual resource access request message carries identification information of the virtual machine and identification information of the virtual resource to be accessed; The computing node determines, according to the identification information of the virtual machine and the identification information of the virtual resource to be accessed, whether the virtual machine has the right to access the virtual resource corresponding to the identification information of the virtual resource; When determining that the virtual machine has the right to access the virtual resource corresponding to the identification information of the virtual resource, the computing node allows the virtual machine to access the virtual resource corresponding to the identification information of the virtual resource; When determining that the virtual machine does not have the right to access the virtual resource corresponding to the identification information of the virtual resource, the computing node prevents the virtual machine from accessing the virtual resource corresponding to the identification information of the virtual resource. 2. The method according to claim 1, further comprising: before the computing node receives the virtual resource access request message sent by the virtual machine: The cloud computing control node determines the computing node running the virtual machine according to the user's interest information; The cloud computing control node sends a message to the computing node running the virtual machine to establish an operating relationship with the virtual machine; the computing node receives the message sent by the cloud computing control node to establish an operating relationship with the virtual machine news; The computing node allocates running resources to the virtual machine according to the message of establishing the running relationship with the virtual machine, and establishes a running relationship with the virtual machine. 3. The method according to claim 2, wherein, before the cloud computing control node determines the computing node running the virtual machine according to the user's interest information, it also includes: The cloud computing control node determines whether to migrate the virtual machine according to the load information of the computing node where the virtual machine is located; The cloud computing control node determines the computing node running the virtual machine according to the user's interest information including: When the cloud computing control node determines to migrate the virtual machine, it determines the computing node running the virtual machine according to the benefit information of the user. 4. The method according to claim 2, wherein the cloud computing control node determines the computing node running the virtual machine according to the user's interest information comprising: When the cloud computing control node determines to create a virtual machine, the cloud computing control node determines a computing node for running the virtual machine according to the benefit information of the user. 5. A virtual machine system, characterized in that it comprises: a computing node, a cloud computing control node, and a virtual machine; wherein, The cloud computing control node is configured to configure corresponding identification information for the virtual machine and virtual resources corresponding to the virtual machine when the virtual machine is established; The computing node is configured to receive a virtual resource access request message sent by a virtual machine; wherein, the virtual resource access request message carries identification information of the virtual machine and identification information of the virtual resource to be accessed; The computing node is further configured to determine, according to the identification information of the virtual machine and the identification information of the virtual resource to be accessed, whether the virtual machine has the right to access the virtual resource corresponding to the identification information of the virtual resource; When it is determined that the virtual machine has the right to access the virtual resource corresponding to the identification information of the virtual resource, allow the virtual machine to access the virtual resource corresponding to the identification information of the virtual resource; when it is determined that the virtual machine does not have access to the virtual resource When the permission of the virtual resource corresponding to the identification information of the virtual resource is disabled, the virtual machine is prevented from accessing the virtual resource corresponding to the identification information of the virtual resource. 6. The system according to claim 5, characterized in that, The cloud computing control node is also used to determine the computing node running the virtual machine according to the user's interest information; The cloud computing control node is further configured to send a message for establishing an operating relationship with the virtual machine to the computing node running the virtual machine; The computing node is further configured to receive a message for establishing an operating relationship with the virtual machine sent by the cloud computing control node; The computing node is further configured to allocate running resources to the virtual machine and establish a running relationship with the virtual machine according to the message of establishing the running relationship with the virtual machine. 7. The system of claim 6, wherein: The cloud computing control node is further configured to determine whether to migrate the virtual machine according to the load information of the computing node where the virtual machine is located; The cloud computing control node is specifically configured to determine, when migrating the virtual machine, a computing node for running the virtual machine according to user interest information. 8. The system of claim 6, wherein: The cloud computing control node is specifically used to determine the computing node for running the virtual machine according to the benefit information of the user when determining to create the virtual machine.