TWI493377B - A kind of cloud ARP and IP spoofing protection system - Google Patents

Description

Cloud ARP and IP spoofing protection system

The invention provides a protection system, and a cloud ARP and IP spoofing protection system, which protects the network behavior between the virtual host of the cloud service platform and protects the virtual host from ARP spoofing attacks and IP spoofing attacks.

In the ARP spoofing attack defense mode of the traditional physical machine, static ARP records must be set on the host, and the IP address and MAC address must be bound. In order to improve network security, all host ARP data must be set up with additional security devices. To protect regional network security.

However, if the Hypervisor implements the ARP spoofing attack defense mechanism on the cloud virtual platform, it can directly detect and block malicious packets from the bottom of the cloud network, and does not need to purchase additional security hardware devices.

In addition, the hypervisor on the cloud virtual platform is a software component between the actual hardware and the virtual host, which allows a large number of virtual hosts to run on the same physical host. It is responsible for managing the virtual host on the virtual platform to share the hardware device and use it. Virtualization technology manages the allocation of virtual host resources such as: memory, CPU, network, and storage. However, the traditional defense method is set to spend a lot of time and hardware costs on the cloud virtual platform, so the protection mechanism is provided on the hypervisor. Set in each virtual host, the protection can be set uniformly in the Hypervisor, and the same is not Additional security devices must be added to detect and block malicious packets from the bottom of the cloud network to prevent derivative attacks caused by ARP/IP spoofing and to protect all virtual machines on the cloud.

It can be seen that there are still many shortcomings in the above-mentioned methods of use, which is not a good design, but needs to be improved.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventors of the present invention have developed and improved the cloud ARP and IP spoofing protection system of the present invention.

The object of the present invention is to provide a cloud ARP and IP spoofing protection system. When any virtual host is opened on the cloud service platform XEN, the cloud virtual host operation script intercepting module intercepts the cloud virtual host operation script and automatically calls the cloud virtual host. The security module is managed, and the virtual host status module is used to determine the virtual host status, and the virtual host data module is obtained by the cloud virtual host data module, and the virtual network dynamic creation is obtained through the virtual host data module and the virtual host dynamic data module. The virtual network card and the virtual host MAC address, the ARP spoofing protection rule processing module and the IP spoofing protection rule processing module will create ARP spoof protection rules and IP spoof protection rules for the virtual host, and pass the rules through the delivery module. Delivered to the cloud platform system firewall to provide network security protection between virtual hosts of the cloud service platform.

The invention provides a cloud ARP and IP spoofing protection system, comprising: a cloud virtual host operation script intercepting module, which intercepts a cloud virtual host operation script on a cloud service platform, and provides virtualization of a plurality of virtual hosts on the cloud service platform. Network security protection; a cloud virtual host management security module is triggered when the cloud virtual host operation script interception module intercepts the cloud virtual host operation script of the cloud service platform, and provides virtualized network security Full protection, improve the information security protection of the plurality of virtual hosts on the cloud service platform; and a cloud virtual host data module, and store a plurality of the virtual host materials on the cloud service platform.

The cloud virtual host data module includes: a virtual host data module, which stores a plurality of the virtual host data on the cloud service platform; and a virtual host dynamic data module, which stores a plurality of the virtual hosts on the cloud service platform. After startup, the data is dynamically allocated via the cloud service platform.

The cloud virtual host management security module includes: a virtual host status module, determining that the plurality of virtual hosts are in an open state or a closed state, to provide a plurality of virtualized network security protections of the virtual host; and an ARP spoofing protection The rule processing module establishes a firewall protection rule according to the plurality of virtual host data, and protects a plurality of ARP spoofing attacks between the virtual hosts; and an IP spoof protection rule module establishes firewall protection according to the plurality of virtual host data The rule protects a plurality of IP spoofing attacks between the virtual hosts; and a dispatch module that executes the firewall protection rules to the cloud service platform system firewall to provide ARP spoofing protection for the plurality of virtual hosts on the cloud service platform XEN And IP spoofing protection.

The cloud ARP and IP spoofing protection system provided by the invention has the following advantages when compared with other conventional technologies:

1. The system provided by the present invention adds a security mechanism to the cloud service platform, and uses the method of intercepting the cloud virtual host operation script to automatically enable the network security protection mechanism when any virtual host performs the booting action, and enhance the cloud service platform virtual host. Security.

2. The system provided by the present invention is a network protection method built on the cloud service platform, which provides security protection for the virtual host on the cloud service platform, and does not affect the habit of the virtual host user system operation.

3. The system provided by the invention is a software information security protection mechanism, and the purpose of network attack protection can be achieved without additional hardware installation, and the construction of the cloud service platform system can be reduced.

The system provided by the present invention is a network attack protection method built on the cloud service platform, which can protect against ARP spoofing attacks and IP spoofing attacks between virtual hosts, and avoids the derivative network attacks based on this.

5. The system provided by the present invention utilizes virtualization technology to obtain virtual host data, generates protection rules against ARP spoofing and IP spoofing, and sends ARP spoof protection rules and IP spoof protection rules to the cloud platform system firewall to provide a virtualized network. Security protection protects virtual hosts from ARP spoofing attacks and IP spoofing attacks of other virtual hosts, and improves information security protection of cloud service platform virtual hosts.

The detailed description of the preferred embodiments of the present invention is intended to be limited to the scope of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

In summary, this case is not only innovative in terms of space type, but also can enhance the above-mentioned multiple functions compared with the customary items. It should fully meet the statutory invention patent requirements of novelty and progressiveness, and apply for it according to law. This invention patent application, in order to invent invention, to the sense of virtue.

1‧‧‧Cloud virtual host operation script interception module

2‧‧‧Cloud virtual host data module

3‧‧‧Cloud Virtual Host Management Security Module

4‧‧‧Web Hosting

5‧‧‧Cloud virtual host operation script

6‧‧‧Cloud Platform System Firewall

7‧‧‧Cloud Service Platform

21‧‧‧Virtual Host Data Module

22‧‧‧Virtual Host Dynamic Data Module

31‧‧‧Virtual Host Status Module

32‧‧‧ARP fraud protection rule processing module

33‧‧‧IP fraud protection rule processing module

34‧‧‧delivery module

Figure 1 is a block diagram of the cloud ARP and IP spoofing protection system of the present invention.

Figure 2 is a flow chart of the cloud ARP and IP spoofing protection system of the present invention.

The technical features, contents, and advantages of the present invention, as well as the advantages thereof, can be understood by the reviewing committee, and the present invention will be described in detail with reference to the accompanying drawings. The subject matter is only for the purpose of illustration and description. It is not intended to be a true proportion and precise configuration after the implementation of the present invention. Therefore, the scope and configuration relationship of the attached drawings should not be interpreted or limited. First described.

Please refer to FIG. 1 , which is a structural diagram of the cloud ARP and IP spoofing protection system of the present invention, including a cloud virtual host operation script interception module, a cloud virtual host data module 2, and a cloud virtual host management security. Module 3, virtual host 4, cloud virtual host operation script 5 and cloud platform system firewall 6, wherein cloud service platform 7 is XEN cloud virtualization platform, and cloud platform system firewall 6 is Linux system firewall.

Please refer to FIG. 2, which is a flow chart of the cloud ARP and IP spoofing protection system of the present invention. Before the cloud ARP and IP spoofing protection system is started, the cloud service platform 7 processes the hardware resource management and the virtual host 4 When the cloud service platform 7 wants to open the virtual host 4, the cloud virtual host operation script 5 is executed to open the virtual host 4, and the virtual host 4 is dynamically given to the virtual host network. Host 4 can connect to other hosts via the network. The cloud ARP and IP spoofing protection system of the present invention uses the cloud virtual host operation script interception module 1 to intercept the cloud virtual host operation script 5 opened by the virtual host 4, triggers the cloud virtual host management security module 3, and automatically provides virtual for the virtual host 4. Network security protection.

After being triggered, the cloud virtual host management security module 3 reads the virtual host data module 21 in the cloud virtual host data module 2, and obtains all protected virtual host data. For example: virtual host name and IP address. All protected virtual hosts 4 may be in an open state or a closed state. After the virtual host state module 31 determines that all protected virtual hosts 4 are turned on, dynamic data capture is performed on the opened virtual host 4, and each virtual host 4 is used. When the cloud service platform 7 is opened, it will be assigned to its own virtual network card for virtual network communication, and the virtual host dynamic data module 22 in the cloud virtual host data module 2 is used to obtain the virtual of each virtual host 4. After the network card and the virtual host MAC address, the virtual host 4 can control the network traffic of the virtual network to provide security protection.

The ARP spoofing protection rule processing module 32 in the cloud virtual host management security module 3 uses the acquired virtual host data to create a firewall rule that can protect against ARP spoofing attacks, and the IP address and MAC address of the individual virtual host 4 For protection, the IP spoofing protection rule processing module 33 also uses the acquired virtual host data to create a firewall rule that can protect against IP spoofing attacks, and protects the IP address of the individual virtual host 4.

The ARP spoofing protection rule processing module 32 and the IP spoofing protection rule processing module 33 of the cloud ARP and IP spoofing protection system of the present invention generate ARP spoofing protection rules and IP spoofing protection rules, and use the delivery module 34 to spoof ARP. The protection rules and IP spoofing protection rules are implemented to the cloud platform system firewall 6, which provides ARP spoofing protection and IP spoofing protection for the virtual host 4 on the cloud service platform XEN.

The cloud ARP and IP spoofing protection system provided by the invention has the following advantages when compared with other conventional technologies:

1. The system provided by the present invention adds a security mechanism to the cloud service platform, and uses the method of intercepting the cloud virtual host operation script to automatically enable the network security protection mechanism when any virtual host performs the booting action, and enhance the cloud service platform virtual host. Security.

2. The system provided by the present invention is a network protection method built on the cloud service platform, which provides security protection for the virtual host on the cloud service platform, and does not affect the habit of the virtual host user system operation.

3. The system provided by the invention is a software information security protection mechanism, and the purpose of network attack protection can be achieved without additional hardware installation, and the construction of the cloud service platform system can be reduced.

The system provided by the present invention is a network attack protection method built on the cloud service platform, which can protect against ARP spoofing attacks and IP spoofing attacks between virtual hosts, and avoids the derivative network attacks based on this.

5. The system provided by the present invention utilizes virtualization technology to obtain virtual host data, generates protection rules against ARP spoofing and IP spoofing, and sends ARP spoof protection rules and IP spoof protection rules to the cloud platform system firewall to provide a virtualized network. Security protection protects virtual hosts from ARP spoofing attacks and IP spoofing attacks of other virtual hosts, and improves information security protection of cloud service platform virtual hosts.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

1‧‧‧Cloud virtual host operation script interception module

2‧‧‧Cloud virtual host data module

3‧‧‧Cloud Virtual Host Management Security Module

4‧‧‧Web Hosting

5‧‧‧Cloud virtual host operation script

6‧‧‧Cloud Platform System Firewall

7‧‧‧Cloud Service Platform

21‧‧‧Virtual Host Data Module

22‧‧‧Virtual Host Dynamic Data Module

31‧‧‧Virtual Host Status Module

32‧‧‧ARP fraud protection rule processing module

33‧‧‧IP fraud protection rule processing module

34‧‧‧delivery module

Claims (4)

A cloud ARP and IP spoofing protection system includes: a cloud virtual host operation script intercepting module, which intercepts a cloud virtual host operation script on a cloud service platform, and provides virtualized network security of a plurality of virtual hosts on the cloud service platform. Protection; a cloud virtual host management security module is triggered when the cloud virtual host operation script interception module intercepts the cloud virtual host operation script of the cloud service platform, provides virtualized network security protection, and improves cloud service A plurality of information security protections of the virtual host on the platform; and a cloud virtual host data module, which stores a plurality of the virtual host data on the cloud service platform. The cloud ARP and IP spoofing protection system, as described in claim 1, wherein the cloud virtual host data module comprises: a virtual host data module, which stores a plurality of the virtual host data on the cloud service platform; The virtual host dynamic data module stores the data dynamically allocated by the cloud service platform after the plurality of virtual hosts are started on the cloud service platform. The cloud ARP and IP spoofing protection system, as described in claim 1, wherein the cloud virtual host management security module comprises: a virtual host status module, determining that the plurality of virtual hosts are in an on state or a closed state, Providing a plurality of virtualized network security protections for the virtual host; an ARP spoofing protection rule processing module, which establishes a firewall protection rule according to the plurality of virtual host data, and protects a plurality of ARP spoofing attacks between the virtual hosts; An IP spoofing protection rule module, which establishes a firewall protection rule according to a plurality of the virtual host data, protects a plurality of IP spoofing attacks between the virtual hosts; and sends a module to execute the firewall protection rule to the cloud service platform system A firewall provides ARP spoofing protection and IP spoofing protection for multiple virtual hosts on the cloud service platform. For example, the cloud ARP and IP spoofing protection system described in claim 1 of the patent scope, wherein the cloud service platform is the XEN cloud virtualization platform.