Log file security audit system and method based on security virtual machine

Abstract

The invention provides a log file security auditing system and method based on a security virtual machine. The log file security auditing system comprises a professional virtual machine; a virtual machine monitor and a storage backup module are arranged in the professional virtual machine; the virtual machine monitor is used for intercepting I / O requests of all client virtual machines, judging whether the I / O requests aim at a modification or deletion operation of the log file, if no, allowing to execute the I / O requests, and if yes, sending out a warning and starting the backup module; and the backup module is used for restoring the modified or deleted log file in the client virtual machines, and storing to the professional virtual machine. According to the log file security auditing system and method based on the security virtual machine provided by the invention, compared with the existing virtual machine security auditing system, under the conditions of not modifying the client virtual machines and not installing any security module inside the client virtual machines, a reliable auditing service can be provided for the client virtual machines, and the security of the client virtual machines is guaranteed; and thus, the wide application of the virtual machines and cloud computing is promoted, and considerable social benefit and economic benefit are brought about.

Description

technical field [0001] The invention relates to the technical field of system virtualization, in particular to a log file security audit system and method based on a security virtual machine. Background technique [0002] Cloud computing and virtualization provide users with simpler and cheaper ways to deploy devices and applications, and are trusted by a large number of users. In order to save costs, the cloud provider deploys a large number of virtual machines on the same physical machine, and different users can access the same physical machine. In this case, the security and data privacy of the cloud platform are very important. [0003] The industry is always looking for ways and strategies to secure cloud platforms. One method is security monitoring, that is, the cloud provider provides security protection measures instead of customer virtual machines. Typical examples of this method include VMware's VMsafe, McAfee's MOVE, and TrendMicro's Deep Security. There is st...

AI Technical Summary

Problems solved by technology

However, today's security services are faced with three major problems: 1) Most security services require client virtual machines to install corresponding security modules

During this period, the module may be attacked by viruses or malware, or the user's wrong configuration may cause the module to fail to work properly

2) Some services are heavily dependent on the functionality and semantics of the guest operating system, once the guest operating system is upgraded, the service will not work

3) Some security services will seriously affect the performance of the guest operating system

Images