一种基于OpenvSwitch的虚拟机安全防护方案

A Safety Protection Scheme of the Virtual Machine Based on Openv Switch

针对虚拟网络安全边界不清晰,传统的网络设备无法监控虚拟机间的数据流量等问题,提出了一种虚拟网络安全防护方案。该方案基于OpenvSwitch技术,实现了虚拟机之间的访问控制、安全域划分策略、安全域间访问控制、虚拟机准入控制以及网络功能划分功能,有效地加强了虚拟网络边界,检测和控制网络访问。经部署和测试,说明方案的可行性与合理性。

Aiming at the problems that there are undefined boundary in virtual network and the inability of traditional network equipment in monitoring or controlling the data flow between virtual machines,the paper proposes a scheme to protect the virtual network. Based on the technique of Openv Switch,the scheme realizes the access control between virtual machines,the partitioning strategy of security domain,the access control between security domains,the admission control of virtual machine and the division of network functional,and reinforcing the boundary of virtual network efficiently,detecting and the network controll access. The scheme proves to be feasible and rational after deploying and testing.