JP2010073011A - Virtual machine security management system and virtual machine security management method - Google Patents

Abstract

[PROBLEMS] To improve security in a virtual environment.
A virtual machine security management computer generates a quarantine virtual machine on a quarantine virtualization server prepared for quarantine when a user request, a virus infection detection or a security patch not applied message is issued. Then, it is determined whether or not the template that is the basis of the generated quarantine virtual machine 119 has been quarantined, and the virtual machine 119 that has passed the quarantine is transferred from the quarantine virtualization server 107 to the operation virtualization server 107 in the production environment. By moving, a virtual machine free from virus infection and having a security patch is generated.
[Selection] Figure 1

Description

  The present invention relates to a virtual machine security management system and a virtual machine security management method in a computer system using a pseudo machine environment called a virtual machine emulated by virtualization software, and in particular, antivirus software, patch management software, etc. The present invention relates to a virtual machine security management system and a virtual machine security management method capable of operating a virtual machine in an environment based on a quarantine result of the security quarantine software.

  In recent years, companies and the like use virtual software for the purpose of reducing operation costs and provide virtual machines that operate a plurality of operating systems on one piece of hardware. In addition, for the purpose of preventing information leaks, a solution that provides a virtual machine as a client terminal in the data center and accesses it from a thin client terminal that does not have a mechanism for recording information on a medium such as a hard disk or a CD drive attracts attention. Yes. The virtualization software here refers to software that artificially creates hardware controlled by the operating system. Common virtualization software includes VMware (registered trademark) ESX Server (software provided by VMware), Microsoft (registered trademark) Hyper-V (registered trademark) (software provided by Microsoft), etc. To do.

  In general, the operation related to the security of a virtual machine is similar to a general machine environment in which one operating system is arranged on one piece of hardware. A security check method, a security patch patch management machine that is distributed when a security weakness (security hole) is detected in the software, and an agent (software) that resides on the monitored machine are prepared. However, a method is employed in which the patch management machine inspects whether or not the security patch of the monitored machine has been applied (whether or not the latest correction program has been applied).

For example, the following Patent Document 1 is cited as a document describing a technique related to security of a virtual machine. In Patent Document 1, a virtual network system including a virtual machine and a virtual switch is configured, and virtual machine software of a server is configured. There is described a quarantine network system technology for performing an inspection from the outside of the computer to be inspected so that the computer to be inspected cannot be started unless it has passed the inspection according to.
JP 2008-90791 A

  The security technology for virtual machines according to the above-mentioned conventional technology is that when virus infection is confirmed by quarantine with anti-virus software while the virtual machine is running, it is possible to reinstall the operating system, recover to the state before infection, Alternatively, it is necessary to remove them manually according to the procedure published by the company that develops anti-virus software. However, since these countermeasures must be manually operated by an administrator or a user, there is a problem that there is a risk of spreading virus infection due to delays in countermeasures or missing countermeasures.

  The technology for checking security patches using patch management software according to the prior art is a method for applying a patch manually by an administrator or user when a security patch is not applied, or for applying a specified patch using patch management software. Work to apply forcibly becomes necessary. In the former case, response delays and missing patches may occur, which may make it easier for crackers and viruses to attack. In the latter case, the user will be forced to restart when using the machine. There was a problem that the service provided by the machine could not be used.

  An object of the present invention is to use a virtual machine replication function and a virtual machine migration function of virtual software, and to define security conditions defined by the user based on the quarantine results of anti-virus software and patch management software. To provide a virtual machine security management system and a virtual machine security management method capable of operating a virtual machine in a satisfied environment.

In order to achieve the above object, the present invention provides:
A plurality of operating virtualization servers that operate a plurality of virtual machines that execute programs;
Quarantine virtualization that operates a quarantine virtual machine that executes anti-virus software that detects virus infection of the program and patch management software that determines whether a correction program that corrects security weaknesses of the program is up-to-date Server,
A virtual environment management computer that stores the program configuration information of the plurality of virtual machines as a template and controls the virtual machines;
A virtual machine security management system of a computer system comprising a virtual machine security management computer for managing security related to virus infection of the virtual machine,
The virtual machine security management computer is
A message master table that stores identifiers of countermeasure processes corresponding to a plurality of messages, a template identifier of a working virtual machine that operates on the working virtualization server, and a virtual that stores a quarantine flag indicating whether or not the template has been quarantined Refer to the information of the machine master table, the host machine master table that stores the number of installed active virtual machines running on multiple active virtualization servers, and the message master table, virtual machine master table, and host machine master table information. And a control unit for generating a quarantine virtual machine on the quarantine virtualization server,
When the control unit determines that a message for generating a new virtual machine has been received with reference to the identifier of the message master table,
A first step of generating a quarantine virtual machine on the quarantine virtualization server with reference to the template of the virtual environment management computer;
A second step of determining whether or not the quarantine virtual machine template generated in the first step is quarantined with reference to a quarantine flag of the virtual machine master table;
A third step of moving the quarantine virtual machine on the quarantine virtualization server as an active virtual machine to the active virtualization server when it is determined that the quarantine virtual machine template generated in the second step has been quarantined; Execution is the first feature.

In the virtual machine security management system according to the first aspect of the present invention, the message master table indicates that the control unit of the virtual machine security management computer has received a virus infection message from the anti-virus software of the operating virtual machine. When it is determined with reference to the identifier During the transition from the first step to the second step, the presence or absence of virus infection and the security patch by the anti-virus software and patch management software of the quarantine virtual machine generated in the first step The second feature is that a fourth step of shifting to the second step is executed when it is determined whether the latest security patch is free of virus infection and is the latest security patch.

According to the present invention, in the virtual machine security management system according to the first feature, the message master table indicates that the control unit of the virtual machine security management computer is a message indicating that a patch has not been applied from the patch management software of the operating virtual machine. When judging by referring to the identifier of
A third feature is that a fifth step of deleting the operating virtual machine that has issued the message from the operating virtualization server is executed during the transition from the first step to the second step.

  According to the present invention, in the virtual machine security management system according to the first feature, when the control unit of the virtual machine security management computer receives a message other than a new virtual machine generation or a virus infection or a patch non-applied message The fourth feature is that the first to third steps are executed.

  According to the present invention, in the virtual machine security management system according to any of the above features, the control unit of the virtual machine security management computer virtualizes the quarantine virtual machine on the quarantine virtualization server according to the third step. When moving as an active virtual machine on a server, refer to the host machine master table and move the quarantine virtual machine to the active virtualization server with the smallest number of active virtual machines installed. The fifth feature.

Furthermore, the present invention provides
A plurality of operating virtualization servers that operate a plurality of virtual machines that execute programs;
Quarantine virtualization that operates a quarantine virtual machine that executes anti-virus software that detects virus infection of the program and patch management software that determines whether a correction program that corrects security weaknesses of the program is up-to-date Server,
A virtual environment management computer that stores the program configuration information of the plurality of virtual machines as a template and controls the virtual machines;
A virtual machine security management method for a computer system comprising a virtual machine security management computer for managing security related to virus infection of the virtual machine,
In the virtual machine security management computer,
A message master table that stores identifiers of countermeasure processes corresponding to a plurality of messages, a template identifier of a working virtual machine that operates on the working virtualization server, and a virtual that stores a quarantine flag indicating whether or not the template has been quarantined Refer to the information of the machine master table, the host machine master table that stores the number of installed active virtual machines running on multiple active virtualization servers, and the message master table, virtual machine master table, and host machine master table information. And a control unit for generating a quarantine virtual machine on the quarantine virtualization server,
When the control unit determines that a message for generating a new virtual machine has been received with reference to the identifier of the message master table,
A first step of generating a quarantine virtual machine on the quarantine virtualization server with reference to the template of the virtual environment management computer;
A second step of determining whether or not the quarantine virtual machine template generated in the first step is quarantined with reference to a quarantine flag of the virtual machine master table;
A third step of moving the quarantine virtual machine on the quarantine virtualization server as an active virtual machine to the active virtualization server when it is determined that the quarantine virtual machine template generated in the second step has been quarantined; Execution is a sixth feature.

  In the virtual machine security management method according to the sixth aspect, the message master table indicates that the control unit of the virtual machine security management computer has received a virus infection message from the anti-virus software of the operating virtual machine. When determining with reference to the identifier, during the transition from the first step to the second step, the presence or absence of virus infection and the security patch by the anti-virus software and patch management software of the quarantine virtual machine generated by the first step A sixth feature is that a fourth step of shifting to the second step is executed when it is determined whether the latest security patch is free of virus infection and is the latest security patch.

  In the virtual machine security management method according to the sixth aspect, the message master table indicates that the control unit of the virtual machine security management computer is a message indicating that a patch has not been applied from the patch management software of the operating virtual machine. When the determination is made with reference to the identifier, the fifth process of deleting the operating virtual machine that issued the message from the operating virtualization server is executed during the transition from the first process to the second process. The eighth feature.

  In the virtual machine security management method according to the sixth aspect of the present invention, when the control unit of the virtual machine security management computer receives a message other than a new virtual machine generation or a virus infection or a patch non-applied message The ninth feature is that the third to third steps are executed.

  According to the present invention, in the virtual machine security management method according to any one of the above features, the control unit of the virtual machine security management computer virtualizes the quarantine virtual machine on the quarantine virtualization server according to the third step. When moving as an active virtual machine on a server, refer to the host machine master table and move the quarantine virtual machine to the active virtualization server with the smallest number of active virtual machines installed. A tenth feature is provided.

  The virtual machine security management system and the virtual machine security management method according to the present invention provide a quarantine virtual machine to a quarantine virtualization server prepared for quarantine when a user request or a virus infection detection or security patch non-apply message is issued. , Determine whether the template that is the source of the generated quarantine virtual machine has been quarantined, and move the virtual machine that passed the quarantine from the quarantine virtualization server to the production virtualization server in the production environment. As a result, it is possible to generate a virtual machine without virus infection and having a security patch applied thereto.

  A virtual machine security management system to which a virtual machine security management method according to the present invention is applied will be described below with reference to the drawings. FIG. 1 is an overall configuration diagram of a computer system to which a virtual machine security management system according to an embodiment of the present invention is applied, FIG. 2 is a diagram illustrating a configuration of a virtual machine security management system according to the embodiment, and FIG. FIG. 4 is an operation flowchart of a message analysis unit according to the present embodiment, and FIG. 5 is an operation flowchart of a virtual machine creation processing unit according to the present embodiment. .

[Constitution]
[overall structure]
The overall configuration of a computer system to which the virtual machine security management system according to the present embodiment is applied is as follows. As shown in FIG. 1, a plurality of virtual machines 108 to 110 are operated (operated) by a virtualization software 113, Anti-virus software management computer 105 equipped with anti-virus software 106 for managing anti-virus software 111 of virtual machine 110 of virtualization server 107 and patch management agent (software) of virtual machine 110 of virtualization server 107 A virtualization server for operating the patch management computer 103 having the patch management software 104 for managing 112 and the virtual machine 119 for security management according to this embodiment by the virtualization software 113 118, for managing an anti-virus software management computer 117 having anti-virus software 106 for managing the anti-virus software 111 of the virtual machine 119, and a patch management agent 112 of the virtual machine 119 of the virtualization server 118. Of the virtual machine by the patch management computer 116 having the patch management software 104, the virtual machine security management computer 101 having the virtual machine security management program 102 characteristic of the present embodiment, and the virtualization servers 107 and 118 described above. A virtual environment management computer 114 having a virtual environment management software 115 for controlling the virtual environment and the virtualization servers 107 and 118 are connected to store data of the virtual machine. A SAN (Storage Area Network) storage 124 of Utame, consists enterprise network 120 / management network 121 / quarantine network 122 that connects the computers and servers, these networks are individually separated. The virtual machine security management computer 101 loaded with the virtual machine security management program 102 uses the patch management software 104 to monitor the patch application status using the patch management agent 112 embedded in the monitored virtual machine. The virtual environment management computer 114 refers to a server on which software running an API that manages a virtual environment and a virtual machine and automatically starts the virtual machine on a host machine having a low resource usage state is operated. As general virtual environment management software, VMware (registered trademark) Virtual Center (software provided by VMware), VMware (registered trademark) Virtual Desktop Manager 2 (software provided by VMware), etc. are suitable. However, it is not limited to this. In FIG. 1, an example in which one virtualization server 107 is provided is illustrated. However, in the present embodiment, a plurality of virtualization servers are connected.

[Virtual Machine Security Management Computer 101]
The functional configuration of the virtual machine security management computer 101, which is a feature of the present embodiment, includes a data communication unit 202 that receives a processing request from a user or a warning from anti-virus software or a patch management agent 112, as shown in FIG. A message analysis unit 203 that determines processing required for a request or warning, a virtual machine creation processing unit 204 that creates a virtual machine and executes a quarantine, and then moves the virtual machine to the actual operation environment, and a virus infection A virtual machine deletion processing unit 205 that deletes a virtual machine, a virtual machine information synchronization processing unit 206 that periodically monitors the placement status of virtual machines, a message master table 207 for determining the type of processing request or warning, Whether it is a template that makes up a virtual machine or has been quarantined It includes a virtual machine master table 208 for storing Rukado of information, and a host machine master table 209 to operate the virtual machine.

[Data table]
As shown in FIG. 3A, the information stored in the message master table 207 includes an identifier ID 301, a message name 302, and a corresponding process ID 303 assigned in correspondence with a handling method corresponding to the message. Each item information includes, for example, a countermeasure processing ID “1” registered for the message name “virus infection warning” with ID “0001”, and includes anti-virus software and a patch management agent. Multiple messages such as a warning from 112 or a user request issued when creating a new virtual machine are classified into three warnings: a warning from anti-virus software, a warning from the patch management agent, and a request from the user. It is a table for.

  As shown in FIG. 3B, the information stored in the virtual machine master table 208 includes an identifier ID 304, a virtual machine name 305, an IP address 306 of the virtual machine, and a host operating the virtual machine. ID 307, a template flag 308 indicating whether or not the virtual machine is a template, a creation source template 309 indicating which template the virtual machine is created from, and a quarantine flag 310 indicating whether or not the template has already been quarantined. For example, a virtual machine with an ID “1” having a name “ABC” has an IP address “192.168.0.1”, a host ID “0001”, and a template flag “ 1 ”(indicating that this is a template), no source template, and quarantine flag“ 0 ”( The virtual machine whose ID is “DEF” and whose name is “DEF” has an IP address of “192.168.0.2”, a host ID of “0001”, and a template flag of “0”. (Indicating that it is not a template), the creation source template is registered as “ABC”, and the quarantine flag is registered as “1” (quarantined). This makes it possible to prepare a machine having the same function as the current machine as a substitute machine for a virtual machine when a virus is infected. In addition, the presence of the quarantine flag can prevent quarantine from being performed many times for a template that is not likely to be infected with a virus.

  The host machine master table 209 includes an ID 311 that is an identifier, a name 312 of the host that operates the virtual machine, an IP address 313 of the host machine, a host machine virtual machine maximum mounted number 314, and a current virtual machine mounted number 315. For example, the host having the host ID “001” with the name “UVW” has the host ID “172.16.0.1”, the maximum number of mounted units is “20”, and the number of mounted units is “10” is registered. Based on these pieces of information, the virtual machine creation processing unit 204 can select the host with the smallest number of mounted devices and move between the hosts when moving the quarantined virtual machine from the quarantine network to the business network. The information stored in the tables 207 to 209 is obtained by extracting necessary information from management information registered in advance in the virtual environment management computer 114 and storing it.

[Operation]
Next, the operation of the computer system to which the virtual machine security management system configured as described above is applied will be described with reference to the flowcharts of FIG.
[Operation when creating a new virtual machine]
First, since the computer system according to the present embodiment newly generates a virtual machine, when a user who wants to create a virtual machine issues a creation request to the virtual machine security management computer 101 via the business network 120, FIG. The message analysis unit 203 of the virtual machine security management computer 101 that has received the request refers to the countermeasure processing ID (user request “3”) in the message master table 207 and the message content is a new creation request from the user. Step 401 for determining whether or not, a step 402 for requesting the virtual machine creation processing unit 204 to create a new virtual machine when it is determined in step 401 that the request is a virtual machine new creation from the user, New virtual machine from user When determining not request, it executes the request or determining 403 due to the detected virus infections.

  The virtual machine creation processing unit 204 that has received the request for creating a new virtual machine in Step 402 creates a virtual machine 119 in the virtualization server 118 that is a quarantine environment with reference to the template, as shown in FIG. It is determined in step 502 whether or not the template that generated the created virtual machine 119 has been quarantined with reference to the quarantine flag in the virtual machine master table 208, and when it is determined in step 502 that the template has been quarantined (the quarantine flag is “ Step 503 for determining whether or not the processing is due to security patch non-application with reference to the countermeasure processing ID of the message master table 207, and the step 503 (for new creation in this processing) Determines that the process is not due to security patch not being applied. Step 507 for selecting the host (virtualization server 107) with the smallest number of virtual machines mounted in the actual operating environment segment (virtualization server 107) with reference to the number of installations 315 in the master table 209, and the above step 501 By executing step 508 of moving the virtual machine created in the virtualization server 118 to the virtualization server 107, a new virtual machine whose template has been quarantined can be created. Note that the selection of the host (virtualized server) in step 507 and step 505 described later is not limited to the number of mounted units, but, for example, the host having the smallest value (number of mounted units / maximum number of mounted units) May be selected.

[Processing during virus infection]
The computer system to which the virtual machine security management system according to the present embodiment is applied determines whether or not the message is a user request at step 401 shown in FIG. Step 403 that is determined with reference to the countermeasure processing ID 207, and (in this case, because of virus infection warning “1”), it is determined that there is a virus infection in Step 403, and the virtual machine deletion processing unit 205 deletes the infected virtual machine Step 404 for requesting the virtual machine, and Step 405 for issuing a request for creating a new virtual machine to the virtual machine creation processing unit 204 in the same manner as the above-described new creation.

  The virtual machine creation processing unit 204 that has received the new virtual machine creation request in step 405 refers to the creation source template registered in the virtual machine master table 208 in the quarantine environment shown in FIG. Step 501 for creating a new virtual machine using the same template as the virtual machine deleted in Step 404 Step 501 for determining whether the template has been quarantined Step 2 for determining whether the patch has not been applied Step 507 And 508, the infected virtual machine can be deleted and a new virtual machine can be created using the same template as the deleted virtual machine.

[Processing when patch application is detected in a production environment]
Furthermore, the computer system to which this virtual machine security management system is applied determines that the message is not a user request at step 401 shown in FIG. 4, and determines whether or not the message is a process at the time of virus infection. When it is determined in step 403 that is determined with reference to the ID that the process is not a virus infection (patch not applied message “2”), step 406 for issuing a new virtual machine creation request to the virtual machine creation processing unit 204 is executed.

  The virtual machine creation processing unit 204 that has received the request for creating a new virtual machine in step 406 refers to the creation source template registered in the virtual machine master table 208 in the quarantine environment shown in FIG. Step 501 for generating a new virtual machine with the same template as the virtual machine and step 502 for determining whether the template has been quarantined have been executed.

  In this step 502, the virtual machine creation processing unit 204 refers to the virtual machine master table 208 and confirms the quarantine flag of the virtual machine for which the message has been issued. For example, the virtual machine “ABC” with ID “0001” At this time, as shown in FIG. 5, a step 509 for requesting a quarantine system (not shown) for quarantine by the anti-virus software 106 and the patch management software 104, a step 510 for determining whether or not the quarantine by the step 509 has passed, If it is determined in step 510 that the quarantine is not passed, step 511 is executed to notify the administrator user that a virtual machine cannot be created because there is an abnormality in the template, and the process is terminated.

  When it is determined in step 510 that the quarantine has passed, the system executes step 503 with reference to the message master table 207 to determine whether the process is a security patch non-applied process. For application processing, delete the corresponding virtual machine in step 504 and select the host (virtualization server 107) with the smallest number of virtual machines mounted in the actual operating environment segment (virtualization server) in step 505, By executing the process of moving the virtual machine in the quarantine environment to the host selected in step 506, a new virtual machine that has been quarantined can be generated even when a patch is not applied.

[Other processing]
Furthermore, the computer system to which this virtual machine security management system is applied determines that the message is not a user request at step 401 shown in FIG. 4, and determines whether or not the message is a process at the time of virus infection. When it is determined in step 403 that is determined with reference to the ID that the process is not during virus infection (other message “4”), step 406 for issuing a new virtual machine creation request to the virtual machine creation processing unit 204 is executed.

  The virtual machine creation processing unit 204 that has received the request for creating a new virtual machine in step 406 refers to the creation source template registered in the virtual machine master table 208 in the quarantine environment shown in FIG. Step 501 for generating a new virtual machine with the same template as the virtual machine and step 502 for determining whether the template has been quarantined have been executed.

  In this step 502, the virtual machine creation processing unit 204 refers to the virtual machine master table 208 and confirms the quarantine flag of the virtual machine for which the message has been issued. For example, the virtual machine “ABC” with ID “0001” At this time, as shown in FIG. 5, a step 509 for requesting a quarantine system (not shown) for quarantine by the anti-virus software 106 and the patch management software 104, a step 510 for determining whether or not the quarantine by the step 509 has passed, When it is determined in step 510 that the quarantine is not passed, step 511 for notifying the administrator user that a virtual machine cannot be created is executed, and the process is terminated.

  When it is determined in step 510 that the quarantine has passed, the system executes step 503 with reference to the message master table 207 to determine whether the process is a security patch non-applied process. Since it is not an application process, by executing the process of moving the virtual machine generated in the virtualization server 118 in step 501 by step 507 and step 508 to the virtualization server 118, the quarantine has been completed even in the case of that message. A new virtual machine can be created.

  In this way, the virtual machine security management system to which the virtual machine security management method according to the present embodiment is applied, the virtualization server 118 prepared for quarantine when a user request or a virus infection detection or security patch non-apply message is issued. A virtual machine is generated, and it is determined whether or not the template that is the basis of the generated virtual machine has been quarantined, and the virtual machine that has passed the quarantine is transferred from the virtualization server 118 of the quarantine environment to the virtualization server of the production environment By moving to 107, it is possible to generate a virtual machine without virus infection and with a security patch applied.

1 is an overall configuration diagram of a computer system to which a virtual machine security management system according to an embodiment of the present invention is applied. The figure which shows the structure of the virtual machine security management system by this embodiment. The figure for demonstrating the structure of the various data table by this embodiment. The operation | movement flowchart figure of the message analysis part by this embodiment. The operation | movement flowchart figure of the virtual machine creation process part by this embodiment.

Explanation of symbols

  101: Virtual machine security management computer, 102: Virtual machine security management program, 103: Patch management computer, 104: Patch management software, 105: Anti-virus software management computer, 106: Anti-virus software, 107: Virtualization server, 108- 110: Virtual machine, 111: Anti-virus software, 112: Patch management agent, 113: Virtualization software, 114: Virtual environment management computer, 115: Virtual environment management software, 116: Patch management computer, 117: Anti-virus software management computer 118: Virtualization server, 119: Virtual machine, 120: Business network, 121: Management network, 122: Quarantine network, 124: SAN storage 202: Data communication unit 203: Message analysis unit 204: Virtual machine creation processing unit 205: Virtual machine deletion processing unit 206: Virtual machine information synchronization processing unit 207: Message master table 208: Virtual machine master table 209: Host machine master table.

Claims (10)

A plurality of operating virtualization servers that operate a plurality of virtual machines that execute programs;
Quarantine virtualization that operates a quarantine virtual machine that executes anti-virus software that detects virus infection of the program and patch management software that determines whether a correction program that corrects security weaknesses of the program is up-to-date Server,
A virtual environment management computer that stores the program configuration information of the plurality of virtual machines as a template and controls the virtual machines;
A virtual machine security management system of a computer system comprising a virtual machine security management computer for managing security related to virus infection of the virtual machine,
The virtual machine security management computer is
A message master table that stores identifiers of countermeasure processes corresponding to a plurality of messages, a template identifier of a working virtual machine that operates on the working virtualization server, and a virtual that stores a quarantine flag indicating whether or not the template has been quarantined Refer to the machine master table, the host machine master table that stores the number of active virtual machines installed on multiple active virtualization servers, and the message master table, virtual machine master table, and host machine master table information. And a control unit for generating a quarantine virtual machine on the quarantine virtualization server,
When the control unit determines that a message for generating a new virtual machine has been received with reference to the identifier of the message master table,
A first step of generating a quarantine virtual machine on the quarantine virtualization server with reference to the template of the virtual environment management computer;
A second step of determining whether or not the quarantine virtual machine template generated in the first step is quarantined with reference to a quarantine flag of the virtual machine master table;
A third step of moving the quarantine virtual machine on the quarantine virtualization server as an active virtual machine to the active virtualization server when it is determined that the quarantine virtual machine template generated in the second step has been quarantined; Virtual machine security management system to be executed. When the control unit of the virtual machine security management computer determines that a virus infection message has been received from the anti-virus software of the operating virtual machine with reference to the identifier of the message master table,
During the transition from the first step to the second step, it is determined by the anti-virus software and patch management software of the quarantine virtual machine generated in the first step whether or not there is a virus infection and whether the security patch is the latest. The virtual machine security management system according to claim 1, wherein a fourth step of shifting to the second step is executed when it is determined that there is no virus infection and the latest security patch. When the control unit of the virtual machine security management computer determines from the patch management software of the operating virtual machine that the message is that a patch has not been applied with reference to the identifier of the message master table,
The virtual machine security management system according to claim 1, wherein a fifth step of deleting the active virtual machine that issued the message from the active virtualization server is executed during the transition from the first step to the second step. When the control unit of the virtual machine security management computer receives a message other than the creation of a new virtual machine or a virus infection or non-patched message,
The virtual machine security management system according to claim 1, wherein the first to third steps are executed.   When the control unit of the virtual machine security management computer moves the quarantine virtual machine on the quarantine virtualization server to the active virtualization server as an active virtual machine in the third step, refer to the host machine master table. The virtual machine security management system according to any one of claims 1 to 4, wherein the quarantine virtual machine is moved to an active virtualization server having a minimum number of active virtual machines mounted. A plurality of operating virtualization servers that operate a plurality of virtual machines that execute programs;
Quarantine virtualization that operates a quarantine virtual machine that executes anti-virus software that detects virus infection of the program and patch management software that determines whether a correction program that corrects security weaknesses of the program is up-to-date Server,
A virtual environment management computer that stores the program configuration information of the plurality of virtual machines as a template and controls the virtual machines;
A virtual machine security management method for a computer system comprising a virtual machine security management computer for managing security related to virus infection of the virtual machine,
In the virtual machine security management computer,
A message master table that stores identifiers of countermeasure processes corresponding to a plurality of messages, a template identifier of a working virtual machine that operates on the working virtualization server, and a virtual that stores a quarantine flag indicating whether or not the template has been quarantined Refer to the information of the machine master table, the host machine master table that stores the number of installed active virtual machines running on multiple active virtualization servers, and the message master table, virtual machine master table, and host machine master table information. And a control unit for generating a quarantine virtual machine on the quarantine virtualization server,
When the control unit determines that a message for generating a new virtual machine has been received with reference to the identifier of the message master table,
A first step of generating a quarantine virtual machine on the quarantine virtualization server with reference to the template of the virtual environment management computer;
A second step of determining whether or not the quarantine virtual machine template generated in the first step is quarantined with reference to a quarantine flag of the virtual machine master table;
A third step of moving the quarantine virtual machine on the quarantine virtualization server as an active virtual machine to the active virtualization server when it is determined that the quarantine virtual machine template generated in the second step has been quarantined; Virtual machine security management method to be executed. When the control unit of the virtual machine security management computer determines that a virus infection message has been received from the anti-virus software of the operating virtual machine with reference to the identifier of the message master table, from the first step to the second step During the transition, the anti-virus software and patch management software of the quarantine virtual machine generated in the first step determines whether or not there is a virus infection and whether or not the security patch is the latest, and there is no virus infection and the latest security. The virtual machine security management method according to claim 5, wherein a fourth step of shifting to the second step when the patch is determined is executed. When the control unit of the virtual machine security management computer determines from the patch management software of the operating virtual machine that the message is that a patch has not been applied with reference to the identifier of the message master table,
The virtual machine security management method according to claim 6, wherein a fifth step of deleting the active virtual machine that issued the message from the active virtualization server is executed during the transition from the first step to the second step. When the control unit of the virtual machine security management computer receives a message other than the creation of a new virtual machine or a virus infection or non-patched message,
The virtual machine security management method according to claim 6, wherein the first to third steps are executed.   When the control unit of the virtual machine security management computer moves the quarantine virtual machine on the quarantine virtualization server to the active virtualization server as an active virtual machine in the third step, refer to the host machine master table. The virtual machine security management method according to any one of claims 6 to 9, wherein the quarantine virtual machine is moved to an active virtualization server having a minimum number of active virtual machines mounted.

Images