CLOUD SYSTEM WITH ATTACK PROTECTION MECHANISM AND PROTECTION METHOD USING FOR THE SAME

A cloud system includes a security center server, a monitoring server, and a host. The host is deployed by the monitoring server after booting to install a detecting procedure and execute a local security policy therein. The host provides a self-monitoring operation through the detecting procedure and replies to the monitoring server when any monitoring data therein exceeds a threshold value according to the local security policy. The monitoring server judges whether the host is attacked or not, and notifies the security center server when the host is judged to be attacked. After receiving the notification, the security center server analyzes attack types, and generates a new security policy according to analyzed results. Finally, the security center server redeploys the host by the new generated security policy, so as to update the local security policy in the host, and protects the host from the attack.

DETAILED DESCRIPTION

Reference will now be made to the drawing figures to describe the present disclosure in detail.

Reference is made toFIG. 1which is a system structure view of a cloud system with an attack protection mechanism according to a preferred embodiment of the present disclosure. The cloud system mainly includes a monitoring server1, a security center server2, a knowledge base3, and at least one host4. In this embodiment, the host4can be various types of physical machines (PMs), such as a computing host41, a storage host42, or a network switch43, or can be various types of virtual machines (VMs), such as a virtual host or a virtual switch. However, the embodiments are only exemplified but are not intended to limit the scope of the disclosure. For convenience, it is assumed that the amount of the host4is one but that is exemplified for further demonstration.

For the cloud system, the host4mainly plays a corresponding role to provide services to clients. The monitoring server1is connected to the host4to monitor and detect operation conditions of the host4. When the host4is abnormal, the abnormal condition is replied to the monitoring server1so that the monitoring server1judges whether the abnormal condition of the host4is caused due to the attack occurrence.

In this embodiment, the “attacked host” means that the host4encounters a virus or hacker attack so that the throughput of the host4is suddenly increased or the file access rate of the host4is abnormal due to the injection of Trojan horse in internal files. Once the attacked situation is replied to the monitoring server1, the monitoring server1can confirm that the host4is really attacked.

After confirming that the host4is attacked, the monitoring server1notifies the security center server2with events according to the monitored information so that the security center server2is provided to perform assessments and analyses of the events. The security center server2is the core of the information security in the whole cloud system. When the security center server2receives the event notice from the monitoring server1, the security center server2assesses and analyzes the corresponding data by algorithms so as to identify the attacked type. Accordingly, the security center server2can provide solutions according to analyzed results to redeploy the attacked host4to generate a new information security policy so that the host4cannot be attacked by the same attack type which had occurred.

Especially, the analyzed results and solutions provided from the security center server2are stored in the knowledge base3. Accordingly, any one new booting host in the cloud system is deployed through the latest information security policy so that the new host cannot be attacked by the same attack type which had occurred.

Reference is made toFIG. 2which is a schematic view of a cabinet in a cloud-based data center according to the preferred embodiment of the present disclosure. In this embodiment, the monitoring server1, the security center server2, the knowledge base3, and the host4can be installed in an identical cabinet5of a cloud-based data center, and which are physically connected to each other by a network switch (not shown) in the cabinet5. In this embodiment, only one cabinet5in the cloud-based data center is exemplified. However, the embodiment is only exemplified but is not intended to limit the scope of the disclosure. In other embodiments, the monitoring server1, the security center server2, the knowledge base3, and the host4can be installed in different cabinets of a cloud-based data center, and which are physically connected to each other.

Reference is made toFIG. 3which is a system block diagram of the cloud system with the attack protection mechanism according to the preferred embodiment of the present disclosure. After booting, the host4accepts deployment of the monitoring server1so that a detecting procedure40and a local security policy400are installed in the host4. The host4executes the local security policy400to provide security protection, and the corresponding threshold values of the data are set. Especially, the local security policy400can be a firewall policy, but not limited, to prevent various possible malicious attacks.

The host4further provides a self-monitoring operation through the detecting procedure40to detect various data thereof, such as the throughput, CPU usage rate, hard disk rotation speed, hard disk capacity, temperature, humidity, procedure or file access rate, and so on. When the detecting procedure40detects that any one of the data exceeds the corresponding threshold value, an event will be triggered by the host4and that is replied to the monitoring server1.

More specifically, the detecting procedure40is deployed by the monitoring server1and installed in the host4so that the host4replies the event to the monitoring server1through the detecting procedure40. Also, the host4generates an event-related datum, namely, the related data of exceeding the corresponding threshold values, and simultaneously replies the event-related datum to the monitoring server1.

When the event is triggered, the monitoring server1can judge whether the host4is unstable because of malicious attacks or other problems. More specifically, the monitoring server1can execute a notice policy10therein and analyze the event-related datum through the notice policy10, thus judging whether the host4is attacked or not.

If the event is caused by other factors, the monitoring server1will carry out the corresponding actions, whereas the monitoring server1generates a warning message according to the event-related datum so that the monitoring server1can notify the security center server2with events if the host4is really attacked. More specifically, the monitoring server1judges whether the event-related datum meets the notice standard set by the notice policy10after analyzing the event-related datum. If “Yes”, the monitoring server1sends the warning message to notify the security center server2. In which, the warning message includes the event-related datum.

When the security center server2receives the warning message sent from the monitoring server1, the security center server2assesses the event and to analyze the attack type. Afterward, the security center server2generates an updated security policy30stored in the knowledge base3according to analyzed results. More specifically, the security center server2can execute an attack analysis algorithm20therein and analyze the event-related datum through the attack analysis algorithm20to identify the attack type and provide solutions to generate the updated security policy30.

Finally, the security center server2redeploys the attacked host4according to the updated security policy30so as to update the local security policy400inside the host4to a new one. Accordingly, the technical feature of the present disclosure is that the updated security policy30is generated after the host4is attacked. Also, the updated security policy30is deployed by the host4to easily eliminate the attack. Especially, the updated security policy30can be a firewall policy, but not limited, to prevent various possible malicious attacks.

For example, if the attack is an external attack, the security center server2can calculate the source address of the external attack according to the event-related datum so as to block accessing the source address according to the updated security policy30. For another example, if the attack is an internal attack, the security center server2can calculate which procedure or file launches the internal attack according to the event-related datum so as to isolate the procedure or the file, thus preventing other procedures or files of the host4being interfered with the internal attack. Until the host4is idle, the isolated procedure or the file will be deleted. However, the above-mentioned description is only a preferred embodiment but not intended to limit the scope of the disclosure. The security center server2can generate different updated security policies30depending on analyzed attack types.

Besides the attacked host4, the security center server2can redeploy all hosts in the cloud system according to the updated security policy30so that other non-attacked hosts cannot be attacked by the same attack type which had occurred.

Reference is made toFIG. 4andFIG. 5which are flowcharts of host deployment and security policy update according to a preferred embodiment of the present disclosure, respectively. As shown inFIG. 4, the host4is first booted by the administrator (S10). More specifically, if the host4is a physical machine, the administrator can boot the host4by Wake on LAN technology or directly pressing the physical power button (not shown). On the contrary, the administrator can generate the host4by a standard generation of virtual machine if the host4is a virtual machine.

Afterward, the monitoring server1can detect out existence of the host4and deploy the detecting procedure40to the host4(S12) so that the host4provides a self-monitoring operation to detect various data thereof through the detecting procedure40. In addition, the monitoring server1can also deploy the required local security policy400to the host4(S14) so that the host4can execute the local security policy400to perform the security protection (S16) and set threshold values of various data according to the local security policy400. After the step S16, the host4formally became the corresponding role in the cloud system.

As shown inFIG. 5, the host4can further raise a query to the security center server2according to the local security policy400(S20) after the local security policy400is deployed to the host4. Also, the security center server2inquires whether the updated security policy30is generated (S22). More specifically, the host4can raise a query to the security center server2by MD5or Hash table to confirm the version of the local security policy400and an old/new version relationship between the local security policy400and the security policy of knowledge base3.

If the updated security policy30has not yet generated after the security center server2inquires, that presents the version of the local security policy400is the latest so that the host4and the security center server2have nothing to do. On the contrary, if the knowledge base3has the updated security policy30after the security center server2inquires, the security center server2will redeploy the host4to update the version of the local security policy400by using the updated security policy30(S24) so that the host4can operate in the optimal protection condition.

Reference is made toFIG. 6which is a flowchart of attack notification according to a preferred embodiment of the present disclosure. First, the host4provides a self-monitoring operation through the detecting procedure40(S30) so as to acquire various data thereof, such as the throughput, CPU usage rate, hard disk rotation speed, hard disk capacity, temperature, humidity, procedure or file access rate, and so on. Afterward, the host4regularly judges whether any one of the acquired data exceeds the corresponding threshold value (S32). If all acquired data are correct (within the threshold values), the host4has nothing to do besides continually providing the self-monitoring operation.

On the contrary, if any one of the acquired data exceeds the corresponding threshold value, the host4triggers an event and simultaneously replies to the monitoring server1(S34). More specifically, the host4can trigger the event and simultaneously reply the event-related datum, namely, the related data of exceeding the corresponding threshold values to the monitoring server1so that the monitoring server1can perform the detailed analysis.

After the event is triggered, the monitoring server1is mainly used to receive the replied event-related datum from the host4(S36) and analyze the event-related datum according to the notice policy10(S38) so as to judge whether the host4is really attacked or not (S40). After analyzing, if the event-related datum does not meet the notice standard set by the notice policy10, it indicates that the host4does not been attacked rather affected by other factors. In this condition, the monitoring server1will carry out the corresponding actions, such as recording data or notifying the administrator instead of notifying the security center server2.

On the contrary, the monitoring server1sends the warning message to notify the security center server2when the host4is really attacked after analyzing (S42). More specifically, the monitoring server1notifies the security center server2according to the warning message generated from the event-related datum so that the security center server2can analyze the attack type in detail through the event-related datum.

Reference is made toFIG. 7which is a flowchart of attack protection according to a preferred embodiment of the present disclosure. Once the host4is probably attacked, the host4replies to the monitoring server1. When the monitoring server1confirms that the host4is really attacked, the monitoring server1notifies the security center server2to receive the warning message sent from the monitoring server1(S50) and analyzes the attack type. More specifically, the security center server2analyzes the event-related datum according to the attack analysis algorithm20(S52) to identify the attack type and generates the updated security policy30according to the analyzed result (S54). That is, the updated security policy30is obtained by updating the original security policy according to the analyzed results so as to effectively prevent the attack.

After the step S54, the security center server2redeploys the attacked host4by using the updated security policy30(S56). As described above, because the updated security policy30is generated due to the attack occurrence, the attack can be easily eliminated after the security center server2redeploys the attacked host4so that operation of the host4and the various data thereof return to normal. Especially, the security center server2can further redeploy non-attacked hosts by using the updated security policy30besides the attacked host4(S58), that is, all hosts in the cloud system can be redeployed. Because the updated security policy30enhances protection ability, the non-attacked hosts cannot be attacked by the host which had been attacked when all hosts are redeployed by the updated security policy30so as to effectively prevent the attack.

The cloud system and protection method are provided to redeploy all hosts in the cloud system once any one of the hosts is attacked. In which, the monitoring server1notifies the security center server2to analyze the attack type and generate the updated security policy30according to the analyzed result. As long as all hosts in the cloud system are redeployed and the updated security policy30are performed, the non-attacked hosts cannot be attacked by the host which had been attacked, that is all hosts cannot be attacked by the same attack type.

Reference is made toFIG. 8which is a system block diagram of the cloud system with the attack protection mechanism according to another preferred embodiment of the present disclosure. In the above-mentioned example, the knowledge base3is a stand-alone server in the cloud system for demonstration. The knowledge base3plays a role of storing the updated security policy30, which is connected to the security center server2through the wired connection or wireless connection. In addition, the cloud system can further provide another security center server2′. The security center server2′ has a storage unit and the security center server2′ is served as the knowledge base3in the cloud system. In this embodiment, the cloud system does not install external physical servers to as the knowledge base3so as to effectively save the quantity of the servers. However, the above-mentioned description is only another preferred embodiment but not intended to limit the scope of the disclosure. The knowledge base3can be used alone or in combination with the security center server2′ depending on the actual requirements of the cloud system.

Reference is made toFIG. 9which is a flowchart of attack protection according to a preferred embodiment of the present disclosure. First, the monitoring server1deploys the detecting procedure40for the host4(S60). Afterward, the monitoring server1deploys the local security policy400for the host4(S62). Afterward, the host4raises a query to the security center server2whether the version of the local security policy400is the latest (S64). Afterward, if “Yes”, the security center server2replies that the version of the local security policy400is the latest to the host4. If “No”, namely, the updated security policy30is generated in the knowledge base3, the security center server2deploys the host4to upgrade the local security policy400to the updated security policy30(S66).

After booting, the host4provides a self-monitoring operation to detect various data thereof through the detecting procedure40(S68). Also, once any one of the data exceeds the corresponding threshold value set by the local security policy400, the host4triggers an event and simultaneously replies to the monitoring server1(S70). After receiving the reply from the host4, the monitoring server1analyzes the event to judge whether the host4is attacked or not (S72). Afterward, if the host4is really attacked, the monitoring server1sends the warning message to notify the security center server2.

After receiving the warning message, the security center server2analyzes the event-related datum and identifies the attack type. Also, the security center server2generates the updated security policy30according to the analyzed result (S76) and stores the updated security policy30to the knowledge base3(S78) to upgrade the existing local security policy400to the updated security policy30. Afterward, the security center server2deploys the attacked host4according to the updated security policy30(S80). Accordingly, the local security policy400in the host4is updated to generate a new local security policy400so that the host4cannot be attacked by the same attack type which had occurred and the host4can restore to the stable operation. Finally, the host4continually provides the self-monitoring operation through the detecting procedure40after the step S80.