基于硬件虚拟化技术的进程保护和监控  

Effective Process Protection and Monitoring with Hardware Virtualization

作　　者：王陆悠悠 

机构地区：[1]上海交通大学电子通信工程系

出　　处：《电子技术（上海）》2012年第4期13-16,共4页Electronic Technology

摘　　要：随着网络技术的发展,网络恶意代码的越来越有攻击性,系统的安全漏洞往往导致数据丢失。虽然每天更新保护方法和软件,一些最近的rootkit,无形中仍然可以访问内核,是系统安全的新挑战。对系统安全的重点是如何保护受感染的操作系统上选定的进程。进程的保护和监控正越来越重要。在文章中,我们提出了一种基于硬件的虚拟化技术。它引入了一种新的机制虚拟机监视器(VMM)。和原始方法相比,它提供了一个超越传统的操作系统和处理器架构实施分级的保护域。With the development of network malicious code becomes more and more aggressive, and the existed security holes tend to lead the data loss. Though protection methods and software are updated day by day, some recent rootkits can still invisibly access kernel, and become new challenges for the system security. Process protection and monitoring are becoming more and more important for emerging networks and systems. In this paper, we present a new technique, which is based on hardware virtualization technology. It introduces a novel mechanism, that is located in Virtual Machine Monitor （VMM）. This primitive offers an additional dimension of protection beyond the hierarchical protection domains, implemented by traditional operating systems and processor architectures. Our design has been fully implemented and used to protect a wide range of legacy process without any modification on Windows operating system.

关 键 词：硬件虚拟化技术 进程保护 虚拟机管理器 

分 类 号：TP391.9[自动化与计算机技术—计算机应用技术]