虚拟化系统中的攻击与防护模型研究  

Research on Attack and Protection Model in Virtualization System

作　　者：王晓睿[1] 王清贤 郭玉东[1] 卢建平[3] 

机构地区：[1]解放军信息工程大学四院,河南郑州450002 [2]数学工程与先进计算国家重点实验室,河南郑州450002 [3]重庆通信学院通信指挥系,重庆400035

出　　处：《武汉大学学报（理学版）》2013年第5期416-424,共9页Journal of Wuhan University:Natural Science Edition

基　　金：国家863计划项目(2009AA012200);河南省科技经费项目(SP09JH11158)资助

摘　　要：针对目前的攻击模型不能充分表达虚拟化系统所面临的威胁,可信基设计忽略虚拟机监控器(virtual machine monitor,VMM)完整性,客户机资源保护不充分等问题,设计了基于协作型VMM的安全模型.采用非对称的地址映射和访问权限使安全部件及监控点隔离于易受感染代码,建立了双系统间引用监控机制验证VMM内存完整性,并根据恶意行为的语义映射在关键路径上保护系统资源.实验结果表明协作型VMM安全模型能够捕获到客户机中完整的信息流,并能准确识别出其中的异常系统调用序列.Aiming at the problems such as current attack model can＇t fully express threats faced by virtualization system,a security model based on cooperative-VMM（virtual machne monitor）is designed ignoring the integrity of VMM and insufficient.Asymmetrical address mapping and access was adopted so that safety components and monitoring points can be isolated from the vulnerable code,and a dual system reference monitoring mechanism was established to verify the integrity of the VMM memory,and system resources on the critical path were protected according to the semantic mapping of malicious.Experimental results showed that the security model of cooperative-VMM is able to capture complete information within the guest,and to identify abnormal sequence of system call accurately.

关 键 词：虚拟化 攻击模型 安全防护 内存完整性 资源监控 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]