VirtinSpector:一种基于UEFI的虚拟机动态安全度量框架设计与实现  

VirtinSpector: A UEFI Based Dynamic Secure Measurement Framework for Virtual Machine

作　　者：严飞[1] 石翔[1] 李志华[1] 王鹃[1] 张焕国[1] 

机构地区：[1]武汉大学计算机学院,湖北武汉430072

出　　处：《四川大学学报（工程科学版）》2014年第1期22-28,共7页Journal of Sichuan University (Engineering Science Edition)

基　　金：国家自然科学基金资助项目(61003268;61272452;91118003;61173138;61003185)

摘　　要：通过可信硬件能够弥补单纯软件安全的不足,从整体上提高云系统的安全性。但是,面对云环境运行时的安全,传统可信硬件技术无法提供足够的保障。为此,提出了一种基于UEFI的虚拟机动态安全框架——VirtinSpector。该框架能够将UEFI固件作为可信基础,对云系统的基础设施层进行实时、动态的安全度量,提供传统可信技术无法达到的动态保护。在此框架基础上,以某国产服务器为实验平台,构建云环境,实现了一个面向Xen环境的UEFI虚拟机动态安全度量原型系统。实验与分析表明,该框架能够有效检测针对虚拟域、管理域和虚拟化软件的攻击,为云系统提供来自基础设施层的安全支撑。并且对原有系统的性能损耗在允许范围之内,不影响用户的正常使用。Trusted computing technology has been introduced to build a secure cloud infrastructure, which can improve the dilemma of software security. However, traditional trusted hardware technology does not provide sufficient protection for runtime security for cloud. To solve this problem, a UEFI based dynamic security framework for virtual machine, named VirtinSpector, was proposed. The Virtin- Spector treated UEFI firmware as a trusted computing base to acquire a run-time and dynamic security measurement for cloud, providing a dynamic protection out of traditional solution. And a prototype of VirtinSpector for the Xen hypervisor was implemented. The experi- ments showed that the framework can measure and explore some mainstream attacks of cloud, and its performance payload is restricted whining an acceptable range, without affecting the user＇ s daily use.

关 键 词：云安全 可信计算 动态度量 虚拟化 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]