基于微内核的虚拟机I/O安全机制  

I/O Security Mechanism for Microhypervisor Based Virtualization Architecture

作　　者：王玉菁 吴涛[1,2] 杨秋松[1] 

机构地区：[1]中国科学院软件研究所基础软件国家工程研究中心,北京100190 [2]中国科学院大学,北京100190

出　　处：《计算机系统应用》2015年第10期162-168,共7页Computer Systems & Applications

基　　金：国家自然科学基金(61303163;91218302;61432001);中国科学院重大方向性项目(KGCX2–YW–125)

摘　　要：NOVA等微内核虚拟化架构解决了宏内核平台可信计算基体积和攻击面过大的问题,但其仍缺乏虚拟机分等级保护和I/O资源访问控制等安全机制.本文提出了安全域的概念,并将虚拟机划分至不同的安全域,进而建立可定制的I/O资源访问控制机制.通过将访问控制模块添加至I/O资源访问的关键代码路径,实现了不同安全域的I/O资源访问控制.实验表明,该机制提高了数据的隔离性与安全性,仅对计算密集型、I/O密集型任务造成了较小的性能损耗.Micro-kernel based virtualization architectures such as NOVA solves the problems of large trusted computing base and attack surface in most macro-kernel based virtualization systems. However, NOVA lacks of protections for the virtual machines of different security levels separately. Also, it lacks of access control mechanisms of the virtual machines to the I/O resources. In this paper, we propose the concept of security regions and introduce a way to divide virtual machines into several security regions, upon which the I/0 resources access control mechanism is built. To implement I/0 resource access control between different security regions, this mechanism adds an access control module to the key code path between the virtual machine monitor to the I/O services. The experiments show that when promoting the isolation and safety of data, it only impacts the performance of CPU bound tasks and I/O bound tasks slightly.

关 键 词：微内核 虚拟化 安全域 I/O资源访问控制 

分 类 号：TP302[自动化与计算机技术—计算机系统结构]