基于硬件虚拟化的安全高效内核监控模型  

Secure and Efficient Kernel Monitoring Model Based on Hardware Virtualization

作　　者：黄啸[1,2] 邓良[1,2] 孙浩[1,2] 曾庆凯[1,2] 

机构地区：[1]计算机软件新技术国家重点实验室(南京大学),江苏南京210023 [2]南京大学计算机科学与技术系,江苏南京210023

出　　处：《软件学报》2016年第2期481-494,共14页Journal of Software

基　　金：国家自然科学基金(61170070;61572248;61431008;61321491);国家科技支撑计划(2012BAK26B01)~~

摘　　要：传统的基于虚拟化内核监控模型存在两个方面的不足:(1)虚拟机监控器(virtual machine monitor,简称VMM)过于复杂,且存在大量攻击面(attack surface),容易受到攻击;(2)VMM执行过多虚拟化功能,产生严重的性能损耗.为此,提出了一种基于硬件虚拟化的安全、高效的内核监控模型Hyper NE.Hyper NE舍弃VMM中与隔离保护无关的虚拟化功能,允许被监控系统直接执行特权操作,而无需与VMM交互;同时,Hyper NE利用硬件虚拟化中的新机制,在保证安全监控软件与被监控系统隔离的前提下,两者之间的控制流切换也无需VMM干预.这样,Hyper NE一方面消除了VMM的攻击面,有效地削减了监控模型TCB(trusted computing base);另一方面也避免了虚拟化开销,显著提高了系统运行效率和监控性能.Traditional kernel monitoring models based on virtualization have two main drawbacks： 1） Virtual machine monitor （VMM） is vulnerable to attacks due to its non-trivial complexity and considerable attack surface; 2） VMM executes redundant virtualization functionalities, leading to heavy performance loss. To address those issues, this paper proposes a secure and efficient kernel monitoring model, named HyperNE, based on hardware virtualization. In HyperNE, any virtualization functionalities that are isolation and protection unrelated are removed from VMM, and guest OS is allowed to directly conduct privileged operations with no need to interact with VMM. Meanwhile, without sacrificing isolation guarantees, HyperNE utilizes a newly supported virtualization feature to transfer execution between security monitoring applications and guest OS in a controlled manner with no VMM involvement. As a result, HyperNE can not only eliminate the attack surface of VMM and effectively reduce trusted computing base （TCB） size of monitoring model, but also greatly improve system and monitoring performance by avoiding virtualization overheads.

关 键 词：虚拟化 内核监控 特权模式切换 攻击面 

分 类 号：TP316[自动化与计算机技术—计算机软件与理论]