基于虚拟化的不可信模块运行监控  

Virtualization-based monitoring of untrusted extensions execution

作　　者：陈兴蜀[1] 赵丹丹 李辉 张磊 

机构地区：[1]四川大学网络空间安全研究院,计算机学院,四川成都610065

出　　处：《华中科技大学学报（自然科学版）》2016年第3期34-38,共5页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家自然科学基金资助项目(61272447)

摘　　要：为了监控内核模块rootkit的行为,提出一种基于硬件辅助虚拟化的虚拟机内核模块隔离框架,采用两套硬件辅助页表技术实现不可信模块与内核的隔离运行,并使用一种基于栈帧基地址链的方法保护内核堆栈的完整性.在KVM(基于内核的虚拟机)全虚拟化环境下实现了虚拟机内核模块隔离运行的原型系统Hyper-ISO(超级隔离).实验结果表明:Hyper-ISO可以实时监控不可信模块与内核之间的控制转移过程、不可信模块对内核代码与数据的访问序列,并保护内核堆栈在模块运行期间不被模块恶意修改.To trace the behavior of LKM（loadable kernel modules）rootkits,a hardware assisted virtualization based framework for kernel modules running in isolation was proposed to isolate drivers in an address space separate from the kernel by two sets of hardware assisted page tables and to protect integrity of the kernel stack basing on the chain composed of base pointers of stack frames.Eventually aprototype system on the full-virtualization platform of KVM was implemented which was called Hyper-ISO（Hyper-ISOlation）.The experimental result shows that the Hyper-ISO is able to monitor the control transfer processes between the untrusted module and the kernel timely,monitor the untrusted module accessing kernel code or data,and protect the kernel stack from the untrusted module.

关 键 词：内核完整性 模块隔离 堆栈保护 虚拟机 虚拟机监视器 KVM 

分 类 号：TP316[自动化与计算机技术—计算机软件与理论]