基于KVM的可信虚拟化平台设计与实现  

KVM-based trusted virtualization platform design and implementation

作　　者：池亚平[1] 李欣[2] 王艳[1,2] 王慧丽[2] 

机构地区：[1]北京电子科技学院通信工程系,北京100070 [2]西安电子科技大学通信工程学院,陕西西安710071

出　　处：《计算机工程与设计》2016年第6期1451-1455,共5页Computer Engineering and Design

基　　金：中央高校基本科研业务费专项基金项目(YZDJ1202);中央高校基本科研业务费基金项目(328201537)

摘　　要：针对云计算环境下非特权虚拟化平台KVM的安全问题,基于可信计算技术,设计实现一种面向KVM的可信虚拟化平台。按照一级度量一级和一级信任一级的原则,在KVM中建立一条从可信根TPM到Hypervisor的可信链,该可信链将可信根TPM的可信状态从物理宿主机经过vCRTM、vTPM传递到虚拟机VMM,增强KVM虚拟化环境的安全可信。设计实现一个虚拟化远程证明方案,验证了该可信平台方案的可行性。Aiming at the problem of the unprivileged virtualization security issues of cloud computing,a KVM-based virtualization technology trusted virtualization platform was designed and implemented.In accordance with the principles of a level measures next level then the level trusts the next level,a credible chain was established from trusted root TPM to hypervisor.The trust chain transferred the trusted state of the trusted root TPM from the host machine,then to vCRTM,vTPM and the virtual machine VMM,which enhanced the safety and credibility in KVM virtual environments.A remote attestation scheme was designed and implemented,which verified the feasibility for the scheme.

关 键 词：云计算 可信计算 虚拟化 安全可信链 内核虚拟化技术 

分 类 号：TP39[自动化与计算机技术—计算机应用技术]