虚拟化架构下管理域安全增强方法  

The Security Enhancement Method of Administrative Domain in the Virtualization Architecture

作　　者：付楠[1] 余荣威[1] 王丽娜[1] 刘维杰[1] 鞠瑞[1] 宋衍 

机构地区：[1]武汉大学计算机学院,湖北武汉430072 [2]信息保障技术重点实验室,北京100072

出　　处：《武汉大学学报（理学版）》2016年第3期218-224,共7页Journal of Wuhan University:Natural Science Edition

基　　金：国家自然科学基金(61373169);国家高技术研究发展计划(863)项目(2015AA016004);信息保障技术重点实验室开放基金(KJ-14-110;KJ-14-101)资助项目

摘　　要：针对虚拟化信息系统的可信度量和可信计算基繁重的问题,对TPM进行软件虚拟化,建立了基于vTPM的信任链;根据虚拟化管理域的操作集属性,将特权操作移植入只读域,并对其部署新型访问控制策略,隔离Dom0的用户空间与特权操作,规避用户空间非法访问物理内存的安全风险.实验结果表明,本文建立的基于vTPM的信任链实现了对虚拟化系统的可信度量,新型访问控制策略有效地阻断了用户空间对物理内存的访问权限,缩小了可信计算基,从而保护虚拟机系统的完整性和机密性,极大地增强了虚拟化平台的安全性.The paper focuses on the problem about trust evaluation and heavy trusted computing base. By the software virtualization of TPM , we established the trust chain of vTPM; according to the attribute of operation set for virtualization management domain, we remove the privileged operations into a read-only domain and deploy a new access control policy on it to isolate user space and privileged operation in Dom0, which could avoid the risk of unau- thorized access to safe physical memory from user space. Finally, we verify this idea on the Xen virtualization plat- form. The experiment result shows the trust chain of vTPM could achieve trust evaluation successfully. Meanwhile the new access control policies could prevent user space accessing to physical memory illegally, which would lighten trusted computing base and enhance the security of virtualization platform.

关 键 词：虚拟化安全 可信计算 管理域安全 访问控制 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]