A Protective Mechanism for the Access Control System in the Virtual Domain  

作　　者：Jinan Shen Deqing Zou Hai Jin Kai Yang Bin Yuan Weiming Li 

机构地区：[1]Services Computing Technology and System Laboratory,Cluster and Grid Computing Laboratory,School of Computing Science and Technology,Huazhong University of Science and Technology [2]School of Information Engineering,Hubei University for Nationalities

出　　处：《China Communications》2016年第11期129-142,共14页中国通信（英文版）

基　　金：supported by the National 973 Basic Research Program of China under grant No.2014CB340600;the National Natural Science Foundation of China under grant No.61370230 and No.61662022;Program for New Century Excellent Talents in University Under grant NCET-13-0241;Natural Science Foundation of Huhei Province under Grant No.2016CFB371

摘　　要：In traditional framework,mandatory access control(MAC) system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system(OS) is comprised since malwares are running in ring 0 level. In this paper,we propose a novel way to use hypervisors to protect kernel integrity and the access control system in commodity operating systems. We separate the access control system into three parts: policy management(PM),security server(SS) and policy enforcement(PE). Policy management and the security server reside in the security domain to protect them against malware and the isolation feather of the hypervisor can protect them from attacks. We add an access vector cache(AVC) between SS and PE in the guest OS,in order to speed up communication between the guest OS and the security domain. The policy enforcement module is retained in the guest OS for performance. The security of AVC and PE can be ensured by using a memory protection mechanism. The goal of protecting the OS kernel is to ensure the security of the execution path. We implementthe system by a modified Xen hypervisor. The result shows that we can secure the security of the access control system in the guest OS with no overhead compared with modules in the latter. Our system offers a centralized security policy for virtual domains in virtual machine environments.Keywords: hypervisor; virtualization; memo-In traditional framework,mandatory access control（MAC） system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system（OS） is comprised since malwares are running in ring 0 level. In this paper,we propose a novel way to use hypervisors to protect kernel integrity and the access control system in commodity operating systems. We separate the access control system into three parts： policy management（PM）,security server（SS） and policy enforcement（PE）. Policy management and the security server reside in the security domain to protect them against malware and the isolation feather of the hypervisor can protect them from attacks. We add an access vector cache（AVC） between SS and PE in the guest OS,in order to speed up communication between the guest OS and the security domain. The policy enforcement module is retained in the guest OS for performance. The security of AVC and PE can be ensured by using a memory protection mechanism. The goal of protecting the OS kernel is to ensure the security of the execution path. We implementthe system by a modified Xen hypervisor. The result shows that we can secure the security of the access control system in the guest OS with no overhead compared with modules in the latter. Our system offers a centralized security policy for virtual domains in virtual machine environments.Keywords： hypervisor; virtualization; memo-

关 键 词：HYPERVISOR VIRTUALIZATION memory protection guest OS access control system 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP316[自动化与计算机技术—计算机科学与技术]