用错误围堵策略建立可生存的网络安全设备内核

Utilizing Fault Containment to Construct a Survivable Network Security Device Kernel

提出在IBM虚拟机器的架构上,使用错误围堵策略建立可生存的网络安全设备内核的思想。建立有效的资源管理器,分割、调度机器资源,把物理资源提供给虚拟机器,平衡错误围堵与其它的性能要求。利用软件和硬件错误围堵技术制约对系统攻击引起的错误,防止一个错误引起整个系统的崩溃。用以上策略建立了内核模型,给它加上大负荷,正常和异常的工作。实验结果显示:即使在系统中某些部分出错的情况下,依然不影响系统的整体性能,并且错误围堵的开销几乎可以忽略不计。

Fault containment is proposed to construct a survivable kemel of the network security device based on the IBM virtual machine. This is aecemplished by setting up an efficient resource manager to supply physical resources to the virtual machine and to balance other performance requirements. Software and hardware fault containment technology is used to protect against system attacks, and avoid a system breakdown from a single fault. Model and tests prove this idea and the overheads are almost negligible.