桌面虚拟化安全访问控制架构的设计与实现

Design and implementation of secure access control architecture of desktop virtualization

为解决桌面虚拟化环境中虚拟桌面共享数据中心服务器并将用户数据集中存储带来的安全隐患,对原有虚拟桌面结构进行改进,并结合虚拟安全域、hypervisor安全增强技术和安全标签技术,实现了全新的桌面虚拟化安全访问控制架构。将用户虚拟桌面中不同安全等级的应用程序运行在不同的虚拟机中,将虚拟桌面中不同安全等级的虚拟机和用户数据划分到不同的虚拟安全域并下发相应的安全策略,实现了虚拟桌面的通信隔离和对存储资源的访问控制。

To mitigate the security threats of current virtual desktops, a new secure architecture of desktop virtualization is proposed. Applications of different users and classifications are run in different virtual machines, and resources are stored separately. Virtual secure domains, hypervisor security enhanced technology and security label are used in the architecture. Security policies are deployed to keep the security of virtual desktops. Finally, a prototype based on Xen is demonstrated.