一种基于VT-d技术的虚拟机安全隔离框架研究

Research on VT-d based Virtual Machine Isolation Framework

虚拟化技术作为云计算Iaa S服务的支撑,能从根本上解决云计算平台上虚拟机面临的安全威胁问题。针对目前云计算虚拟机隔离执行环境在设备I/O和内存访问隔离方面的不足,文章结合基于硬件辅助虚拟化的VT-d技术以及可信计算中虚拟可信平台模块(v TPM)独立域的思想,提出了一个在Xen云平台上的安全隔离框架。该框架中由v TPM独立域对虚拟机内的数据和代码进行加密保护,并基于独立域思想对虚拟机镜像本身加密;使用VT-d技术为虚拟机直接分配网卡设备,并扩展XSM安全模块,增加了虚拟机之间授权表策略控制。实验与分析表明,该框架能够有效确保虚拟机之间的设备I/O及内存访问安全隔离,提升虚拟机隔离环境的安全性,且能较好满足系统运行性能。

As the basis of cloud computing IaaS service, virtualization technology can fundamentally solve the threats that the virtual machines face on the cloud computing platform. In view of the deficiencies of the current cloud computing virtual machine isolation implementation environment in the aspect of device I/O and memory access isolation, this paper presents security isolation framework on a Xen cloud platform, combining the ideal of virtualization technology VT-d with trusted computing independent domain. In the framework, data and code encryption is implemented by vTPM independent domain, which encrypts the VM image. The framework assigns NIC to VM through VT-d technology, and extends the authorization control of grant table mechanism in XSM module. Experiments and analysis show that the framework is able to ensure device I/O and memory access security isolation between the virtual machines effectively, enhance the security of virtual machine isolation environment, and meet the system performances.