虚拟化安全:机遇,挑战与未来

Virtualization security: the good, the bad and the ugly

随着云计算的流行,虚拟化安全问题受到了广泛的关注。通过引入额外的一层抽象,虚拟化技术为整个系统提供了更强级别的隔离机制,并为上层软件提供了一系列自底向上的安全服务。另一方面,抽象的引入所带来的复杂性提升和性能损失,都对虚拟化安全的研究带来了巨大的挑战。介绍了上海交通大学并行与分布式系统研究所近几年来在虚拟化安全领域所做的一系列具有代表性的工作,包括利用虚拟化提供可信执行环境、虚拟机监控、域内隔离等一系列安全服务,以及对虚拟化环境的可信计算基和跨域调用等方面进行优化的成果,并对当前和未来虚拟化安全领域的问题和探索方向进行了总结。

The virtualization security has increasingly drawn widespread attention with the spread of cloud computing in recent years. Thanks to another level of indirection, virtualization can provide stronger isolation mechanisms, as well as bottom-up security services for upper-level software. On the other side, the extra indirection brings complexity and overhead as well, which poses huge challenges. A series of recent representative work done by the institute of parallel and distributed system shanghai jiaotong university, including providing security services of trusted execution environment, virtual machine monitoring, intra-domain isolation, as well as optimizing trusted computing base and cross-world calls in the virtualization environment. Finally the problems and directions in the space of virtualization security were summarized.