基于硬件虚拟化的虚拟机进程代码分页式度量方法

Paging-measurement method for virtual machine process code based on hardware virtualization

云环境下恶意软件可利用多种手段篡改虚拟机(VM)中关键业务代码,威胁其运行的稳定性。传统的基于主机的度量系统易被绕过或攻击而失效,针对在虚拟机监视器(VMM)层难以获取虚拟机中运行进程完整代码段并对其进行完整性验证的问题,提出基于硬件虚拟化的虚拟机进程代码分页式度量方法。该方法以基于内核的虚拟机(KVM)作为虚拟机监视器,在VMM层捕获虚拟机进程的系统调用作为度量流程的触发点,基于相对地址偏移解决了不同版本虚拟机之间的语义差异,实现了分页式度量方法在VMM层透明地验证虚拟机中运行进程代码段的完整性。实现的原型系统——虚拟机分页式度量系统(VMPMS)能有效度量虚拟机中进程,性能损耗在可接受范围内。

In cloud environment, the code of pivotal business in Virtual Machine( VM) can be modified by malicious software in many ways, which can pose a threat to its stable operation. Traditional measurement systems based on host are liable to be bypassed or attacked. To solve the problem that it is difficult to obtain a complete virtual machine running process code and verify its integrity at Virtual Machine Monitor( VMM) layer, a paging-measurement method based on hardware virtualization was proposed. The Kernel-based Virtual Machine( KVM) was used as the VMM to capture the system calls of virtual machine process in VMM and regarde it as the trigger point of the measurement process; the semantic differences of different virtual machine versions were solved by using relative address offset, then the paging-measurement method could verify the code integrity of running process in virtual machine transparently at VMM layer. The implemented prototype system of VMPMS( Virtual Machine Paging-Measurement System) can effectively measure the virtual machine process code with acceptable performance loss.