一种利用EPT机制的动态物理内存隔离方法

Dynamic Physical Memory Isolation Method Using EPT Mechanism

传统的物理内存保护机制主要依赖具体硬件和操作系统实现,存在可靠性低、隔离性差、安全性弱等缺点.Intel VT的VM X架构通过引入扩展页表(Extended Page Table,EPT)机制实现对物理内存的访问控制.在深入分析EPT实现原理的基础上,设计了一种动态物理内存隔离与访问验证方法,并设计了原型系统PMM (Physical Memory Monitor),该系统能够隐藏Linux操作系统应用程序进程访问的物理内存.在Linux操作系统上进行了原型实现和验证,实验结果表明,该方法能够隐藏应用程序进程访问的物理内存,防止应用程序的物理内存隐私数据和功能代码被非法访问和篡改,并且带来较少的性能开销.

Traditional physical memory protection mechanism mainly depends on the specific hardware and operation system,which has disadvantage including low reliability,bad isolation and weak security and so on. VMX architecture of Intel VT realizes controlling operation system users to access the physical memory. On the basis of analysis of EPT implementation principle,designed method of physical memory dynamic isolation and access simulation,then implemented prototype system PMM( Physical Memory Monitor),which used EPT mechanism to hide physical memory accessed by Linux application program process. The experiment results shows that this method can hide physical memory accessed by application program process and prevent illegal program from accessing protected physical memory and produce less performance cost.