虚拟化技术研究广泛应用于服务器到PC机,目前在嵌入式机载领域也有很多相关研究。存储虚拟化是虚拟化技术的关键部分,能够提供虚拟机之间的空间隔离能力,保证虚拟机之间不会出现空间访问越界,并且保证客户操作系统的MMU功能。本文在机...虚拟化技术研究广泛应用于服务器到PC机,目前在嵌入式机载领域也有很多相关研究。存储虚拟化是虚拟化技术的关键部分,能够提供虚拟机之间的空间隔离能力,保证虚拟机之间不会出现空间访问越界,并且保证客户操作系统的MMU功能。本文在机载领域使用的硬件平台Power PC E500mc处理器上设计实现了存储虚拟化。展开更多
In traditional framework,mandatory access control(MAC) system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved ...In traditional framework,mandatory access control(MAC) system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system(OS) is comprised since malwares are running in ring 0 level. In this paper,we propose a novel way to use hypervisors to protect kernel integrity and the access control system in commodity operating systems. We separate the access control system into three parts: policy management(PM),security server(SS) and policy enforcement(PE). Policy management and the security server reside in the security domain to protect them against malware and the isolation feather of the hypervisor can protect them from attacks. We add an access vector cache(AVC) between SS and PE in the guest OS,in order to speed up communication between the guest OS and the security domain. The policy enforcement module is retained in the guest OS for performance. The security of AVC and PE can be ensured by using a memory protection mechanism. The goal of protecting the OS kernel is to ensure the security of the execution path. We implementthe system by a modified Xen hypervisor. The result shows that we can secure the security of the access control system in the guest OS with no overhead compared with modules in the latter. Our system offers a centralized security policy for virtual domains in virtual machine environments.Keywords: hypervisor; virtualization; memo-展开更多
为解决操作系统在运行于虚拟机管理器提供的虚拟化环境中,无法直接处理系统中的中断的问题,针对虚拟化操作系统的中断处理,结合虚拟机管理器所能提供的功能,提出了一种中断虚拟化的模型,并以Vx Works 5.5为验证对象进行了中断虚拟化的...为解决操作系统在运行于虚拟机管理器提供的虚拟化环境中,无法直接处理系统中的中断的问题,针对虚拟化操作系统的中断处理,结合虚拟机管理器所能提供的功能,提出了一种中断虚拟化的模型,并以Vx Works 5.5为验证对象进行了中断虚拟化的实现以及验证,通过验证结果表明,中断虚拟化模型能够保证客户操作系统中断的正常处理。展开更多
文摘虚拟化技术研究广泛应用于服务器到PC机,目前在嵌入式机载领域也有很多相关研究。存储虚拟化是虚拟化技术的关键部分,能够提供虚拟机之间的空间隔离能力,保证虚拟机之间不会出现空间访问越界,并且保证客户操作系统的MMU功能。本文在机载领域使用的硬件平台Power PC E500mc处理器上设计实现了存储虚拟化。
基金supported by the National 973 Basic Research Program of China under grant No.2014CB340600the National Natural Science Foundation of China under grant No.61370230 and No.61662022+1 种基金Program for New Century Excellent Talents in University Under grant NCET-13-0241Natural Science Foundation of Huhei Province under Grant No.2016CFB371
文摘In traditional framework,mandatory access control(MAC) system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system(OS) is comprised since malwares are running in ring 0 level. In this paper,we propose a novel way to use hypervisors to protect kernel integrity and the access control system in commodity operating systems. We separate the access control system into three parts: policy management(PM),security server(SS) and policy enforcement(PE). Policy management and the security server reside in the security domain to protect them against malware and the isolation feather of the hypervisor can protect them from attacks. We add an access vector cache(AVC) between SS and PE in the guest OS,in order to speed up communication between the guest OS and the security domain. The policy enforcement module is retained in the guest OS for performance. The security of AVC and PE can be ensured by using a memory protection mechanism. The goal of protecting the OS kernel is to ensure the security of the execution path. We implementthe system by a modified Xen hypervisor. The result shows that we can secure the security of the access control system in the guest OS with no overhead compared with modules in the latter. Our system offers a centralized security policy for virtual domains in virtual machine environments.Keywords: hypervisor; virtualization; memo-
文摘为解决操作系统在运行于虚拟机管理器提供的虚拟化环境中,无法直接处理系统中的中断的问题,针对虚拟化操作系统的中断处理,结合虚拟机管理器所能提供的功能,提出了一种中断虚拟化的模型,并以Vx Works 5.5为验证对象进行了中断虚拟化的实现以及验证,通过验证结果表明,中断虚拟化模型能够保证客户操作系统中断的正常处理。
