Xen虚拟机内存安全隔离技术研究与设计

发布时间：2018-04-26 09:10

本文选题：虚拟化 + Xen　；参考：《中国舰船研究院》2016年硕士论文

【摘要】：目前云计算已经进入一个飞速发展的年代,通过采用虚拟化、分布式等新技术,云端已逐渐存储很多重要数据,一方面对云计算安全要求大大提高,另一方面也对虚拟机环境提出安全需求。虚拟化技术通过虚拟机管理器,对真实的计算环境进行抽象和模拟,在一台物理主机上虚拟出多个硬件环境,虚拟机通过运行在虚拟的硬件环境中完成与真实计算机相同的功能,同一台物理机上运行的多个虚拟机依赖同一个真实物理硬件环境。基于虚拟化技术的特点,在云端多用户环境下,虚拟机管理器必须对不同用户使用的虚拟硬件环境进行安全隔离,才能满足云端系统和数据安全性的基本需求。针对虚拟化环境自身体系结构和虚拟机之间内存映射的特点,提出一种特权域(Domain0,简称Dom0)和普通域(DomainU,简称DomU,即用户域)间可配置的内存隔离方法,实现特权域和普通域间的内存隔离;同时,扩展Xen平台下XSM(Xen Security Module)关于Xenstore的安全架构,实现普通域和普通域之间共享内存的安全隔离。研究虚拟环境下Dom0与DomU之间,DomU与DomU之间的内存安全隔离增强技术,目的是防止虚拟机客户机之间的相互攻击、隔离特权域用户利用安全漏洞越权访问其他域内存,从而在现有技术基础上提升虚拟机运行和数据的安全性,创建更安全的虚拟机环境。内存安全隔离及共享存储安全隔离方案经测试实验表明,可配置的内存隔离方法及扩展Flask框架Xenstore模块能够实现对普通域内存信息的安全性保护,在保证普通域运行过程内存信息可靠性和秘密性的同时,增强普通域内存信息管理的可维护性。
[Abstract]:Cloud computing has entered a rapid development era, through the use of virtualization, distributed and other new technologies, cloud has gradually stored a lot of important data, on the one hand, cloud computing security requirements greatly increased, On the other hand, the security requirements of virtual machine environment are also put forward. Virtualization technology abstracts and simulates the real computing environment through a virtual machine manager, and virtual multiple hardware environments on a physical host. Virtual machines perform the same functions as real computers by running in a virtual hardware environment, and many virtual machines running on the same physical machine depend on the same real physical hardware environment. Based on the characteristics of virtualization technology, in the cloud multi-user environment, the virtual machine manager must isolate the virtual hardware environment used by different users, in order to meet the basic needs of cloud system and data security. According to the characteristics of memory mapping between virtualized environment and virtual machine, a configurable memory isolation method between privilege domain (Domain0) and common domain (domain) is proposed. At the same time, we extend the security architecture of XSM(Xen Security module on Xen platform to realize the security isolation of shared memory between common domain and common domain. This paper studies the memory security isolation enhancement technology between Dom0 and DomU in virtual environment. The purpose is to prevent the virtual machine clients from attacking each other and isolate privileged domain users to access other memory by exploiting security vulnerabilities. In order to improve the running and data security of virtual machine based on the existing technology, create a more secure virtual machine environment. The test results of memory security isolation and shared storage security isolation scheme show that the configurable memory isolation method and the extended Flask framework Xenstore module can realize the security protection of common domain memory information. At the same time, the maintainability of common domain memory information management is enhanced.
【学位授予单位】：中国舰船研究院
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP302

【相似文献】