Xen云环境虚拟机安全隔离技术研究与实现

发布时间：2018-06-26 09:55

本文选题：Xen + 云安全　；参考：《电子科技大学》2013年硕士论文

【摘要】：云技术的应用目前已经逐步深入了人们的生产与生活，给人们带来了不少的便利。在云技术逐渐改变人们生活的同时，也在不断重新定义着计算机安全的内容。越来越多的数据被移动到了云端，安全问题也逐渐引起人们的重视。目前云安全方面研究仍然集中在传统的安全模型之上，很少有人去关注来自云内部的安全隐患。内部安全问题一直被忽视，直到谷歌员工两次被爆出利用管理权限窃取用户在云环境中隐私数据的时候，人们才意识到云内部安全问题不容忽视。如今，云安全问题成为了云计算发展最大阻碍之一。Xen作为云的最主要载体，绝大多数情况仍然“裸奔”在运营商的机房中，来自云内部的安全威胁正在威胁着所有云用户的数据安全。本文正是从这样的问题入手，以防护来自Xen内部安全隐患为目标，，以隔离为手段，分别从块设备、内存以及桌面协议三方面对Xen云环境中的虚拟机安全隔离进行研究。研究针对这三方面出现的攻击方式，结合Xen源码进行了细粒度的分析研究，最终找到了这三方面隔离的关键技术切入点。在这些切入点基础上，块设备隔离通过加密Qemu中模拟的硬盘数据，使得Domain0中管理员无法通过管理工具查看虚拟硬盘中数据内容；内存隔离通过修改Hypervisor中授权表工作流程，并扩展ACM框架完成了内存映射的控制与鉴别，使得管理员无法从Domain0中非法访问用户虚拟机内存；桌面协议隔离通过在虚拟VGA图像产生过程中对图像进行加密，并配合加密的VNC客户端实现了安全的桌面协议，杜绝了管理员在物理网卡抓取虚拟机内桌面协议数据还原会话的隐患。所有涉及加解密的过程都建立在PKI技术之上，秘钥使用独立的服务器进行管理，并且通过安全秘钥接口完成访问，这样保证了加密过程的安全可验证性。经过测试，本系统中的隔离模块达到了预期目标，在性能方面对内存、硬盘以及桌面协议的效率最大影响均小于预期指标，达到了预期的目标，实现了Domain0与DomainU之间数据的隔离。本课题研究顺应了互联网安全态势发展，能够提升基于Xen云的环境中数据安全性，能够对我国云安全相关工作起到积极的推动作用。
[Abstract]:The application of cloud technology has gradually deepened people's production and life, and brought a lot of convenience to people. As cloud technology gradually changes people's lives, it also redefines the content of computer security. As more and more data are moved to the cloud, people pay more and more attention to security issues. At present, the research on cloud security is still focused on the traditional security model, and few people pay attention to the hidden danger from the cloud interior. Internal security issues have been ignored until Google employees were twice exposed to using administrative authority to steal users' privacy data in the cloud environment before people realized that cloud internal security problems can not be ignored. Nowadays, cloud security has become one of the biggest obstacles to the development of cloud computing. Xen, as the main carrier of cloud, is still "naked" in the computer room of the operator. Security threats from within the cloud are threatening the data security of all cloud users. This paper starts with this problem, taking the protection from the hidden danger of Xen internal security as the goal, and taking isolation as the means, studies the security isolation of virtual machine in Xen cloud environment from three aspects of block device, memory and desktop protocol respectively. This paper studies the attack mode of these three aspects, combining with the Xen source code, carries on the fine grain analysis research, finally has found the key technology breakthrough point of these three aspects isolation. On the basis of these pointcuts, block device isolation encrypts hard disk data simulated in Qemu, which makes it impossible for administrators in Domain0 to view the data content in virtual hard disks through administrative tools, and memory isolation by modifying the workflow of authorization tables in the hypervisor. The ACM framework is extended to control and authenticate the memory mapping, which makes the administrator unable to illegally access the memory of the user virtual machine from Domain0. Desktop protocol isolation encrypts the image in the process of generating virtual VGA image. A secure desktop protocol is implemented in conjunction with the encrypted VNC client, which eliminates the hidden danger of the administrator grabbing the desktop protocol data restore session in the virtual machine in the physical network card. All the processes involved in encryption and decryption are based on PKI technology, and the secret key is managed by a separate server and accessed through the secure key interface, which ensures the security verifiability of the encryption process. After testing, the isolation module in the system has achieved the expected goal, and the maximum effect on the efficiency of memory, hard disk and desktop protocol is less than the expected target in the performance aspect. The expected goal has been achieved, and the data isolation between Domain0 and DomainU has been realized. This research conforms to the development of Internet security situation, can improve the data security in the environment based on Xen cloud, and can play an active role in promoting the related work of cloud security in China.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2013
【分类号】：TP302

【相似文献】