IVirt:基于虚拟机自省的运行环境完整性度量机制

发布时间：2019-01-07 11:44

【摘要】：完整性度量是检测程序篡改的重要方法,但是在虚拟化环境下传统的检测方法已体现出不足.例如,度量软件与被度量对象处于相同操作系统中易受攻击.该文从安全性和性能两方面出发,提出了一种基于虚拟机自省的完整性度量机制IVirt(Integrity for Virtualization).该机制从虚拟机外部通过地址转换和内容定位得到所需的虚拟机内存数据,从而对虚拟机内部的程序进行完整性度量,以检验程序是否遭到篡改.该文以典型的虚拟机监视器Xen为例实现了IVirt原型系统.相比于同类工作,IVirt一方面将度量软件与被度量对象分离,防止度量软件遭到攻击;另一方面采用地址转换来度量运行时状态,这区别于采用事件拦截机制的度量方法,以降低性能开销.实验结果表明,该方法能够检测出虚拟机运行时的软件篡改,而且在性能上不会引入过高的代价.
[Abstract]:Integrity measurement is an important method to detect program tampering, but the traditional detection method in virtualization environment has been shown to be inadequate. For example, measurement software is vulnerable to attack in the same operating system as the object being measured. This paper proposes an integrity measurement mechanism IVirt (Integrity for Virtualization). Based on virtual machine introspection from the aspects of security and performance. This mechanism obtains the memory data of the virtual machine from the outside of the virtual machine through address translation and content location, so as to measure the integrity of the internal program of the virtual machine and verify whether the program has been tampered with. This paper takes the typical virtual machine monitor Xen as an example to implement the IVirt prototype system. Compared with the similar work, IVirt separates the measurement software from the measured object on the one hand, and prevents the measurement software from being attacked. On the other hand, address translation is used to measure runtime state, which is different from the measurement method using event interception mechanism to reduce performance overhead. The experimental results show that the proposed method can detect the software tampering while the virtual machine is running, and it can not introduce too high a cost in performance.
【作者单位】：北京邮电大学计算机学院;北京邮电大学可信分布式计算与服务教育部重点实验室;北京邮电大学软件学院;
【基金】：国家自然科学基金(61202081) 国家“八六三”高技术研究发展计划项目基金(2012AA012606)资助~~
【分类号】：TP302

【相似文献】