基于VMFUNC的虚拟机自省触发机制

发布时间：2019-04-23 15:28

【摘要】：虚拟化技术作为云计算的基础得到了广泛应用,但随之而来的虚拟机安全问题日趋严重.虚拟机自省作为一种从外部监控虚拟机内部运行状态的方法,为解决虚拟机安全问题提供了新视角,但同时也引入了巨大开销,阻碍了实际应用.提出了一种基于VMFUNC的虚拟机自省(virtual machine introspection,VMI)触发机制.该机制借助CPU硬件特性VM-Function以及RDTSC指令模拟,将调用时产生VM Exit开销降至最低;利用VMFUNC的功能为目标虚拟机切换备用扩展页表,避免VMI程序运行时对虚拟机执行的中断;通过重载VMFUNC指令和Xentrace的功能实现高效的触发与信息传递机制,主动触发VMI程序运行,克服了VMI程序常驻带来的大量资源消耗.实现了虚拟机自省即服务系统,并进行了实验验证.结果表明:本系统带来额外性能开销不超过2%,使VMI在实际云环境中的广泛应用成为了可能.
[Abstract]:Virtualization technology is widely used as the foundation of cloud computing, but the security problem of virtual machine is becoming more and more serious. As a way to monitor the internal running state of virtual machine from the outside, virtual machine self-reflection provides a new perspective to solve the security problem of virtual machine, but it also introduces huge overhead, which hinders the application of virtual machine. A virtual machine self-reflection (virtual machine introspection,VMI (virtual machine introspection,VMI) trigger mechanism based on VMFUNC is proposed in this paper. With the help of CPU hardware characteristic VM-Function and RDTSC instruction simulation, this mechanism minimizes the VM Exit overhead when calling, and uses the function of VMFUNC to switch the backup extended page table for the target virtual machine, so as to avoid the interruption of the execution of the virtual machine when the VMI program is running. By overloading the VMFUNC instruction and the function of Xentrace to realize the efficient trigger and information transfer mechanism, the VMI program is actively triggered to run, which overcomes the large amount of resource consumption brought by the VMI program resident. The virtual machine self-reflection-as-a-service system is implemented and verified by experiments. The results show that the additional performance overhead of the system is less than 2%, which makes it possible for VMI to be widely used in real cloud environments.
【作者单位】：空天信息安全与可信计算教育部重点实验室(武汉大学);武汉大学计算机学院;软件工程国家重点实验室(武汉大学);
【基金】：国家自然科学基金项目(61373169,61672394) 国家“八六三”高技术研究发展计划基金项目(2015AA016004) 国家科技支撑计划基金项目(2014BAH41B00) NSFC-通用技术基础研究联合基金项目(U1536204)~~
【分类号】：TP302;TP309

【相似文献】