基于vTPM的Xen虚拟机动态完整性度量模型研究

发布时间：2019-07-09 20:32

【摘要】：随着云计算的发展,虚拟化技术得到了广泛应用,虚拟机在为用户提供服务的同时也成为了攻击者重点攻击的对象。如何保证虚拟机中运行程序的完整性成为亟待解决的问题,现有的完整性度量机制引入可信计算技术,以可信平台模块(Trusted Platform Module,TPM)为可信根建立一条可信链,对进程进行静态完整性度量,这种单一链式静态度量无法确保平台运行后的动态可信,而在虚拟环境下更不能满足安全和性能的要求。本文针对虚拟平台中不能保证运行程序动态可信的问题,以典型的虚拟机监视器Xen为例实现了一种基于虚拟可信平台模块(virtual Trusted Platform Module,vTPM)的动态完整性度量模型,该模型结合虚拟机自省和事件截获技术保证整个用户域的安全性,在该框架基础之上提出并实现一种自修改动态度量策略(Self-modify Dynamic Measurement Strategy),通过该策略可以有效降低度量频次,提高度量性能,最后通过对比实验证明了所提模型的有效性和可行性。
文内图片：

图片说明：自修改动态度量测量实例对比
[Abstract]:With the development of cloud computing, virtualization technology has been widely used. Virtual machine not only provides services to users, but also becomes the object of attack by attackers. How to ensure the integrity of running programs in virtual machines has become an urgent problem to be solved. The existing integrity measurement mechanism introduces trusted computing technology to establish a trusted chain with trusted platform module (Trusted Platform Module,TPM) as the trusted root to measure the static integrity of the process. This single chain static measurement can not ensure the dynamic credibility of the platform after running, and can not meet the requirements of security and performance in the virtual environment. In order to solve the problem that the running program can not be trusted dynamically in virtual platform, a dynamic integrity measurement model based on virtual trusted platform module (virtual Trusted Platform Module,vTPM is implemented by taking the typical virtual machine monitor Xen as an example. This model combines virtual machine introspect and event interception technology to ensure the security of the whole user domain. On the basis of this framework, a self-modifying dynamic measurement strategy is proposed and implemented. Self-modify Dynamic Measurement Strategy), can effectively reduce the measurement frequency and improve the measurement performance. Finally, the effectiveness and feasibility of the proposed model are proved by comparative experiments.
【学位授予单位】：河北大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP309;TP302

【参考文献】