【作者】 蒋雅利；

【导师】 蒋文斌；

【作者基本信息】 华中科技大学 ， 计算机系统结构， 2009， 硕士

【摘要】 随着虚拟化技术越来越广泛的应用,各种针对虚拟机的攻击工具也层出不穷,尤其是保存着用户大量重要数据的客户操作系统的安全性令人担忧。传统的文件保护位于目标操作系统之中,很容易受到内核态攻击工具的攻击,其软件本身的安全很难得到保证。另外,由于虚拟化环境下,一台主机上同时运行多个操作系统,传统的文件保护需要在每台虚拟机上冗余地安装各自的文件保护系统,这对系统资源造成了很大的浪费,也严重地影响了系统的性能。基于虚拟机的实时文件保护机制有效地解决了上述问题。首先,由于该机制的关键模块在特权虚拟域中实现,与目标虚拟机有效隔离,不易受到内核态攻击工具的危害。其次,由于特权虚拟域有较高的管理权限,非特权虚拟域中的恶意软件无法感知到特权虚拟域中文件保护系统的存在,且相比在非特权虚拟域中实现能够更容易检测出恶意攻击的存在。该机制结合虚拟机分离设备驱动模型,利用特权操作系统中用户态设备管理工具实现对客户虚拟机中文件操作捕获,不修改虚拟机监控器和客户操作系统的代码,保证了其代码的完整性。最后,该机制实时获取客户操作系统中文件操作的相关信息,并在特权虚拟域中利用文件沙箱对非特权虚拟域的客户操作系统中文件实现有效地保护,保证了客户操作系统重要文件的安全性。总的来说该机制实现了以下四个特色:隔离性、透明性、非侵入性和实时性。测试表明,基于虚拟机的实时文件保护机制能够有效地保证客户操作系统中指定文件的安全性,且对文件系统的压缩和解压缩速度以及文件的读写速度影响较小,并能够适应主机中虚拟机的动态部署、创建和销毁,同时对多个客户操作系统中的指定文件实施保护。更多还原

【Abstract】 With the development of virtualization technology, file protection in virtual machine (VM), especially in guest OS, becomes more and more important. Traditional host-based file protection system resides the critical modules in monitored system, which is easily explored and destroyed by malwares. Moreover, in order to protect the multiple operation systems running on the same platform, it is necessary to install independent file protection system (FPS) for each of them, which greatly wastes computing resources and brings serious performance overhead.A novel VM-based real-time file protection system, named VRFP, is proposed to solve these problems. Firstly, virtual machine monitor (VMM) introspect all file operations of guest OS; then, semantic gap between disk block and logic files is narrowed by blktap; finally, a virtual sandbox is implemented in privileged domain to prevent protected files in guest domain from modifying illegally. The approach is highly-isolated, transparent and without modification on virtual machine monitor and guest OS. The experimental results show that the presented system is validate and of low performance overhead.The results of tests show that virtual machine based real-time file protection mechanism can effectively ensure the specified files in guest OS, and has low performance overhead to the speed of compressing and decompressing files and the file reading and writing speed in the target OS. Besides, it can adapt to the dynamic deployment of virtual machine, creation and destroy, providing the file protection for several virtual machines at the same time.更多还原