HyperSpector：基于UEFI的VMM动态可信监控基的设计与实现

王锴; 李志华; 黄凡; 严飞

doi:10.11959/j.issn.2096-109x.2016.00133

您当前的位置：

首页 >

文章列表页 >

HyperSpector：基于UEFI的VMM动态可信监控基的设计与实现

学术论文 | 更新时间：2024-06-03

- HyperSpector：基于UEFI的VMM动态可信监控基的设计与实现
- HyperSpector:VMM dynamic trusted monitor based on UEFI
- 网络与信息安全学报 2016年2卷第12期页码：47-55
- 作者机构：
  
  1. 空天信息安全与可信计算教育部重点实验室，湖北武汉 430072
  2. 武汉大学计算机学院，湖北武汉430072
- 作者简介：
  
  [ "王锴（1993-），男，河北石家庄人，武汉大学硕士生，主要研究方向为系统安全、可信计算。" ]
  [ "李志华（1988-），男，山西晋城人，硕士，主要研究方向为系统安全、可信计算。" ]
  [ "黄凡（1992-），女，湖南常德人，武汉大学硕士生，主要研究方向为系统安全、可信计算。" ]
  [ "严飞（1980-），男，湖北武汉人，博士，武汉大学副教授，主要研究方向为系统安全、可信计算。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61003268);国家自然科学基金资助项目;The National Natural Science Foundation of China(61272452);国家重点基础研究发展计划（“973”计划）基金资助项目;The Major State Basic Research Development Program of China (973 Program)(2014CB340601)
- DOI：10.11959/j.issn.2096-109x.2016.00133
  中图分类号： TP309
- 网络首发：2016-12，
  
  纸质出版：2016-12-15
- 稿件说明：
移动端阅览
王锴, 李志华, 黄凡, 等. HyperSpector：基于UEFI的VMM动态可信监控基的设计与实现[J]. 网络与信息安全学报, 2016,2(12):47-55.

Kai WANG, Zhi-hua LI, Fan, HUANG, et al. HyperSpector:VMM dynamic trusted monitor based on UEFI[J]. Chinese Journal of Network and Information Security, 2016, 2(12): 47-55.
王锴, 李志华, 黄凡, 等. HyperSpector：基于UEFI的VMM动态可信监控基的设计与实现[J]. 网络与信息安全学报, 2016,2(12):47-55. DOI： 10.11959/j.issn.2096-109x.2016.00133.

Kai WANG, Zhi-hua LI, Fan, HUANG, et al. HyperSpector:VMM dynamic trusted monitor based on UEFI[J]. Chinese Journal of Network and Information Security, 2016, 2(12): 47-55. DOI： 10.11959/j.issn.2096-109x.2016.00133.

摘要

随着计算机技术的高速发展，云计算这一计算模式得到迅速推广。尽管可通过VMM来对云服务安全状态进行监控与安全增强，但VMM自身的安全性往往是安全的前提。为了增强VMM的安全性，提出一种基于UEFI的VMM动态可信监控基的设计与实现方法，通过UEFI的固件运行特性，在VMM下增加一层安全监控层，实现在不增加新硬件成本的前提下对VMM的透明监测。实验表明，所提出的监控方案是安全有效的。

Abstract

With the rapid innovation of computer technology

cloud computing model expands.VMM was intro-duced to enhance the cloud safety and enhance the cloud safety.The safety of VMM itself

however

is the prerequi-site of the safety of the cloud service.A method of VMM dynamic trusted monitor based on UEFI was proposed on the purpose of enhancing the safety of VMM.The monitor of VMM was realized by adding a monitor layer beneath it

which needed no more newly hardware cost.Experiment results show that the solution is efficient.

关键词

Keywords

references

周振柳，栾好利，张楠，等 . 基于动态安全属性保护的可信固件 [J ] . 计算机工程， 2011 , 37 ( 4 ): 137 - 139 .

ZHOU Z L , LUAN H L , ZHANG N , et al . Trusted firmware based on dynamic security attribute protection [J ] . Computer Engineering , 2011 , 37 ( 4 ): 137 - 139 .

李博，李建欣，胡春明，等 . 基于VMM层系统调用分析的软件完整性验证 [J ] . 计算机研究与发展， 2011 , 48 ( 8 ): 1438 - 1446 .

LI B , LI J X , HU C M . oftware integrity verification based on VMM-Level system call analysis technique [J ] . Journal of Com-puter Research and Development , 2011 , 48 ( 8 ): 1438 - 1446 .

严飞，石翔，李志华， VirtinSpector：一种基于 UEFI 的虚拟机动态安全度量框架设计与实现 [J ] . 四川大学学报， 2014 , 46 ( 1 ): 22 - 28 .

YAN F , SHI X , LI Z H , et al . VirtinSpector:a UEFI based dynamic secure measurement framework for virtual machine [J ] . Journal of Sichuan University , 2014 , 46 ( 1 ): 22 - 28 .

Intel . Intel® 64 and IA-32 architectures software developer man-ual [M ] . Intel Press , 2014 .

Unified extensible firmware interface specification [EB/OL ] . http://www.uefi.org http://www.uefi.org .

Coreboot [EB/OL ] . http://www.coreboot.org http://www.coreboot.org .

VINCENT Z , MICHAEL R , SURESH M . Beyond BIOS develop-ing with the uenified extensible firmware interface [M ] . Intel Press , 2010 .

Handling interrupt descriptor table for fun and profit [EB/OL ] . http://www.phrack.org/issues/59/4.html http://www.phrack.org/issues/59/4.html .

Hijacking the linux kernel [EB/OL ] . http://www.drops.dagstuhl.de/opus/volltexte/2011/3063/pdf/7.pdf http://www.drops.dagstuhl.de/opus/volltexte/2011/3063/pdf/7.pdf .

FU Y , LIN Z . Space traveling across VM:automatically bridging the semantic gap in virtual machine introspection via online kernel data redirection[C]//IEEE Symposium on Security and Privacy . 2012 .

BRENDAN D G , TIM L , MICHAEL Z , et al . Virtuoso:narrowing the semantic gap in virtual machine introspection[C]//IEEE Sym-posium on Security and Privacy . 2011 .

LIONEL L , HORACIO A L C , DAVID L . Hypervisor support for identifying covertly executing binaries[C]//Usenix Security Sym-posium . 2008 .

BRYAN D P , MARTIM D P D A C , WENKE L . Secure and flexible monitoring of virtual machines[C]//The Annual Computer Security Applications Conference . 2007 .

Following the white rabbit:Software Attacks against Intel VT-d [EB/OL ] . http://www.invisiblethingslab.com/itl/Resources.html http://www.invisiblethingslab.com/itl/Resources.html .

KUN S , WANG J , ZHANG F W , et al . SecureSwitch:BIOS-assisted isolation and switch between trusted and untrusted commodity OSes[C]//Network＆Distributed System Security Symposium . 2012 .

KOSTYA K . Cloudburst:a vMware guest to host escape[C]//Blackhat Talk . 2009 .

SHAWN E , SHERRI S , CLIFF Z . SMM rootkits:a new breed of OS independent malware[C]//Security and privacy in communica-tion networks . 2008 .

JONATHAN M M , BRYAN J P , ADRIAN P , et al . Flicker:an execution infrastructure for TCB minimization[C]//ACM European Conference on Computer Systems . 2008 .

JONATHAN M M , LI Y L , QU N , et al . TrustVisor:efficient TCB reduction and attestation [J ] . IEEE Symposium on Security ＆ Pri-vacy , 2010 , 41 ( 3 ): 143 - 158 .

NICK L P J , TIMOTHY F , JESUS M , et al . Copilot — a coproces-sor-based kernel runtime integrity monitor [J ] . Proceedings of Usenix Security Symposium , 2010 ,( 13 ): 179 - 194 .

ZHANG F W , KEVIN L , ANGELOS S , et al . Using hardware features for increased debugging transparency[C]//IEEE Sympo-sium on Security and Privacy . 2015 .

AHMED M A , NING P , WANG Z , et al . HyperSentry:enabling stealthy incontext measurement of hypervisor integrity [J ] . ACM Conference on Computer and Communications Security , 2010 : 38 - 49 .

浏览量

2126

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

面向云环境的虚拟机可信迁移方案

云环境面向虚拟域的安全状态一致性保障机制研究

云计算多授权中心CP-ABE代理重加密方案

容器云中基于信号博弈的容器迁移与蜜罐部署策略

基于FANP的云用户行为信任评估优化机制