Kernel integrity detection method based on Xen virtualization

Abstract

The invention discloses a kernel integrity detection method based on Xen virtualization. According to the method, a kernel integrity detection system is utilized to detect kernel integrity of a virtual machine operation system which is operated on a Xen virtualized platform; a memory mapping part, an information acquisition part and a safety detection part are arranged on a Dom 0 of the system, wherein the memory mapping part provides an interface for acquiring machine byte data of a hardware level of a Dom U; the information acquisition part deploys the machine byte data, acquired by the interface provided by the memory mapping part, of the hardware level of the Dom U, and converts the machine byte data of the hardware level into information of the level of the operation system according to the version of the operation system in the Dom U; the safety detection part calls kernel key data, acquired by the information acquisition part, of the operation system in the Dom U in a polling mode, and judges whether kernel integrity of the operation system in the Dom U is damaged or not according to safety policies of the system. According to the method, the detection system is deployed outside a monitored system, and therefore the safety of the detection system is guaranteed, and meanwhile kernel integrity of the monitored system is detected.

Description

technical field [0001] The invention relates to the technical field of computer virtualization, and further relates to the field of computer virtualization and security. It is a kernel integrity detection method based on Xen virtualization. It is used on the Xen virtualization platform where the guest operating system is Linux or Unix-like operating system. The key data structures and codes of the kernel of the operating system are inspected for integrity, providing security for the operating system running on the virtualization platform. Background technique [0002] Operating system security is an integral part of computer security. The kernel is the core of an operating system. It is the first layer of software expansion based on hardware. It provides the most basic functions of the operating system and is the basis for the operation of the operating system. [0003] In recent years, with the development of hacking technology, especially rootkit technology, attackers ha...

AI Technical Summary

Problems solved by technology

The integrity protection and detection tools realized by the above technologies are typically checkidt, kem-check, etc., and they all have a deficiency: the security software for kernel integrity detection and protection is in the same address space as the detected system, and the currently popular Rootkit Malware such as malware runs in the kernel state of the system and is at the same privilege level as security software. Compared with malware, security software does not have any privilege advantages.

Images