Method for running programs in isolation manner on basis of local virtualization mechanism

Abstract

The invention discloses a method for running programs in an isolation manner on the basis of a local virtualization mechanism. The method aims to solve the problem that an existing method for running programs in an isolation manner cannot simultaneously meet three application constraints required when non-trusted software is executed. The technical scheme includes that a local virtualization system which comprises a type-two virtual machine monitor, a starter and a read-write monitor is installed in a host operating system, the type-two virtual machine monitor starts a local virtual machine according to volume snapshots provided by the starter, and the read-write monitor performs read-write operation on an original volume device object in a unified manner according to a principle that 'basic blocks in a snapshot space only can be written by the virtual machine and original basic blocks only can be written by a host machine'. The method has the advantages that a host computation environment can be reconstructed on a personal computing platform, file system access conflict of the local virtual machine and the host operating system can be prevented, and non-trusted software can effectively and safely run in an isolation manner.

Description

technical field [0001] The invention relates to a program isolation running method in the field of computer security, in particular to a program isolation running method based on a local virtualization mechanism. Background technique [0002] With the widespread application of network security protection methods such as firewalls and network intrusion detection systems, it is becoming more and more difficult for attackers to directly invade computer systems through network intrusion means. [0003] However, various existing network protection products are difficult to effectively defend against attacks from malicious codes hidden in actively executed untrusted software. Therefore, various host-based security protection methods such as access control, virus detection, and sandbox are introduced to supplement the deficiency of network-based protection technology. However, the access control method cannot effectively protect the system against the malicious behavior of authori...

AI Technical Summary

Problems solved by technology

[0011] The technical problem to be solved by the present invention is: for the problem that the existing program isolation operation method cannot satisfy the three application constraints required for executing untrusted software at the same time, that is, the security isolation, functional integrity and Find a suitable balance between performance adaptability, and propose a method of using virtual machine monitor VMM (Virtual Machine Monitor) to create an isolated operating environment for untrusted software (that is, a localized virtual machine)

Images