Virtual hardware characteristic-based system and method for efficiently isolating kernel modules

Abstract

The invention provides a virtual hardware characteristic-based system and method for efficiently isolating kernel modules. According to the system and method, a secure and efficient strong isolation mechanism aiming at incredible kernel modules is designed, so that the present requirements for the security and functionality can be satisfied. Compared with the existing solutions, the system and method has better performance, stronger isolation and higher backward compatibility. The designed mechanism is easy to deploy in the present mainstream cloud computing platforms, so that considerable social benefit and economic benefit can be provided. In the mechanism, when the incredible kernel modules need to call functions of kernel cores or the kernel cores need to call functions in the incredible kernel modules, a secure and efficient virtual hardware characteristic-based control flow transformation mechanism is established, so that more attack surfaces are not exposed in the switching.

Description

technical field [0001] The invention belongs to the technical field of cloud computing platform system security, and specifically relates to a safe and efficient malicious kernel module prevention mechanism capable of finding a balance between security and performance. Background technique [0002] At first the technical terms involved in the present invention are explained: [0003] Kernel - all code and data running in kernel mode [0004] Kernel core - included in the kernel file, the code and data loaded into the kernel state when the system starts [0005] Kernel module - independent of the kernel file, code and data dynamically inserted into the kernel state during system operation [0006] During the running of the system, the code and data running in the kernel mode are composed of the kernel core and the kernel module. [0007] In cloud computing platforms, virtualization technology is usually used to efficiently integrate servers and improve the utilization of h...

AI Technical Summary

Problems solved by technology

In theory, we can operate the memory allocation in the client by operating EPT (that is, changing the mapping between GPA and HPA), but in normal mode, modifying the mapping relationship of addresses in EPT is performed by the virtual machine monitor VMM For operation, switching between different EPTPs in the virtual machine will cause the virtual machine to sink, resulting in relatively large performance overhead

Images