Agent-free client process protection method based on virtualization technology

Abstract

The invention discloses an agent-free client process protection method based on a virtualization technology. The method comprises the steps of transparently obtaining a windows non-paging memory page in a KVM, and recording an initial address of the memory page to a KVM structure body corresponding to a virtual machine; injecting virtual machine information; setting an IA32-SYSENTER-EIP register as a newly injected KiFastCallEntry function address, and conducting hook on a KiSystemService function; conducting clearing on original SSDT contents; setting VMCS structure relevant fields, and setting read-write sinking of the IA32-SYSENTER-EIP register and pagefault abnormal sinking of an instruction fetching type; intercepting instruction fetching pagefault abnormality of a client by a virtual machine monitor, analyzing a current operation, feeding a result back to the client, and finishing one-time accessing processing. According to the agent-free client process protection method based on the virtualization technology, the safe execution of system functions is ensured, there is no need to install an agent drive inside the client, there is no need to consider the security of the agent drive, and the influence on the performance of the virtual machine is reduced to the minimum.

Description

technical field [0001] The invention relates to the field of client process protection, in particular to an agentless client process protection method based on virtualization technology. Background technique [0002] In recent years, cloud computing technology has developed rapidly. On the one hand, by using cloud services, customers can save a lot of hardware costs and maintenance costs; on the other hand, as cloud vendors, while providing services to users, they can focus more on the research of cloud services themselves and promote cloud computing technology. development of. In order to reduce costs, customers are migrating more and more services to virtual machines on the cloud platform. However, the "Complete Virtualization Security Guide" released by the US National Standards Institute NIST pointed out that the security threats faced in traditional hosts also exist in virtual machines. Based on the characteristics of the operating system, the process, as the entity ...

AI Technical Summary

Problems solved by technology

Furthermore, the security of the agent itself is difficult to guarantee. Once the agent is uninstalled, the security measures to be implemented will no longer exist.

Images