Method and device for protecting virtual machine kernel

Abstract

Embodiments of the present invention provide a method and device for protecting a virtual machine kernel. The method includes: intercepting a system call function initiated by an application program; Point to the shadow kernel, and determine the corresponding entry address of the system call function in the shadow kernel according to the shadow SSDT in the shadow kernel; wherein, the shadow kernel is built in the non-paged pool of the original kernel of the virtual machine, and the shadow kernel is based on the virtual machine The executable kernel code built from the image file of the original kernel. It realizes that the system call path is completely executed in the pure code of the shadow kernel, which ensures the integrity of the system call path, thereby also ensuring the integrity of the entire kernel code operation. Moreover, the shadow kernel is built in the non-paged pool of the original kernel of the virtual machine, which is simple and easy to implement, and will not leave traces in other places such as the registry, which is more secure.

Description

technical field [0001] The invention relates to virtual machine technology, in particular to a method and device for protecting the kernel of a virtual machine. Background technique [0002] In recent years, cloud computing technology has developed rapidly. It cannot be ignored that many malicious programs and kernel malicious codes currently exist will also pose security threats to the internal processes of cloud platform virtual machines. Among them, the virtual machine kernel plays a central role in the virtual machine. During the running of the virtual machine, all application system call requests, as well as internal and external interrupt processing, etc. will directly enter the virtual machine kernel and be processed by the virtual machine kernel. Necessary treatment. In the specific implementation process, among all the interfaces entering the virtual machine kernel, the system call interface is an important interface for the application program to interact with the...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides a method and device for protecting the kernel of a virtual machine, which are used to solve the problem that the prior art has poor interception effect on malicious codes and requires real-time interception

Images