Self-examination automated management and configuration based on virtual machine and self-examination method

Abstract

The invention provides a self-examination automated management and configuration based on a virtual machine and a self-examination method. The self-examination method comprises the steps that 1) system call needs to be reused is screened out so as to form dummy system call according to a call execution process of an operating process of an operating system, and the dummy system call is executed bya target virtual machine; the target virtual machine comprises a control module, a data switching module and a system call control module; 2) target virtual machine system call is injected; 3) protective virtual machine system call is executed; 4) virtual machine storage is isolated, wherein from the outside of the target virtual machine, VCPU dispatch of the target virtual machine is tracked, and the target virtual machine storage is operated; the self-examination method can better strengthen safety, dummy system call codes executed by the target virtual machine are taken from a safe kernelimage, and the reused dummy system does not need to depend on the kernel integrity of the target virtual machine.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a virtual machine-based introspection automatic management, configuration and introspection method. Background technique [0002] In cloud computing, virtual machine introspection technology provides a means of security for cloud security. A virtual machine introspection technology (Virtual Machine Introspection, VMI) is a typical representative of a monitoring technology based on a virtual machine architecture. The architecture of the virtual machine introspection technology is to obtain the underlying state data of the virtual machine (CPU registers, I / O controller registers, memory, mass storage devices, etc.) intervene in its internal operating state. Since a virtual machine management layer (Virtual Machine Monitor, VMM) has the highest authority and there is strong isolation between virtual machines, this monitoring method has higher security and transparency. Because ...

AI Technical Summary

Problems solved by technology

But these methods face security, automation, and scalability issues

Both Hypershell and PI need virtual machine assistance to complete management and analysis, and there are problems with security and transparency. Once the virtual machine kernel is damaged, it will not work

EXT is to use the security virtual machine (SVM) to replace the target virtual machine (TVM) to process data, and then copy the results to the target virtual machine, but it faces scalability problems

Because the data to be operated by each system call is different, it needs to be processed separately, and Linux has many kinds of calls, so it is difficult to cover the functions used

Images