Client virtual machine memory dynamic isolation and monitoring method and system

Abstract

The invention provides a client virtual machine memory dynamic isolation and monitoring method and system. A user request processing module, an extended page table exception interception and processing module, a virtual machine monitor interaction module and an extended page table communication module are respectively deployed in a client virtual machine; and an extended page table management module and an application behavior learning module are respectively deployed in a virtual machine monitor. The kernel address space isolation technology of the virtual machine is utilized to effectively defend stealing of kernel key data and random overwriting attacks of a memory. Even if a vulnerability of a certain module in the kernel is grasped, protected key data cannot be randomly tampered. Different isolation execution environments are provided for different modules, so that the kernel is protected from being stolen by unauthorized data and memory overwriting attacks. A virtualization mechanism provided by hardware is used to accelerate the switching function of the extended page table, so that the performance overhead is reduced.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to a method and system for dynamically isolating and monitoring the memory of a guest virtual machine. Background technique [0002] Kernel security of operating systems has always been a research hotspot in academia and industry. Because the kernel has higher authority than user-mode programs, once the kernel is compromised by an attacker, the entire system will lose its protection. With the prevalence of cloud platforms, many manufacturers place their services on cloud platforms, but kernel security issues are still important. Most of the virtual machines have run large-scale operating systems such as linux and windows, and a large number of user programs have run on these operating systems. Both the operating system and the user program are complex software. This complexity makes it difficult to find many hidden errors or loopholes in the entire system, and these erro...

AI Technical Summary

Problems solved by technology

The above scheme can realize read-only protection for key data in the same privilege level. However, in terms of security, attackers still have specific read permissions for key data, and there is still the possibility of leakage of sensitive data.

In terms of performance, because every time you modify key data or key registers, you need to enter the Nested Kernel to simulate execution, so some micro benchmarks have a greater impact on performance

Images