Virtual machine construction method and device capable of resisting side channel attack and virtual machine

Abstract

The invention discloses a side channel attack resistant virtual machine construction method and device and a virtual machine. A virtual machine monitor is configured with a security partition module, and a virtual machine operating system is configured with a virtual machine security cache module; the security partitioning module is used for statically partitioning a third-level cache of the physical host into a common region and a security region which are isolated from each other; reserving a continuous physical memory as a host security memory, and forcibly enabling the host security memory to correspond to the security area; based on the virtual machine starting request, a certain number of host security memories are distributed to the virtual machine to create a virtual machine security memory for the virtual machine; and the virtual machine security cache module is configured to access and manage the virtual machine security memory, respond to the security resource allocation request and allocate the virtual machine security memory for the corresponding application process. According to the scheme, the cache space of the virtual machine process is partitioned and isolated by utilizing the security capability of hardware layer extension, so that various side channel attacks implemented by utilizing the cache are effectively resisted.

Description

Technical Field

[0001] This invention belongs to the field of anti-side-channel attack technology, and in particular relates to a method, apparatus and virtual machine for constructing a virtual machine that is resistant to side-channel attacks. Background Technology

[0002] Side-channel attacks (SCA) exploit indirect physical or software-level information (such as time, temperature, electromagnetic radiation, and access patterns) leaked during the operation of a target system to infer confidential information within the system. Software side-channel attacks, in particular, utilize runtime software behavior (such as execution time, cache hit rate, branch prediction state, and memory access patterns) to deduce confidential information such as keys and passwords. Compared to traditional software attacks that directly target system vulnerabilities or logical flaws, these software side-channel attacks are characterized by low implementation barriers, high stealth, and cross-layer threats (leaking information across multiple layers such as CPU cache, operating system, and application layer), posing new and greater challenges to information system security.

[0003] In the era of cloud computing, virtual machines (VMs), due to their balance of efficiency and security, have been widely deployed on cloud servers and have even become a fundamental cloud resource configuration and application model. However, VMs also face the threat of side-channel attacks. Although VMs have a certain degree of resource isolation capabilities, they are still powerless against side-channel attacks based on CPU microarchitecture and cache levels. Summary of the Invention

[0004] The purpose of this invention is to provide a virtual machine construction method that resists side-channel attacks in order to address the above-mentioned problems. By utilizing the security capabilities extended at the hardware layer, the cache space of the virtual machine process is partitioned and isolated, thereby effectively resisting various side-channel attacks that exploit the cache.

[0005] Another objective of this invention is to provide a virtual machine and apparatus resistant to side-channel attacks.

[0006] To achieve the above objectives, the present invention adopts the following technical solutions: A method for constructing a virtual machine resistant to side-channel attacks, the method comprising: The physical host's virtual machine monitor is configured with a security partition module, and the virtual machine operating system is configured with a virtual machine security cache module; The security partition module is configured as follows: The physical host's third-level cache is statically divided into mutually isolated normal areas and secure areas; During the physical host system startup process, a contiguous block of physical memory is reserved as host secure memory, and the host secure memory is forcibly mapped to the secure region so that the data in the host secure memory is loaded into the secure region cache. Based on the virtual machine startup request, a certain amount of host-secure memory is allocated to the virtual machine to create virtual machine-secure memory for the virtual machine. The virtual machine security caching module is configured as follows: Access and manage the virtual machine secure memory, respond to security resource allocation requests from application processes in the virtual machine user layer, allocate virtual machine secure memory to the corresponding application processes, so that the relevant data of the application processes are loaded into the secure area cache.

[0007] In the above-described method for constructing a virtual machine to resist side-channel attacks, the host secure memory is forcibly mapped to the secure region in the following manner: The masks corresponding to the normal area and the security area are obtained through the interfaces provided by the hardware mechanism. Write the mask of the security region into the registers specified by the hardware mechanism within the currently running CPU core; The CPU executes read instructions on the preset host secure memory and continues to execute them until all of the host secure memory is read, so that the CPU forces the data of the host secure memory to be cached in the secure area according to the mask; Based on cache consistency, during subsequent system operation, any CPU core's read and write operations on data within the host secure memory address range are fixedly cached in the secure region, thereby establishing a mandatory correspondence between the host secure memory and the secure region.

[0008] In the above-described method for constructing a virtual machine to resist side-channel attacks, during the process of creating memory for the virtual machine, a certain amount of host-secure memory and virtual machine-secure memory is added to the physical memory address translation table between the physical host and the virtual machine, and the certain amount of host-secure memory is allocated to the virtual machine to create virtual machine-secure memory for the virtual machine.

[0009] In the above-described method for constructing a virtual machine to resist side-channel attacks, the virtual machine security cache module is configured as follows: During the virtual machine startup phase, a secure memory allocation request is initiated so that the secure partition module adds a certain amount of host secure memory and virtual machine secure memory mapping to the physical memory address translation mapping table. During the virtual machine shutdown phase, a secure memory reclamation request is initiated so that the secure partition module removes the mapping relationship corresponding to the virtual machine secure memory in the physical memory address translation mapping table.

[0010] In the above-described method for constructing a virtual machine to resist side-channel attacks, the virtual machine security cache module is configured to provide a system call interface to the virtual machine user to respond to the application process's security resource allocation request and allocate virtual machine security memory to the corresponding application process.

[0011] In the above-described method for constructing a virtual machine to resist side-channel attacks, during the virtual machine runtime phase, the application process requests a corresponding amount of virtual machine secure memory from the virtual machine secure cache module through the system call interface, so as to store the confidential data that needs to be protected in the virtual machine secure memory.

[0012] In the above-mentioned method for constructing a virtual machine to resist side-channel attacks, after the application process ends, the system call interface triggers the virtual machine security cache module to clear and release the confidential data in the virtual machine security memory based on the run-end instruction.

[0013] In the above-mentioned method for constructing a virtual machine to resist side-channel attacks, the virtual machine security cache module is deployed in the virtual machine operating system kernel and is initialized synchronously with the virtual machine operating system kernel during the virtual machine startup process; After the virtual machine has started, the virtual machine security cache module accesses and manages the virtual machine security memory and responds to security resource allocation requests from the application process.

[0014] A device for resisting side-channel attacks includes a physical host, a virtual machine monitor deployed on the physical host, and virtual machines created and managed by the virtual machine monitor. The virtual machine monitor has a security partitioning module, and the operating system kernel of the virtual machine includes a virtual machine security cache module. The security partition module is configured as follows: The physical host's third-level cache is statically divided into mutually isolated normal areas and secure areas; During the physical host system startup process, a contiguous block of physical memory is reserved as host secure memory, and the host secure memory is forcibly mapped to the secure region so that the data in the host secure memory is loaded into the secure region cache. Based on the virtual machine startup request, a certain amount of host-secure memory is allocated to the virtual machine to create virtual machine-secure memory for the virtual machine. The virtual machine security caching module is configured as follows: Access and manage the virtual machine secure memory, respond to security resource allocation requests from application processes in the virtual machine user layer, allocate virtual machine secure memory to the corresponding application processes, so that the relevant data of the application processes are loaded into the secure area cache.

[0015] A virtual machine resistant to side-channel attacks, wherein the virtual machine is created with virtual machine ordinary memory and virtual machine secure memory, and the operating system kernel includes a virtual machine secure cache module; The virtual machine secure memory is created by the physical host's security partition module in the following way: During the physical host system startup process, a contiguous block of physical memory is reserved as host secure memory, and the host secure memory is forcibly mapped to a secure zone so that the data in the host secure memory is loaded into the secure zone cache. Based on the virtual machine startup request, a certain amount of host-secure memory is allocated to the virtual machine to create virtual machine-secure memory for the virtual machine. The security zone is one of two mutually isolated zones into which the third-level cache of the physical host is divided; The virtual machine security cache module is used to access and manage the virtual machine security memory, respond to security resource allocation requests from application processes in the virtual machine user layer, and allocate virtual machine security memory to the corresponding application processes so that the relevant data of the application processes are loaded into the security area cache.

[0016] The advantages of this invention are: This solution utilizes existing hardware features without requiring hardware changes. It only requires adding corresponding functional modules to the existing virtual machine monitor and virtual machine operating system, resulting in low cost and high feasibility. This solution leverages the scalability of host hardware, partitions the LLC cache, and combines two newly added functional modules to achieve a high level of defense against side-channel attacks that exploit the cache in virtual machines. Attached Figure Description

[0017] Figure 1 The flowchart illustrates the virtual machine construction method for resisting side-channel attacks according to the present invention. Figure 2 This is a structural block diagram of the anti-side-channel attack device of the present invention.

[0018] Figure label: Physical host 1, Virtual machine 2, Virtual machine monitor 3, Security partition module 4, Virtual machine security cache module 5. Detailed Implementation

[0019] like Figure 1 and Figure 2 As shown, this embodiment provides a method for constructing a virtual machine resistant to side-channel attacks, mainly used to defend against various side-channel attacks on virtual machine 2 using cache. Based on this method, a device for resisting side-channel attacks and a virtual machine 2 capable of resisting side-channel attacks are implemented. The specific implementation is as follows: 1) A virtual machine monitor (Hypervisor) 3 is deployed on the physical host system. The type of Virtual Machine Monitor 3 can be KVM, XEN, etc., and is not specifically limited here. In particular, Virtual Machine Monitor 3 has an added functional module—Security Partition Module 4. The function of Security Partition Module 4 is: a. Utilize the security extension capabilities of the physical host 1 hardware, such as IntelCAT, ArmMPAM, etc., to statically divide the third-level cache (LastLevelCache, LLC) into two isolated regions: a normal region and a security region.

[0020] b. During the initialization phase of the Virtual Machine Monitor 3 (which occurs during the host system startup phase), a contiguous block of physical memory is reserved as host secure memory. A mandatory mapping relationship is established between the secure memory and the secure area in the LLC, guaranteed by hardware mechanisms (Intel CAT, ArmMPAM, etc.) and implemented through a hardware-software co-operation method. This mapping relationship forces that data in the secure memory can only be cached in the secure area of ​​the LLC, while memory data in other parts (ordinary areas) can only be cached in the ordinary area of ​​the LLC, and the two are isolated from each other.

[0021] Specifically, the method for establishing the above-mentioned mandatory mapping relationship is as follows: b1. Obtain the mask (equivalent to the zone ID) of each zone (including normal zones and security zones) through the interface provided by hardware mechanisms (Intel CAT, ArmMPAM, etc.); b2. Fill the mask of the security region into the registers specified by the hardware mechanism within the currently running CPU core; b3. Execute read instructions (such as the x86 movq instruction) on the preset host safe memory, and continue to execute until all safe memory is read. During the read process, the CPU will force the data to be cached in the LLC safe area according to the mask information. Based on the basic mapping principle and characteristics of LLC (cache coherence), during the subsequent operation of this system, any read or write operation of data within the safe memory address range by any CPU core will be fixedly cached in the same LLC location (i.e., the LLC safe region) as in step b3. This establishes a mandatory mapping relationship from safe memory to the LLC safe region.

[0022] c. Accept the request from virtual machine 2 and allocate a certain amount of host secure memory to virtual machine 2. The specific implementation process is as follows: During the startup phase of virtual machine 2, the security partition module 4 selects a portion of the free host secure memory and adds its address to the physical memory address translation mapping table (GPA-HPM mapping table) between physical host 1 and virtual machine 2, so that virtual machine 2 adds an extra portion of host secure memory.

[0023] During the startup phase of virtual machine 2, virtual machine 2 has no memory. At this stage, the memory for virtual machine 2 is created (simulated) by the virtual machine monitor 3 on physical host 1. This memory creation process involves the virtual machine monitor 3 creating a GPA-HPM mapping table to map a block of host memory from physical host 1 to virtual machine 2, effectively allocating a block of memory to virtual machine 2. For virtual machine ordinary memory, the creation method is consistent with existing technology: the virtual machine monitor 3 actively requests the corresponding resources from physical host 1 and creates a GPA-HPM mapping table based on the request result.

[0024] The key feature of this solution is that, during the virtual machine 2 memory creation phase, the two proposed functional modules, security partitioning module 4 and virtual machine security cache module 5, add additional memory mappings to the GPA-HPM mapping table, and also add separately allocated security memory to the mapping, thereby allocating a certain amount of host security memory to virtual machine 2 to create virtual machine security memory for virtual machine 2.

[0025] After virtual machine 2 starts up, in addition to traditional virtual machine ordinary memory, it also has virtual machine secure memory. From a physical perspective, virtual machine ordinary memory is part of the host ordinary memory, and virtual machine secure memory is part of the host secure memory. From the perspective of virtual machine 2, virtual machine secure memory is an independent part of the virtual machine's physical memory, and virtual machine 2 uses the virtual machine secure cache module 5 (mentioned later) to process this virtual machine secure memory. The processing of virtual ordinary memory can use existing technologies, which will not be elaborated here.

[0026] 3) A functional module, Virtual Machine Security Cache Module 5, has been added to the kernel of Virtual Machine 2 managed by Virtual Machine Monitor 3. Its function is: a. During the startup phase of virtual machine 2, a secure memory allocation request is sent to virtual machine monitor 3 to request the allocation of a certain amount of secure memory. Based on the secure memory allocation request, the secure partition module 4 of virtual machine monitor 3 adds a certain amount of host secure memory and virtual machine secure memory mapping to the GPA-HPM mapping table.

[0027] Typically, a host can create multiple virtual machines 2, and the virtual machine security memory of each virtual machine 2 corresponds to a portion of the host security memory.

[0028] b. During the shutdown phase of virtual machine 2, a safe memory reclamation request is initiated to virtual machine monitor 3. The virtual machine monitor is responsible for clearing and reclaiming the safe memory. The reclaimed safe memory is recorded as free in the virtual machine monitor.

[0029] c. Provide a system call interface to the virtual machine user layer: hyp_cache_call(), which is used to allocate virtual machine secure memory for specific application processes.

[0030] The virtual machine security cache module 5 is initialized together with the virtual machine operating system kernel. After the virtual machine 2 starts, it will directly access and manage the virtual machine security memory, and at the same time respond to requests from the virtual machine 2 user layer, and be responsible for allocating security memory to user processes for use.

[0031] 4) During the virtual machine 2 runtime phase, the user's application process calls the system interface: hyp_cache_call() to request the allocation of a certain amount of virtual machine secure memory and stores the confidential data that actually needs to be protected in the virtual machine secure memory. Since the virtual machine secure memory is isolated and protected in LLC cache, it can effectively defend against side-channel attacks.

[0032] 5) When the user's application process is completed, the system interface: hyp_cache_call() is called again. The confidential data in the secure memory will be cleared until it is used again.

[0033] Specifically, the device for resisting side-channel attacks includes a physical host 1, a virtual machine monitor 3 deployed on the physical host 1, and a virtual machine 2 created and managed by the virtual machine monitor 3. The virtual machine monitor 3 has the aforementioned security partition module 4, and the operating system kernel of the virtual machine includes the aforementioned virtual machine security cache module 5.

[0034] The virtual machine 2, which is resistant to side-channel attacks, is implemented using the virtual machine construction method described above. It is created with virtual machine ordinary memory and virtual machine secure memory, and its operating system has a virtual machine secure cache module 5.

[0035] The principle behind the security of the LLC cache's secure zone is that it is isolated from the normal zone. Any attack requires an entry point, and for LLC caches, this entry point is the network. Generally, network-connected software caches its data in the normal zone, which is isolated from the secure zone. Therefore, even if an attacker attacks the LLC cache via the network, they cannot directly access the data in the secure zone. This security involves two layers. First, from the attacker's perspective, they see a target machine and are unaware of cache isolation. The normal zone is considered the final attack location, thus ensuring the security of the data in the secure zone. Second, the division between the normal and secure zones adds another layer of protection. For any attack, each additional layer requires overcoming a new barrier, significantly increasing the difficulty and thus enhancing the security of the data in the secure zone. Moreover, the division between the LLC cache's normal and secure zones is supported by underlying hardware; the defense between them is guaranteed by hardware circuitry, and software cannot cross this line. Theoretically, breaching this barrier requires physical possession of the target machine. From this perspective, it achieves a very strong resistance to attacks.

[0036] The security of virtual machine secure memory stems from its correspondence to host secure memory, which in turn maps to a secure region within the LLC cache. Throughout system operation, data in this memory is isolated and protected within the LLC. This solution divides the LLC cache into a normal region and a secure region, and adds a security partition module 4 to the virtual machine monitor 3 and a virtual machine secure cache module 5 to the virtual machine 2 operating system. These two new modules ensure that the specified application process data of the virtual machine user is cached in the isolated and protected secure region, effectively resisting side-channel attacks on virtual machine 2 that exploit the LLC cache.

[0037] The specific embodiments described herein are merely illustrative of the spirit of the invention. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to substitute them, without departing from the spirit of the invention or exceeding the scope defined by the appended claims.

[0038] Although this document frequently uses terms such as physical host 1, virtual machine 2, virtual machine monitor 3, security partition module 4, and virtual machine security cache module 5, the possibility of using other terms is not excluded. These terms are used merely for the convenience of describing and explaining the essence of this invention; interpreting them as any additional limitation would contradict the spirit of this invention.

Claims

1. A method for constructing a virtual machine resistant to side-channel attacks, characterized in that, The method includes: The physical host's virtual machine monitor is configured with a security partition module, and the virtual machine operating system is configured with a virtual machine security cache module; The security partition module is configured as follows: The physical host's third-level cache is statically divided into mutually isolated normal areas and secure areas; During the physical host system startup process, a contiguous block of physical memory is reserved as host secure memory, and the host secure memory is forcibly mapped to the secure region so that the data in the host secure memory is loaded into the secure region cache. Based on the virtual machine startup request, a certain amount of host-secure memory is allocated to the virtual machine to create virtual machine-secure memory for the virtual machine. The virtual machine security caching module is configured as follows: Access and manage the virtual machine secure memory, respond to security resource allocation requests from application processes in the virtual machine user layer, allocate virtual machine secure memory to the corresponding application processes, so that the relevant data of the application processes are loaded into the secure area cache.

2. The virtual machine construction method for resisting side-channel attacks according to claim 1, characterized in that, The host secure memory is forced to correspond to the secure zone in the following manner: The masks corresponding to the normal area and the security area are obtained through the interfaces provided by the hardware mechanism. Write the mask of the security region into the registers specified by the hardware mechanism within the currently running CPU core; The CPU executes read instructions on the preset host secure memory and continues to execute them until all of the host secure memory is read, so that the CPU forces the data of the host secure memory to be cached in the secure area according to the mask; Based on cache consistency, during subsequent system operation, any CPU core's read and write operations on data within the host secure memory address range are fixedly cached in the secure region, thereby establishing a mandatory correspondence between the host secure memory and the secure region.

3. The virtual machine construction method for resisting side-channel attacks according to claim 1, characterized in that, During the process of creating memory for the virtual machine, a certain amount of host-secure memory and virtual machine-secure memory is added to the physical memory address translation table between the physical host and the virtual machine, and the certain amount of host-secure memory is allocated to the virtual machine to create virtual machine-secure memory for the virtual machine.

4. The virtual machine construction method for resisting side-channel attacks according to claim 3, characterized in that, The virtual machine security caching module is configured as follows: During the virtual machine startup phase, a secure memory allocation request is initiated so that the secure partition module adds a certain amount of host secure memory and virtual machine secure memory mapping to the physical memory address translation mapping table. During the virtual machine shutdown phase, a secure memory reclamation request is initiated so that the secure partition module removes the mapping relationship corresponding to the virtual machine secure memory in the physical memory address translation mapping table.

5. The virtual machine construction method for resisting side-channel attacks according to claim 4, characterized in that, The virtual machine security cache module is configured to provide a system call interface to virtual machine users to respond to the security resource allocation request of the application process and allocate virtual machine security memory to the corresponding application process.

6. The virtual machine construction method for resisting side-channel attacks according to claim 5, characterized in that, During the virtual machine runtime phase, the application process requests a corresponding amount of virtual machine secure memory from the virtual machine secure cache module through the system call interface in order to store the confidential data that needs to be protected in the virtual machine secure memory.

7. The virtual machine construction method for resisting side-channel attacks according to claim 6, characterized in that, After the application process ends, the system call interface triggers the virtual machine security cache module to clear and release the confidential data in the virtual machine security memory based on the run termination instruction.

8. The virtual machine construction method for resisting side-channel attacks according to claim 1, characterized in that, The virtual machine security cache module is deployed in the virtual machine operating system kernel and is initialized synchronously with the virtual machine operating system kernel during the virtual machine startup process; After the virtual machine has started, the virtual machine security cache module accesses and manages the virtual machine security memory and responds to security resource allocation requests from the application process.

9. A device for resisting side-channel attacks, comprising a physical host, a virtual machine monitor deployed on the physical host, and virtual machines created and managed by the virtual machine monitor, characterized in that, The virtual machine monitor has a security partitioning module, and the operating system kernel of the virtual machine includes a virtual machine security cache module; The security partition module is configured as follows: The physical host's third-level cache is statically divided into mutually isolated normal areas and secure areas; During the physical host system startup process, a contiguous block of physical memory is reserved as host secure memory, and the host secure memory is forcibly mapped to the secure region so that the data in the host secure memory is loaded into the secure region cache. Based on the virtual machine startup request, a certain amount of host-secure memory is allocated to the virtual machine to create virtual machine-secure memory for the virtual machine. The virtual machine security caching module is configured as follows: Access and manage the virtual machine secure memory, respond to security resource allocation requests from application processes in the virtual machine user layer, allocate virtual machine secure memory to the corresponding application processes, so that the relevant data of the application processes are loaded into the secure area cache.

10. A virtual machine resistant to side-channel attacks, characterized in that, The virtual machine is created with virtual machine ordinary memory and virtual machine secure memory, and the operating system kernel includes a virtual machine secure cache module; The virtual machine secure memory is created by the physical host's security partition module in the following way: During the physical host system startup process, a contiguous block of physical memory is reserved as host secure memory, and the host secure memory is forcibly mapped to a secure zone so that the data in the host secure memory is loaded into the secure zone cache. Based on the virtual machine startup request, a certain amount of host-secure memory is allocated to the virtual machine to create virtual machine-secure memory for the virtual machine. The security zone is one of two mutually isolated zones into which the third-level cache of the physical host is divided; The virtual machine security cache module is used to access and manage the virtual machine security memory, respond to security resource allocation requests from application processes in the virtual machine user layer, and allocate virtual machine security memory to the corresponding application processes so that the relevant data of the application processes are loaded into the security area cache.

Images