A memory address space isolation method and system for a cloud computing environment

Abstract

The application discloses a memory address space isolation method and system of a cloud computing environment and belongs to the technical field of cloud computing virtual machines. In the application, a virtual machine manager constructs a two-level mapping page table, through the mapping, the virtual machine manager can manage the address space permission accessible by the physical machine kernel, and prevents the physical machine from randomly accessing the address space of the virtual machine; when a virtual machine is started, the virtual machine manager constructs a two-level mapping page table for the virtual machine, and unmapping the physical address required by the virtual machine in the two-level mapping page table of the physical machine, so as to isolate the address space between the physical machine and the virtual machine; in the application, the physical machine and the virtual machine both need to pass through the page table maintained by the virtual machine manager to realize the mapping from the virtual physical address to the real physical address, therefore, the physical machine cannot randomly access the memory address space of the virtual machine, and the virtual machines cannot cross access the memory address space of each other.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of cloud computing virtual machines, and more particularly relates to a memory address space isolation method and system for a cloud computing environment. BACKGROUND

[0002] With the development of virtualization-related technologies, the current cloud computing environment has a situation of cross use of two service forms of physical machines and virtual machines. However, the traditional memory virtualization architecture has a congenital security defect, that is, the physical machine kernel can access the entire memory space of the virtual machine, which is the main reason for the tampering or leakage of sensitive data in the virtual machine. Therefore, in the face of the risk problem of leakage of key sensitive data when the physical machine and the virtual machine share access to the memory in the cloud computing environment, how to design an effective memory address space isolation method is crucial.

[0003] The existing virtual machine memory address space isolation focuses on identifying attacks and avoiding attacks through real-time monitoring, or giving access permission through address comparison. That is, the existing conventional memory virtualization is only to build two-level mapping pages for the virtual machine, while the physical machine can directly access the entire memory address space, resulting in the risk of leakage and tampering of sensitive data in the virtual machine. SUMMARY

[0004] In view of the above defects or improvement needs of the prior art, the present application provides a memory address space isolation method and system for a cloud computing environment, which aims to solve the problem that the physical machine can access the entire memory address space of the virtual machine in the traditional memory virtualization mode, which may cause sensitive data in the virtual machine to be tampered with or leaked, affecting the memory data security of the cloud computing environment.

[0005] To achieve the above-mentioned purpose, in a first aspect, the present application provides a memory address space isolation method for a cloud computing environment, which comprises: a virtual machine manager builds two-level mapping page tables for a physical machine, in the first-level mapping page table, the virtual address of the physical machine is mapped to the virtual physical address of the physical machine, and in the second-level mapping page table, the virtual physical address of the physical machine is mapped to the real physical address of the physical machine; through initialization mapping, the virtual machine manager has the permission to manage the access of the physical machine kernel to the memory address space.

[0006] If a virtual machine is started, the virtual machine manager builds two-level mapping page tables for the virtual machine, in the first-level mapping page table, the virtual address of the virtual machine is mapped to the virtual physical address of the virtual machine, and in the second-level mapping page table, the virtual physical address of the virtual machine is mapped to the real physical address of the virtual machine; and the real physical address required by the virtual machine is unmapped in the two-level mapping page tables of the physical machine.

[0007] Preferably, the two-level mapping page tables of the physical machine are as follows:

[0008]

[0009] in, and These represent the first-level and second-level mapping page tables of the physical machine, respectively. Represents the virtual address space of the physical machine virtual physical address The mapping relationship; Represents the virtual physical address of the physical machine Real physical address The mapping relationship;

[0010] After the virtual machine starts, the two-level mapping page table of the virtual machine is as follows:

[0011] ( )

[0012] in, and They represent virtual machines. i The first-level mapping page table and the second-level mapping page table; Represents virtual machine i virtual address space virtual physical address The mapping relationship; Represents virtual machine i virtual physical address Real physical address The mapping relationship; The total number of virtual machines launched;

[0013] After the virtual machine starts, the two-level mapping page table of the physical machine is as follows:

[0014]

[0015] in, for inverse function, for The inverse function of .

[0016] Preferably, the virtual machine's memory address space is divided into sensitive and non-sensitive areas, and the virtual machine manager maps the non-sensitive memory of the virtual machine to the virtual address space of the physical machine.

[0017] Preferably, after mapping the non-sensitive memory area of ​​the virtual machine to the virtual address space of the physical machine, the two-level mapping page table of the physical machine is as follows:

[0018]

[0019] in, f is the inverse function of f is the inverse function of f is the inverse function of f is the inverse function of represents the mapping relationship of the virtual address space of the physical machine to the virtual physical address represents the mapping relationship of the virtual physical address of the physical machine to the real physical address represents the mapping relationship of the virtual physical address of the physical machine to the real physical address represents the mapping relationship of the virtual physical address of the physical machine to the real physical address represents the mapping relationship of the virtual physical address of the physical machine to the real physical address represents the mapping relationship of the virtual physical address of the physical machine to the real physical address represents the accessible memory address space of the physical machine represents the non-sensitive area memory space of the virtual machine i represents the non-sensitive area memory space of the virtual machine

[0020] Preferably, the real physical address space of the physical machine and the sensitive area real physical address space of the virtual machine have no intersection:

[0021]

[0022] wherein, represents the sensitive area address space of the virtual machine i represents the sensitive area address space of the virtual machine is the total number of virtual machines started.

[0023] Preferably, if the real physical address space of the virtual machine is to be dynamically adjusted, the virtual machine manager adjusts the page table information corresponding to the real physical address space in the mapping page table of the virtual machine and the physical machine; if the real physical address space of the virtual machine increases, the real physical address space of the physical machine decreases by a corresponding space; if the real physical address space of the virtual machine decreases, the real physical address space of the physical machine increases by a corresponding space.

[0024] Preferably, the virtual machine manager manages the access permission of the real physical address space in the granularity of each page of the mapping page table.

[0025] Preferably, when the real physical address space of the virtual machine is dynamically adjusted,

[0026] The two-level mapping page table of the virtual machine is as follows:

[0027] ( ))

[0028] wherein, f is the inverse function of f is the inverse function of f is the inverse function of f is the inverse function of represents the mapping relationship of the virtual address space of the virtual machine to the virtual physical address represents the mapping relationship of the virtual physical address of the virtual machine to the real physical address represents the mapping relationship of the virtual physical address of the virtual machine to the real physical address represents the mapping relationship of the virtual physical address of the virtual machine to the real physical address to real physical address mapping relationship; representing virtual machine i real physical address space; representing a page of memory space mapping page table; representing virtual machine i the minimum memory unit number of adjustment;

[0029] The two-level mapping page table of the physical machine is as follows:

[0030] ( )

[0031] wherein, is the inverse function of , is the inverse function of ; representing the virtual address space of the physical machine mapping relationship to virtual physical address ; representing the virtual physical address of the physical machine mapping relationship to real physical address ; representing the accessible memory address space of the physical machine; is the total number of virtual machines started.

[0032] Preferably, if the virtual machine needs to be closed or deleted, the virtual machine manager recycles the real physical address space of the virtual machine and remaps the recycled real physical address space to the mapping page table of the physical machine for the physical machine to access.

[0033] In the second aspect, the application provides a memory address space isolation system of a cloud computing environment, the system comprising:

[0034] a mapping page table construction unit for controlling the virtual machine manager to construct a two-level mapping page table for the physical machine, in the first-level mapping page table, the virtual address of the physical machine is mapped to the virtual physical address of the physical machine, in the second-level mapping page table, the virtual physical address of the physical machine is mapped to the real physical address of the physical machine; through the initialization mapping, the virtual machine manager has the permission to manage the kernel of the physical machine to access the memory address space;

[0035] a mapping page table adjustment unit for judging, if a virtual machine is started, the virtual machine manager constructs a two-level mapping page table for the virtual machine, in the first-level mapping page table, the virtual address of the virtual machine is mapped to the virtual physical address of the virtual machine, in the second-level mapping page table, the virtual physical address of the virtual machine is mapped to the real physical address of the virtual machine; and the real physical address required by the virtual machine is unmapped in the two-level mapping page table of the physical machine.

[0036] Compared with the prior art, the above technical solutions conceived by the present application have the following beneficial effects in general:

[0037] (1) In the present application, both the physical machine and the virtual machine need to pass through the two-level mapping page table maintained by the virtual machine manager to realize the mapping from the virtual physical address to the real physical address, so that the physical machine cannot access the memory address space of the virtual machine at will, and the virtual machines cannot cross-access each other's memory address space; in addition, the present application also ensures the complete mapping of the entire memory space address, that is, all are included in the management range of the virtual machine manager, preventing malicious programs from attacking the memory address space;

[0038] (2) In the present application, the memory address space of the virtual machine is divided into a sensitive area and a non-sensitive area, and the virtual machine manager adjusts the mapping page table of the virtual machine and the physical machine to realize that the physical machine cannot access the sensitive area address space of the virtual machine, while the virtual machine and the physical machine can jointly access the non-sensitive area address space, which can solve the problem that in the traditional memory virtualization mode, the physical machine accesses all the memory space of the virtual machine, thereby causing the sensitive data of the virtual machine to be leaked, and the data communication efficiency is improved through the access of the physical machine to the non-sensitive address space of the virtual machine;

[0039] (3) In the present application, the virtual machine manager can dynamically adjust the page table information corresponding to the real physical address space, and manage the access permission of the real physical address space with the granularity of each page of the page table memory space, realizing fine-grained memory address space isolation and improving the flexibility of memory address space access;

[0040] (4) In the present application, after the virtual machine is closed or deleted, the memory address space is recycled by the virtual machine manager, and the recycled memory address space is added to the mapping page table of the physical machine for the physical machine to access, which improves the memory utilization. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 is the mapping of the memory address space of the physical machine in the embodiment of the present application.

[0042] Figure 2 is the mapping of the memory address space after starting one virtual machine in the embodiment of the present application.

[0043] Figure 3 is the mapping of the memory address space after starting multiple virtual machines in the embodiment of the present application.

[0044] Figure 4 is the mapping of the memory address space of the physical machine and the virtual machine (divided into a sensitive area and a non-sensitive area) in the embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the present application more clear, the present application is further described in detail below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application and do not limit the present application.

[0046] In the description of the embodiments of the present application, unless otherwise specified, the meaning of "a plurality of" is two or more, for example, a plurality of processing units means two or more processing units, and the like; a plurality of elements means two or more elements, and the like.

[0047] Next, the technical solutions of the present application are introduced in the form of examples. The present application embodiment is a memory address space isolation method for a cloud computing environment, specifically including the following steps:

[0048] (1) Based on a two-level page table mapping mechanism, the virtual machine manager initializes the two-level mapping page table of the physical machine in the EL2 privilege level and By initializing the mapping, the virtual machine manager can manage the address space permissions of the physical machine kernel accessible memory, i.e. the physical machine can access the entire memory space at initialization , as shown in Figure 1 .

[0049] Specifically, the two-level mapping page table of the physical machine initialization and As follows:

[0050]

[0051] Among them, is the initialization virtual address space of the physical machine, is the initialization physical address space of the physical machine (referred to as virtual physical address in the present application), is the memory machine address space of the physical machine initialization (referred to as real physical address in the present application), at initialization , the memory address space accessible by the physical machine, the entire memory address space;

[0052] Indicates the first level mapping page table of the physical machine, i.e. the mapping of the virtual address to the virtual physical address, and the mapping table is maintained by the operating system of the physical machine and the virtual machine respectively, and the first level mapping of the virtual machine and the physical machine is completed by the function;

[0053] a second level mapping page table of the physical machine, i.e. implementing mapping of virtual physical addresses to real physical addresses of the physical machine, which is maintained by the virtual machine manager;

[0054] The advantage of this step is that by treating the physical machine the same as the virtual machine, the virtual machine manager builds a two-level mapping page table for the physical machine, completing the two-level mapping of the physical machine virtual address to the virtual physical address (first level mapping) and the virtual physical address to the real physical address (second level mapping). In this way, since the second level mapping page table is maintained by the virtual machine manager, the physical machine kernel cannot directly access the memory space, thereby protecting the safety of the memory address space.

[0055] (2) When starting the virtual machine , the virtual machine manager builds a two-level mapping page table for the virtual machine at the EL2 privilege level and , and unmapping all real physical addresses needed to start the virtual machine in the two-level mapping page table of the physical machine, as shown in , and Figure 2 , and Figure 3 ; Figure 2 is the mapping of the memory address space after starting 1 virtual machine; Figure 3 is the mapping of the memory address space after starting multiple virtual machines;

[0056] Specifically, the two-level mapping page tables of the physical machine and the virtual machine are as follows:

[0057] ( )

[0058]

[0059] Among them, represents the first level mapping page table of the virtual machine, i.e. implementing mapping of the virtual address space of the virtual machine to the virtual physical address ;

[0060] represents the second level mapping page table of the virtual machine, i.e. implementing mapping of the virtual physical address of the virtual machine to the real physical address , which is maintained by the virtual machine manager.

[0061] is the inverse function of , and is the inverse function of , implementing mapping of the real physical address of the physical machine to the virtual physical address.​

[0062] Among them, the physical addresses accessible by the physical machine and each virtual machine Accessible physical address The following relationship exists between them:

[0063]

[0064] Each virtual machine Accessible physical address The following relationship exists between them:

[0065]

[0066] Therefore, since there is no overlap between the physical machine's physical address and the physical addresses of each virtual machine, as well as between the physical addresses of each virtual machine, memory address space isolation can be achieved between the physical machine and the virtual machines, and between the virtual machines.

[0067] (3) If the virtual machine needs to protect sensitive data from being accessed by the physical machine and other virtual machines, the virtual machine can be... ( The memory address space is divided into sensitive areas. Non-sensitive areas If non-sensitive areas Access can be granted to the physical machine. In this case, the virtual machine manager, at the EL2 privilege level, maps the virtual machine's non-sensitive memory area to the physical machine's virtual address space, thus enabling both the physical machine and the virtual machine to share access to the virtual machine's non-sensitive memory area. Figure 4 As shown.

[0068] Specifically, the two-level mapping page table of the physical machine in this process is as follows:

[0069]

[0070] in, for The inverse function; for The inverse function; at this point, the accessible physical address of the physical machine is: ;

[0071] Therefore, through a two-level inverse function mapping, the physical machine can map to the virtual machine. Non-sensitive memory space This means that both the virtual machine and the physical machine can access the physical address space corresponding to this part of the page table.

[0072] (4) Physical machine accessing virtual machine ( Sensitive area address space When this happens, because the physical machine's mapped page table in the virtual machine manager does not contain a corresponding mapped page table for the sensitive area address space, the memory management unit will generate an access error and prevent the physical machine from accessing the virtual machine's sensitive area memory space. At this point, the physical machine's physical address space... The physical address space of the sensitive area of ​​the virtual machine must satisfy the following conditions:

[0073]

[0074] (5) After starting the virtual machine, if you need to dynamically adjust the first... virtual machines ( The accessible physical address space can be dynamically adjusted by the virtual machine manager in the page table mapping between the virtual machine and the physical machine, and the page table information corresponding to the physical address space can be adjusted according to the memory space of each page of the page table. It enables granular access control of the physical address space, achieving fine-grained memory address space isolation and improving the flexibility of memory address space access.

[0075] Specifically, this process involves both physical machines and virtual machines. The two-level mapping page table is as follows:

[0076] ( ))

[0077] ( ))

[0078] in, A page of memory space represents the page table, which is the smallest unit of memory accessible by the page table in the memory address space. Representing the i virtual machines The minimum number of memory units to be adjusted means that when the virtual machine increases its accessible physical address space, the physical machine needs to reduce its physical address space by the same amount, and vice versa. After adjustment by the virtual machine manager, the physical addresses of the virtual machine and the physical addresses of the physical machine always satisfy the following relationship:

[0079] =

[0080] (6) When closing or deleting the first i virtual machines At that time, the virtual machine manager reclaims the virtual machine at the EL2 privilege level. The address space is then reclaimed and remapped into the physical machine's page tables for use by the physical machine. This process involves the physical machine's two-level page tables, as follows:

[0081]

[0082] The advantage of this step is that the memory address space of the virtual machine is recycled in time, the whole memory address is always in the effective management range of the virtual machine manager, and the resource utilization efficiency is improved.

[0083] The application also realizes a memory address space isolation system for a cloud computing environment.

[0084] It should be understood that the above system is used to execute the method in the above embodiment, the corresponding unit in the system, the implementation principle and technical effect are similar to the description in the above method, and the working process of the system can refer to the corresponding process in the above method, which will not be described here.

[0085] It can be understood that various numerical numbers involved in the embodiments of the present application are only for convenient differentiation, and are not used to limit the scope of the embodiments of the present application.

[0086] The above is easily understood by those skilled in the art, and the above is only the preferred embodiment of the present application, and is not used to limit the present application, any modification, equivalent replacement and improvement within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for memory address space isolation of a cloud computing environment, comprising: The method comprises: The virtual machine manager builds two-level mapping page tables for the physical machine, in the first-level mapping page table, the virtual address of the physical machine is mapped to the virtual physical address of the physical machine, in the second-level mapping page table, the virtual physical address of the physical machine is mapped to the real physical address of the physical machine; through the initialization mapping, the virtual machine manager has the permission to manage the memory address space accessed by the kernel of the physical machine; If the virtual machine is started, the virtual machine manager builds two-level mapping page tables for the virtual machine, in the first-level mapping page table, the virtual address of the virtual machine is mapped to the virtual physical address of the virtual machine, in the second-level mapping page table, the virtual physical address of the virtual machine is mapped to the real physical address of the virtual machine; and the real physical address required by the virtual machine is unmapped in the two-level mapping page tables of the physical machine; The two-level mapping page tables of the physical machine are as follows: wherein, and denote a first level mapping page table and a second level mapping page table of the physical machine, respectively; denotes a virtual address space of the physical machine to a virtual physical address ; and denotes a mapping relationship of a virtual physical address to a real physical address of the physical machine. After the virtual machine is started, the two-level mapping page tables of the virtual machine are as follows: ( ) wherein, and denote a first level mapping page table and a second level mapping page table of a virtual machine i respectively; denote a mapping relationship from a virtual address space i of a virtual machine to a virtual-physical address ; denote a mapping relationship from a virtual-physical address i of a virtual machine to a real-physical address ; is the total number of virtual machines started. After the virtual machine is started, the two-level mapping page tables of the physical machine are as follows: wherein is the inverse function of is the inverse function of is the inverse function of is the inverse function of The memory address space of the virtual machine is divided into a sensitive area and a non-sensitive area, the virtual machine manager maps the non-sensitive area memory of the virtual machine to the virtual address space of the physical machine, and the physical machine cannot access the address space of the sensitive area of the virtual machine.

2. The method of claim 1, wherein, After the non-sensitive area memory of the virtual machine is mapped to the virtual address space of the physical machine, the two-level mapping page tables of the physical machine are as follows: wherein, is the inverse function of is the inverse function of represents the mapping relationship from the virtual address space of the physical machine to the virtual-physical address represents the mapping relationship from the virtual-physical address space of the physical machine to the real-physical address represents the accessible memory address space of the physical machine; represents the non-sensitive area memory space of the virtual machine i .​​​​ 3. The method of claim 2, wherein, The real physical address space of the physical machine and the sensitive area real physical address space of the virtual machine have no intersection: wherein, represents a sensitive zone address space of a virtual machine i is the total number of virtual machines to be started.​ 4. The method of claim 1, wherein, If the real physical address space of the virtual machine is to be dynamically adjusted, the virtual machine manager adjusts the page table information corresponding to the real physical address space in the mapping page tables of the virtual machine and the physical machine; if the real physical address space of the virtual machine increases, the real physical address space of the physical machine decreases by a corresponding space; if the real physical address space of the virtual machine decreases, the real physical address space of the physical machine increases by a corresponding space.

5. The method of claim 4, wherein, The virtual machine manager manages the access permission of the real physical address space in the granularity of each page memory space of the mapping page table.

6. The method of claim 5, wherein, When the real physical address space of the virtual machine is dynamically adjusted, The two-level mapping page tables of the virtual machine are as follows: ( )) wherein, is the inverse function of ; is the inverse function of ; represents a virtual address space of a virtual machine to a real physical address ; represents a virtual physical address space of a virtual machine to a real physical address ; represents a real physical address space of a virtual machine i ; represents a page of memory space mapping a page table; represents a minimum memory unit number of a virtual machine i adjustment; The two-level mapping page tables of the physical machine are as follows: ( )) wherein, is the inverse function of is the inverse function of represents a virtual address space of a physical machine represents a mapping relationship from a virtual physical address to a real physical address represents a mapping relationship from a virtual physical address to a real physical address represents an accessible memory address space of a physical machine is the total number of started virtual machines.​​​ 7. The method of claim 1, wherein, If the virtual machine needs to be closed or deleted, the virtual machine manager recycles the real physical address space of the virtual machine, and remaps the recycled real physical address space to the mapping page table of the physical machine for the physical machine to access.

8. A memory address space isolation system for a cloud computing environment, comprising: The system comprises: A mapping page table building unit is configured to control the virtual machine manager to build two-level mapping page tables for the physical machine, in the first-level mapping page table, the virtual address of the physical machine is mapped to the virtual physical address of the physical machine, in the second-level mapping page table, the virtual physical address of the physical machine is mapped to the real physical address of the physical machine; through the initialization mapping, the virtual machine manager has the permission to manage the memory address space accessed by the kernel of the physical machine; A mapping page table adjusting unit is configured to judge, if the virtual machine is started, the virtual machine manager builds two-level mapping page tables for the virtual machine, in the first-level mapping page table, the virtual address of the virtual machine is mapped to the virtual physical address of the virtual machine, in the second-level mapping page table, the virtual physical address of the virtual machine is mapped to the real physical address of the virtual machine; and the real physical address required by the virtual machine is unmapped in the two-level mapping page tables of the physical machine; The two-level mapping page table of the physical machine is as follows: wherein, and respectively represent a first level mapping page table and a second level mapping page table of the physical machine; represents a virtual address space of the physical machine to a virtual physical address mapping relationship; represents a virtual physical address of the physical machine to a real physical address mapping relationship; After starting the virtual machine, the two-level mapping page table of the virtual machine is as follows: ( ) in, and They represent virtual machines. i The first-level mapping page table and the second-level mapping page table; Represents virtual machine i virtual address space virtual physical address The mapping relationship; Represents virtual machine i virtual physical address Real physical address The mapping relationship; The total number of virtual machines launched; After starting the virtual machine, the two-level mapping page table of the physical machine is as follows: wherein is the inverse function of is the inverse function of The memory address space of the virtual machine is divided into a sensitive area and a non-sensitive area, and the virtual machine manager maps the non-sensitive area memory of the virtual machine to the virtual address space of the physical machine, and the physical machine cannot access the sensitive area address space of the virtual machine.

Images