A defense method, device and medium against cross-domain attacks of a virtual machine manager

Abstract

The application discloses a defense method, device and medium against cross-domain attacks of a virtual machine manager. The method is against cross-domain attacks existing in the virtual machine manager, that is, an attack method of directly obtaining or indirectly utilizing a virtual address of a guest in a host memory space, thereby breaking a memory boundary between the host and the guest. The method is through a pointer encryption verification method, avoids directly exposing a guest memory address in a host memory space, and strengthens memory isolation between the host and the guest. The method can effectively resist cross-domain attacks with extremely small overhead, and can maintain normal work of the virtual machine manager when suffering from attacks of malicious guests, can guarantee running efficiency, and can provide sufficient security defense capability.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of network security, and particularly relates to a defense method, device and medium against cross-domain attacks on a virtual machine manager. BACKGROUND

[0002] In today's computer field, virtualization technology has been widely used in data centers, cloud computing, test environments and other scenarios, and these application scenarios also put higher requirements on the security of virtualization technology, so the security of virtualization technology is highly valued by manufacturers and developers. The hypervisor, as the core component of virtualization technology, is a high-value target for attackers. Attackers can use vulnerabilities in the hypervisor to gain control of the host computer on the guest computer side, thereby stealing sensitive data or destroying the entire cloud environment, i.e. virtual machine escape. Therefore, among the numerous hypervisor vulnerabilities discovered each year, vulnerabilities that can be exploited and constructed into exploit code are often the target of attackers.

[0003] In the context of hypervisor exploit, there is an efficient exploitation method - cross-domain attack. This attack can bypass various modern protection measures (address randomization, etc.) in a harsh scenario by exploiting the weakness of host and guest memory isolation introduced by DMA address mapping in the hypervisor, using the guest memory space as an exploitation primitive, to maliciously invade the target hypervisor and cause great security risks.

[0004] The present application proposes a defense method against cross-domain attacks on a virtual machine manager, the main idea of which is to use pointer encryption to store the guest memory address in the host memory space in ciphertext form, and to perform instantaneous decryption when performing DMA data transmission to effectively hide the address information. As a result, the attacker cannot directly obtain the guest memory address, nor can he indirectly use the guest memory pointer to forge malicious attack payloads, effectively defending against attacks. SUMMARY

[0005] The present application aims to defend against cross-domain attacks on a virtual machine manager, i.e. attacks that directly obtain or indirectly use the virtual address of the guest in the host memory space, thereby breaking the memory boundary between the host and the guest. The present application provides a defense method, device and medium against cross-domain attacks on a virtual machine manager, which uses pointer encryption verification to avoid direct exposure of the guest memory address in the host memory space and strengthens the memory isolation between the host and the guest.

[0006] The purpose of the present application is achieved by the following technical solution: a defense method against cross-domain attacks on a virtual machine manager, comprising the following steps:

[0007] (1) At the start of the virtual machine manager, initialize the pointer encryption key;

[0008] (2) Initialize a timing task to update the pointer encryption key in step (1) in time, and maintain a management chain table to re-encrypt all encrypted pointers managed in the management chain table;

[0009] (3) When performing DMA address mapping, use the latest updated key to encrypt the mapping address to obtain an encrypted pointer; and after the encrypted pointer is stored in the memory, the memory address is inserted as a node into the management list in step (2);

[0010] (4) When performing DMA data transmission, use the latest updated key to decrypt the encrypted pointer and then perform data transmission; verify the legality of the pointer while decrypting, and if it is illegal, cancel the data transmission action, otherwise proceed normally;

[0011] (5) When performing DMA address demapping, use the latest updated key to decrypt the encrypted pointer, and remove the node inserted in step (3) after completing address mapping from the management chain table; verify the legality of the pointer while decrypting, and if it is illegal, cancel the demapping operation, otherwise proceed normally.

[0012] Further, the key is a random number equal in length to the machine word length.

[0013] Further, when performing DMA address mapping, the key in step (1) is used to encrypt the mapping address, and the encryption algorithm used is a symmetric encryption algorithm.

[0014] A defense device against cross-domain attacks of a virtual machine manager, comprising one or more processors for implementing the above-mentioned defense method against cross-domain attacks of a virtual machine manager.

[0015] A computer-readable storage medium having a program stored thereon, which, when executed by a processor, is used to implement the above-mentioned defense method against cross-domain attacks of a virtual machine manager.

[0016] The present application has the following beneficial effects: the present application can effectively resist cross-domain attacks with minimal overhead, and maintain the normal operation of the virtual machine manager when attacked by malicious clients, ensuring running efficiency while providing sufficient security defense capability. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is the defense principle architecture diagram of the present application;

[0018] Figure 2 is a structural hardware diagram of the present application. DETAILED DESCRIPTION

[0019] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The description of the embodiments below refers to the accompanying drawings that show by way of example specific embodiments. Unless identified as otherwise, the same numbers in different drawings refer to the same or similar elements. The embodiments described in the following exemplary embodiments are not meant to represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0020] The present invention will be described in detail herein with reference to the attached drawings. The features of the embodiments and implementation described below can be combined with each other in the case of no conflict.

[0021] The present invention protects the DMA mapping address by encryption, prevents it from being directly exposed in the host memory space, cuts off the necessary conditions required for cross-domain attacks, realizes the security isolation between the host and the guest, and enables the virtual machine manager to effectively resist cross-domain attacks.

[0022] As shown in the figure, a defense method against cross-domain attacks of a virtual machine manager according to the present invention specifically includes the following steps: Figure 1

[0023] (1) When the virtual machine manager starts, initialize the pointer encryption key;

[0024] Obtain a random number (such as 8 bytes long for x86-64) as the key, which is equal in length to the machine word length; the way of obtaining the random number can be different due to the running environment of the virtual machine manager, and can be obtained through software or hardware.

[0025] (2) Initialize a timing task to update the pointer encryption key in step (1) in a timely manner, and maintain a management linked list to re-encrypt all encrypted pointers managed in the management linked list;

[0026] The timing task maintains two key structures:

[0027] a) The key is used for the encryption and decryption of the pointer.

[0028] b) The mapping pointer address (secondary pointer) that has been encrypted in the DMA mapping process can be maintained through a one-way linked list.

[0029] The timing task implements two key steps:

[0030] a) Dynamically update the pointer encryption key.

[0031] ​b) re-encrypt all the maintained mapping pointers (i.e. decrypt using the old key, then encrypt using the new key) before the key update action is completed

[0032] (3) When performing DMA address mapping, use the latest updated key to encrypt the mapping address to obtain an encrypted pointer; and after the encrypted pointer is stored in the memory (e.g. as a member of a structure, etc.), insert the memory address as a node into the management list in step (2);

[0033] Specifically, when performing DMA address mapping, use the latest updated key to encrypt the client address pointer obtained by mapping (the encryption algorithm can use any symmetric encryption algorithm, or can use simple encryption such as bitwise XOR, etc.), and then fill the encrypted ciphertext pointer into the corresponding position of the target structure. At the same time, insert the "corresponding position" as a node into the secondary pointer queue maintained by the timer task in (2).

[0034] (4) When performing DMA data transmission, use the latest updated key to decrypt the encrypted pointer and then perform data transmission; verify the legality of the pointer at the same time, and if it is illegal, cancel the data transmission action, otherwise proceed normally (i.e. complete the data transmission action);

[0035] Specifically, when performing DMA data transmission, two key operations are performed:

[0036] (4.1) Use the latest updated key to decrypt the pointer and verify whether it belongs to a legal client address space. If it is legal, perform subsequent operation (4.2); otherwise, abort the operation and return an error code.

[0037] (4.2) Use the decrypted pointer to perform normal data transmission action.

[0038] (5) When performing DMA address unmapping, use the latest updated key to decrypt the encrypted pointer, and remove the node inserted after completing address mapping in step (3) from the management chain table; verify the legality of the pointer at the same time, and if it is illegal, cancel the unmapping operation, otherwise proceed normally (i.e. complete the unmapping operation).

[0039] Specifically, when performing DMA address unmapping, three key operations are performed:

[0040] (a) Delete the node inserted in the queue maintained by the timer task in step (3).

[0041] (b) Perform the same decryption verification operation in step (4), and if it is legal, continue to perform operation (c); otherwise, abort and return an error code.

[0042] (c) Call the corresponding interface to perform the unmapping operation.

[0043] Corresponding to the foregoing embodiment of the method for defending against cross-domain attacks on a virtual machine manager, the application also provides an embodiment of a device for defending against cross-domain attacks on a virtual machine manager.

[0044] Referring to Figure 2 The device for defending against cross-domain attacks on a virtual machine manager provided by the embodiment of the application comprises one or more processors for implementing the method for defending against cross-domain attacks on a virtual machine manager in any of the foregoing embodiments.

[0045] The device for defending against cross-domain attacks on a virtual machine manager in the embodiment of the application can be applied to any device with data processing capability, which can be a device or apparatus such as a computer. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking the software implementation as an example, as a logically meaningful device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory for execution by the processor of the device with data processing capability where the device is located. From the hardware perspective, as shown in Figure 2 Fig. 1 is a hardware structure diagram of a device with data processing capability where the device for defending against cross-domain attacks on a virtual machine manager in the embodiment of the application is located. In addition to the processor, the memory, the network interface, and the non-volatile memory shown in Fig. 1, the device with data processing capability where the device in the embodiment is located usually also comprises other hardware according to the actual functions of the device with data processing capability, and thus no further description is given. Figure 2

[0046] The implementation processes of the functions and roles of the units in the device are specifically described in the implementation processes of the corresponding steps in the method, and thus no further description is given.

[0047] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts are described with reference to the parts of the method embodiment. The device embodiment described above is merely illustrative, and the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e., they can be located in one place or distributed on multiple network units. According to actual needs, some or all of the modules can be selected to achieve the purposes of the application scheme. Those skilled in the art can understand and implement without creative labor.

[0048] The embodiment of the application also provides a computer readable storage medium having a program stored thereon, and the program is executed by a processor to implement the method for defending against cross-domain attacks on a virtual machine manager in any of the foregoing embodiments.​

[0049] The computer readable storage medium can be an internal storage unit of any of the aforementioned data processing capable devices, such as a hard disk or a memory. The computer readable storage medium can also be any of the aforementioned data processing capable devices, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. Further, the computer readable storage medium can also include both an internal storage unit of any of the aforementioned data processing capable devices and an external storage device. The computer readable storage medium is used to store the computer program and other programs and data required by the aforementioned data processing capable devices, and can also be used to temporarily store data that has been output or will be output.

[0050] The above only describes the preferred embodiments of the present application and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0051] The above embodiments are only used to illustrate the design ideas and characteristics of the present application, and the purpose is to enable those skilled in the art to understand the content of the present application and implement it, and the protection scope of the present application is not limited to the above embodiments. Therefore, any equivalent change or modification made according to the disclosed principles and design ideas of the present application is within the protection scope of the present application.

[0052] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The specification and examples given are intended as illustrative only and not limiting of the present application. The application is to be limited only by the claims.

Claims

1. A defense method for cross-domain attacks on virtual machine managers, characterized in that: The steps include: (1) Initialize the pointer encryption key when the virtual machine manager starts; (2) Initialize a scheduled task to regularly update the pointer encryption key in step (1), and at the same time maintain a management linked list to re-encrypt all encrypted pointers managed in the management linked list; (3) When performing DMA address mapping, the mapping address is encrypted using the latest updated key to obtain an encrypted pointer; and after the encrypted pointer is stored in the memory, the memory address is inserted as a node into the management list in step (2); (4) When performing DMA data transmission, the encrypted pointer is decrypted using the latest updated key before data transmission; while decrypting, the legitimacy of the pointer is verified. If it is illegal, the data transmission action is canceled; otherwise, the data transmission is carried out normally; (5) When performing DMA address demapping, the encrypted pointer is decrypted using the latest updated key, and the node inserted after the address mapping in step (3) is removed from the management list; while decrypting, the legality of the pointer is verified. If it is illegal, the demapping operation is canceled, otherwise it proceeds normally.

2. A defense method for cross-domain attacks on virtual machine managers according to claim 1, characterized in that: The key is a random number that is equal to the machine word length.

3. A defense method against cross-domain attacks on virtual machine managers according to claim 1, characterized in that: When performing DMA address mapping, the mapping address is encrypted using the key in step (1), and the encryption algorithm used is a symmetric encryption algorithm.

4. A defense device for cross-domain attacks on virtual machine managers, characterized in that: The method comprises one or more processors, and is used to implement a defense method against cross-domain attacks on virtual machine managers according to any one of claims 1 to 3.

5. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, it is used to implement a defense method against cross-domain attacks on virtual machine managers according to any one of claims 1 to 3.

Images