Virtual machine security protection method and device and readable medium

Abstract

The invention provides a virtual machine security protection method, which is applied to security equipment, the security equipment receives a data processing request sent by a host machine, the data processing request is a request of a virtual machine for accessing a first virtual machine control structure VMCS page table, the virtual machine is deployed on the host machine, and the first VMCS page table is configured on the host machine; accessing a second VMCS page table according to the data processing request, wherein the second VMCS page table is a page table obtained by mapping the first VMCS page table by the security device; in the embodiment of the invention, the memory space of the host machine is completely isolated from the memory space of the security equipment, and the virtual machine substantially performs data access on the memory of the security equipment, so that attacks from the virtual machine and the host machine can be resisted, and security protection on the VMCS page table is realized. The disclosure also provides a security device and a readable medium.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a virtual machine security protection method, device and readable medium. Background Art

[0002] Virtualization is the technical cornerstone of cloud computing. In order to better support virtualization technology, the VMX (Virtual Machine Extension) function allows vCPU to run directly on the logical CPU. Among them, VMCS (Virtual Machine Control Structure) is a key data structure that records the status of vCPU. In this structure, the status parameters of the host and virtual machine are saved, and the transition of entering and exiting the virtual machine and the processor behavior are managed. Therefore, VMCS is key information that needs to be detected and protected. How to perform security protection for VMCS in the virtual machine scenario is an urgent problem to be solved. Summary of the invention

[0003] The present invention provides a virtual machine security protection method, device and readable medium.

[0004] In a first aspect, an embodiment of the present disclosure provides a virtual machine security protection method, the method being applied to a security device, the method comprising:

[0005] receiving a data processing request sent by a host machine, wherein the data processing request is a request for a virtual machine to access a first virtual machine control structure VMCS page table, wherein the virtual machine is deployed on the host machine and the first VMCS page table is configured on the host machine;

[0006] A second VMCS page table is accessed according to the data processing request, wherein the second VMCS page table is a page table obtained by mapping the first VMCS page table by the security device.

[0007] On the other hand, an embodiment of the present disclosure also provides a security device, comprising: one or more processors; a storage device, on which one or more programs are stored; when the one or more programs are executed by the one or more processors, the one or more processors implement the virtual machine security protection method as described above; one or more I / O interfaces, connected between the processor and the storage device, configured to implement information interaction between the processor and the storage device.

[0008] On the other hand, an embodiment of the present disclosure further provides a computer-readable medium having a computer program stored thereon, wherein the program, when executed, implements the virtual machine security protection method as described above.

[0009] The virtual machine security protection method provided by the embodiment of the present disclosure is applied to a security device, the security device receives a data processing request sent by a host machine, the data processing request is a request for the virtual machine to access a first virtual machine control structure VMCS page table, wherein the virtual machine is deployed on the host machine, and the first VMCS page table is configured on the host machine; according to the data processing request, a second VMCS page table is accessed, wherein the second VMCS page table is a page table obtained by mapping the first VMCS page table by the security device; in the embodiment of the present disclosure, the memory space of the host machine is completely isolated from the memory space of the security device, and the virtual machine actually accesses data to the memory of the security device, which can not only resist attacks from the virtual machine, but also resist attacks from the host machine, thereby realizing security protection of the VMCS page table. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 A schematic diagram of the system architecture of an embodiment of the present disclosure;

[0011] Figure 2 Schematic diagram of the virtual machine security protection process provided by the embodiment of the present disclosure Figure 1 ;

[0012] Figure 3 A schematic diagram of the principles of a virtual machine security protection method provided by an embodiment of the present disclosure;

[0013] Figure 4 A schematic diagram of the structure of a second VMCS page table provided in an embodiment of the present disclosure;

[0014] Figure 5 Schematic diagram of the virtual machine security protection process provided by the embodiment of the present disclosure Figure 2 ;

[0015] Figure 6 A schematic diagram of a process for performing error correction processing on a virtual machine provided in an embodiment of the present disclosure;

[0016] Figure 7 A schematic diagram of the structure of a security device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0017] Example embodiments will be described more fully below with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete and to enable those skilled in the art to fully understand the scope of the present disclosure.

[0018] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0019] The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a", "an" and "the" are also intended to include the plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "comprising" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof is not excluded.

[0020] The embodiments described herein may be described with reference to plan views and / or cross-sectional views by means of idealized schematic diagrams of the present disclosure. Therefore, the example illustrations may be modified according to manufacturing techniques and / or tolerances. Therefore, the embodiments are not limited to the embodiments shown in the accompanying drawings, but include modifications of the configurations formed based on the manufacturing process. Therefore, the regions illustrated in the accompanying drawings have schematic properties, and the shapes of the regions shown in the figures illustrate the specific shapes of the regions of the elements, but are not intended to be limiting.

[0021] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined as such herein.

[0022] Intel x86 processors introduce the root operation mode (VMX root operation) and non-root mode (VMX non-root operation) in the VMX function, allowing the vCPU to run directly on the logical CPU, eliminating the need to simulate the vCPU operation in software and greatly improving performance. For this reason, Intel introduced VMCS. VMCS is a key data structure that records the status of the vCPU. This data structure mainly contains the following six aspects of information: client status domain, host status domain, VM execution control domain, VM exit control domain, VM entry control domain, and VM exit information domain. These six domains store the status parameters of the host and virtual machines, manage the transition of entering and exiting the virtual machine, and the processor behavior.

[0023] In cloud computing platforms, physical resources are shared by multiple tenants through virtualization technology, which may cause attackers and other users to be in the same host machine. However, the isolation provided by virtualization technology is not strong. For example, virtual machine escape, denial of service attack, remote management defects, etc. all bring great security risks. The security issues caused by virtualization technology will seriously affect the security of cloud computing platforms and architectures. Existing virtual machine security protection technologies are mainly divided into two types: internal monitoring and external monitoring. Internal monitoring is to monitor by installing agents in the host system. In this mode, the operation of security agents will seriously affect system performance and is easily detected by the target system. At the same time, it is also impossible to detect the security status of external VMM (Virtual Machine Monitor) and VMCS. The external monitoring mode adopts the virtual machine introspection mechanism to analyze the host physical memory and its changes, detect the running virtual machine and obtain the virtual machine running status information. This mode protects the security of virtual machines by detecting VMCS information. However, the weakness is that the detection program itself runs on the host machine and can be easily discovered and attacked by malicious programs on the host machine. Once the protection program itself is compromised by malicious programs, it can unauthorizedly read and write the VMCS structure of the virtual machine, stealing or destroying user data.

[0024] To solve the above problems, an embodiment of the present disclosure provides a virtual machine security protection method, which is applied to a security device. Figure 1 A schematic diagram of the system architecture provided by the embodiment of the present disclosure, such as Figure 1 As shown, the system includes a host machine and a security device, and the security device is connected to the host machine through a hardware interface. Exemplarily, the hardware interface can be a PCIE (Peripheral Component Interconnect Express, a quick peripheral interconnect standard) interface. One or more virtual machines are deployed on the host machine. When the CPU switches from root mode to non-root mode, the virtual machine exits and switches from virtual machine (VM) mode to virtual machine monitor (VMM) mode; when the CPU switches from non-root mode to root mode, the host machine switches from kernel mode to user mode, that is, the virtual machine enters, and switches from virtual machine monitor (VMM) mode to virtual machine (VM) mode. The host machine is configured with a first VMCS page table, and the security device is configured with a second VMCS page table. The second VMCS page table is a page table obtained by mapping the first VMCS page table. The security device and the host machine can exchange data through a dedicated security channel VMCS Call. VMCS Call is a custom remote message communication interface. The security device and the host machine can maintain the second VMCS page table through VMCS Call, and the process_recv_vmcs thread on the security device processes the VMCS Call request sent by the host machine.

[0025] Combination Figure 1 and Figure 2 As shown, the virtual machine security protection method is applied to a security device, and the method includes the following steps:

[0026] Step S11, receiving a data processing request sent by a host machine, where the data processing request is a request for a virtual machine to access a first VMCS page table, wherein the virtual machine is deployed on the host machine, and the first VMCS page table is configured on the host machine.

[0027] The virtual machine sends a data processing request to access the first VMCS page table, and the host sends the data processing request to access the first VMCS page table to the security device through a VMCS Call. The data processing request can be a data read request or a data write request. The data read request refers to reading data from a register to a memory, and the data write request refers to writing data in the memory to a register.

[0028] Step S12: accessing a second VMCS page table according to the data processing request, wherein the second VMCS page table is a page table obtained by mapping the first VMCS page table by the security device.

[0029] The security device accesses the second VMCS page table in the local memory based on the received data processing request. Since the second VMCS page table is a mapping table of the first VMCS page table, the virtual machine can process the data in the first VMCS page table on the security device.

[0030] Figure 3 The schematic diagram of the principle of the virtual machine security protection method provided by the embodiment of the present disclosure. Figure 3As shown, the traditional external monitoring mode protects the security of the virtual machine by detecting the information recorded in the first VMCS page table maintained in the host machine, but it cannot resist the malicious program on the host machine. Once the protection program itself is broken by the malicious program, it can read and write the first VMCS page table maintained in the host machine without authorization, stealing or destroying user data. The disclosed embodiment sets a security device isolated from the host machine hardware, configures the mapping table of the first VMCS page table in the security device, that is, the second VMCS page table, obtains the control right of the VMCS core data structure on the security device, and maintains the information of the second VMCS page table on the security device through VMCS Call. In addition, the security device also has a security verification mechanism and an error correction mechanism, which can detect abnormal virtual machines and use the information of the second VMCS page table to correct the abnormal data recorded in the first VMCS page table. The disclosed embodiment adopts a hardware isolation method, and the memory space of VMCS Call and security verification is completely isolated from the operating system memory space of the host machine, has good isolation, and can resist attacks from the host machine. The entire protection system is transparent and imperceptible to the host machine and virtual machine. Malicious programs cannot discover the existence of security devices by checking process information, memory data, etc., nor can they tamper with the detection results of abnormal virtual machines. It has high reliability and improves the security protection effect of virtual machines.

[0031] The virtual machine security protection method provided by the embodiment of the present disclosure is applied to a security device, the security device receives a data processing request sent by a host machine, the data processing request is a request for the virtual machine to access a first virtual machine control structure VMCS page table, wherein the virtual machine is deployed on the host machine, and the first VMCS page table is configured on the host machine; according to the data processing request, a second VMCS page table is accessed, wherein the second VMCS page table is a page table obtained by mapping the first VMCS page table by the security device; in the embodiment of the present disclosure, the memory space of the host machine is completely isolated from the memory space of the security device, and the virtual machine actually accesses data to the memory of the security device, which can not only resist attacks from the virtual machine, but also resist attacks from the host machine, thereby realizing security protection of the VMCS page table.

[0032] In some embodiments, before receiving a data processing request sent by a host machine through a dedicated secure channel, the virtual machine security protection method may further include the step of establishing a second VMCS page table in a security device, wherein the step of establishing a second VMCS page table in a security device includes: establishing a mapping table of the first VMCS page table, and obtaining the first VMCS page table information; updating the mapping table according to the first VMCS page table information to obtain the second VMCS page table. When virtual machine information is needed on the host machine, the value of the second VMCS page table can be queried by means of vmcs_readl. It should be noted that the data structure of the second VMCS page table may be different from the data structure of the first VMCS page table, and the data structure of the second VMCS page table may be customized. In the disclosed embodiment, the second VMCS page table may be a two-dimensional array storage method, where one dimension represents a field, and the order in which the fields are stored follows the access order in the code.

[0033] like Figure 4 As shown, the field definition of each field is as follows:

[0034] field: represents the index of each data field in the second VMCS page table, not the offset;

[0035] value: represents the value of the second VMCS page table;

[0036] front_r_cnt: indicates the number of front-end reads, that is, the number of times the host reads data;

[0037] back_r_cnt: indicates the number of backend reads, that is, the number of times the security device reads data;

[0038] front_w_cnt: indicates the number of front-end writes, that is, the number of times the host writes data;

[0039] back_w_cnt: indicates the number of back-end writes, that is, the number of times the security device writes data.

[0040] Among them, r stands for vmcs_write and w stands for vmcs_read.

[0041] front_r_cnt, back_r_cnt, front_w_cnt and back_w_cnt are data processing information, and the data processing information is used to analyze the legitimacy of the data processing request and the data to be processed corresponding to the data processing request.

[0042] In some embodiments, accessing the second VMCS page table according to the data processing request (i.e., step S12) may include the following steps: updating the data processing information corresponding to the data processing request in the second VMCS page table; performing a legitimacy verification on the operation corresponding to the data processing request according to the data processing information, and accessing the second VMCS page table according to the operation if the legitimacy verification passes. That is, front_r_cnt and back_r_cnt, or front_w_cnt and back_w_cnt, are updated in the second VMCS page table. The data processing information may reflect the data read and write operation. When the read and write data of a certain field is abnormal, the above abnormality can be discovered in time by querying the data processing information. Before performing a data read and write operation on the data in the second VMCS page table, the legitimacy of the data read and write operation is first verified, and access to the second VMCS page table is allowed only after the legitimacy passes.

[0043] In some embodiments, the data processing information includes the number of operations, and updating the data processing information corresponding to the data processing request in the second VMCS page table includes the following steps: updating the number of operations corresponding to the data processing request in the second VMCS page table.

[0044] In some embodiments, the step of verifying the legitimacy of the operation corresponding to the data processing request based on the data processing information includes: comparing the number of updated operations with a preset number threshold, and determining that the legitimacy verification of the operation has passed if the number of updated operations meets the preset number threshold.

[0045] In the case where the operation is a data read operation, the updated number of data read operations is compared with the preset first number threshold, and if the updated number of data read operations is less than the preset first number threshold, it is considered that the legitimacy verification of the data read operation has passed. In the case where the operation is a data write operation, the updated number of data write operations is compared with the preset second number threshold, and if the updated number of data write operations is less than the second preset number threshold, it is considered that the legitimacy verification of the data write operation has passed.

[0046] In some embodiments, when the operation is a data read operation, the step of accessing the second VMCS page table according to the operation includes: obtaining first target data from a register according to the data read operation, writing the first target data into the second VMCS page table, and sending the first target data to the host machine.

[0047] When the host needs to read the data in the register, it calls the vmx hardware to request to read the value of the register, which is the first target data. A data read request carrying the value is sent to the security device through a VMCS Call. The security device updates the number of data read operations in the second VMCS page table. If the number of updated data read operations is less than the preset first count threshold, it is determined that the data read operation is legal, then the value is obtained from the register, the value is written into the second VMCS page table, and the value is sent to the host through a VMCS Call. It should be noted that the host can also write the value into the first VMCS page table to update the first VMCS page table. It can be seen from this that if a malicious program on the host illegally modifies the data in the local (host) first VMCS page table, when the virtual machine needs to read the data during operation, it will fetch the value from the second VMCS page table of the security device through a VMCS Call, thereby avoiding the impact of malicious modifications on the virtual machine.

[0048] In some embodiments, when the operation is a data write operation, accessing the second VMCS page table according to the operation includes the following steps: determining second target data corresponding to the data write operation; when the second target data meets a preset data threshold, writing the second target data in the second VMCS page table, and instructing the host machine to write the second target data into the register; when the second target data does not meet the preset data threshold, notifying the host machine that the second target data is illegal data.

[0049] When the host needs to write the second data to the register, it is determined whether it is necessary to call read_vmcs_tbl according to shouldReadTbl, that is, whether the security device needs to verify the legitimacy of the write operation and the legitimacy of the second data; if verification is required, a data write request carrying the second data is sent to the security device through VMCS Call, and the security device verifies it. Specifically, the security device updates the number of data write operations in the second VMCS page table. If the number of updated data write operations is less than the preset second number threshold, it is determined that the data write operation is legal, and then it is determined whether the second target data is less than the preset data threshold. If the second target data is less than the preset data threshold, it is determined that the second target data is legal. In this case, the second target data is written in the second VMCS page table, and the second target data is sent to the host through VMCS Call to instruct the host to write the second target data to the register by executing the vmx hardware instruction. The host can also write the second target data to the first VMCS page table to update the first VMCS page table. If the second target data is greater than or equal to the preset data threshold, the host is notified that the second target data is illegal.

[0050] The disclosed embodiment also provides a security verification mechanism and an error correction mechanism. The security verification mechanism is used to detect the state of the virtual machine. When the state of the virtual machine is abnormal, the error correction mechanism is used to restore the virtual machine to a normal state.

[0051] In some embodiments, Figure 5 As shown, the virtual machine security protection method may also include the following steps:

[0052] Step S21: analyzing the state information of the virtual machine according to the second VMCS page table, where the state information includes at least one of running state information and state switching information.

[0053] In some embodiments, obtaining the running status information of the virtual machine may include the following steps: obtaining the extended page table EPT (Extended Page Table) pointer of the virtual machine, and using the EPT pointer to convert the physical address of the virtual machine into the physical address of the host machine; according to the physical address of the host machine, copying the data of the corresponding host machine to the security device; and obtaining the running status information of the virtual machine based on the data copied to the security device.

[0054] In some embodiments, the running state information may also include a two-way linked list (i.e., a process chain), and analyzing the running state information of the virtual machine may also include the following steps: after obtaining the two-way linked list of the virtual machine, analyzing whether the virtual machine has a malicious process according to the two-way linked list of the virtual machine. Each normal process should appear in the two-way linked list. Some malicious programs escape from the two-way linked list in order to evade detection. Therefore, malicious processes can be detected based on the two-way linked list. For Linux systems, the obtained process chain and process object can be compared to determine the hidden process.

[0055] It should be noted that the running status information of the virtual machine can also be analyzed in the following ways: obtain the process information in the virtual machine, determine which applications are running based on the process information, determine the creation time of these applications, the files opened by the process, and the relationship between the processes, so as to further determine whether there are malicious applications running in the system.

[0056] In some embodiments, the running state information may also include logs and registers, and analyzing the running state information of the virtual machine may also include the following steps: analyzing the logs and registers of the virtual machine. Specifically, the logs may be queried according to a specific field (struct log) to obtain the debugging information recorded in the logs, and whether the running state of the virtual machine is abnormal may be analyzed by analyzing the debugging information.

[0057] In some embodiments, the second VMCS page table includes control domain information and / or status domain information, and the control domain information may include virtual machine execution control domain information, virtual machine entry control domain information, and virtual machine exit control domain information; the status domain information may include virtual machine status domain information and host machine status domain information. The control domain information may be the value of a control register, and the status domain information may be the value of a status register. Accordingly, analyzing the status switching information may include the following steps: analyzing whether the virtual machine status switching is abnormal based on the control domain information and / or status domain information. It should be noted that whether the virtual machine status switching is abnormal may be analyzed when the virtual machine exits (i.e., switches from VM mode to VMM mode) or enters (i.e., switches from VMM mode to VM mode).

[0058] Analyzing whether the running state of the virtual machine is abnormal and analyzing whether the state switching of the virtual machine is abnormal refers to analyzing whether there are abnormalities in the virtual machine's sensitive instruction calls, I / O operations, etc., and / or analyzing whether the frequency of virtual machine switching is abnormal.

[0059] Step S22: When the state information of the virtual machine indicates that an abnormality exists, error correction processing is performed on the virtual machine.

[0060] In some embodiments, Figure 6 As shown, the error correction process for the virtual machine (i.e., step S22) includes the following steps:

[0061] Step S221, obtaining abnormal data of the virtual machine, and obtaining backup data of the virtual machine from the second VMCS page table.

[0062] After analyzing the abnormality of the virtual machine, the security device obtains abnormal data of the abnormal virtual machine and obtains backup data of the virtual machine related to the abnormal data from the second VMCS page table. Exemplarily, if the running state of the abnormal virtual machine is abnormal, the normal running state data of the abnormal virtual machine is obtained from the second VMCS page table.

[0063] Step S222: Send the backup data to the host machine, so that the host machine can write the backup data back to the first VMCS page table.

[0064] The security device sends the backup data of the abnormal virtual machine to the host machine through a VMCS Call, and the host machine writes the backup data back to the first VMCS page table, thereby implementing abnormal error correction processing for the abnormal virtual machine.

[0065] Through the second VMCS page table, the security device can obtain and analyze the physical memory of the host machine in real time, and can detect the virtual machine in the host machine by using the security verification mechanism, and obtain the running status information and switching status information of the virtual machine. When the virtual machine abnormality is detected, the backup data of the virtual machine can be written back to the memory of the host machine through the data backed up in the second VMCS page table, so as to correct the abnormality of the virtual machine.

[0066] Memory-based analysis is an important method for virtual machine system self-checking. It analyzes physical memory and its changes by obtaining the physical memory information of the host machine, detects the running virtual machine and obtains the running status information of the virtual machine, and further analyzes the running status of the virtual machine process and other information to see if there is any malicious behavior. One way is to install a monitoring program in the host machine, obtain VMCS structure information through software, and analyze the physical memory information of the host machine and virtual machine. Another way is that the host machine's monitoring program collects data through the network to a remote server for monitoring and analysis. The main function of these two methods is to monitor the security status. The monitoring or agent program runs on the host machine, and its own security is difficult to effectively guarantee. At the same time, it is also impossible to correct and repair the damaged virtual machine in a timely manner.

[0067] The disclosed embodiment adopts VMCS isolation technology. Through hardware isolation, the security device can obtain the first VMCS page table information on the host in real time through interfaces such as PCIE. The host creates a virtual machine, and at the same time establishes a second VMCS page table (mapping table) corresponding to the first VMCS page table in the security device. After the mapping relationship is established, the redefinition of the execution path of the read and write operations of the key data of the VMCS is set in the virtual machine monitor of the host. Each read and write operation of the key data in the VMCS will be mapped to the security device for execution. This method has strong anti-attack and reliability, and will not bring a large performance impact to the virtual machine and the host. An attack test is performed on the virtual machine state domain field GUEST_INTERRUPTIBILITY_INFO (used to record whether the vcpu can respond to interrupts), and an illegal value is violently written on the host. If the isolation technology is not used, the illegal value is implanted and the virtual machine runs down; after the isolation technology is used, the read value operation of the first VMCS page table is executed in the second VMCS page table of the security device through the secure channel provided by the VMCS Call, and the virtual machine runs normally.

[0068] The disclosed embodiment adopts a security verification mechanism. Each virtual machine is configured with a first VMCS page table. By recording the read and write records of the status domain information and the control domain information, it can be determined whether the virtual machine has abnormal read and write behavior. At the same time, the conversion from the virtual machine physical address to the host machine physical address can be achieved according to the EPT pointer in the first VMCS page table. After obtaining the physical memory of the virtual machine, the running state of the virtual machine can be reconstructed according to the operating system version, and the process information of the virtual machine can be further obtained. By analyzing the process information, it can be obtained which applications are running, when they were created, which files these processes have opened, and the relationship between each process, and further determine whether there are malicious applications running in the system; abnormal service information can also be found from the system log, and when the virtual machine is found to be abnormal, an alarm can be issued in time and the abnormal log can be saved, and the erroneous information can be corrected by writing back.

[0069] The disclosed embodiment uses hardware separation technology to isolate VMCS key data and security detection programs and run them on a security device. The host machine cannot perceive the transfer of key data and the operation of the security detection program, thereby improving the security protection effect of the virtual machine.

[0070] like Figure 7 As shown, an embodiment of the present disclosure also provides a security device, which includes: one or more processors 701, a storage device 702 and one or more I / O interfaces 703; wherein, one or more programs are stored on the storage device 702, and when the one or more programs are executed by the one or more processors, the one or more processors 701 implement the installation package image detection method provided in the aforementioned embodiments; the I / O interface 703 is connected between the processor 701 and the storage device 702, and is configured to implement information interaction between the processor 701 and the storage device 702.

[0071] Among them, the processor 701 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the storage device 702 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) 703 is connected between the processor 701 and the storage device 702, and can realize information interaction between the processor 701 and the storage device 702, including but not limited to a data bus (Bus), etc.

[0072] The embodiments of the present disclosure also provide a computer-readable medium on which a computer program is stored, wherein when the computer program is executed, the virtual machine security protection method provided in the aforementioned embodiments is implemented.

[0073] It will be appreciated by those skilled in the art that all or some of the steps in the method disclosed above, the functional modules / units in the device may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable requests, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable requests, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0074] Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly stated, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, it will be understood by those skilled in the art that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A virtual machine security protection method, the method is applied to a security device, the method comprising: receiving a data processing request sent by a host machine, wherein the data processing request is a request for a virtual machine to access a first virtual machine control structure VMCS page table, wherein the virtual machine is deployed on the host machine and the first VMCS page table is configured on the host machine; A second VMCS page table is accessed according to the data processing request, wherein the second VMCS page table is a page table obtained by mapping the first VMCS page table by the security device.

2. The method according to claim 1, characterized in that Before receiving the data processing request sent by the host machine, the method further includes: Establishing a mapping table of the first VMCS page table, and obtaining the first VMCS page table information; The mapping table is updated according to the first VMCS page table information to obtain the second VMCS page table.

3. The method according to claim 1, characterized in that The accessing the second VMCS page table according to the data processing request comprises: updating data processing information corresponding to the data processing request in the second VMCS page table; Performing legitimacy verification on the operation corresponding to the data processing request according to the data processing information; In a case where the legality verification passes, the second VMCS page table is accessed according to the operation.

4. The method according to claim 3, characterized in that The data processing information includes the number of operations, and the updating of the data processing information corresponding to the data processing request in the second VMCS page table includes: The number of operations corresponding to the data processing request is updated in the second VMCS page table.

5. The method according to claim 4, characterized in that The performing legality verification on the operation corresponding to the data processing request according to the data processing information includes: The updated number of operations is compared with a preset number threshold, and when the updated number of operations meets the preset number threshold, it is determined that the legality verification of the operation has passed.

6. The method according to claim 3, characterized in that In a case where the operation is a data read operation, accessing the second VMCS page table according to the operation includes: Acquire first target data from a register according to the data read operation, write the first target data into the second VMCS page table, and send the first target data to the host machine.

7. The method according to claim 3, characterized in that In the case where the operation is a data write operation, accessing the second VMCS page table according to the operation includes: Determining second target data corresponding to the data writing operation; When the second target data meets a preset data threshold, the second target data is written into the second VMCS page table, and the host machine is instructed to write the second target data into a register.

8. The method according to claim 7, characterized in that After determining the second target data corresponding to the data write operation, accessing the second VMCS page table according to the data processing request further includes: When the second target data does not meet the preset data threshold, the host machine is notified that the second target data is illegal data.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: Analyzing state information of the virtual machine according to the second VMCS page table, the state information including at least one of running state information and state switching information; When the state information of the virtual machine indicates that an abnormality exists, error correction processing is performed on the virtual machine.

10. The method according to claim 9, characterized in that The performing error correction processing on the virtual machine includes: Acquire abnormal data of the virtual machine, and acquire backup data of the virtual machine from the second VMCS page table; The backup data is sent to the host machine, so that the host machine writes the backup data back to the first VMCS page table.

11. A safety device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the virtual machine security protection method according to any one of claims 1 to 10; One or more I / O interfaces are connected between the processor and the storage device and are configured to implement information interaction between the processor and the storage device.

12. A computer readable medium having a computer program stored thereon, wherein: When the program is executed, the virtual machine security protection method as described in any one of claims 1-10 is implemented.

Images