A security management method and device for a virtual machine and a storage medium

Abstract

Embodiments of the present application provide a security management method and device for a virtual machine and a storage medium. In the embodiments of the present application, when a kernel-mode component in a virtual machine manager intercepts an access request for virtual device state data sent in any virtual machine on a host computer, the kernel-mode component performs security verification on the virtual device state data to which the access request points, and only after the security verification passes, the kernel-mode component forwards the access request to a user-mode component in the virtual machine manager, and then the user-mode component responds to the access request. In this way, it can be determined whether the virtual device state data stored in the user-mode memory address space has been tampered with in time, and after the tampering problem is found, access control is performed in the kernel mode in time to avoid the virtual machine accessing the tampered virtual device state data, thereby reducing the security risk of the virtual machine.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a method, device and storage medium for the security management of virtual machines. Background Technology

[0002] In virtualization technology, to better support the operation of virtual machines, various virtual peripherals are typically simulated and provided to the virtual machine for its use. These virtual peripherals may include virtual keyboards, virtual mice, and various virtual PCI (Peripheral Component Interconnect) devices.

[0003] Currently, the state data of virtual devices is generally stored in the user-space memory address space. Since memory leaks or abnormal memory accesses are more likely to occur in the user-space memory address space, the state data of virtual devices is vulnerable to attacks and tampering, which in turn poses a significant security risk to the virtual machine. Summary of the Invention

[0004] This application provides a method, device, and storage medium for the security management of virtual machines, in order to reduce the security risks of virtual machines.

[0005] This application provides a security management method for virtual machines, applicable to kernel-mode components included in a virtual machine manager running on a host machine. The virtual machine manager also includes user-mode components. The method includes:

[0006] If an access request for virtual device status data is intercepted from any virtual machine on the host machine, the virtual device status data pointed to by the access request is subjected to security verification.

[0007] If the virtual device status data passes the security verification, the access request is forwarded to the user-mode component, which then responds to the access request.

[0008] This application embodiment also provides a physical device, including a memory and a processor, wherein a virtual machine manager runs in the processor, and the virtual machine manager includes user-mode components and kernel-mode components;

[0009] The memory is used to store one or more computer instructions;

[0010] The processor is coupled to the memory and the communication component to execute one or more computer instructions for performing the aforementioned virtual machine security management method.

[0011] This application also provides a computer-readable storage medium for storing computer instructions, which, when executed by one or more processors, cause the one or more processors to execute the aforementioned virtual machine security management method.

[0012] In this embodiment, when the kernel-mode component in the virtual machine manager intercepts an access request for virtual device state data from any virtual machine on the host machine, the kernel-mode component performs a security verification on the virtual device state data pointed to by the access request. Only after the security verification passes will the kernel-mode component forward the access request to the user-mode component in the virtual machine manager, which can then respond to the access request. This allows for timely detection of whether the virtual device state data stored in the user-mode memory address space has been tampered with. Upon detection of tampering, access control is promptly implemented in the kernel mode to prevent the virtual machine from accessing the tampered virtual device state data, thereby reducing the security risk to the virtual machine. Attached Figure Description

[0013] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0014] Figure 1a A flowchart illustrating a security management method for a virtual machine provided as an exemplary embodiment of this application;

[0015] Figure 1b A logical schematic diagram of a security management method for a virtual machine provided as an exemplary embodiment of this application;

[0016] Figure 2a A flowchart illustrating another virtual machine security management method provided as an exemplary embodiment of this application;

[0017] Figure 2b A logical schematic diagram of another virtual machine security management method provided for an exemplary embodiment of this application;

[0018] Figure 3 A logical schematic diagram of a preferred embodiment provided for an exemplary embodiment of this application;

[0019] Figure 4a A flowchart illustrating another virtual machine security management method provided as an exemplary embodiment of this application;

[0020] Figure 4b A logical schematic diagram of another virtual machine security management method provided for an exemplary embodiment of this application;

[0021] Figure 5a A flowchart illustrating another virtual machine security management method provided as an exemplary embodiment of this application;

[0022] Figure 5b A logical schematic diagram of another virtual machine security management method provided for an exemplary embodiment of this application;

[0023] Figure 6 This is a schematic diagram of the structure of a physical device provided for an exemplary embodiment of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] With the development of I / O virtualization technology, in order to improve the I / O performance of virtual machines in virtualization scenarios, various virtual peripherals are typically simulated for the virtual machines using I / O virtualization technology. As introduced in the background section, these virtual peripherals are diverse, including virtual keyboards, virtual mice, and various virtual PCI devices. For ease of description, these virtual peripherals used in virtual machines will be described as virtual devices in the following text.

[0026] Like hardware peripherals, each virtual device also possesses device state. Device state refers to the state data configured in the configuration space of the virtual device. Device state records the state of the virtual device's configuration space and / or registers at a given moment. Virtual machines can read and write the device state of virtual devices to achieve various uses such as performance awareness, function configuration, and action enabling. Furthermore, similar to hardware peripherals, I / O virtualization technology also requires real-time storage of virtual device state data. Since virtual devices do not have storage hardware like hardware peripherals, virtual device state data is typically stored in the host machine's physical memory. However, to support the isolation mechanism for virtual machines in CPU virtualization technology, virtual device state data usually needs to be stored in user-space memory address space, and the virtual device state data involved in different virtual machines is typically isolated.

[0027] During their research, the inventors discovered that because user-mode memory address space is prone to memory leaks and abnormal memory accesses, virtual device state data is vulnerable to attack and tampering. However, the virtual machine is unaware of this, causing it to continue reading and writing the tampered virtual device state data as usual. This can lead to attacks on related processes within the virtual machine, posing a significant security risk.

[0028] Therefore, this embodiment proposes a security management method for virtual machines, suggesting that the security of virtual device state data be ensured to reduce the security risks to virtual machines. Thus, ensuring the security of virtual device state data is a key concern in this embodiment. This embodiment provides a novel technical concept to ensure the security of virtual device state data.

[0029] This embodiment proposes a security management method for virtual machines, applicable to virtual machine managers running on the host machine. The Virtual Machine Manager (VMM) can be considered the actual operating system, used to establish and maintain a framework for managing virtual machines. The virtual devices mentioned in this embodiment are virtual I / O devices created by the VMM and provided to the virtual machine (specifically, the guest operating system) for I / O access. The guest operating system can only observe its own virtual devices, and all I / O accesses from the guest operating system can only be sent to its own virtual devices. The virtual machine manager can then obtain the guest operating system's access requests from the virtual devices and complete the actual I / O access.

[0030] During their research, the inventors discovered that virtual machine managers typically consist of user-mode components and kernel-mode components. User-mode components are generally used for user-mode tasks, such as the QEMU (quick emulator) component; while kernel-mode components are typically used for kernel-mode tasks, such as the KVM (Kernel-based Virtual Machine) component. The tasks handled by user-mode components may include, but are not limited to, creating virtual machines, allocating addresses from the virtual address space occupied by the virtual machine manager as the physical addresses of the virtual machines, and simulating the necessary virtual devices for the virtual machines, etc., which will not be exhaustively listed here. Kernel-mode components provide a series of interfaces to user-mode components, through which user-mode components can control various aspects of the virtual machine, such as the number of CPUs, memory layout, and operation. Kernel-mode components are also used to handle privileged instructions issued by the virtual machine; these privileged instructions are typically those that may affect the entire host machine, such as I / O requests occurring within the virtual machine.

[0031] This embodiment proposes to ensure the security of virtual device state data by having user-mode components and kernel-mode components work together.

[0032] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0033] Figure 1a This is a flowchart illustrating a security management method for a virtual machine, provided as an exemplary embodiment of this application. Figure 1b This is a logical schematic diagram of a virtual machine security management method provided as an exemplary embodiment of this application. (Reference) Figure 1a The method may include:

[0034] Step 100: When the kernel-mode component intercepts an access request for virtual device status data from any virtual machine on the host machine, the kernel-mode component performs a security verification on the virtual device status data pointed to by the access request.

[0035] Step 101: If the virtual device status data passes the security verification, the kernel-mode component will transfer the access request to the user-mode component.

[0036] Step 102: The user-space component responds to the access request.

[0037] In step 100, when an access request for virtual device state data is issued from any virtual machine on the host machine, such access requests can be intercepted by kernel-mode components. It is worth noting that the access requests in this embodiment can include write requests and read requests, so that when a write request or a read request for virtual device state data is issued from any virtual machine on the host machine, it can be intercepted by kernel-mode components.

[0038] refer to Figure 1b In this embodiment, the virtual machine can be regarded as a process managed by the user-mode component. Therefore, when the virtual machine issues an access request for virtual device state data, it will be detected by the user-mode component first. However, since the access request for virtual device state data belongs to the privileged instruction mentioned above, such access request can be accurately intercepted by the kernel-mode component.

[0039] For such access requests, after identifying the privileged reason (which can be understood as the intent of the access request), the kernel-mode component will then hand it over to the user-mode component for processing.

[0040] refer to Figure 1b In this embodiment, it is proposed that before such access requests are handed over to user-space components for processing, kernel-space components perform security verification on the virtual device state data pointed to by the intercepted access request.

[0041] The virtual device state data requested in this access request refers to the virtual device state data stored in the user-mode memory address space mentioned earlier. It should be understood that the virtual device state data requested in this access request may have already been modified in the user-mode memory address space. Based on step 100, in this embodiment, a security verification of the requested virtual device state data can be performed in kernel mode to determine whether the virtual device state data has been modified.

[0042] Furthermore, it's worth noting that kernel-mode components possess the ability to access user-mode memory address space. Therefore, they can seamlessly read the required virtual device state data from the user-mode memory address space for security verification. In practical applications, for example, a kernel-mode component can initiate an address mapping instruction to a user-mode component, causing the user-mode component to return the host virtual address (HVA) mapped to the access address in the access request (usually the guest physical address GPA). The kernel-mode component can then read the required virtual device state data from the host machine's physical memory based on the host machine's page table (which records the mapping relationship between the host virtual address HVA and the host physical address HPA). Of course, this is only one exemplary reading method, and this embodiment is not limited to it.

[0043] Continue to refer to Figure 1a In step 101, if the virtual device state data passes the security verification, the kernel-mode component forwards the access request to the user-mode component. That is, after the kernel-mode component performs the security verification on the required virtual device state data according to step 100, it will only forward the access request to the user-mode component if it determines that the virtual device state data has not been tampered with. This ensures the security of access requests for virtual device state data forwarded to the user-mode component.

[0044] refer to Figure 1a In step 102, the user-mode component may respond to the access request.

[0045] As mentioned earlier, in this embodiment, the access request may be a write request or a read request. Therefore, the response operation performed by the user-space component based on the access request may at least include writing the accessed virtual device state data according to the write request and reading the accessed virtual device state data according to the read request. Furthermore, it should be understood that the user-space component typically also has operation functions associated with various device state values. In this embodiment, the response operation performed by the user-space component based on the access request may also include performing simulation operations based on the operation functions associated with the device state values ​​after the read / write operations, to realize the virtual machine's usage requirements for the virtual device. These simulation operations may include, but are not limited to, interrupt enabling, DMA space allocation, device function configuration, and device function awareness, etc., which will not be exhaustively listed here.

[0046] In summary, in this embodiment, when the kernel-mode component in the virtual machine manager intercepts an access request for virtual device state data from any virtual machine on the host machine, the kernel-mode component performs a security verification on the virtual device state data pointed to by the access request. Only after the security verification passes will the kernel-mode component forward the access request to the user-mode component in the virtual machine manager, which can then respond to the access request. This allows for timely detection of whether the virtual device state data stored in the user-mode memory address space has been tampered with. Upon detection of tampering, access control is promptly implemented in the kernel mode to prevent the virtual machine from accessing the tampered virtual device state data, thereby reducing the security risks to the virtual machine.

[0047] Figure 2a This is a flowchart illustrating another virtual machine security management method provided as an exemplary embodiment of this application. Figure 2b A logical schematic diagram of another virtual machine security management method provided for an exemplary embodiment of this application. (Reference) Figure 2a The method may include:

[0048] Step 200: When the kernel-mode component intercepts an access request for virtual device state data from any virtual machine on the host machine, the kernel-mode component searches for the verification data configured for the virtual device state data in the kernel-mode memory address space.

[0049] Step 201: The kernel-mode component performs security verification on the virtual device status data based on the verification data;

[0050] Step 202: If the virtual device status data passes the security verification, the kernel-mode component will transfer the access request to the user-mode component.

[0051] Step 203: The user-space component responds to the access request.

[0052] Steps 202-203 can be referred to the relevant descriptions in the foregoing embodiments, and will not be repeated here. This embodiment provides an implementation method for security verification of the virtual device status data to be accessed, based on steps 200 and 201. This implementation method can be applied to the foregoing or subsequent embodiments, and can be combined with various implementation methods provided therein to form various technical solutions of different ranges.

[0053] refer to Figure 2b In this embodiment, the kernel-mode component maintains corresponding verification data for each virtual device status data stored in the user-mode address space within the kernel-mode memory address space.

[0054] Based on this, refer to Figure 2a In step 200, if the kernel-mode component intercepts an access request for virtual device state data from any virtual machine on the host machine, the kernel-mode component can retrieve the verification data configured for the virtual device state data from the kernel-mode memory address space. In this embodiment, the verification data is located in the kernel-mode memory address space. The verification data serves as the basis for security verification. That is, the kernel-mode component can use the verification data to evaluate whether the virtual device state data in the user-mode memory address space has been tampered with.

[0055] In this embodiment, the user-mode memory address space and kernel-mode memory address space are defined based on memory virtualization technology. Based on memory virtualization technology, both the virtual machine and the host machine have the concepts of Virtual Address (VA) and Physical Address (PA), namely, Guest Virtual Address (GVA) and Guest Physical Address (GPA), and Host Virtual Address (HVA) and Host Physical Address (HPA). The virtual machine manager can generally be considered as a process within the host machine; therefore, an address space can be allocated from the host virtual address space for the virtual machine manager. Furthermore, user-mode memory address space and kernel-mode memory address space can be divided from the virtual address space occupied by the virtual machine manager. Kernel-mode components within the virtual machine manager have access permissions to both the user-mode and kernel-mode memory address spaces, while user-mode components only have access permissions to the user-mode memory address space. In addition, a typical task of the user-mode component mentioned above is to allocate addresses from the virtual address space occupied by the virtual machine manager as the physical address of the virtual machine, that is, to allocate addresses from the user-mode memory address space of the virtual machine manager as the physical address GPA of the virtual machine.

[0056] Based on this, refer to Figure 2b In this embodiment, the kernel-mode component can request address space from the kernel-mode memory address space to store verification data. In practical applications, corresponding verification data can be configured in the kernel-mode memory address space for each virtual device used in different virtual machines in the user-mode memory address space, so as to support individual verification of a single virtual device in a single virtual machine and improve the accuracy of verification.

[0057] In addition, in this embodiment, the kernel-mode component can also be configured to point to the access address in the access request for virtual device state data and the verification data stored in the kernel-mode memory address space, so that the kernel-mode component can accurately find the verification data used for security verification based on the access address in the access request for virtual device state data. This pointing relationship can be an address-to-address relationship (e.g., GPA pointing to HVA), allowing the kernel-mode component to find the storage location of the verification data in the kernel-mode memory address space. Alternatively, it can be an address-to-data identifier relationship (e.g., GPA pointing to a data identifier), allowing the kernel-mode component to accurately hit the verification data in the kernel-mode memory address space based on the data identifier. It should be understood that these are merely exemplary, and the implementation scheme for kernel-mode verification data hitting in this embodiment is not limited to these; further examples are not provided here.

[0058] Based on this, refer to Figure 2a In step 201, the kernel-mode component can perform security verification on the virtual device status data based on the verification data. Since the verification data is located in the kernel-mode memory address space, there is no risk of it being tampered with. This provides a secure and stable verification basis for the kernel-mode component's security verification process.

[0059] Furthermore, this embodiment does not limit the content format of the verification data. Figure 3 A logical schematic diagram illustrating a preferred embodiment of this application. (Reference) Figure 3 In a preferred implementation, the verification data may include mirror data configured for the virtual device state data. In this embodiment, the mirror data is used to record the unaltered values ​​corresponding to data items in the virtual device state data. It should be understood that the unaltered value is the value that the virtual device state data should hold if it has not been attacked. That is, the mirror data in this embodiment is equivalent to a copy of the virtual device state data stored in the user-space memory address space. However, this copy is not a simple copy of the virtual device state data stored in the user-space memory address space, but rather it presents the original appearance of the virtual device state data stored in the user-space memory address space, that is, the data values ​​that should be present if it has not been tampered with.

[0060] In this embodiment, various solutions can be employed to ensure that the image data records the authentic values ​​corresponding to the virtual device status data. A preferred solution is provided below. For ease of description, the solution is described using the target virtual device used by the target virtual machine on the host machine as an example. The target virtual device can be any virtual device used by the target virtual machine, and the target virtual machine can be any virtual machine running on the host machine. It should be understood that other virtual devices can also obtain corresponding image data using the same solution.

[0061] In this preferred solution: the user-mode component can create initial values ​​for the virtual device state data of the target virtual device in the user-mode memory address space; the kernel-mode component can copy the initial values ​​of the virtual device state data of the target virtual device from the kernel-mode memory address space as the initial values ​​of the mirror data. Thus, for the target virtual device, the initial values ​​of the virtual device state data in the user-mode memory address space and the initial values ​​of the mirror data in the kernel-mode memory address space are consistent. The initial values ​​of the virtual device state are assumed to be unmodified by default. Therefore, the user-mode and kernel-mode memory address spaces possess the same initial values ​​for the target virtual device. Based on this, the kernel-mode component can use the initial values ​​of the mirror data as a starting point and, in the kernel-mode memory address space, sequentially execute write operations according to each write request that accesses the target virtual device and passes security verification, to obtain the unmodified values ​​corresponding to the data items in the virtual device state data of the mirror data corresponding to the target virtual device.

[0062] In other words, in this preferred solution, the write operation performed on the relevant image data in the kernel-mode memory address space is synchronized and consistent with the write operation on the virtual device state data in the user-mode memory address space. Therefore, if the virtual device state data in the user-mode memory address space is not tampered with, the state data for the same virtual device in the same virtual machine will remain consistent in both the user-mode and kernel-mode memory address spaces. However, if the virtual device state data in the user-mode memory address space is tampered with, the corresponding image data in the kernel-mode memory address space will not be synchronously tampered with.

[0063] Based on this, in step 201, the process of performing security verification on the virtual device status data based on the verification data can be specifically implemented as follows: the kernel-mode component reads the virtual device status data from the user-mode memory address space; and determines whether the virtual device status data and its corresponding image data are consistent. Specifically, if the virtual device status data and its corresponding image data are consistent, the virtual device status data is determined to have passed the security verification; conversely, if the virtual device status data and its corresponding image data are inconsistent, the virtual device status data is determined to have failed the security verification.

[0064] Furthermore, this solution ensures that the image data records the unaltered values ​​corresponding to the data items in the virtual device status data. (Reference) Figure 3 If the virtual device state data passes the security check in step 201, then in addition to executing steps 202 and 203 as described above, if the access request is a write request, after the user-space component completes the write operation on the virtual device state data according to the currently security-checked write request, the kernel-space component can then perform a write operation on the image data corresponding to the virtual device state data according to the write request. The image data after the write operation is completed will then serve as the verification data for the next write request for that virtual device state data. That is, the image data at the time of the write operation will be consistent with the corresponding virtual device state data obtained in the user-space memory address space after the user-space component responds to the write request. Thus, the image data will always record the latest, unaltered value corresponding to the virtual device state data.

[0065] In summary, this embodiment proposes configuring corresponding verification data for virtual device state data in user-mode memory address space within the kernel-mode memory address space. The kernel-mode component then uses this verification data to perform security verification on the virtual device state data targeted by intercepted access requests, thereby enabling access control of such requests within the kernel. Furthermore, this embodiment proposes a preferred form of verification data—mirror data. Mirror data records the unaltered values ​​that the corresponding virtual device state data should possess. In this way, the kernel-mode component can determine whether the virtual device state data in user-mode memory address space has been tampered with by comparing it with the corresponding mirror data in the kernel-mode memory address space, thus effectively improving the accuracy of security verification.

[0066] It is worth noting that the implementation method for security verification of the virtual device state data provided in this embodiment is optional. This embodiment supports other implementation methods for performing security verification of the virtual device state data. For example, the user-space component can generate a hash check value for the virtual device state data after each write operation and store it in the kernel-space memory address space; the kernel-space memory address space can use the hash check value as verification data for security verification of the virtual device state data. Further examples of implementation methods are not provided here.

[0067] Figure 4a This is a flowchart illustrating another virtual machine security management method provided as an exemplary embodiment of this application. Figure 4b A logical schematic diagram of another virtual machine security management method provided as an exemplary embodiment of this application. (Reference) Figure 4a The method may include:

[0068] Step 400: When the kernel-mode component intercepts an access request for virtual device status data from any virtual machine on the host machine, the kernel-mode component performs a security verification on the virtual device status data pointed to by the access request.

[0069] Step 401: If the virtual device status data passes the security verification, the kernel-mode component will transfer the access request to the user-mode component.

[0070] Step 402: The user-space component responds to the access request;

[0071] Step 403: If the virtual device status data fails the security check, the kernel-mode component will intercept the access request and handle the access request as an exception.

[0072] Steps 400-402 can be referred to the relevant descriptions in the foregoing embodiments, and will not be repeated here. In this embodiment, a processing scheme is provided based on step 403 when the virtual device status data fails the security verification. This processing scheme can be applied to the foregoing or subsequent embodiments, and can be combined with various implementation methods provided therein to form various technical solutions of different ranges.

[0073] refer to Figure 4aIn step 403, if the virtual device state data fails the security check, the kernel-mode component will no longer forward the currently intercepted access request to the user-mode component. Thus, access requests for virtual device state data that fail the security check will not reach the user-mode component. Therefore, in this embodiment, even if an attacker tampers with the virtual device state data in the user-mode memory address space, since this embodiment has already blocked access requests for the tampered virtual device state data in the kernel mode, this attack method can no longer achieve its purpose of attacking the virtual machine.

[0074] In addition, step 402 proposes that kernel-mode components handle access requests that fail security checks.

[0075] This embodiment supports multi-dimensional exception handling. Several exemplary exception handling dimensions are provided below.

[0076] In one exemplary scheme, if the virtual device status data fails the security verification, the kernel-mode component can return a response failure notification to the virtual machine that issued the access request. The format of the response failure notification can be set as needed. For example, it could be some meaningless status values, or it could be a status code indicating a hardware error in the virtual device, etc. No further examples are given here, and this embodiment does not limit this. Furthermore, the method of issuing the response failure notification is not limited here. For example, the response failure notification can be passed to a user-mode component, which then uses it as the response result of the access request, etc. No further examples are given here. Through this level of exception handling, the virtual machine can be informed that its access request has failed.

[0077] refer to Figure 4b In one exemplary solution, if the virtual device state data fails the security verification, the kernel-mode component can isolate the virtual device targeted by the access request in the virtual machine. This exemplary solution proposes that, upon discovering that the virtual device state data has failed the security verification, the kernel-mode component proactively isolates the relevant virtual device.

[0078] Here, the process of isolating the virtual device targeted by the access request can be as follows: the kernel-mode component issues a unplug command for the virtual device to the user-mode component; the user-mode component responds to the unplug command and unplugs the virtual device from the virtual machine. In practical applications, the user-mode component can perform hot-plug control on virtual devices within the virtual machine. Here, the user-mode component unplugs the relevant virtual device from the virtual machine. It should be understood that the unplugged virtual device is no longer visible to the virtual machine, and the virtual machine usually will not issue any further access requests for the virtual device status of the isolated virtual device. However, considering that in special cases, subsequent access requests for the virtual device status data of the isolated virtual device may be issued from within the virtual machine, the kernel-mode component can record information such as the identifier of the isolated virtual device for each virtual machine. In this way, when the kernel-mode component intercepts an access request for the virtual device status data of the isolated virtual device, it can directly return a response failure notification to the corresponding virtual machine without performing the aforementioned security verification operation. That is, access requests for the virtual device status data initiated for the isolated virtual device will be directly rejected by the kernel-mode component without further security verification.

[0079] It should be understood that the above isolation schemes are merely exemplary. Other isolation schemes can also be used in this embodiment. For example, the kernel-mode component can maintain an access control table for virtual devices, recording the access control mode corresponding to each virtual device. For the virtual devices that need to be isolated, their corresponding access control mode can be recorded as "isolated". When the kernel-mode component subsequently intercepts a virtual device status data access request for an isolated virtual device, it can directly reject such access requests, thereby achieving isolation of the virtual device. Further examples of isolation schemes are not provided here.

[0080] This approach to anomaly handling narrows the scope to the virtual device level, eliminating the need for comprehensive anomaly handling of the entire virtual machine. In other words, in the event of such a security risk, instead of shutting down the virtual machine to mitigate the risk, the relevant virtual devices can be isolated. Other virtual devices within the virtual machine remain functional, and the entire virtual machine continues to operate normally. This effectively reduces the impact of the anomaly and ensures the continued operation of the virtual machine.

[0081] Furthermore, it should be understood that the above-mentioned exception handling dimensions are merely exemplary, and this embodiment is not limited thereto. Moreover, multiple exception handling dimensions can be combined with each other, that is, exception handling operations of multiple dimensions can be implemented simultaneously. The details of the combination scheme are not described here.

[0082] Therefore, in this embodiment, if the virtual device state data fails the security check, the kernel-mode component no longer forwards the corresponding access request to the user-mode component. Instead, the kernel-mode component directly handles the exception for the access request. This effectively improves the efficiency of handling access requests that fail the security check.

[0083] Figure 5a This is a flowchart illustrating another virtual machine security management method provided as an exemplary embodiment of this application. Figure 5b A logical schematic diagram of another virtual machine security management method provided as an exemplary embodiment of this application. (Reference) Figure 5a The method may include:

[0084] Step 500: When the kernel-mode component intercepts an access request for virtual device status data from any virtual machine on the host machine, the kernel-mode component performs a security verification on the virtual device status data pointed to by the access request.

[0085] Step 501: If the virtual device status data fails the security check, the kernel-mode component repairs the virtual device status data in the user-mode memory address space based on the check data in the kernel-mode memory address space.

[0086] Step 502: After the repair is completed, the kernel-mode component will transfer the access request to the user-mode component;

[0087] Step 503: The user-space component responds to the access request.

[0088] Steps 500 and 503 can be referred to the relevant descriptions in the foregoing embodiments, and will not be repeated here. In this embodiment, a processing scheme is provided based on steps 501 and 502 when the virtual device status data fails security verification. This processing scheme can be applied to the foregoing or subsequent embodiments, and combined with various implementation methods provided therein to form various technical solutions of different ranges.

[0089] and Figure 4a The processing schemes provided in the illustrated embodiments are different. In this embodiment, based on the processing schemes provided in steps 501 and 502, the kernel-mode component no longer directly handles the access requests that have failed the security check. Instead, the kernel-mode component modifies the virtual device state data and then returns to the normal access request handling process. That is, after the repair is completed, the access requests that have failed the security check will be transferred to the user-mode component for processing.

[0090] As mentioned earlier, the verification data serves as the basis for security verification of kernel-mode components. Therefore, based on the verification data, the virtual device state data in the user-mode memory address space can be restored to its state before tampering.

[0091] refer to Figure 5b Echoing the mirrored data proposed in the preceding embodiments, in step 501, if the verification data includes mirrored data configured for virtual device state data, the kernel-mode component can overwrite the virtual device state data in the user-mode memory address space based on the corresponding mirrored data in the kernel-mode memory address space. Since the mirrored data records the unaltered values ​​corresponding to the data items in the virtual device state data, after the overwriting operation performed by the kernel-mode component, the virtual device state data in the user-mode memory address space can be restored to its state before being tampered with.

[0092] It should be understood that in step 501, appropriate repair methods can be adopted according to the content format of the verification data. For example, in the case mentioned in the previous embodiments, where the verification data contains a hash verification value configured for the virtual device state data, the kernel-mode component can perform reverse hashing on the virtual device state data based on the hash verification value to restore the value of the data item in the virtual device state data. Further examples of repair methods will not be provided here.

[0093] Based on this, in step 502, after the repair is completed, the kernel-mode component can transfer the access request to the user-mode component. After the repair is completed, the virtual device state data in the user-mode memory address space has been restored to its original state before being tampered with. Therefore, this embodiment considers the security risk to have been eliminated, and thus proposes to continue the normal access request handling process.

[0094] In this embodiment, the kernel-mode component may not need to perform security verification on the repaired virtual device state data; of course, security verification may be performed again, but this embodiment does not limit this.

[0095] Therefore, in this embodiment, by repairing the virtual device status data, the success rate of responding to access requests for virtual device status data can be effectively improved, thereby reducing the probability of virtual machine failure and thus effectively improving the stability and reliability of the virtual machine.

[0096] During their research, the inventors discovered that even after repairs were completed and the kernel-mode component forwarded the access request to the user-mode component, access failures could still occur. This is likely because, due to tampering, other data items related to the device state may have also changed. Therefore, even after repairs, the device is essentially still in a faulty state, leading to access failures for the user-mode component after responding to the corresponding access request. To address this, in this embodiment, the kernel-mode component can support receiving isolation commands from external sources. This allows virtual machine users, upon discovering an access request failure, to send an isolation command for the virtual device to the kernel-mode component in response to the access request.

[0097] Upon receiving an isolation command, kernel-mode components can isolate the corresponding virtual devices. Specific technical details regarding isolation can be found in the preceding description and will not be repeated here. However, it should be understood that... Figure 4a In the illustrated embodiment, the isolation operation is initiated actively by the kernel-mode component, while in this embodiment, the isolation operation is passively initiated by the kernel-mode component in response to external instructions.

[0098] Accordingly, in this embodiment, if the virtual device state data fails the security check, the kernel-mode component attempts to repair the failed virtual device state data and returns to the normal access request handling process after repair, so that the current access request can be normally transferred to the user-mode component. This can effectively reduce the number of abnormal responses to access requests in the virtual machine, thereby improving the stability and reliability of the virtual machine. Moreover, safeguards are proposed for situations where normal response is still not possible after repair. That is, if repair is ineffective, the corresponding virtual device is isolated. Isolation can minimize the scope of virtual machine anomalies and ensure the working efficiency of the virtual machine.

[0099] It should be noted that some processes described in the above embodiments and accompanying drawings include multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or they may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel.

[0100] Figure 6 This is a schematic diagram of the structure of a physical device provided for an exemplary embodiment of this application. For example... Figure 6 As shown, the physical device may include: a memory 60 and a processor 61, wherein a virtual machine manager 62 runs in the processor 61, and the virtual machine manager 62 includes a user-mode component 63 and a kernel-mode component 64;

[0101] Memory is used to store one or more computer instructions;

[0102] The processor is coupled to memory and is used to execute one or more computer instructions for:

[0103] If the kernel-mode component intercepts an access request for virtual device status data issued by any virtual machine on the host machine, the kernel-mode component shall perform a security verification on the virtual device status data pointed to by the access request.

[0104] If the virtual device status data passes the security verification, the kernel-mode component will forward the access request to the user-mode component 63.

[0105] The user-mode component 63 responds to the access request.

[0106] In an optional embodiment, when performing security verification on the virtual device state data pointed to by the access request, the kernel-mode component 64 can be used to:

[0107] The kernel-mode component searches for the verification data configured for the virtual device state data in the kernel-mode memory address space;

[0108] The virtual device status data is security verified based on the verification data.

[0109] In an optional embodiment, the verification data includes mirror data configured for the virtual device state data, and the kernel-mode component 64, when performing security verification on the virtual device state data based on the verification data, can be used to:

[0110] Read the virtual device status data from the user-mode memory address space;

[0111] Determine whether the virtual device status data and its corresponding image data are consistent;

[0112] The mirror data is used to record the unaltered values ​​corresponding to data items in the virtual device status data.

[0113] In an optional embodiment, for a target virtual device in a target virtual machine, the initial value of the virtual device state data created by the user-mode component 63 in the user-mode memory address space is consistent with the initial value of the image data created by the kernel-mode component in the kernel-mode memory address space. The kernel-mode component 64 can also be used for:

[0114] Starting from the initial value of the image data, in the kernel-mode memory address space, write operations are performed sequentially according to each write request that accesses the target virtual device and passes the security check, so as to obtain the unaltered value corresponding to the data item in the virtual device status data in the image data corresponding to the target virtual device;

[0115] The target virtual device can be any virtual device used by the target virtual machine.

[0116] In an optional embodiment, when the access request is a write request, the kernel-mode component 64 can also be used for:

[0117] After the user-space component completes the write operation on the virtual device status data according to the write request, it performs a write operation on the image data corresponding to the virtual device status data according to the write request.

[0118] The image data after the write operation is completed serves as verification data when the next write request is made for the virtual device status data.

[0119] In an alternative embodiment, kernel-mode component 64 can also be used for:

[0120] If the virtual device status data fails the security verification, the access request is intercepted and the access request is handled as an exception.

[0121] In an optional embodiment, the kernel-mode component 64, when handling exceptions in the access request, can be used to:

[0122] Return a failure response notification to the virtual machine that issued the access request.

[0123] In an optional embodiment, the kernel-mode component, when handling exceptions in the access request, can be used to:

[0124] The virtual device to which the access request in the virtual machine is directed is isolated.

[0125] In an alternative embodiment, kernel-mode component 64 can also be used for:

[0126] If the virtual device status data fails the security check, the virtual device status data in the user space memory address space is repaired based on the check data in the kernel space memory address space.

[0127] After the repair is completed, the kernel-mode component transfers the access request to the user-mode component 63 and subsequent operations are performed.

[0128] In an optional embodiment, when the kernel-mode component 64 repairs the virtual device state data in the user-mode memory address space based on the verification data in the kernel-mode memory address space, it may specifically be used to:

[0129] If the verification data includes mirror data configured for virtual device status data, then the virtual device status data in the user-mode memory address space is overwritten based on the mirror data in the kernel-mode memory address space;

[0130] The mirror data is used to record the unaltered values ​​corresponding to data items in the virtual device status data.

[0131] In an alternative embodiment, kernel-mode component 64 can also be used for:

[0132] After the repair is completed, if an isolation instruction is received for the virtual device to which the access request is directed, the virtual device to which the access request is directed will be isolated.

[0133] In an optional embodiment, when isolating the virtual device to which the access request is directed, the kernel-mode component 64 may specifically be used to:

[0134] A disconnect command for the virtual device is issued to the user-mode component 63, so that the user-mode component 63, in response to the disconnect command, disconnects the virtual device from the virtual machine.

[0135] Furthermore, such as Figure 6 As shown, the physical device also includes other components such as a communication component 65 and a power supply component 66. Figure 6 The diagram only shows some components and does not mean that the physical device only includes... Figure 6 The components shown.

[0136] It is worth noting that the technical details of the above embodiments of the physical device can be referred to the relevant descriptions in the foregoing method embodiments. To save space, they will not be repeated here, but this should not cause any loss to the scope of protection of this application.

[0137] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed, can perform the steps executed in the above method embodiments.

[0138] The above Figure 6The memory in a computer is used to store computer programs and can be configured to store various other data to support operation on a computing platform. Examples of this data include instructions for any application or method operating on the computing platform, contact data, phone book data, messages, pictures, videos, etc. The memory can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disks, or optical disks.

[0139] The above Figure 6 The communication component is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G / LTE, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component further includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID), Infrared Data Association (IrDA) technology, Ultra-Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0140] The above Figure 6 The power supply component provides power to the various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which it resides.

[0141] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0142] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0143] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0144] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0145] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0146] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0147] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A security management method for virtual machines, characterized in that, The method applies to kernel-mode components contained in a virtual machine manager running on a host machine, the virtual machine manager also including user-mode components, and includes: If an access request for virtual device status data is intercepted from any virtual machine on the host machine, a security verification is performed on the virtual device status data pointed to by the access request. The security verification is used to determine whether the virtual device status data has been tampered with. If the virtual device status data passes the security verification, the access request is forwarded to the user-mode component, which then responds to the access request.

2. The method according to claim 1, characterized in that, The security verification of the virtual device status data targeted by the access request includes: Retrieve the verification data configured for the virtual device status data from the kernel-mode memory address space; The virtual device status data is security verified based on the verification data.

3. The method according to claim 2, characterized in that, The verification data includes mirror data configured for the virtual device status data. Security verification of the virtual device status data based on the verification data includes: Read the virtual device status data from the user-mode memory address space; Determine whether the virtual device status data and its corresponding image data are consistent; The mirror data is used to record the unaltered values ​​corresponding to data items in the virtual device status data.

4. The method according to claim 3, characterized in that, For a target virtual device in a target virtual machine, the initial value of the virtual device state data created by the user-mode component in the user-mode memory address space is consistent with the initial value of the image data created by the kernel-mode component in the kernel-mode memory address space. The method further includes: Starting from the initial value of the image data, in the kernel-mode memory address space, write operations are performed sequentially according to each write request that accesses the target virtual device and passes the security check, so as to obtain the unaltered value corresponding to the data item in the virtual device status data in the image data corresponding to the target virtual device; The target virtual device can be any virtual device used by the target virtual machine.

5. The method according to any one of claims 3 or 4, characterized in that, If the access request is a write request, the method further includes: After the user-space component completes the write operation on the virtual device status data according to the write request, it performs a write operation on the image data corresponding to the virtual device status data according to the write request. The image data after the write operation is completed serves as verification data when the next write request is made for the virtual device status data.

6. The method according to claim 1, characterized in that, Also includes: If the virtual device status data fails the security verification, the access request is intercepted and the access request is handled as an exception.

7. The method according to claim 6, characterized in that, The exception handling for the access request includes: Return a failure response notification to the virtual machine that issued the access request.

8. The method according to claim 6, characterized in that, The kernel-mode component performs exception handling on the access request, including: The virtual device to which the access request in the virtual machine is directed is isolated.

9. The method according to claim 2, characterized in that, The method further includes: If the virtual device status data fails the security check, the virtual device status data in the user space memory address space is repaired based on the check data in the kernel space memory address space. After the repair is completed, the access request is transferred to the user-space component and subsequent operations are performed.

10. The method according to claim 9, characterized in that, Repairing the virtual device status data in the user-mode memory address space based on the verification data in the kernel-mode memory address space includes: If the verification data includes mirror data configured for virtual device status data, then the virtual device status data in the user-mode memory address space is overwritten based on the mirror data in the kernel-mode memory address space; The mirror data is used to record the unaltered values ​​corresponding to data items in the virtual device status data.

11. The method according to claim 9, characterized in that, The method further includes: After the repair is completed, if an isolation instruction is received for the virtual device to which the access request is directed, the virtual device to which the access request is directed will be isolated.

12. The method according to claim 8 or 11, characterized in that, Isolating the virtual device targeted by the access request includes: A disconnect command is issued to the user-mode component for the virtual device, so that the user-mode component, in response to the disconnect command, disconnects the virtual device from the virtual machine.

13. A physical device, characterized in that, It includes memory and a processor, wherein a virtual machine manager runs in the processor, and the virtual machine manager includes user-mode components and kernel-mode components; The memory is used to store one or more computer instructions; The processor is coupled to the memory and is used to execute one or more computer instructions to perform the security management method for the virtual machine as described in any one of claims 1-12.

14. A computer-readable storage medium for storing computer instructions, characterized in that, When the computer instructions are executed by one or more processors, the one or more processors perform the virtual machine security management method according to any one of claims 1-12.

Images