KVM (Keyboard Video Mouse) runtime integrity measurement method based on self-adaptive threshold

Abstract

The invention belongs to the technical field of trusted computing and virtualization security, and discloses a KVM runtime integrity measurement method based on a self-adaptive threshold value. Generating a reference value file of a KVM code segment in an initialization stage and performing digital signature; in the runtime stage, the measurement opportunity is dynamically determined by monitoring the ioctl system calling frequency of the KVM and combining the self-adaptive adjustment triggering threshold value; when the measurement is triggered, a random sampling mechanism is adopted to carry out Hash calculation on the virtual page of the KVM code segment, and an aggregation measurement value is generated; and in the verification stage, the integrity verification is completed by comparing the reconstructed reference value with the real-time measurement result. According to the method, the defects that a static or periodic measurement mechanism is high in overhead and easy to predict are overcome, runtime integrity protection with low overhead, high real-time performance and anti-prediction capability is realized, continuous, active and anti-prediction integrity protection of the KVM runtime state is realized, and the virtualization underlying security is effectively enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of trusted computing and virtualization security, in particular to a KVM (Kernel-based Virtual Machine) runtime integrity measurement method based on an adaptive threshold. BACKGROUND

[0002] With the rapid development of information technology, cloud computing has become a key infrastructure supporting the digital transformation of modern society. Its on-demand supply, elastic expansion and resource pooling characteristics have been widely used in education, medical care, finance, government affairs and industrial manufacturing. In the current mainstream cloud computing service architecture, virtual machines (VMs) are the main paradigm of cloud service provision, and the security of VMs is highly dependent on the virtual machine monitor (VMM). Therefore, many attackers have made the VMM on the cloud environment as the main attack target.

[0003] The VMM is a bottom-layer software running between physical hardware and virtual machines, which is responsible for managing and arbitrating the access of all virtual machines to hardware resources (such as CPU, memory, I / O devices), and is the cornerstone of resource isolation and virtualization. From a security perspective, the VMM is the core part of the entire cloud platform providing virtualization services. Once its security is compromised, all VMs hosted by it will face serious security risks, and even further threaten the security of the entire cloud computing. Among them, the VMM escape attack is the most typical attack. Attackers may first exploit the vulnerabilities of the VM operating system or its application programs to successfully break into a single VM. Then, they can use it as a springboard to break through the security boundary built by the VMM, so that the attacker can obtain illegal access and control permissions of the VMM level and even other tenant VMs on the same physical machine from the inside of the controlled VM. Once the VMM is compromised, the entire physical server and all tenant workloads on it will fall into the hands of the attacker, which will lead to large-scale data leakage, service interruption and devastating damage to the reputation of the cloud infrastructure. Therefore, how to ensure the runtime security of the VMM in the cloud link has become a problem to be solved in the field of cloud computing security.

[0004] Trusted computing is an information technology designed to ensure endpoint security from the source. Its core concept is to build a trusted computing environment by implementing comprehensive protection measures at the hardware, firmware, operating system, and application levels, isolating the vast majority of security threats from the endpoint. This technology relies on a physically secure chip centered around a Trusted Platform Module (TPM). This module has tamper-proof characteristics and can accurately measure, securely store, and reliably report the integrity status of critical system components, thereby ensuring that these core components are protected from damage and laying a solid security foundation for the entire computing system.

[0005] Combining trusted computing concepts with virtualization security offers a new approach to hardening cloud infrastructure. By incorporating the Virtual Machine Model (VMM) and its key components into the scope of trusted chain metrics, the integrity of the VMM's code can be ensured, preventing malicious tampering. Summary of the Invention

[0006] To address the aforementioned security issues, the present invention aims to provide a KVM runtime integrity measurement method based on adaptive thresholds. This method monitors KVM's system call activity in real time during runtime and adaptively adjusts the measurement triggering conditions based on the frequency of system call activity. It combines a random sampling mechanism to perform lightweight measurement of KVM code segments and verifies integrity by comparing the results with a benchmark value stored securely. This invention achieves KVM runtime integrity protection while effectively controlling additional system overhead.

[0007] A KVM runtime integrity measurement method based on adaptive thresholds includes the following steps:

[0008] Step 1: Generating KVM metric baselines:

[0009] During the initialization phase, all virtual memory pages corresponding to the KVM code segment are obtained, and the hash value of each virtual memory page is calculated. Data in the data area of ​​each virtual memory page that does not belong to the KVM code segment is replaced with zero bytes. Then, the hash values ​​of all virtual memory pages after replacement are saved in order of their corresponding virtual addresses to generate a base value file, and the base value file is digitally signed using TPM.

[0010] Step 2: Dynamic triggering of KVM runtime metrics:

[0011] During KVM operation, the frequency of ioctl system calls is monitored within a preset time window. When the number of ioctl triggers reaches a threshold within the time window, a runtime metric of KVM is immediately triggered and the counting is paused. If the metric has not been executed by the end of the time window, a metric operation is immediately triggered. After each metric trigger, the metric trigger threshold for the next time window is dynamically adjusted based on the relative position of the current metric trigger time within the time window.

[0012] Step 3: KVM runtime metrics:

[0013] After the runtime metric is triggered, the virtual memory pages of the KVM code segment in the current memory are sampled according to the randomly generated sampling sequence; the hash value of each sampled memory page in the sampling sequence is calculated, and then the metric value is calculated.

[0014] Step 4: KVM runtime integrity verification:

[0015] After the KVM runtime measurement is completed, the baseline value file is digitally signed and verified using TPM. After the signature verification is successful, the baseline value for this integrity verification is calculated based on the sampling sequence used in this measurement. If the current measurement value is consistent with the baseline value, the integrity verification of the KVM runtime is deemed to have passed.

[0016] The beneficial effects of this invention are:

[0017] This invention achieves runtime measurement of KVM by introducing a system call frequency monitoring and adaptive triggering mechanism;

[0018] This invention dynamically adjusts the measurement triggering conditions, ensuring both the randomness and real-time nature of the measurement timing and the frequency of measurement execution, effectively avoiding performance bottlenecks caused by excessively frequent measurements or security blind spots caused by infrequent measurements.

[0019] This invention combines random sampling and benchmark comparison strategies to significantly improve the unpredictability and tamper resistance of integrity verification while ensuring lightweight operation.

[0020] This invention not only enhances the real-time detection and defense capabilities against potential runtime attacks, but also provides reliable technical support for the secure and trustworthy operation of virtualization platforms in cloud environments, thereby enhancing the system's proactive defense capabilities and long-term security. Attached Figure Description

[0021] Figure 1 This is the process of generating KVM metric benchmark files.

[0022] Figure 2 This is a diagram illustrating the dynamic triggering of KVM runtime metrics.

[0023] Figure 3 This is a diagram illustrating KVM runtime metrics.

[0024] Figure 4 This is a diagram illustrating KVM integrity verification. Detailed Implementation

[0025] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. The present invention proposes a batch cloud forensics method based on trusted computing. In the initialization phase, a baseline value file for the KVM code segment is generated and digitally signed. In the runtime phase, the timing of measurement is dynamically determined by monitoring the frequency of KVM's ioctl system calls and combining this with an adaptively adjusted trigger threshold. When measurement is triggered, a random sampling mechanism is used to perform hash calculations on the virtual pages of the KVM code segment to generate aggregated measurement values. In the verification phase, integrity verification is completed by comparing the reconstructed baseline value with the real-time measurement results.

[0026] The specific steps are as follows:

[0027] Step 1: Generate KVM metric baseline values.

[0028] The system retrieves all virtual memory pages corresponding to the KVM code segment by parsing ` / proc / kallsyms`, and calculates the hash value of each page. During calculation, for each page, data regions that do not belong to the KVM code segment are identified, and the data within these regions is replaced with zero bytes. Subsequently, the hash values ​​of all pages are saved in order of their corresponding virtual addresses, generating a baseline file. Finally, the baseline file is digitally signed using TPM to ensure its integrity and immutability.

[0029] Figure 1 The process of generating KVM baseline files is described:

[0030] Step 1 specifically involves:

[0031] Step 1.1: Parse / proc / kallsyms to obtain the start and end virtual addresses of the KVM code segment.

[0032] Step 1.2: Based on the address range obtained in Step 1.1, enumerate all the virtual memory pages it covers. For each page, identify the data regions within the page that do not belong to the KVM code segment using the virtual address, and replace them with 0 bytes. For example... Figure 1 As shown in ①, the black part is the KVM code segment content. The content in the page that does not belong to the KVM code segment is replaced with 0 bytes, and the binary data of the entire virtual memory page is extracted.

[0033] Step 1.3: As Figure 1As shown in ② and ③, the processed virtual memory pages described in step 1.2 are hashed, and all hash values ​​are stored in order of their corresponding virtual addresses to generate a metric benchmark file.

[0034] Step 1.4: As Figure 1 As shown in ④, TPM is used to digitally sign the measurement benchmark value file described in step 1.3 to ensure the integrity, authenticity and immutability of the file.

[0035] Step 2: KVM runtime metrics are dynamically triggered.

[0036] During KVM operation, the frequency of ioctl system calls is monitored within a preset time window to determine the timing of runtime metrics triggering. When the number of ioctl triggers reaches a threshold within a time window, a KVM runtime metric is immediately triggered, and the ioctl system call count is paused before the end of the time window to ensure no additional metrics are executed. If no metrics are executed by the end of the time window, a metric operation is immediately triggered. After each metric trigger, the metric trigger threshold for the next time window is dynamically adjusted based on the relative position of the current metric trigger time within the time window.

[0037] Figure 2 The KVM runtime metric dynamic triggering method is described, and step 2 specifically includes:

[0038] Step 2.1: During KVM operation, monitor the ioctl system calls within each preset time window and count the number of ioctl system calls.

[0039] Step 2.2: If the number of ioctl calls reaches the trigger threshold within a time window, a KVM runtime metric is immediately triggered, and the ioctl counting stops for the remainder of the time window.

[0040] Step 2.3: If no metric has been triggered by the end of the time window, a KVM runtime metric is triggered immediately when the window ends.

[0041] Step 2.4: Each time a metric is triggered, the trigger threshold will be adjusted based on the relative position of the current metric within the time window. Assuming the time window length is T, and the current trigger threshold is... Then the threshold update rule is:

[0042] If the metric is triggered in the interval (0, T / 2), the trigger threshold will be updated as follows:

[0043] ;

[0044] in, The range is indicated in Random numbers.

[0045] If the metric is triggered in the interval [T / 2, T), the trigger threshold will be updated as follows:

[0046] ;

[0047] in, It is within the range ) random numbers.

[0048] If the measurement window is triggered at its end, the threshold is updated according to the following formula:

[0049] ;

[0050] Among them, operators This indicates rounding down to the nearest integer.

[0051] Step 3: Execute KVM runtime metrics.

[0052] When a runtime metric is triggered, virtual memory pages of the KVM code segment in the current memory are sampled according to a randomly generated sampling sequence, and the hash value of each sampled memory page in the sampling sequence is calculated. Then, all hash values ​​are concatenated in their sampling order, and the concatenated composite data is hashed again. The result is the runtime metric value for this time. The sampling sequence and the runtime metric value are recorded together in a metric log, and the runtime metric value is extended to the specified PCR (Platform Configuration Register).

[0053] Figure 3 The KVM runtime metrics method is described, and step 3 specifically involves:

[0054] Step 3.1: According to preset parameters ,in Calculate the number of pages c to be sampled. Specifically, assuming the number of KVM code segment pages obtained in step 1.2 is n, then... , where the operator This indicates rounding up to the nearest integer.

[0055] Step 3.2: Generate a random number sequence of length c as the sampling sequence S. The elements in S are arranged in strict ascending order, and all elements are integers in [0, n-1].

[0056] Step 3.3: Sample the KVM code segment according to the sampling sequence S described in Step 3.2. For each element in S... The first KVM code segment collected Add one page, and calculate the hash value of that page according to steps 1.2 and 1.3. Finally, concatenate the hash values ​​of each page in the corresponding sampling order and perform another hash; the result is the metric for this measurement. Figure 3 As shown in ① and ②, the virtual pages corresponding to the KVM code segment, such as page 1 and page 3, are sampled according to the sampling sequence. After processing, each page is hashed. The hash values ​​of each page are concatenated in the corresponding sampling order and then hashed again. The result H' is the measurement result of this time.

[0057] in, Let represent the i-th element of the sampling sequence S, which is a random integer in the range [0, n-1]. For example, if S = {0, 2, ...}, then... =0, =2……, then the first virtual page and the third virtual page of KVM are sampled accordingly.

[0058] Step 3.4: As Figure 3 As shown in ③ and ④, the measurement value described in step 3.3 is extended to the specified PCR, and the measurement value and the sampled sequence generated in this step are recorded in the measurement log.

[0059] Step 4: KVM runtime integrity verification.

[0060] After the KVM runtime metric is completed, the baseline value file is digitally signed and verified using TPM. Once the signature verification is successful, the corresponding virtual page hash value is extracted from the baseline value file based on the sampling sequence used in this metric. These baseline hash values ​​are then concatenated in order and hashed to obtain the baseline value for this integrity verification. This result is compared with the current metric value. The integrity verification of the KVM runtime is considered successful only if both the first verification step (signature verification) and the second verification step (comparison of the metric value and the baseline value) are successful.

[0061] Figure 4 The process of performing KVM runtime integrity verification is described:

[0062] Step 4 specifically involves:

[0063] Step 4.1: As Figure 4 As shown in ①, TPM is used to perform digital signature verification on the baseline value file described in step 1. Subsequent steps are only performed if the signature verification passes.

[0064] Step 4.2: Based on the sampling sequence used in this measurement, extract the hash value of the corresponding page from the baseline value file, concatenate them according to the corresponding sampling sequence, and then hash them to obtain the baseline value for this integrity check. For example... Figure 4As shown in ②, based on the sampling sequence S, the hash values ​​of the first page, third page, and other virtual pages of the KVM code segment in the baseline value file are extracted, concatenated in the sampling order, and then hashed. The result B is the baseline value for this integrity verification.

[0065] Step 4.3: As Figure 4 As shown in ③, the current metric value is compared with the current baseline value. If the two are consistent, the KVM runtime integrity verification is considered to have passed.

Claims

1. A KVM runtime integrity measurement method based on adaptive thresholds, characterized in that, Includes the following steps: Step 1: Generating KVM metric baselines: During the initialization phase, all virtual memory pages corresponding to the KVM code segment are obtained, and the hash value of each virtual memory page is calculated. Replace the data in the data area of ​​each virtual memory page that does not belong to the KVM code segment with zero bytes; then save the hash values ​​of all virtual memory pages after replacement in order of their corresponding virtual addresses to generate a base value file, and use TPM to digitally sign the base value file; Step 2: Dynamic triggering of KVM runtime metrics: During KVM operation, the frequency of ioctl system calls is monitored within a preset time window. When the number of ioctl triggers reaches a threshold within the time window, a runtime metric of KVM is immediately triggered, and the counting is paused. If a measurement has not been performed by the end of the time window, a measurement operation will be triggered immediately. After each metric is triggered, the metric trigger threshold for the next time window is dynamically adjusted based on the relative position of the current metric trigger time within the time window. Step 3: KVM runtime metrics: After the runtime metric is triggered, the virtual memory pages of the KVM code segment in the current memory are sampled according to the randomly generated sampling sequence; Calculate the hash value of each sampled memory page in the sampling sequence, and then calculate the current metric value; Step 4: KVM runtime integrity verification: After the KVM runtime measurement is completed, the baseline value file is digitally signed and verified using TPM. After the signature verification is successful, the baseline value for this integrity verification is calculated based on the sampling sequence used in this measurement. If the current measurement value is consistent with the baseline value, the integrity verification of the KVM runtime is deemed to have passed.

2. The KVM runtime integrity measurement method based on adaptive threshold according to claim 1, characterized in that, Step 1 specifically includes: Step 1.1: Parse / proc / kallsyms to obtain the start and end virtual addresses of the KVM code segment; Step 1.2: Based on the address range obtained in Step 1.1, enumerate all the virtual memory pages it covers; for each virtual memory page, identify the data area within the virtual memory page that does not belong to the KVM code segment by using the virtual address, and replace it with 0 bytes; Step 1.3: Hash the virtual memory pages replaced in Step 1.2, store all hash values ​​in order of their corresponding virtual addresses, and generate a benchmark value file; Step 1.4: Use TPM to digitally sign the measurement benchmark file generated in Step 1.3 to ensure the integrity, authenticity and immutability of the measurement benchmark file.

3. The KVM runtime integrity measurement method based on adaptive threshold according to claim 1, characterized in that, Step 2 specifically includes: Step 2.1: During KVM operation, monitor the ioctl system calls within each preset time window and count the number of ioctl system calls. Step 2.2: If the number of ioctl calls reaches the trigger threshold within a time window, a KVM runtime metric is immediately triggered, and the ioctl counting stops for the remainder of the time window. Step 2.3: If no metric has been triggered by the end of the time window, then trigger a KVM runtime metric immediately at the end of the window; Step 2.4: Each time a metric is triggered, the trigger threshold will be adjusted according to the relative position of the current metric within the time window.

4. The KVM runtime integrity measurement method based on adaptive threshold according to claim 1, characterized in that, The specific steps for adjusting the trigger threshold in step 2.4 are as follows: Assuming the time window length is T, and the current trigger threshold is... The threshold update rule is then triggered as follows: If the metric is triggered in the interval (0, T / 2), the trigger threshold will be updated as follows: ； in, The range is indicated in A random integer; If the metric is triggered in the interval [T / 2, T), the trigger threshold will be updated as follows: ； in, It is within the range A random integer; If the trigger occurs only at the end of the measurement time window, the trigger threshold will be updated to: ； Among them, operators This indicates rounding down to the nearest integer.

5. The KVM runtime integrity measurement method based on adaptive threshold according to claim 2, characterized in that, Step 3 specifically includes: Step 3.1: According to preset parameters ,in Calculate the number of pages c to be sampled; specifically, assuming the number of virtual memory pages of the KVM code segment obtained in step 1.2 is n, then the number of pages c to be sampled is: ； Among them, operators Indicates rounding up; Step 3.2: Generate a random number sequence of length c as the sampling sequence S. The elements in the sampling sequence S are arranged in ascending order, and all elements are integers in [0, n-1]. Step 3.3: Sample the KVM code segment according to the sampling sequence S; for each element in the sampling sequence S... The first KVM code segment collected Page, and calculate the first according to steps 1.2 and 1.

3. The hash value of each page; finally, the hash values ​​of each page are concatenated according to the corresponding sampling order and hashed again. The result is the measurement value for this time. Step 3.4: Extend the current measurement value to the specified PCR and record it along with the sampled sequence S in the measurement log.

6. The KVM runtime integrity measurement method based on adaptive threshold according to claim 1, characterized in that, Step 4 specifically includes: Step 4.1: Use TPM to digitally sign the baseline value file described in Step 1. Only proceed to the next step if the signature verification is successful. Step 4.2: Based on the sampling sequence used in this measurement, extract the hash value of the corresponding virtual memory page from the baseline value file, concatenate them according to the corresponding sampling sequence, and then hash them to obtain the baseline value for this integrity check; Step 4.3: Compare the current metric with the baseline value. If they match, the KVM runtime integrity verification is considered successful.

Images