面向云的动态完整性度量框架设计.pdfVIP

面向云的动态完整性度量框架设计 1 1 1 毛亚强 ，王瑶 ，骆源 1 上海交通大学电子信息与电气工程学院，上海200240 摘要：随着虚拟化技术在云服务中的广泛研究和应用。保证虚拟机的完整性可以让云服务商为 客户提供更加可靠和安全的计算环境。本文针对云环境下的虚拟机设计并实现了一个动态完整 性度量框架 EHybrid-M ：该框架在客户虚拟机内部动态度量用户软件在内存中的完整性；同时 利用内省技术，在客户虚拟机外部监控其内核的完整性。相比于其他度量框架，EHybrid-M 具 有度量的动态性、可扩展（Extension ）的完整性以及内外混合（Hybrid ）监控的优点。在Xen 虚拟机上实现了 EHybrid-M 原型系统，这个原型不仅完成了预期的目标，并且给虚拟机带来 了轻量级的性能消耗。 关键词：虚拟化；完整性度量；语义鸿沟；虚拟机内省；Xen 中图分类号：TP315 A Design of Dynamic Integrity Measurement Framework towards The Cloud 1 1 1 MAO Ya-qiang , WANG Yao , LUO Yuan 1 Department of Computer Science and Engineering , Shanghai Jiao Tong University, Shanghai 200240 Abstract: With the extensive researches and applications of virtualization technology in Cloud, the Cloud Service Provider provides customs with a more reliable and secure computing environment via guaranteeing the integrity of virtual machine (VM). In this paper, we design and implement a dynamic integrity measurement framework EHybrid-M on the top of virtual machine towards the cloud. The framework measures software’s memory image integrity in guest VM and monitors the guest OS kernel integrity out of VM leveraging virtual machine introspection (VMI) technology. Compared with other measurement framework, EHybrid-M has following advantages: 1.Dynamic measurement; 2.Extensional integrity; 3.In and out of VM hybrid monitoring. A prototype system of EHybrid-M was implemented based on Xen and the prototype system not only achieved all expected goals, but also introduced a light performance overhead. Key words: virtualization; integrity measurement; semantic gap; virtual machine introspection; Xen 基金项目： 博士点基金 (No. 20100073110016) 作者简介：毛亚强（1990-），男，硕士研究生，主要研究方向：虚拟化安全。通信作者：骆源（1971-），男，教授