基于虚拟机监控器Windows剪贴板操作监控.docVIP

基于虚拟机监控器Windows剪贴板操作监控 　　摘要：针对现有剪贴板操作监控无法抵御内核层攻击，且所采取的单一保护策略无法满足现实需求的问题，提出一种基于虚拟机监控器（VMM）的文档内容剪贴板操作监控技术，并提出基于剪贴板操作监控的电子文档分级保护策略。首先，通过修改影子寄存器的方法在VMM层截获并识别系统调用；其次，监控文档打开操作建立进程标识符和文档路径之间的映射表，并在截获到剪贴板操作后通过进程标识符解析文档路径；最后，根据电子文档分级保护策略对剪贴板操作进行过滤。实验结果表明，监控系统给客户机文件系统带来的性能损耗随着文件读写块的增大而减小，当读写块大小达到64KB以上时，客户机性能损耗在10%以内，对用户影响不大。 　　关键词：虚拟机监控器；剪贴板监控；系统调用；电子文档；分级保护 　　中图分类号： TP309.2 　　文献标志码：A 　　Abstract：The existing methods for monitoring clipboard operations cannot defend kernellevel attacks and satisfy the practical needs due to the simple protection strategy. In order to mitigate these disadvantages， a clipboard operations monitoring technique for document contents based on Virtual Machine Monitor （VMM） was proposed， as well as a classification protection strategy for electronic documents based on clipboard operations monitoring. 　　Firstly， system calls were intercepted and identified in VMM by modifying the shadow registers. Secondly， a mapping table between process identifier and document path was created by monitoring the document open operations， then the document path could be obtained by process identifier when the clipboard operations were intercepted. Finally， clipboard operations were filtered according to classification protection strategy. The experimental results show that the performance loss to Guest OS file system caused by the monitoring system decreases with the increase of the record size； when the record size reaches more than 64KB， the performance loss is within 10%， which has little effect on the user. 　　Key words：Virtual Machine Monitor （VMM）； clipboard monitoring； system call； electronic document； classification protection 　　0 引言 　　随着信息技术的快速发展，电子文档逐渐取代了传统纸质文档。电子文档的广泛使用为信息处理过程带来了便利，但却使得信息泄露问题日趋严重。常见的文档保护方法包括设置文档密码、访问控制列表（Access Control List， ACL）、加密文件系统（Encrypting File System， EFS）[1]等。但无论采取以上哪种保护方式，在文档被打开后，攻击者便可以利用剪贴板非法窃取到文档明文内容，从而造成信息泄露。因此，对剪贴板实施有效监控是防止信息泄露的一个必要功能。 　　剪贴板监控技术的研究是按照从应用层到内核层发展的，随着内核层攻击的出现，大量恶意程序能够获得内核权限，这使得现有监控技术无法保证自身的安全性。虚拟机监控器（V