Client virtual machine memory dynamic isolation and monitoring method and system

Abstract

The present invention provides a method and system for dynamically isolating and monitoring the memory of a client virtual machine. In the client virtual machine, a user request processing module, an extended page table exception interception and processing module, a virtual machine monitor interaction module, and an extended page table communication module are respectively deployed. module, respectively deploying the extended page table management module and the application behavior learning module in the virtual machine monitor. Utilizes virtual machine kernel address space isolation technology to effectively defend against the theft of key kernel data and random overwrite attacks on memory. Even if the vulnerability of a module in the kernel is mastered, the protected key data cannot be tampered with at will. Provide different isolated execution environments for different modules to protect the kernel from unauthorized data theft and memory overwrite attacks. Use the virtualization mechanism provided by the hardware to accelerate the switching function of the extended page table and reduce performance overhead.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to a method and system for dynamically isolating and monitoring the memory of a guest virtual machine. Background technique [0002] Kernel security of operating systems has always been a research hotspot in academia and industry. Because the kernel has higher authority than user-mode programs, once the kernel is compromised by an attacker, the entire system will lose its protection. With the prevalence of cloud platforms, many manufacturers place their services on cloud platforms, but kernel security issues are still important. Most of the virtual machines have run large-scale operating systems such as linux and windows, and a large number of user programs have run on these operating systems. Both the operating system and the user program are complex software. This complexity makes it difficult to find many hidden errors or loopholes in the entire system, and these erro...

AI Technical Summary

Problems solved by technology

The above scheme can realize read-only protection for key data in the same privilege level. However, in terms of security, attackers still have specific read permissions for key data, and there is still the possibility of leakage of sensitive data.

In terms of performance, because every time you modify key data or key registers, you need to enter the Nested Kernel to simulate execution, so some micro benchmarks have a greater impact on performance

Images