作　　者： ; ; ; ;

机构地区： 湘潭大学数学与计算科学学院

出　　处： 《计算机应用研究》 2010年第8期3045-3049,共5页

摘　　要： 虚拟化技术越来越多地被用于增强商用操作系统的安全性。现有的解决方案通常将虚拟机管理软件(VMM)作为可信集,利用其作为底层架构的优势来为上层软件提供安全功能。这些方案都是基于通用虚拟机管理软件,因而存在以下问题:a)虚拟化性能上开销大;b)作为可信集相对比较庞大;c)不能提供有效的信任链证明自身可信性。针对上述问题,提出以轻量虚拟机监控器作为可信集的安全架构——Cherub架构,Cherub利用主流处理器的安全扩展指令和硬件辅助虚拟化技术在运行的操作系统中插入轻量级的虚拟机监控器,并利用该虚拟机监控器作为可信集用于实现多种安全目标。实验结果证明了该架构的有效性,并具有代码量小、动态可加载和虚拟化开销小等优点。 Virtualization technology is more and more popular in enhancing the security of the operating system. The previous solutions usually take the virtual machine moniter （ VMM） as the trusted computing base （ TCB） and provide a security func- tion by virtualization technology. However,those solutions have the following problems： a） Virtualization brings overhead which requires the users to bear the cost of virtualization when they don’t need high security environment. b） The general-purpose VMMs based solution cannot meet the users’（ especially the client-side users） demand for the environmental diversity. c） The general-purpose VMMs are relatively large as a trusted computing base （ TCB） . This paper addressed the challenge to reduce the overhead of virtualization and established a dynamic chain of trust when used VMM to enhance the security of OS. This paper proposed a security architecture named Cherub which took a lightweight virtual machine moniter（ LVMM） as the TCB. Cherub utilized the dynamic root of trust for measurement and hardware virtualization to insert a trusted LVMM under the commercial operating system,which could be the TCB to achieve various security goals. Implemented Cherub in Linux and the evaluation demonstrates that Cherub is effective and practical in security and performance perspectives.

关 键 词： 轻量级虚拟机监控器 信任链 安全架构 动态加载

领　　域： [自然科学总论]