NoHype:云计算安全新策略——去中心化虚拟化保护

需积分: 10 65 浏览量更新于2024-09-13 收藏 1003KB PDF 举报

云计算虚拟化层安全是当前云服务领域的重要议题，尤其是在保证服务可用性的同时，如何提升系统的安全性。虚拟机管理器（VMM）层作为云计算架构中的关键组件，其复杂性和庞大代码量往往意味着更高的漏洞风险。攻击者可以利用这些漏洞对虚拟机（VM）进行攻击，从而影响到其他共享资源的VM，这引发了企业向云迁移时的严重安全顾虑。本文提出了一种名为"无Hype系统"（NoHype）的方法，旨在通过精简虚拟机管理器（Hypervisor）来消除这一安全隐患。NoHype系统的核心在于四个关键技术点： 1. 预分配处理器核心和内存资源：通过预先为每个VM预留特定的硬件资源，避免了因资源竞争引发的安全问题，同时保持了并发运行多个VM的能力。 2. 使用虚拟化I/O设备：通过虚拟化I/O设备，将底层硬件与VM隔离开来，减少了直接暴露在外部攻击路径上的组件，降低了潜在攻击面。 3. 最小化的修改：NoHype系统对VMM进行了优化，尽可能减少不必要的功能，降低引入新漏洞的可能性。这意味着在保持功能完整性的同时，简化了系统架构，使其更难以被恶意利用。 4. 隔离与安全设计：通过上述策略，NoHype使得guest VM能够在底层硬件上原生运行，实现了更为严格的权限控制，确保每个VM只能访问其预定义的资源范围，进一步减小了攻击者能触及的范围。这种设计方法不仅提升了云计算环境的整体安全性，还提高了资源利用率和性能，因为它消除了传统的Hypervisor攻击面，减少了系统复杂性带来的安全风险。这对于企业和组织来说，是实现云迁移过程中必不可少的安全保障措施。未来的研究可能还会围绕如何在保持兼容性和灵活性的同时，持续优化虚拟化层的安全性进行探索。

Figure 2: VM exits in stock Xen 4.0 during server bootup and runtime of a guest VM.

host OS may also include drivers for the physical devices

which are used by the system (

). An emulator which em-

ulates system devices that guest VMs interact with is also

commonly run within the host OS. All together, this func-

tionality req uires over a million lines of code.

We now dicuss the roles of the hypervisor in emulating and

managing th e main resources in today’s computer systems.

Processor cores: The ﬁrst responsibility of any virtualiza-

tion solution is the ability to arbitrate access to the processor

cores as well as sometimes emulate their functionality. The

hypervisor needs to cope with the dyn amic addition and re-

moval of VMs as they get started and stopped, as well as

the ability to schedule multiple VMs on the same system. In

addition to scheduling the VMs, the virtualization layer also

uses the scheduler to periodically, every clock tick, run some

of its own functionality – for example the hypervisor need s

to check whether to deliver timer interrupts to the VM in

this clock tick. The virtualization layer may also emulate

the underlying processor as the presented processor cores

may diﬀer in capabilities from the actual cores.

Memory: The hypervisor is also in charge of managing the

host physical memory of the system. Each VM is assigned

some guest physical memory that the guest OS can man-

age and assign as virtual memory to the applications. Here,

the virtualization layer can take a number of diﬀerent ap-

proaches to managing the allocation of host physical memory

among the various VMs. One popular use of virtualization is

server consolidation which relies on the virtu alization layer

to dynamically manage the allocation of physical memory

to the diﬀerent VMs in the system.

I/O devices: Another important functionality of the virtu-

alization layer is dealing with I/O devices such as a network

interface card (N IC). Today’s virtualization solutions com-

monly create virtual devices that they assign to the guest

VMs. The v irtualization layer needs to manage these virtual

devices and emulate their behavior. There is also the option

of dedicating physical devices to the VMs. In t his situation,

the virtualization layer only needs to assign and reclaim the

devices. It does not need to emulate their behavior. In both

cases, however, the emulator is needed to emulate the PCI

(Peripheral Component Interconnect) bus. The guest OS

interacts with the PCI bus d uring bootup to discover and

conﬁgure the available devices.

Interrupts and Timers: The virtualization layer must also

emulate the interrupt subsystem and timers for the guest

VMs.

For interrupts, the main parts of the underlying hard-

are interrupt subsystem emulated by the hypervisor in-

clude the I/O APIC

(which routes interrupts from devices

to processor cores) and local APICs (which are attached

to each core as an interface to the interrupt subsystem for

sending and receiving interrupt messages to and form other

local APICs or the I/O APIC). These APICs are emulated

so the guest OS can use them to conﬁgure and manage in-

terrupts inside the VM, while physical APICs are controlled

by the hypervisor for the management of the physical plat-

form.

For timers, since the hypervisor utilizes the physical

imer devices to get periodic clock ticks itself, it has to em-

ulate the timer device for each guest VM. Today, VMs can

be scheduled on diﬀerent cores and as such, the interrupts

and timers must ﬁrst go through the hypervisor which will

deliver th e interrupts to the VM by utilizing its knowledge

of the VM’s current location.

2.2 Attack Surface

The v irtualization layer is heavily involved throughout the

lifetime of the guest VM. Each interaction between the VM

and the hypervisor is then a potential attack vector that

could be exploited by the guest. The guest O S interacts di-

rectly with the hypervisor (

) and indirectly with the host

OS and the emulator (

) through VM exits (and hyper-

calls if paravirtualization is used). A VM exit is an event

which occurs when the VM’s code is interrupted and the hy-

pervisor code begins to execute to h andle some event (e.g.,

emulate memory access, deliver a virtual timer interrupt,

etc.). A hypercall is similar to a system call and is used by

guest VMs to request explicit service from the hypervisor.

Hypercalls are not considered further as we are not using

paravirtualization. VM exits are quite frequent even when

the guest OS inside the VM is not doing any work; in an idle

VM running on top of Xen 4.0, the VM exits occur ∼600

times per second.

On a 64-bit Intel x86 architecture with virtualization ex-

tensions, there are 56 reasons for VM exits, and this forms

the large attack surface which is the basis of the security

threat.

The reasons VM for exits are described in Table

. Each VM exit causes the hypervisor code to run so the

hypervisor can intervene when the guest OS performs some

operation that caused the associated exit. This allows the

hypervisor to maintain the abstraction of the system which

it presents to the guest OSes, for example it can return dif-

ferent CPUID values than the values actually reported by

the hardware.

In order to emphasize how often the large and complex

PIC is the advanced programmable interrupt controller.

403

剩余11页未读，继续阅读

rongbear

粉丝: 0
资源: 11

NoHype:云计算安全新策略——去中心化虚拟化保护

云计算虚拟化安全：威胁分析与技术架构

云计算虚拟化技术全套PPT课件资源

云计算虚拟化安全深度剖析：挑战与未来发展

云计算虚拟化平台安全分析.doc

云计算虚拟化技术安全防护.pdf

云计算虚拟化平台安全问题研究.pdf

云计算虚拟化技术安全挑战调查-研究论文

试析云计算虚拟化安全技术.pdf

云计算虚拟化安全问题的研究.docx

云计算虚拟化安全测评方法研究.pdf

最新资源