JP2008269589A - Safe apparatus and method for protecting system in virtualized environment - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To guarantee a security service by protecting system resources from a malicious access such as a malignant code (malware) in a virtualized environment and solving a system failure. <P>SOLUTION: The system protecting apparatus which is safe in a virtualized environment includes a domain unit including a plurality of domains, each having at least one device driver; a system resource unit forming hardware of a device; a DMA (direct memory access) driver; and a control unit including an access control module which controls the access of the domain unit to the system resource unit in the virtualized environment. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a system protection apparatus and method, and more particularly to secure system protection in a virtualized environment for protecting system resources from malicious access in a virtualized environment and ensuring a safe security service. The present invention relates to an apparatus and a method.

  Generally, devices such as a PC, a PDA, a wireless terminal, and a DTV can use a virtualization technology to realize safety and various applications and services. In order to provide a safe environment in such a virtualization technology, functions such as a security boot (Secure Boot), a security software (Secure SW), and an access control (Access Control) are required.

FIG. 1 is a block diagram illustrating the configuration of a conventional virtualization system apparatus.
As shown in FIG. 1, the conventional virtualization system apparatus is a virtual environment using a virtual machine monitor (VMM) 10, and includes a domain unit 20 having a large number of domains (21, 22,...) , ROM, a central processing unit (CPU), a memory, a battery, a system resource unit 30 including an input / output device (I / O DEVICE), and the like.

  Each domain (21, 22,...) Of the domain unit 20 includes at least one device driver (21a, 22a,...), And at least one of the multiple domains (21, 22,...). One domain 21 includes a DMA driver 21b. In such a conventional virtualization system apparatus, the domain unit 20 performs processing for DMA, and there is no limitation in forming a channel between domains. Further, when each domain (21, 22,...) Approaches the system resource unit 30, simple access control is performed in either one of the domain unit 20 or the VMM 10.

  However, in the conventional virtualization system apparatus as described above, the DMA processing is performed in the domain unit 20 and the VMM 10 does not perform the access control for preventing the domain unit 20 from maliciously approaching the system resource unit 30. There is a system security problem.

  More specifically, since DMA is performed in domain 21 and access control to physical memory is not provided, if there is an unstable domain or a buggy device driver in the domain, the VMM or other domain There is a problem that a system failure is caused by approaching a physical domain, bringing confidential data, or overwriting dummy data.

  In addition, when a specific domain uses system memory excessively, there is a problem that a system failure is caused to hinder system availability.

In addition, the number of event channels formed between two domains is limited, but if all the event channels that can be used by a malicious specific domain are used, an event channel cannot be formed between the remaining domains. System failure will result.
Korean Published Patent No. 2007-0108723

  The present invention has been devised to solve the above-described points, and solves a system failure by protecting system resources from malicious access such as malicious code in a virtual environment, The present invention relates to a system protection apparatus and method that are safe in a virtual environment that can ensure a safe security service.

  The objects of the present invention are not limited to the objects mentioned above, and other objects not mentioned will be clearly understood by those skilled in the art from the following description.

  In order to achieve the above object, a secure system protection apparatus in a virtual environment according to an embodiment of the present invention configures a domain unit including a plurality of domains including at least one device driver, and device hardware. A system resource unit; and a control unit including a DMA (Direct Memory Access) driver and an access control module that controls an access operation of the domain unit to the system resource unit in a virtual environment.

  In order to achieve the other objects, a secure system protection method in a virtualized environment according to an embodiment of the present invention includes a device driver I / O space and an IRQ (interrupt request) for each system resource unit. Requesting number assignment, determining whether the domain executing the device driver is allowed access authority to the system resource unit by a predetermined access control policy, and the access control policy If the access authority of the domain to the resource unit is allowed, the requested I / O space and IRQ number are assigned to the device driver of the domain, otherwise the requested I / O space and IRQ number are assigned. Includes non-assignment stages.

  According to another aspect of the present invention, there is provided a method for protecting a system in a virtual environment, wherein a specific device driver of a domain requests access to a memory of a system resource unit through a DMA. Determining whether a domain executing the specific device driver attempts to access the memory to which access authority is allowed according to a predetermined access control policy, and the domain attempts to access the memory according to the access control policy. And allowing the specific device driver of the domain to access the requested memory, and not allowing the specific device driver of the domain to access the requested memory.

According to another aspect of the present invention, a system protection method that is secure in a virtualized environment requests allocation of system resources in at least one domain among a plurality of domains. Determining whether the allocation amount of the system resource requested in the domain does not exceed a reference value set by a predetermined access control policy, and the allocation amount of the system resource requested by the domain according to the access control policy; If the requested system resource is less than or equal to the set reference value, the requested system resource is allowed to be allocated to the domain; otherwise, the requested system resource is not allowed to be allocated.
Specific matters of other embodiments are included in the detailed description and the drawings.

  According to the system protection apparatus and method safe in the virtual environment of the present invention as described above, the system resource is protected from malicious access such as malicious code in the virtual environment, and the system failure is solved. Safe security service can be ensured.

  The effects of the present invention are not limited to the effects mentioned above, and other effects that are not mentioned will be clearly understood by those skilled in the art from the claims.

  Advantages and features of the present invention and methods of achieving them will be apparent with reference to the embodiments described in detail below in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, and can be embodied in various forms different from each other. The embodiments merely complete the disclosure of the present invention and the technical field to which the present invention belongs. And is provided to fully inform those skilled in the art of the scope of the invention, which is defined only by the claims. Like reference numerals refer to like elements throughout the specification.

  Hereinafter, a system protection apparatus and method that are secure in a virtual environment according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings. If it is determined that a specific description of a known function or configuration related to the description of the present invention as a reference may obscure the gist of the present invention, a detailed description thereof will be omitted.

  FIG. 2 is a block diagram illustrating the configuration of a system protection device that is secure in a virtual environment according to an embodiment of the present invention.

  As shown in FIG. 2, a system protection apparatus that is secure in a virtualization environment according to an embodiment of the present invention includes a domain unit 100, a system resource unit 200, a control unit 300, and the like.

  The domain unit 100 includes a plurality of domains (110, 120,...) Including at least one device driver (111, 121,...). For example, the domain unit 100 includes at least one security domain 110 in which security is ensured and a large number of general domains (120,...) Whose security is somewhat weak.

  In the present invention, a domain means an environment in which a corresponding device driver can be executed by each operating system (OS).

  The system resource unit 200 constitutes hardware of the apparatus. The system resource unit 200 includes a ROM (ROM) 210, a central processing unit (CPU) 220, a battery 230, a memory 240, an event channel 250 between domains, an input / output device (I / O device) 260, and the like.

The ROM 210 is a storage area that is not illegally changed by the user or the system.
The memory 240 is a storage for storing data information, and a nonvolatile memory such as a flash memory is applied.

  The memory 240 includes a system memory and a physical memory related to DMA, which will be described later.

  The memory 240 divides various data information according to type and security and is divided into a plurality of storage areas so that the data can be stored, and important data information is encrypted in a predetermined storage area among the storage areas. Preferably it is preserved.

  The control unit 300 uses a virtual machine monitor (VMM) to control the operation so that the domain unit 100 can access the system resource unit 200 in a virtual environment such as a wireless Internet environment.

  The control unit 300 includes a DMA (Direct Memory Access) driver 310 and an access control module 320 that controls an approach operation of the domain unit 100 to the system resource unit 200 in a virtual environment.

The DMA driver 310 is a module that performs a DMA operation.
The access control module 320 controls the operation of the device driver (111, 121,...) Of each domain (110, 120,...) Approaching the system resource unit 200 by the DMA driver 310. In particular, the access control module 320 includes a malicious device driver (121) installed in a general domain (120,...) Vulnerable to security among the domains (110, 120,...). Limit access to I / O space and IRQ associated with. More specifically, the access control module 320 performs DMA if a specific device driver in the domain (110, 120,...) Tries to access the system resource unit 200 through the DMA according to a predetermined access control policy. Access to the input / output space (I / O space) associated with the driver 310 is allowed, otherwise access to the input / output space (I / O space) and IRQ associated with the DMA driver 310 is blocked.

  The access control module 320 separately sets the access authority for the system resource unit 200 for each domain (110, 120,...), And the access authority for the system resource unit 200 sets each domain (110, 120,...). Controls allocation of I / O space and IRQ number requested to the device driver (111, 121,...). More specifically, if the access control module 320 allows the device driver (111, 121,...) To access the system resource unit 200 according to a predetermined access control policy, the device driver (111, 121,...) If the requested I / O space and IRQ number are assigned and access is not permitted, the requested I / O space and IRQ number are not assigned.

  The access control module 320 restricts excessive use access of each domain (110, 120,...) To the system resource unit 200. In more detail, the access control module 320 is used when the device driver (111, 121,...) Of each domain (110, 120,...) Uses the memory 240 of the system resource unit 200 above the allowable reference value. The access of the corresponding domain to the memory 240 is blocked by a predetermined access control policy. In addition, when the event control module 320 forms an event channel between the domains (110, 120,...), An event channel in which each domain (110, 120,...) Exceeds the allowable reference value according to a predetermined access control policy. To prevent it from forming.

  Hereinafter, a system protection method that is safe in a virtual environment according to an embodiment of the present invention will be described in detail with reference to FIGS.

  FIG. 3 is a flowchart for explaining an I / O space allocation process of a device driver by a system protection method secure in a virtual environment according to the present invention.

  As shown in FIG. 3, the present invention sets the access authority for the system resource unit 200 for each domain (110, 120,...) From the access control module 320 of the control unit 300. The allocation of the I / O space and IRQ number requested to the device driver (111, 121,...) Of each domain (110, 120,...) Is controlled according to the access authority.

  More specifically, the system resource unit 200 is requested to allocate the I / O space of the device driver (111, 121,...) Of each domain (110, 120,...) (S101). Next, the domain (110, 120,...) That executes the device driver (111, 121,...) Is determined by the access control module 320 of the control unit 300 according to a predetermined access control policy. It is determined whether the access authority to 200 is permitted (S102). Next, if the access authority of the domain (110, 120,...) Is permitted to the system resource unit 200 by the access control policy, the device driver (111, 121) of the domain (110, 120,...). The requested I / O space and IRQ number are allocated to the request (S103). However, the requested I / O space and the IRQ number are not assigned unless the access authority of the domain is allowed for the system resource unit by the access control policy.

FIG. 4 is a flowchart for explaining an approach control process when the device driver approaches the system memory through the DMA by the secure system protection method in the virtual environment according to the present invention.
As shown in FIG. 4, the present invention is an access control module 320 of the controller 300 in which the device drivers (111, 121,...) Of each domain (110, 120,...) Pass through the DMA driver 310. The operation of approaching the system resource unit 200 is controlled.

  More specifically, the specific device driver of the domain (110, 120,...) Requests access to the memory 240 of the system resource unit 200 through the DMA (S201). Next, it is determined whether a domain executing a specific device driver attempts to access the memory 240 that is allowed to have access authority according to a predetermined access control policy (S202). Next, if the domain (110, 120,...) Tries to access the memory 240 by the access control policy, the access of the specific device driver of the domain (110, 120,...) To the requested memory 240. Is allowed (S203). However, if the domain (110, 120,...) Does not attempt to access the memory 240 due to the access control policy, the access of the specific device driver of the domain (110, 120,. Cut off.

FIG. 5 is a flowchart for explaining a domain access control process for system resources by a system protection method secure in a virtual environment according to the present invention.
As shown in FIG. 5, the present invention restricts the excessive use access of each domain to the system resource unit by the access control module of the control unit.

  More specifically, system resource allocation is requested in at least one of the multiple domains (110, 120, ...) (S301). Next, it is determined whether the allocated amount of system resources requested in the domain exceeds a reference value set by a predetermined access control policy (S302). Next, if the allocation amount of the system resource requested by the domain is equal to or less than the set reference value according to the access control policy, the allocation of the system resource requested by the domain is permitted (S303). However, if the allocation amount of the system resource requested by the domain by the access control policy is equal to or greater than the set reference value, the allocation of the system resource requested by the domain is not permitted. For example, when the device driver (111, 121,...) Of each domain (110, 120,...) Uses the memory 240 of the system resource unit 200 above the allowable reference value, the access control module 320 uses the memory 240. Against the access of the corresponding domain. In addition, when the event channel is formed between the domains (110, 120,...), The access control module 320 blocks the domains (110, 120,...) From being able to form an event channel exceeding the allowable reference value. To do.

  Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art to which the present invention belongs will not change the technical idea or essential features of the present invention. It will be understood that the present invention can be implemented in a specific form. Accordingly, the embodiments described above are to be understood as illustrative in all aspects and not restrictive. The scope of the present invention is defined by the following claims rather than the above detailed description, and all modifications or variations derived from the meaning and scope of the claims and equivalents thereof are included in the scope of the present invention. Must be interpreted.

It is the block diagram which illustrated the structure of the conventional virtualization system apparatus. 1 is a block diagram illustrating a configuration of a secure system protection device in a virtual environment according to an embodiment of the present invention. The flowchart for demonstrating the allocation process of the I / O space and IRQ number of a device driver by the secure system protection method in the virtual environment of this invention. 5 is a flowchart for explaining an approach control process when a device driver approaches a system memory through a DMA by a secure system protection method in a virtual environment according to the present invention. 4 is a flowchart for explaining a domain access control process for system resources by a secure system protection method in a virtual environment according to the present invention.

Explanation of symbols

100 domain parts 110, 120,. . . Domains 111, 121,. . . Device driver 200 System resource unit 300 Control unit 310 DMA driver 320 Access control module

Claims (18)

A domain part having a plurality of domains including at least one device driver;
A virtual system including a system resource unit that configures the hardware of the device, a DMA (Direct Memory Access) driver, and a control unit that includes an access control module that controls an access operation of the domain unit to the system resource unit in a virtual environment. Safe system protection device in a computer environment.   The secure system protection apparatus in a virtual environment according to claim 1, wherein the domain unit includes at least one domain in which security is ensured.   The secure system protection apparatus in a virtual environment according to claim 1, wherein the system resource unit includes at least one of a system memory, a physical memory related to the DMA, and an event channel between the domains.   The secure system protection apparatus in a virtual environment according to claim 1, wherein the control unit is controlled using a VMM (Virtual Machine Monitor).   2. The secure system protection apparatus in a virtual environment according to claim 1, wherein the access control module controls an operation in which a device driver of each domain approaches the system resource unit through the DMA driver.   The access control module limits access to an input / output space (I / O space) and an IRQ (interrupt) related to the DMA driver by a malicious device driver installed in a domain vulnerable to security among the domains. The secure system protection device in a virtual environment according to claim 5.   2. The secure system protection apparatus in a virtual environment according to claim 1, wherein the access control module sets different access authority for the system resource unit for each domain.   8. The secure system protection apparatus in a virtual environment according to claim 7, wherein the access control module controls allocation of an I / O space and an IRQ number requested to a device driver of the domain by an access right to the system resource unit. .   The access control module assigns the requested I / O space and IRQ number to the device driver if the access of the device driver to the system resource unit is allowed, and if the access is not allowed, the requested I / O. 9. The secure system protection device in a virtualized environment according to claim 8, wherein no space or IRQ number is assigned.   The secure system protection device in a virtual environment according to claim 1, wherein the access control module restricts excessive use access of each domain to the system resource unit.   The virtualization environment according to claim 10, wherein when the device driver of each domain uses a memory of the system resource unit at an allowable reference value or more, the access control module blocks access of the corresponding domain to the memory. Safe system protection device at.   11. The secure system protection apparatus in a virtual environment according to claim 10, wherein when the event channel is formed between the domains, the access control module blocks the domains so that an event channel exceeding an allowable reference value cannot be formed. . Requesting allocation of I / O space and IRQ number of the device driver of each domain to the system resource part;
Determining whether the domain executing the device driver is permitted to access the system resource unit according to a predetermined access control policy; and the domain for the system resource unit according to the access control policy If the access authority of the domain is permitted, the requested I / O space and IRQ number are assigned to the device driver of the domain, and if not, the requested I / O space and IRQ number are not assigned. Safe system protection method in the environment. The domain specific device driver requests access to the memory of the system resource part through DMA,
Determining whether a domain executing the specific device driver attempts to access the memory to which access authority is allowed according to a predetermined access control policy; and, according to the access control policy, the domain attempts to access the memory. In a virtualized environment including the step of allowing access of the specific device driver of the domain to the requested memory, and otherwise not allowing access of the specific device driver of the domain to the requested memory. Safe system protection method. Requesting allocation of system resources in at least one of a number of domains;
Determining whether the allocation amount of the system resource requested in the domain does not exceed a reference value set by a predetermined access control policy; and the allocation amount of the system resource requested by the domain by the access control policy A secure system in a virtualized environment including a step of permitting the domain to allocate the requested system resource if it is equal to or less than a requested reference value, and not permitting the domain to allocate the requested system resource otherwise Protection method.   The secure system protection method in a virtual environment according to claim 15, wherein the system resource allocation amount includes a memory usage amount in a system resource section.   The secure system protection method in a virtual environment according to claim 15, wherein the system resource allocation amount includes the number of event channels formed between domains in a system resource section.   The secure system protection method in a virtual environment according to any one of claims 13 to 15, wherein the predetermined access control policy is determined by an access control module provided in the VMM.

Images