JP5564466B2 - Virtualization device, virtualization device control method, virtualization device control program - Google Patents

Description

  The present invention relates to a virtualization apparatus including a CPU having a virtualization support function.

There are virtualization technologies that divide a computer resource of a physical machine into a plurality of logical resources, start a plurality of virtual machines, and operate an OS (Operating System) for each virtual machine (for example, Patent Documents 1 and 2). For example, by emulating processing requests from the OS to the hardware by software, a plurality of OSs can be operated on a single physical machine. Here, considerable hardware overhead is required for hardware emulation processing by software. Therefore, a CPU (Central Processing Unit) having a virtualization support function that supports such virtualization at the hardware level is used. A virtual machine operating on a physical machine can operate efficiently by making a processing request through such a virtualization support function provided in the CPU.
By the way, when starting such a virtual machine on a physical machine, a virtual machine management program is used to start the virtual machine according to a command input by the user and manage the status of the started virtual machines. Has been.

JP 2010-238044 A International Publication No. 2007/108065

  However, the virtual machine is also started by directly inputting a command without using such a virtual machine management program. The state of the virtual machine activated in this way cannot be managed by the virtual machine management program. For example, when providing a cloud service that allows a user to use multiple physical machines by virtualizing them, if an unmanaged virtual machine is up and running due to some kind of attack over the network, it may become a security threat There is sex. Therefore, it is desirable to detect a virtual machine that is activated and operated without using a virtual machine management program.

  The present invention has been made in view of such a situation, and a virtualization apparatus, a virtualization apparatus control method, a virtual apparatus for detecting that a virtual machine other than a predetermined virtual machine is operating on a physical machine is provided. A control apparatus control program is provided.

  In order to solve the above-described problem, the present invention is a virtualization apparatus including a CPU having a virtualization support function, and a processing request input from a process operating on the kernel to a kernel operating on the CPU Among them, a process request storage unit for storing a process request for the virtualization support function in advance, and process identification information for identifying a virtual machine that is a predetermined process for inputting the process request for the virtualization support function to the kernel Is stored, a processing request detection unit that detects a processing request input from the process to the kernel, and a processing request stored in the processing request storage unit when the processing request detection unit detects a processing request. To determine whether or not the processing request detected by the processing request detection unit matches the processing request read from the processing request storage unit When the request determination unit and the processing request detection unit detect the processing request, the process determination unit that determines whether or not the process identification information for identifying the process that has input the processing request is stored in the process storage unit, and the processing request The determination unit determines that the processing request detected by the processing request detection unit matches the processing request read from the processing request storage unit, and the process determination unit includes process identification information for identifying the process that has input the processing request. And a warning unit that outputs a warning when it is determined that it is not stored in the process storage unit.

  The present invention also includes a process management unit that receives a virtual machine activation request, activates the virtual machine on the kernel in response to the activation request, and stores process identification information for identifying the virtual machine in the process storage unit. It is characterized by providing.

  In addition, the present invention includes a CPU having a virtualization support function, and a processing request for the virtualization support function is stored in advance in a kernel operating on the CPU, out of processing requests input from a process operating on the kernel. A processing request storage unit, and a process storage unit storing process identification information for identifying a virtual machine that is a predetermined process for inputting a processing request for the virtualization support function to the kernel. Virtualization apparatus control method for a virtualization apparatus, a step of detecting a processing request input to a kernel from a process, and a processing request stored in a processing request storage unit when a processing request is detected and detected A step for determining whether or not the request matches the processing request read from the processing request storage unit, and the process that has input the processing request The step of determining whether or not the process identification information to be identified is stored in the process storage unit is determined to match the detected processing request with the processing request read from the processing request storage unit, and the processing request is input A step of outputting a warning when it is determined that the process identification information for identifying the processed process is not stored in the process storage unit.

  In addition, the present invention includes a CPU having a virtualization support function, and a processing request for the virtualization support function is stored in advance in a kernel operating on the CPU, out of processing requests input from a process operating on the kernel. A processing request storage unit, and a process storage unit storing process identification information for identifying a virtual machine that is a predetermined process for inputting a processing request for the virtualization support function to the kernel. Detecting a processing request input to the kernel from the process to the computer of the processing apparatus, and when detecting the processing request, the processing request stored in the processing request storage unit is read, and the detected processing request and the processing request storage A step for determining whether or not the processing request read from the processing unit matches, and a process for identifying the process that has input the processing request. The process that determines whether or not the process identification information is stored in the process storage unit, the process request that is detected matches the process request read from the process request storage unit, and the process request is input And a step of outputting a warning when it is determined that the process identification information for identifying is not stored in the process storage unit.

  As described above, according to the present invention, a processing request input to the kernel from an operating process is detected, and whether or not the detected processing request is a processing request for the virtualization support function of the CPU. If it is a processing request for the virtualization support function of the CPU, it is determined whether or not the process that has input the processing request is a predetermined virtual machine process. If not, a warning is output, so that it is possible to detect that a virtual machine other than the specified virtual machine is operating on the physical machine.

It is a block diagram which shows the structural example of the virtualization apparatus by one Embodiment of this invention. It is a figure which shows the example of the process request input into the kernel by one Embodiment of this invention. It is a figure which shows the example of the process request input into the kernel by one Embodiment of this invention. It is a figure which shows the example of data of the process information memorize | stored in the process memory | storage part by one Embodiment of this invention. It is a flowchart which shows the operation example of the virtualization apparatus by one Embodiment of this invention.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram illustrating the configuration of the virtualization apparatus 100 according to the present embodiment. The virtualization apparatus 100 is a computer apparatus that includes hardware 110 and includes a CPU 111, an HD 113, a memory 114, and a NIC 115. The CPU 111 is a central processing unit having a VT (Virtualization Technology) 112 which is a virtualization support function for more efficiently performing parallel operations of a plurality of OSs. As the VT 112, for example, Intel VT (Intel is a registered trademark) or AMD-V (AMD is a registered trademark) can be applied. Such a VT 112 operates in response to a processing request from a program such as a KVM (Kernel-based Virtual Machine) based on a virtualization technology in which the OS kernel itself is a hypervisor of a virtual machine.

An HD (Hard Disk) 113 is a magnetic disk in which data is stored, and is an auxiliary storage device. The memory 114 is a semiconductor memory that stores data, and is a main storage device. A NIC (Network Interface Card) 115 is an expansion card that performs network communication. In addition to this, the virtualization apparatus 100 may include various elements as hardware 110.
Here, an example will be described in which the CPU 111 includes the VT 112 as a virtualization support function at the hardware level. However, the other hardware 110 elements may have a virtualization support function at the hardware level. good.

  The kernel 120 operates on such hardware 110, and processes such as application programs operate on the kernel 120. The kernel 120 is a program that is the core of the OS. In the present embodiment, description will be made assuming a Linux (registered trademark) kernel, but another OS kernel may be used. The kernel 120 has a function of a file system 121 that manages computer resources, data, and the like in units of files, and publishes system calls for making processing requests for such files to processes. The system call is an interface between the kernel 120 and a process operating on the kernel 120.

  Here, a process calls a system call of the kernel 120, and a process inputs a processing request to the kernel 120. 2 and 3 are diagrams showing examples of processing requests input to the kernel 120. FIG. Examples of processing requests include “read” for reading data from a file, “write” for writing data to the file, and “ioctl” for controlling the device. The kernel 120 accepts input of such processing requests from processes operating on the kernel 120 and operates the hardware 110 in accordance with the input processing requests. Processing requests include, for example, reading and writing files, issuing control commands to various hardware elements including the VT 112, creating new processes and threads, and securing memory used in the processes.

  For example, the process A indicated by symbol a in FIG. 1 inputs a read processing request for reading the data of the file “/ tmp” via a system call, or the process B indicated by symbol b via a system call. Thus, a write processing request for writing data to the file “/ usr / harada” can be input. The kernel 120 accesses the hardware 110 in response to the processing request, and performs processing such as file reading and writing.

  A process D indicated by a symbol d and a process E indicated by a symbol e are virtual machines. For the kernel 120, the virtual machine is one process similar to other application programs. The processing request input to the kernel 120 by such a virtual machine is for its own image file (file “/ data / imgD” for process D, file “/ data / imgE” for process E). There are those that perform reading and writing (read or write) and those that perform control (ioctl) for the file “/ dev / kvm” accessing the VT 112. In particular, the processing request for the file “/ dev / kvm” is a characteristic that is generally input only from a process that is a virtual machine. That is, the process that inputs a processing request for the file “/ dev / kvm” is highly likely to be a virtual machine. Therefore, the kernel 120 can detect a process that is highly likely to be a virtual machine by detecting a processing request for the file “/ dev / kvm” from the input processing request. In order to perform such detection processing, the kernel 120 includes a processing request storage unit 122, a processing request detection unit 123, and a processing request determination unit 124. These functional units can be provided as a patch program for the kernel 120, for example.

  The processing request storage unit 122 stores in advance a processing request for the VT 112 among processing requests input from a process operating on the kernel 120 in the kernel 120 operating on the CPU 111. For example, in this embodiment, “ioctl / dev / kvm”, “read / dev / kvm”, “write / dev / kvm”, etc., which are character strings indicating processing requests for the file “/ dev / kvm” are stored. The Alternatively, a character string of only “/ dev / kvm” may be stored.

The processing request detection unit 123 detects a processing request input from the process to the kernel 120 via a system call.
When the processing request detection unit 123 detects a processing request, the processing request determination unit 124 reads out the processing request stored in the processing request storage unit 122, the processing request detected by the processing request detection unit 123, and the processing request storage unit It is determined whether or not the processing request read from 122 matches. For example, the processing request determination unit 124 includes a character string such as “ioctl / dev / kvm”, “read / dev / kvm”, or “write / dev / kvm” as the processing request detected by the processing request detection unit 123. It is determined whether or not. Alternatively, the processing request determination unit 124 may determine whether or not a character string including only “/ dev / kvm” is included. If the process request determination unit 124 determines that the process request detected by the process request detection unit 123 matches the process request read from the process request storage unit 122, the process request determination unit 124 identifies the process that is the input source of the process request. The process determination unit 143 is notified of the process ID to be notified, thereby notifying that the processing request for the VT 112 has been input.

The process F operating in the kernel 120 is a virtual machine management program that starts and manages a virtual machine on the kernel 120, and includes a process storage unit 141, a process management unit 142, a process determination unit 143, a warning unit 144, It has.
The process storage unit 141 stores a process ID (process identification information) that identifies a process of a virtual machine that is activated and managed by the process management unit 142. The virtual machine is a predetermined process for inputting a processing request for the VT 112 to the kernel. FIG. 4 is a diagram illustrating a data example of process information stored in the process storage unit 141. The process storage unit 141 stores a VM (Virtual Machine) name, an image file path, an OS, a memory, a CPU, a status, and a process ID in association with each other. The VM name is the name of the virtual machine. The image file path is information for identifying a location where a virtual machine image file is stored in the file system. The OS is information indicating the type of OS operating in the corresponding virtual machine. The memory is information indicating the capacity of the memory resource allocated to the corresponding virtual machine. The CPU is information indicating the number of CPU resources allocated to the corresponding virtual machine. The status is information indicating the operating state of the corresponding virtual machine, and is associated with information such as “stopped” or “running”, for example. The process ID is identification information for identifying a virtual machine process in the kernel 120.

  The process management unit 142 accepts a virtual machine activation request, activates the virtual machine on the kernel 120 in response to the accepted activation request, and stores a process ID for identifying the activated virtual machine in the process storage unit 141. . In addition, when the process management unit 142 receives a virtual machine stop request and stops the virtual machine according to the received stop request, the process management unit 142 displays the status stored in the process management unit 142 in association with the stopped virtual machine. Update to “Stop”.

  When the process request detection unit 123 of the kernel 120 detects a process request and the process request determination unit 124 notifies that the process request for the VT 112 has been input, the process determination unit 143 receives the process request. It is determined whether or not a process ID for identifying the input process is stored in the process storage unit 141.

  The warning unit 144 is notified by the processing request determination unit 124 that it is determined that the processing request detected by the processing request detection unit 123 matches the processing request read from the processing request storage unit 122, and the process determination unit If it is determined by 143 that the process ID for identifying the process that has input the processing request is not stored in the process storage unit 141, a warning is output. Here, for example, outputting a warning may output a warning text on the display of the virtualization apparatus 100, or may output a log file including the warning text and store it in a storage area. Then, a warning message may be sent by e-mail with a predetermined e-mail address as a destination. In addition, the warning unit 144 outputs a warning to the kernel 120, and the kernel 120 does not execute processing according to the processing request input to the VT 112 in response to the warning output from the warning unit 144. Anyway. Alternatively, for example, a dialog for selecting whether or not to execute processing according to the processing request can be displayed on the display of the virtualization apparatus 100. In this case, the kernel 120 executes the processing request if the selection is made to execute the processing request, and executes the processing request if the selection is made not to execute the processing request. Instead, the process may be stopped.

  Next, an operation example of the virtualization apparatus 100 according to the present embodiment will be described. FIG. 5 is a flowchart showing an operation example in which the virtualization apparatus 100 outputs a warning. When a processing request is input to the kernel 120 by any process (step S1), the processing request detection unit 123 detects the input processing request (step S2). The processing request determination unit 124 reads the processing request stored in the processing request storage unit 122 (step S3), and determines whether or not the processing request detected in step S2 matches the processing request read in step S3. Determine (step S4).

  If the process request determination unit 124 determines that the process request detected in step S2 does not match the process request read in step S3 (step S4: NO), the process ends. On the other hand, when the processing request determination unit 124 determines that the processing request detected in step S2 matches the processing request read in step S3 (step S4: YES), the processing request determination unit 124 inputs the processing request. The process determination unit 143 is notified of the process ID of the processed process (step S5). The process determination unit 143 reads the process ID stored in the process storage unit 141, and determines whether or not the process ID notified from the processing request determination unit 124 is stored in the process storage unit 141 (step S6). . If the process determination unit 143 determines that the process ID notified from the processing request determination unit 124 is stored in the process storage unit 141 (step S6: YES), the process ends. On the other hand, if the process determination unit 143 determines that the process ID notified from the processing request determination unit 124 is not stored in the process storage unit 141 (step S6: NO), the warning unit 144 outputs a warning ( Step S7).

In this way, the administrator of the virtualization apparatus 100 can know that an unintended virtual machine is operating in the virtualization apparatus 100.
In this embodiment, an example in which the process of the virtual machine management program including the process management unit 142 and the process storage unit 141 includes the process determination unit 143 and the warning unit 144 has been described. However, the process management unit 142 and the process In addition to the process of the virtual machine management program including the storage unit 141, a process including the process determination unit 143 and the warning unit 144 may be activated.

  It should be noted that the program for realizing the function of the processing unit in the present invention is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system and executed to manage the virtual machine. May be performed. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system having a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, what is called a difference file (difference program) may be sufficient.

100 Virtualization device 110 Hardware 111 CPU
112 VT
113 HD
114 Memory 115 NIC
120 Kernel 121 File System 122 Processing Request Storage Unit 123 Processing Request Detection Unit 124 Processing Request Determination Unit 130 System Call 141 Process Storage Unit 142 Process Management Unit 143 Process Determination Unit 144 Warning Unit

Claims (4)

A virtualization device including a CPU having a virtualization support function,
A processing request storage unit that stores in advance a processing request for the virtualization support function among processing requests input from a process operating on the kernel to the kernel operating on the CPU;
A process storage unit that stores process identification information for identifying a virtual machine that is a predetermined process for inputting a processing request for the virtualization support function to the kernel;
A processing request detection unit that detects a processing request input to the kernel from the process;
When the processing request detection unit detects the processing request, the processing request stored in the processing request storage unit is read, the processing request detected by the processing request detection unit, and the processing request read from the processing request storage unit A processing request determination unit that determines whether or not and
When the processing request detection unit detects the processing request, a process determination unit that determines whether or not process identification information for identifying the process that has input the processing request is stored in the process storage unit;
The process in which the processing request detected by the processing request detection unit is determined to match the processing request read from the processing request storage unit by the processing request determination unit, and the processing request is input by the process determination unit A warning part for outputting a warning when it is determined that the process identification information for identifying is not stored in the process storage part;
A virtualization apparatus comprising: A process management unit that accepts a startup request for the virtual machine, starts a virtual machine on the kernel in response to the startup request, and stores process identification information for identifying the virtual machine in the process storage unit;
The virtualization apparatus according to claim 1, comprising: A processing request that includes a CPU having a virtualization support function, and in which a processing request for the virtualization support function is stored in advance in a kernel that operates on the CPU and that is input from a process that operates on the kernel Virtualization comprising: a storage unit; and a process storage unit storing process identification information for identifying a virtual machine that is a predetermined process for inputting a processing request for the virtualization support function to the kernel A device virtualization device control method comprising:
Detecting a processing request input to the kernel from the process;
When the processing request is detected, the processing request stored in the processing request storage unit is read, and it is determined whether or not the detected processing request matches the processing request read from the processing request storage unit When,
Determining whether or not process identification information for identifying the process that has input the processing request is stored in the process storage unit;
It is determined that the detected processing request matches the processing request read from the processing request storage unit, and it is determined that the process identification information for identifying the process that has input the processing request is not stored in the process storage unit A step to output a warning, and
A virtualization apparatus control method comprising: A processing request that includes a CPU having a virtualization support function, and in which a processing request for the virtualization support function is stored in advance in a kernel that operates on the CPU and that is input from a process that operates on the kernel Virtualization comprising: a storage unit; and a process storage unit storing process identification information for identifying a virtual machine that is a predetermined process for inputting a processing request for the virtualization support function to the kernel To the computer of the device,
Detecting a processing request input to the kernel from the process;
When the processing request is detected, the processing request stored in the processing request storage unit is read, and it is determined whether or not the detected processing request matches the processing request read from the processing request storage unit When,
Determining whether or not process identification information for identifying the process that has input the processing request is stored in the process storage unit;
It is determined that the detected processing request matches the processing request read from the processing request storage unit, and it is determined that the process identification information for identifying the process that has input the processing request is not stored in the process storage unit A step to output a warning, and
A virtualization apparatus control program for executing

Images