WO2016141719A1

WO2016141719A1 - Channel detection method and apparatus

Info

Publication number: WO2016141719A1
Application number: PCT/CN2015/092975
Authority: WO
Inventors: 袁劲枫; 王胜
Original assignee: 华为技术有限公司
Priority date: 2015-03-11
Filing date: 2015-10-27
Publication date: 2016-09-15
Also published as: CN106034108B; CN106034108A

Abstract

A channel detection method and apparatus. The method comprises: when at least two virtual machines performing memory deduplication merge on the same physical host, intercepting an event sequence executed by an operating system in an operating system instruction stream, wherein the event sequence comprises a time acquisition event; searching for a target sub-sequence from the event sequence, and acquiring a time attribute of the target sub-sequence; and judging whether the time attribute of the target sub-sequence satisfies a pre-set condition, and when the time attribute of the target sub-sequence satisfies the pre-set condition, determining that a hidden channel exists in the system. The use of the present invention can accurately detect whether a hidden channel exists in the system, and will not influence a normal function of a memory deduplication mechanism in the system.

Description

Channel detection method and device

Technical field

The present invention relates to the field of network security technologies, and in particular, to a channel detection method and apparatus.

Background technique

In a multi-tenant cloud environment, virtual machines between tenants usually share the same physical host's memory. The specific sharing method can be shared by memory deduplication technology. Memory deduplication technology combines the same physical memory pages. Only one physical copy of the memory page is kept, and all other virtual machines map the physical memory page together. During subsequent use, when a virtual machine needs to write to the memory page, the operating system will initiate a write operation exception event, such as a copy-on-write (COW) page write operation exception event, and Rewrite a physical memory page for the virtual machine to write.

However, the introduction of memory deduplication technology in the cloud platform can also lead to unexpected security vulnerabilities. Because the virtual machine of the malicious user and the ordinary user may be located on the same physical host, and the memory deduplication technology is used to merge the memory pages. Malicious users can use this shared memory mechanism to construct a covert channel to steal private information from other ordinary users, such as keys.

The specific construction method of the hidden channel is as shown in FIG. 1. The ordinary user Sender and the malicious user Receiver are respectively two virtual machines located on the same physical host, and Receiver invades the Sender by some means, and the Receiver hopes to covertly If the stolen user privacy data is transmitted without being detected, the hidden channel can be constructed based on the memory deduplication mechanism for information transmission, and it is assumed that N bit information needs to be transmitted:

Receiver controls Sender to request a memory of size N*4K and load file A into memory. Then Receiver controls Sender to encode the requested memory according to the memory page granularity (4K). The encoding rule is: if the information to be transmitted is 0, the current memory page is modified (arbitrarily modified), and the information to be passed is 1 to skip without modification. Go to the next memory page. Wait for memory consolidation after encoding.

Receiver requests the same size of n*4K memory and loads the same file A into memory. The operating system automatically performs a memory page merge. Receiver waits for a while and starts receiving messages. That is, the requested memory is decoded according to the memory page granularity, and the decoding rule is: one by one memory page Write operation, and measure the execution time of the memory page write operation. The specific measurement method is to acquire the system time before writing to a certain memory page, and then acquire the system time after the memory page write operation is completed, if The memory page is the memory page after the merge. Because the extra memory page copy process is required, the memory page write operation takes longer to execute than the normal memory page write operation, so Receiver can execute according to the memory page write operation. The length of time is decoded. For example, if the execution time of a memory page write operation is too long, the current page is decoded to 1, otherwise the current page is decoded to 0, and the Receiver receives the information.

In the prior art, in order to prevent malicious users from transmitting the private data of the ordinary user through the covert channel, the memory deduplication mechanism is directly turned off. This method can solve the hidden channel attack, but loses the advantage of the memory deduplication mechanism. , has a greater impact on system performance.

Summary of the invention

The embodiment of the invention provides a channel detection method and device, which can accurately detect whether a hidden channel exists in the system, and does not affect the function of a normal memory deduplication mechanism in the system.

A first aspect of the embodiments of the present invention provides a channel detection method, which may include:

When at least two virtual machines perform memory de-merging on the same physical host, intercepting an event sequence executed by the operating system in an operating system instruction stream, where the event sequence includes an acquisition time event;

Finding a target subsequence from the sequence of events, and acquiring a time attribute of the target subsequence;

Determining whether the time attribute of the target subsequence satisfies a preset condition;

When the time attribute of the target subsequence satisfies a preset condition, it is determined that there is a covert channel in the system.

Based on the first aspect, in a first possible implementation of the first aspect, the time attribute of the target subsequence includes a first time difference between a start time and an end time of the target subsequence.

Determining whether the time attribute of the target subsequence meets a preset condition, including:

Determining whether the first time difference of the target subsequence is less than a first preset threshold;

Determining that there is a hidden channel in the system when the time attribute of the target subsequence meets a preset condition, including:

Determining the system when the first time difference of the target subsequence is less than the first predetermined threshold There is a hidden channel in it.

In a first feasible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, if the event sequence includes multiple target sub-sequences;

And searching for the target subsequence from the sequence of events, and acquiring time attributes of the target subsequence, including:

Finding a preset number of target sub-sequences from the sequence of events;

Calculating a first time difference between a start time and an end time of each target subsequence in the preset number of target subsequences.

The second possible implementation manner of the first aspect, in the third possible implementation manner of the first aspect, the determining whether the first time difference of the target sub-sequence is less than a first preset threshold, including :

Determining whether the first time difference of each target sub-sequence in the preset number of target sub-sequences is less than the first preset threshold;

When the first time difference of the target subsequence is less than the first preset threshold, determining that there is a hidden channel in the system, including:

When the first time difference of each target subsequence in the preset number of target subsequences is less than the first preset threshold, it is determined that there is a covert channel in the system.

According to a third possible implementation manner of the first aspect, in the fourth possible implementation manner of the first aspect, the first one of each target sub-sequence in the preset number of target sub-sequences After the time difference is less than the first preset threshold, the method further includes:

Determining whether a second time difference between a start time of the first target sub-sequence and an end time of the last target sub-sequence in the target number sub-sequence is less than a second preset threshold, the second pre- Setting a threshold smaller than the preset number;

When the second time difference is less than the second preset threshold, it is determined that there is a hidden channel in the system.

A second aspect of the present invention provides a channel detecting apparatus, including:

The intercepting module is configured to: when the at least two virtual machines perform memory de-merging on the same physical host, intercepting an event sequence executed by the operating system in the operating system instruction stream, where the event sequence includes an acquiring time event;

An obtaining module, configured to search for a target subsequence from the sequence of events, and obtain the target subsequence The time attribute of the column;

a determining module, configured to determine whether a time attribute of the target subsequence meets a preset condition,

And a determining module, configured to determine that a hidden channel exists in the system when a time attribute of the target subsequence satisfies a preset condition.

Based on the second aspect, in a first possible implementation of the second aspect, the time attribute of the target subsequence includes a first time difference between a start time and an end time of the target subsequence. ;

The determining module is specifically configured to determine whether the first time difference of the target sub-sequence is less than a first preset threshold;

The determining module is specifically configured to determine that a hidden channel exists in the system when the first time difference of the target subsequence is less than the first preset threshold.

Based on the first possible implementation manner of the second aspect, in the second possible implementation manner of the second aspect, if the event sequence includes multiple target sub-sequences, the acquiring module includes:

a searching unit, configured to sequentially search for a preset number of target sub-sequences from the sequence of events;

And a calculating unit, configured to calculate a first time difference between a start time and an end time of each target sub-sequence in the preset number of target sub-sequences.

Based on the second possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect, the determining module is specifically configured to determine each target subsequence in the preset number of target subsequences Whether the first time difference is less than the first preset threshold.

Based on the third possible implementation manner of the second aspect, in a fourth possible implementation manner of the second aspect, the determining module includes a determining unit and a determining unit;

The determining unit is configured to determine, when the first time difference of each target sub-sequence in the target number sub-sequence of the preset number is less than the first preset threshold, determine the preset number of targets Whether the second time difference between the start time of the first target subsequence and the end time of the last target subsequence in the subsequence is less than a second preset threshold, and the second preset threshold is less than the preset number ,

The determining unit is configured to determine that a hidden channel exists in the system when the second time difference is less than the second preset threshold.

In the embodiment of the present invention, when at least two virtual machines perform memory deduplication on the same physical host, the sequence of events executed by the operating system is intercepted in the operating system instruction stream, and the event sequence includes an acquisition time event, Find the target subsequence in the sequence of events and obtain the time genus of the target subsequence If the time attribute of the target subsequence satisfies the preset condition, it is determined that there is a hidden channel in the system. This method can accurately detect whether there is a hidden channel in the system, improve system security, and this detection method will not affect the function of the system's normal memory deduplication mechanism.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only some of the present invention. For the embodiments, those skilled in the art can obtain other drawings according to the drawings without any creative work.

1 is a schematic diagram of constructing a hidden channel according to an embodiment of the present invention;

2 is a schematic flowchart of a channel detecting method according to an embodiment of the present invention;

3 is a schematic diagram of an instruction flow according to an embodiment of the present invention;

4 is a schematic flowchart of another channel detecting method according to an embodiment of the present invention;

FIG. 5 is a flowchart of a covert channel detection algorithm according to an embodiment of the present invention;

6 is a flowchart of an algorithm for abnormal COW page write operation according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a channel detecting apparatus according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of an acquisition module according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of another channel detecting apparatus according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The channel detection method in the embodiment of the present invention can be applied to a process of detecting a covert channel based on a memory deduplication technology in a multi-tenant cloud environment.

The channel detection method provided by the embodiment of the present invention will be described below with reference to FIG. 1 to FIG. Shaohe explained.

2 is a schematic flowchart of a channel detecting method according to an embodiment of the present invention; as shown in FIG. 2, the channel detecting method includes:

S100, when at least two virtual machines perform memory de-merging on the same physical host, intercepting an event sequence executed by the operating system in an operating system instruction stream, where the event sequence includes an acquisition time event;

In an embodiment, in a multi-tenant cloud environment, a virtual machine between tenants usually shares the memory of the same physical host, and the sharing method may be shared by using a memory deduplication technology, and the memory deduplication technology is the same physical memory. The pages are merged, leaving only one physical copy of the memory page, and all other virtual machines co-map the physical memory page. During subsequent use, when a virtual machine writes to the memory page, the operating system will initiate a write operation exception event, such as a copy-on-write (COW) page write operation exception event, when started. When the COW page writes an operation exception event, the operating system copies a physical memory page for the virtual machine to write. Memory deduplication technology can effectively improve the physical memory utilization in the cloud environment and increase the number of concurrent virtual machines on a single physical host. Therefore, it is widely used in various commercial and open source virtual machine managers.

Receiver controls Sender to request a memory of size N*4K and load file A into memory. Then Receiver controls Sender to encode the requested memory according to the memory page granularity (4K). The encoding rule is: if the information to be transmitted is 0, the current memory page is modified (arbitrarily modified), and the information to be passed is 1 to skip without modification. Go to the next memory page. Wait for the memory page to merge after encoding.

Receiver requests the same size of N*4K memory and loads the same file A into memory. The operating system automatically performs a memory page merge. Receiver waits for a while and starts receiving messages. That is, the requested memory is decoded according to the memory page granularity. The decoding rule is: writing the memory page by page, and measuring the execution time of the memory page write operation. The specific measurement method is to write a certain memory page. Obtain the system time before, and then obtain the system time after the memory page write operation is completed. If the memory page is the memory page after the merge, the memory page write operation is performed because an additional memory page copy process is required. It takes longer than the normal memory page write operation, so Receiver can decode according to the length of the memory page write operation. For example, if the execution time of a memory page write operation is too long, the current page is decoded to 1, otherwise the current page Decoded to 0, Receiver receives the information.

The purpose of loading the same file A by the normal user Sender and the malicious user Receiver is to ensure that the initial contents of the memory page requested by Sender and Receiver are identical. After the subsequent Sender is encoded, the memory page encoded as 0 is modified by Sender, so two The memory pages corresponding to the end are different, and the memory page merge is not performed. On the contrary, the memory page coded as 1 has the same content at both ends, so after a period of time, the memory pages are merged into the same physical memory page. Finally, Receiver can decode 0 or 1 information by writing to the memory page and measuring the length of the write operation.

Since the malicious user Receiver continuously performs the decoding operation by acquiring the system time, the embodiment of the present invention performs the detection of the hidden channel for acquiring the time event in the operating system instruction stream. The specific acquisition method is: intercepting an event sequence executed by the operating system in the operating system instruction stream, where the event sequence includes acquiring a time event. Optionally, the event sequence may further include an abnormal event of a memory page write operation after the merge. After the merge, the memory page is the memory page generated by the memory de-merging of the memory pages of different virtual machines. It should be noted that the acquisition time event in the event sequence may include the acquisition time event of the operating system itself, and may also include malicious users. The acquisition time event, the operating system's own acquisition time events are usually separated by a long time.

S101. Search for a target subsequence from the sequence of events, and obtain a time attribute of the target subsequence.

In an embodiment, the target subsequence is searched from the acquired sequence of events. The target subsequence may exist in multiple forms. For example, the target subsequence may include two adjacent target acquisition time events, since the operating system itself usually The time interval for getting time events is long, so you can pass The time interval attribute of two adjacent target acquisition time events in the target sequence is detected.

Optionally, for the accuracy of the detection and the false positive rate, the target subsequence includes a target acquisition time event and a target write operation abnormal event between the target acquisition time events, as shown in FIG. 3, the white small circle represents interception. In the event sequence, the target acquires the time event, and the black circle represents the target write operation abnormal event in the intercepted event sequence, then the target subsequence that is searched is the target write operation abnormal event between the two target acquisition time events. . The time attribute of the target subsequence includes a first time difference between the start time and the end time of the target subsequence, that is, the system time corresponding to the first target acquisition time event in the target subsequence corresponds to the second target acquisition time event. The difference in system time.

It should be noted that, in the embodiment of the present invention, the existence form of the target subsequence is not limited, and the time attribute of the target subsequence is not limited.

S102. Determine whether a time attribute of the target subsequence meets a preset condition.

S103. Determine that a hidden channel exists in the system when a time attribute of the target subsequence satisfies a preset condition.

In an embodiment, it is determined whether the acquired time attribute of the target subsequence satisfies a preset condition, and when the time attribute of the target subsequence satisfies a preset condition, determining that a hidden channel exists in the system. The preset condition needs to be determined according to the time attribute of the target subsequence. For example, if the time attribute of the target subsequence is the first time difference between the start time and the end time of the target subsequence, the preset condition is that the first condition The time difference is less than the first preset threshold.

Optionally, the step S102 may be specifically: determining whether the first time difference of the target subsequence is less than a first preset threshold;

Step S103 may be specifically: determining that a hidden channel exists in the system when the first time difference of the target subsequence is less than the first preset threshold.

In one embodiment, the setting of the first predetermined threshold is critical to detecting the decoding operation of a single covert channel. If the setting is too short, it is possible for a malicious user to evade by inserting some useless instructions between the two acquisition time events to extend the execution time (but the malicious user can still distinguish between the COW page write operation and the normal page write operation). Detection. Conversely, if you set it too long, it will lead to an increase in false positive rate.

Assume that the covert channel executes n instructions between two acquisition time events (one of which is within In order to accurately encode information, it is necessary to satisfy:

T-Min _cow(n) >T-Max _normal(n)

T-Min _cow(n) : The shortest time to execute n instructions, where the memory write operation is a write to the memory page after the merge.

T-Max _normal(n) : The maximum time for executing n instructions, where the memory write operation is a write to a normal memory page.

Assuming that the average error time of n-1 normal instruction execution is Δt, it can be further derived:

T _min(cow) -T _max(normal) >(n-1)*Δt

T _min(cow) : The memory write operation instruction is the minimum execution time required to write to the merged memory page.

T _{max (normal)} : The maximum execution time required to execute a memory write operation instruction for writing to a normal memory page.

Assuming that the average execution time of n-1 normal instructions is t, you can push:

(n-1)*t+T _min(cow) ≤T ₍₁₎ ≤(n-1)*t+T _max(cow)

2T _min(cow) ≤T ₍₁₎ ≤2T _max(cow)

Where t≈Δt, T _cow >>T _nomal , optionally, the value of T _cow is usually 10 times larger than the value of T _nomal , and the multiples greater than the different systems are different.

In summary, the first preset threshold T ₍₁₎ can be estimated to be 2 times the execution time of the merged memory page write operation, but the execution time of the merged memory page write operation is also A range, ie maximum time T _{max (normal)} and minimum time T _{min (cow)} , so 2T _min(cow) ≤ T ₍₁₎ ≤ 2T _max(cow) . This maximum time and minimum time are different on different systems, and need to be set at the time of deployment according to the measured values of the actual system.

In the embodiment of the present invention, when at least two virtual machines perform memory deduplication on the same physical host, the sequence of events executed by the operating system is intercepted in the operating system instruction stream, and the event sequence includes an acquisition time event, a secondary event. The target subsequence is searched in the sequence, and the time attribute of the target subsequence is obtained, and the time attribute of the target subsequence is determined to meet the preset condition. If the time attribute of the target subsequence satisfies the preset condition, it is determined that there is a hidden channel in the system. This way can accurately detect whether the system is in the system There is a hidden channel, which improves the security of the system, and this detection method does not affect the function of the normal memory deduplication mechanism of the system.

4 is a schematic flowchart of another channel detection method according to an embodiment of the present invention; if a sequence of events includes multiple target sub-sequences, as shown in FIG. 4, a channel detection method according to this embodiment is shown in FIG. Including steps:

S200, when at least two virtual machines perform memory de-merging on the same physical host, intercepting an event sequence executed by the operating system in the operating system instruction stream, where the event sequence includes an acquisition time event;

For the step S200 of the embodiment of the present invention, please refer to the step S100 of the embodiment shown in FIG. 1 , and details are not described herein.

S201. Search for a preset number of target sub-sequences from the sequence of events;

As an optional implementation manner, as shown in FIG. 3, the event sequence may include multiple target subsequences, wherein the target subsequence includes two target acquisition time events, and between the two target acquisition time events. The target write operation abnormal event searches for a preset number (n) of target sub-sequences in the operating system execution instruction stream, and the preset number of values (ie, the value of n) is preset by the user.

S202. Calculate a first time difference between a start time and an end time of each target subsequence in the preset number of target subsequences.

As an optional implementation manner, calculating a first time difference between a start time and an end time of each target sub-sequence in a preset number of target sub-sequences, as shown in FIG. 3, sequentially calculating each target sub-sequence The first time difference Δt ₁ , Δt ₂ , Δt ₃ ..... Δt _n .

S203: Determine whether the first time difference of each target sub-sequence in the preset number of target sub-sequences is less than the first preset threshold;

S204. When the first time difference of each target subsequence in the preset number of target subsequences is less than the first preset threshold, determining that there is a covert channel in the system.

As an optional implementation manner, determining whether the first time difference of each target sub-sequence in the preset number of target sub-sequences is less than a first preset threshold, if each sub-sequence in the preset number of target sub-sequences The first time difference is less than the first preset threshold, that is, Δt _i <T ₍₁₎ , i ∈ [1, n], and it is determined that there is a hidden channel in the system. It should be noted that the first preset threshold T ₍₁₎ may be twice the execution time of the memory page write operation after the merge.

Optionally, in order to further improve the detection accuracy of the hidden channel, considering the communication bandwidth of the hidden channel, the first of each target sub-sequence in the preset number of target sub-sequences in step S204 After a time difference is less than the first preset threshold, the method further includes:

If the second time difference is less than the second predetermined threshold, it is determined that a hidden channel exists in the system.

As an optional implementation manner, in order to improve the detection accuracy, the communication bandwidth of the hidden channel is detected, and the specific detection method is to further determine the starting point of the first target subsequence in the target subsequence of the preset number. Whether the second time difference between the start time and the end time of the last target subsequence is less than a second preset threshold, and if less than the second preset threshold, determining that there is a covert channel in the system. As shown in Figure 3, it is judged:

Δt _i <T ₍₁₎ i∈[1,n] && t _n-end -t _1-beg <T _(n)

It is generally believed that when the communication bandwidth is less than 1 bps, the channel has no communication value. The second preset threshold T _(n) threshold is used to control the longest transmission time when the covert channel transmits n bit information. That is to guarantee:

That is T _(n) <n

Therefore the value of T _(n) cannot exceed n. Since the amount of information transmitted in actual applications is larger than n, the threshold of T( _n ) is slightly smaller than n.

In the embodiment of the present invention, when at least two virtual machines perform memory deduplication on the same physical host, the sequence of events executed by the operating system is intercepted in the operating system instruction stream, and the event sequence includes an acquisition time event, a secondary event. The target subsequence is searched in the sequence, and the time attribute of the target subsequence is obtained, and the time attribute of the target subsequence is determined to meet the preset condition. If the time attribute of the target subsequence satisfies the preset condition, it is determined that there is a hidden channel in the system. This method can accurately detect whether there is a hidden channel in the system, improve system security, and this detection method will not affect the function of the system's normal memory deduplication mechanism.

FIG. 5 is a flowchart of a covert channel detection algorithm according to an embodiment of the present invention. In the embodiment of the present invention, an event sequence includes an acquisition time event and a COW page write operation abnormal event. During the execution of the operating system, these two events are continuously intercepted. That is, along the direction in which the operating system executes the instruction stream, these two events are continuously intercepted and processed into the processing routine.

When intercepting the execution of the acquisition time event, the algorithm flow of the processing routine is as shown in Figure 5: in the processing function, t _{now is} used to record the current system time, and t _pre caches the system time of the last time the processing function was entered. t _{cow_pf} records the system time of the most recent COW page write exception event. It is a global variable and is updated by the page fault exception handler in Figure 6. t _beg records the start time of the detected first target subsequence, and is used to calculate the execution time of the n subsequences when the nth is detected. The Count variable is used to record the first target subsequence detected. At the beginning of the algorithm, the current system time t _now is first obtained, and then subtracted from the system time t _pre of the last acquisition time event of the cache to determine whether the time interval is less than the threshold T ₍₁₎ , and greater than the current subsequence Not a hidden channel decoding operation, updating t _pre . Otherwise, it is further determined whether the last COW page write operation abnormal event is between the two acquisition time events, and it indicates that the decoding operation of the hidden channel is detected, the Count is updated, and it is determined whether the nth decoding operation is currently detected. If yes, it is further determined whether the time interval of the n decoding operations is less than the threshold T _(n) , and if it is less, it is determined that the hidden channel is detected.

Further, please refer to FIG. 6 , which is a flowchart of a page fault processing algorithm according to an embodiment of the present invention:

During the system running process, when a memory page after memory de-merging is written, a COW page write operation exception event is triggered, and the page error exception processing function is entered, and the algorithm of the present invention in the processing function The process is shown in Figure 6:

First, it is necessary to determine whether the current page fault exception variable PFEC is a write operation exception. If yes, continue to traverse the COW page linked list, and determine whether the memory page belongs to the memory after the memory is re-merged according to the virtual address pf_va of the memory page where the page fault exception occurs. The page, if it is, indicates that the COW page write operation exception event has been intercepted, thereby recording the current system time to the global variable t _{cow_pf} .

The specific implementation of the channel detecting apparatus provided by the embodiment of the present invention is described below with reference to FIG. 7 to FIG.

FIG. 7 is a schematic structural diagram of a channel detecting apparatus according to an embodiment of the present invention. As shown in FIG. 7, a channel detecting apparatus according to this embodiment includes: an intercepting module 100, and an acquiring module. 101. The determining module 102 and the determining module 103.

The intercepting module 100 is configured to intercept an event sequence executed by the operating system in the operating system instruction stream when the at least two virtual machines perform memory de-merging on the same physical host, where the event sequence includes an acquiring time event;

The purpose of loading the same file A by the normal user Sender and the malicious user Receiver is to ensure that the initial contents of the memory page requested by Sender and Receiver are identical. After the subsequent Sender is encoded, the memory page encoded as 0 is modified by Sender, so two The memory pages corresponding to the end are different, and the memory page merge is not performed. On the contrary, the memory page coded as 1 has the same content at both ends, so after a period of time, the memory pages are merged into the same physical memory page. Finally, Receiver can decode the 01 information by writing to the memory page and measuring the length of the write operation.

Since the malicious user Receiver continuously performs the decoding operation by acquiring the system time, the embodiment of the present invention performs the detection of the hidden channel for acquiring the time event in the operating system instruction stream. The specific acquisition method is that the intercepting module 100 intercepts an operating system execution event sequence in the operating system instruction stream, and the event sequence includes an acquisition time event. Optionally, the event sequence may further include an abnormal memory page write operation after the merge. The event needs to be described. The acquisition time event in the sequence of events may include the acquisition time event of the operating system itself, and may also include the acquisition time event of the malicious user. The acquisition time event of the operating system itself is usually separated by a long interval.

The obtaining module 101 is configured to search for a target subsequence from the sequence of events, and obtain a time attribute of the target subsequence;

In an embodiment, the obtaining module 101 searches for a target subsequence from the acquired sequence of events, and the target subsequence may exist in multiple forms, for example, the target subsequence may include two adjacent target acquisition time events, since The time interval of the acquisition time event of the system itself is relatively long, so it can be detected by the time interval attribute of the time event of two adjacent targets in the target sequence.

Optionally, for the accuracy of the detection and the false positive rate, the target subsequence includes a target acquisition time event and a target write operation abnormal event between the target acquisition time events, as shown in FIG. 3, the white small circle represents interception. In the event sequence, the target gets the time event, and the small black circle represents the intercepted In the event sequence, the target write operation exception event, the target subsequence found is a target write operation exception event between the two target acquisition time events. The time attribute of the target subsequence includes a first time difference between the start time and the end time of the target subsequence, that is, the system time corresponding to the first target acquisition time event in the target subsequence corresponds to the second target acquisition time event. The difference in system time.

The determining module 102 is configured to determine whether a time attribute of the target subsequence meets a preset condition;

The determining module 103 is configured to determine that a hidden channel exists in the system when a time attribute of the target subsequence satisfies a preset condition.

In one embodiment, the determining module 102 determines whether the acquired time attribute of the target subsequence satisfies a preset condition. When the time attribute of the target subsequence satisfies the preset condition, the determining module 103 determines that a hidden channel exists in the system. The preset condition needs to be determined according to the time attribute of the target subsequence. For example, if the time attribute of the target subsequence is the first time difference between the start time and the end time of the target subsequence, the preset condition is that the first condition The time difference is less than the first preset threshold.

Optionally, the determining module 102 is specifically configured to determine whether the first time difference of the target sub-sequence is less than a first preset threshold;

The determining module 103 is specifically configured to determine that a hidden channel exists in the system when the first time difference of the target subsequence is less than the first preset threshold.

Assuming that the covert channel executes n instructions between two acquisition time events (one of which is a memory write operation instruction), in order to be able to accurately encode the information, it is necessary to satisfy:

T-Min _cow(n) >T-Max _normal(n)

T _min(cow) -T _max(normal) >(n-1)*Δt

(n-1)*t+T _min(cow) ≤T ₍₁₎ ≤(n-1)*t+T _max(cow)

2T _min(cow) ≤T ₍₁₎ ≤2T _max(cow)

In the embodiment of the present invention, when at least two virtual machines perform memory deduplication on the same physical host, the operating system execution event sequence is intercepted in the operating system instruction stream, and the event sequence includes an acquisition time event, a sequence of events. The target subsequence is searched, and the time attribute of the target subsequence is obtained, and the time attribute of the target subsequence is determined to satisfy the preset condition. If the time attribute of the target subsequence satisfies the preset condition, it is determined that there is a hidden channel in the system. This method can accurately detect whether there is a hidden channel in the system, improve system security, and this detection method will not affect the function of the system's normal memory deduplication mechanism.

Please refer to FIG. 8 , if the event sequence includes multiple target sub-sequences; A schematic diagram of a structure of an acquisition module, as shown in FIG. 8, the acquisition module in this embodiment includes:

The searching unit 1010 is configured to sequentially search for a preset number of target sub-sequences from the sequence of events;

As an optional implementation manner, as shown in FIG. 3, the event sequence may include multiple target subsequences, wherein the target subsequence includes two target acquisition time events, and between the two target acquisition time events. The target write operation abnormal event, the search unit 1010 sequentially searches for a preset number (n) of target sub-sequences in the operating system execution instruction stream, and the preset number of values (ie, the value of n) is preset by the user.

The calculating unit 1011 is configured to calculate a first time difference between a start time and an end time of each target sub-sequence in the preset number of target sub-sequences.

As an optional implementation manner, the calculating unit 1011 calculates a first time difference between a start time and an end time of each target sub-sequence in a preset number of target sub-sequences, as shown in FIG. The first time difference Δt ₁ , Δt ₂ , Δt ₃ ... Δt _{n of the} target subsequence.

Optionally, the determining module 102 is specifically configured to determine whether the first time difference of each target sub-sequence in the preset number of target sub-sequences is less than the first preset threshold;

The determining module 103 is specifically configured to determine that a hidden channel exists in the system when the first time difference of each target sub-sequence in the preset number of target sub-sequences is less than the first preset threshold.

As an optional implementation manner, the determining module 102 determines whether the first time difference of each target sub-sequence in the preset number of target sub-sequences is less than the first preset threshold, when the preset number of target sub-sequences The first time difference of each subsequence is less than the first predetermined threshold, that is, Δt _i <T ₍₁₎ , i ∈ [1, n], and the determining module 103 determines that there is a hidden channel in the system. It should be noted that the first preset threshold T ₍₁₎ may be twice the execution time of the memory page write operation after the merge.

Optionally, in order to further improve the detection accuracy of the hidden channel, considering the communication bandwidth of the hidden channel, the determining module 102 includes a determining unit and a determining unit;

a determining unit, configured to determine a target subsequence of the preset number when the first time difference of each target subsequence in the preset number of target subsequences is less than the first preset threshold Whether the second time difference between the start time of the first target subsequence and the end time of the last target subsequence is less than a second preset threshold; the second preset threshold is less than the preset number;

a determining unit, configured to determine, when the second time difference is less than the second preset threshold, In a hidden channel.

As an optional implementation manner, in order to improve the detection accuracy, the communication bandwidth of the hidden channel is detected. The specific detection method is: the determining unit further determines the first target subsequence in the preset number of target sub-sequences. Whether the second time difference between the start time and the end time of the last target subsequence is less than a second preset threshold, and if less than the second preset threshold, the determining unit determines that there is a covert channel in the system. As shown in Figure 3, it is judged:

Δt ₁ <T ₍₁₎ i∈[1,n] && t _n-end -t _1-beg <T _(n)

It is generally believed that when the communication bandwidth is less than 1 bps, the channel has no communication value. The second preset threshold T( _n ) threshold is used to control the longest transmission time when the covert channel transmits n bit information. That is to guarantee:

That is T _(n) <n

Therefore the value of T _(n) cannot exceed n. Since the amount of information transmitted in the actual application is larger than n, the threshold of T _(n) is slightly smaller than n.

FIG. 9 is a schematic structural diagram of another channel detecting apparatus according to an embodiment of the present invention. The channel detecting device of FIG. 9 can be used to implement the steps and methods in the foregoing method embodiments. In the embodiment of FIG. 9, the channel detecting apparatus includes a processor 200, a transceiver 201, a memory 202, and a bus 203. The memory 202 is for storing instructions, and the processor 200 is for executing instructions in the memory 202 to perform subsequent channel detecting operations. The memory 202 can include read only memory and random access memory, the various components of the data communication device being coupled together by a bus system 203, wherein the bus system 203 includes a power bus, a control bus, and a status signal bus in addition to the data bus. But to be clear For the sake of clarity, various buses are labeled as bus system 203 in the figure. The individual components are described in detail below:

The processor is configured to intercept an event sequence executed by an operating system in an operating system instruction stream when at least two virtual machines perform memory de-merging on the same physical host, where the event sequence includes an acquisition time event;

The processor is further configured to search for a target subsequence from the sequence of events, and acquire a time attribute of the target subsequence;

The processor is further configured to determine whether a time attribute of the target subsequence meets a preset condition;

The processor is further configured to determine that a hidden channel exists in the system if a time attribute of the target subsequence satisfies a preset condition.

Optionally, in a multi-tenant cloud environment, the virtual machines of the tenant usually share the memory of the same physical host, and the sharing method may be shared by using a memory deduplication technology, and the memory deduplication technology is to perform the same physical memory page. Merge, leaving only one physical copy of the memory page, all other virtual machines co-map the physical memory page. During subsequent use, when a virtual machine writes to the memory page, the operating system will initiate a write operation exception event, such as a copy-on-write (COW) page write operation exception event, when started. When the COW page writes an operation exception event, the operating system copies a physical memory page for the virtual machine to write. Memory deduplication technology can effectively improve the physical memory utilization in the cloud environment and increase the number of concurrent virtual machines on a single physical host. Therefore, it is widely used in various commercial and open source virtual machine managers.

Receiver controls Sender to request a memory of size N*4K and load file A into memory in. Then Receiver controls Sender to encode the requested memory according to the memory page granularity (4K). The encoding rule is: if the information to be transmitted is 0, the current memory page is modified (arbitrarily modified), and the information to be passed is 1 to skip without modification. Go to the next memory page. Wait for the memory page to merge after encoding.

Optionally, the target subsequence is searched from the obtained sequence of events, and the target subsequence may exist in multiple forms, for example, the target subsequence may include two adjacent target acquisition time events, The time interval of the acquisition time event of the operating system itself is relatively long, so it can be detected by the time interval attribute of the time event of two adjacent targets in the target sequence.

Optionally, it is determined whether the time attribute of the acquired target subsequence satisfies a preset condition, and if the time attribute of the target subsequence satisfies a preset condition, determining that a hidden channel exists in the operating system. The preset condition needs to be determined according to the time attribute of the target subsequence. For example, if the time attribute of the target subsequence is the first time difference between the start time and the end time of the target subsequence, the preset condition is that the first condition The time difference is less than the first preset threshold.

The processor is further configured to determine whether the first time difference of the target subsequence is less than a first preset threshold;

The processor is further configured to determine that a hidden channel exists in the system when the first time difference of the target subsequence is less than the first preset threshold.

Optionally, the setting of the first preset threshold is very critical for detecting a decoding operation of a single covert channel. If the setting is too short, it is possible for a malicious user to evade by inserting some useless instructions between the two acquisition time events to extend the execution time (but the malicious user can still distinguish between the COW page write operation and the normal page write operation). Detection. Conversely, if you set it too long, it will lead to an increase in false positive rate.

T-Min _cow(n) >T-Max _normal(n)

T _min(cow) -T _max(normal) >(n-1)*Δt

(n-1)*t+T _min(cow) ≤T ₍₁₎ ≤(n-1)*t+T _max(cow)

2T _min(cow) ≤T ₍₁₎ ≤2T _max(cow)

If the event sequence includes multiple target subsequences;

The processor is further configured to sequentially search for a preset number of target sub-sequences from the sequence of events;

The processor is further configured to calculate a first time difference between a start time and an end time of each target subsequence in the preset number of target subsequences.

Optionally, as shown in FIG. 3, the event sequence may include multiple target subsequences, where the target subsequence includes two target acquisition time events, and a target write operation abnormal event between the two target acquisition time events. Finding a preset number (n) of target sub-sequences in sequence in the system execution instruction stream. The value of the preset number (i.e., the value of n) is preset by the user.

Optionally, calculating a first time difference between a start time and an end time of each target sub-sequence in the preset number of target sub-sequences, as shown in FIG. 3, sequentially calculating a first time difference Δt of each target sub-sequence ₁ , Δt ₂ , Δt ₃ ..... Δt _n .

The processor is further configured to determine whether the first time difference of each target sub-sequence in the preset number of target sub-sequences is less than the first preset threshold;

The processor is further configured to determine that a hidden channel exists in the system when the first time difference of each target sub-sequence in the preset number of target sub-sequences is less than the first preset threshold.

Optionally, determining whether the first time difference of each target sub-sequence in the preset number of target sub-sequences is less than a first preset threshold, if the first time difference of each sub-sequence in the preset number of target sub-sequences is Less than the first preset threshold, ie, Δt _i <T ₍₁₎ , i ∈ [1, n], it is determined that there is a hidden channel in the operating system. It should be noted that the first preset threshold T ₍₁₎ may be twice the execution time of the memory page write operation after the merge.

The processor is further configured to determine whether a second time difference between a start time of the first target subsequence and an end time of the last target subsequence in the preset number of target subsequences is less than a second preset a threshold, the second preset threshold is less than the preset number;

The processor is further configured to determine that a hidden channel exists in the system when the second time difference is less than the second preset threshold.

Optionally, in order to improve the detection accuracy, the communication bandwidth of the hidden channel is detected, and the specific detection method is to further determine the start time and the last time of the first target subsequence in the preset number of target subsequences. Whether the second time difference between the end times of the target subsequences is less than a second preset threshold, and if less than the second preset threshold, determining that there is a covert channel in the system. As shown in Figure 3, it is judged:

Δt _i <T ₍₁₎ i∈[1,n] && t _n-end -t _1-beg -T _(n)

That is T _(n) <n

One of ordinary skill in the art can understand that all or part of the process of implementing the foregoing embodiments can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The steps in the method of the embodiment of the present invention may be sequentially adjusted, merged, and deleted according to actual needs.

The modules or units in the terminal in the embodiment of the present invention may be combined, divided, and deleted according to actual needs.

The components of the microcontroller and the like may be implemented by a general-purpose integrated circuit, such as a central processing unit (CPU), or an application specific integrated circuit (ASIC).

The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto, and thus equivalent changes made in the claims of the present invention are still within the scope of the present invention.

Claims

A channel detection method, comprising:

When at least two virtual machines perform memory de-merging on the same physical host, intercepting an event sequence executed by the operating system in an operating system instruction stream, where the event sequence includes an acquisition time event;

Finding a target subsequence from the sequence of events, and acquiring a time attribute of the target subsequence;

Determining whether the time attribute of the target subsequence satisfies a preset condition;

When the time attribute of the target subsequence satisfies a preset condition, it is determined that there is a covert channel in the system.
The method of claim 1 wherein the time attribute of the target subsequence comprises a first time difference between a start time and an end time of the target subsequence;

Determining whether the time attribute of the target subsequence meets a preset condition, including:

Determining whether the first time difference of the target subsequence is less than a first preset threshold;

Determining that there is a hidden channel in the system when the time attribute of the target subsequence meets a preset condition, including:

When the first time difference of the target subsequence is less than the first preset threshold, it is determined that a hidden channel exists in the system.
The method of claim 2, wherein the sequence of events comprises a plurality of target subsequences;

And searching for the target subsequence from the sequence of events, and acquiring time attributes of the target subsequence, including:

Finding a preset number of target sub-sequences from the sequence of events;

Calculating a first time difference between a start time and an end time of each target subsequence in the preset number of target subsequences.
The method of claim 3 wherein said determining said target subsequence Whether the first time difference is less than a first preset threshold, including:

Determining whether the first time difference of each target sub-sequence in the preset number of target sub-sequences is less than the first preset threshold;

When the first time difference of the target subsequence is less than the first preset threshold, determining that there is a hidden channel in the system includes:

When the first time difference of each target subsequence in the preset number of target subsequences is less than the first preset threshold, it is determined that there is a covert channel in the system.
The method according to claim 4, wherein after the first time difference of each of the target subsequences in the predetermined number of target subsequences is less than the first preset threshold, include:

Determining whether a second time difference between a start time of the first target sub-sequence and an end time of the last target sub-sequence in the target number sub-sequence is less than a second preset threshold, the second pre- Setting a threshold smaller than the preset number;

When the second time difference is less than the second preset threshold, it is determined that there is a hidden channel in the system.
A channel detecting device, comprising:

The intercepting module is configured to: when the at least two virtual machines perform memory de-merging on the same physical host, intercepting an event sequence executed by the operating system in the operating system instruction stream, where the event sequence includes an acquiring time event;

An obtaining module, configured to search for a target subsequence from the sequence of events, and obtain a time attribute of the target subsequence;

a determining module, configured to determine whether a time attribute of the target subsequence meets a preset condition;

And a determining module, configured to determine that a hidden channel exists in the system when a time attribute of the target subsequence satisfies a preset condition.
The apparatus according to claim 6, wherein the time attribute of the target subsequence comprises a first time difference between a start time and an end time of the target subsequence;

The determining module is specifically configured to determine whether the first time difference of the target subsequence is less than First preset threshold;

The determining module is specifically configured to determine that a hidden channel exists in the system when the first time difference of the target subsequence is less than the first preset threshold.
The apparatus according to claim 7, wherein if the sequence of events comprises a plurality of target subsequences; the obtaining module comprises:

a searching unit, configured to sequentially search for a preset number of target sub-sequences from the sequence of events;

And a calculating unit, configured to calculate a first time difference between a start time and an end time of each target sub-sequence in the preset number of target sub-sequences.
The apparatus according to claim 8, wherein the determining module is specifically configured to determine whether the first time difference of each target sub-sequence in the preset number of target sub-sequences is smaller than the first Preset threshold.
The apparatus according to claim 9, wherein said determining module comprises a determining unit and a determining unit;

The determining unit is configured to determine, when the first time difference of each target sub-sequence in the target number sub-sequence of the preset number is less than the first preset threshold, determine the preset number of targets Whether the second time difference between the start time of the first target subsequence and the end time of the last target subsequence in the subsequence is less than a second preset threshold, and the second preset threshold is less than the preset number ,

The determining unit is configured to determine that a hidden channel exists in the system when the second time difference is less than the second preset threshold.