CN108268306A - Virutal machine memory isolation technology based on internet - Google Patents

Abstract

Virutal machine memory isolation technology based on internet.This technology supports extension and configuration of the Xen security modules to Flask security strategies with Xen Hypervisor, completes the security isolation between privileged domain and common domain memory；This technology ensures the reliability and secret of common domain memory information；Enhance the maintainability of common domain memory information management simultaneously；For DomU memory information read operations, so as to achieve the purpose that DomU and Dom0 memory security isolations.

Description

Virutal machine memory isolation technology based on internet

Technical field

The invention belongs to Internet technical fields, are related to a kind of computer information technology field.

Background technology

With the continuous development of Internet technology, network technology is used by people, and existing memory configurations cannot be to letter Breath carries out security isolation, and particularly common domain memory, memory is the core component of a host, its operation is directly related to whole The operation of a computer system, the safety of memory are also all used in the security performance of virtual machine, and many criminals steal The information of content host causes the interests of people to receive damage, and the virutal machine memory isolation technology of internet can ensure people Computer security.

Invention content

Virutal machine memory isolation technology based on internet, technology are as follows：

1. Flask security frameworks are made of tactful mandatory services device and security server, TE is applied in Flask security frameworks（ Type is strengthened）Model, with Type security attributes come unifying identifier subject and object in Security Context, with RABC moulds Type directly to provide an additional level of abstraction to User and Domain；

2. for DomU memory information read operations, so as to achieve the purpose that DomU and Dom0 memory security isolations；Pass through Onclick is write in the event inside html drives privcmd to call Hypercall using Libxc libraries by privilege, attempts to read Take the running memory information of DomU.Assuming that Xen Hypervisor under the premise of believable, it is any except Hypervisor Have no right to access and obtain other domain system memory private room information in domain；

3. in the existing Type Enforcement models of virtualization software security module Flask security frameworks, handset is marked For special safety label, realize spread F lask about specific safety mark with reference to Hook Function in current FLASK security strategies The strategy of label ensures that the normal of DomU is created and run.

Claims (1)

1. the virutal machine memory isolation technology based on internet, it is characterised in that：Mainly according to virtualization software security module The existing Type Enforcement models of Flask security frameworks, by handset labeled as special safety label, with reference to current Hook Function realizes strategies of the spread F lask about specific safety label in FLASK security strategies, ensures the normal establishment of DomU And operation；When opening Xen Hypervisor, file can be loaded matter virtualization software kernel, the safety of virtualization software Module can control the fictitious host computer on Xen platforms, the relevant operation of authorization list, Memory control carries out safety detection , it can just be performed operation when satisfactory.