JP5637934B2 - Virtualization device, virtualization device control method, virtualization device control program - Google Patents

Description

  The present invention relates to a virtualization apparatus including a CPU having a virtualization support function.

  There are virtualization technologies that divide a computer resource of a physical machine into a plurality of logical resources, start a plurality of virtual machines, and operate an OS (Operating System) for each virtual machine (for example, Patent Documents 1 and 2). For example, by emulating processing requests from the OS to the hardware by software, a plurality of OSs can be operated on a single physical machine. Here, considerable hardware overhead is required for hardware emulation processing by software. Therefore, a CPU (Central Processing Unit) having a virtualization support function that supports such virtualization at the hardware level is used. A virtual machine operating on a physical machine can operate efficiently by making a processing request through such a virtualization support function provided in the CPU.

JP 2010-238044 A International Publication No. 2007/108065

  However, it cannot be said that a virtual machine started up on a physical machine in this way can be taken over and controlled by unauthorized access from outside. If this happens, the virtual machine can be used as a stepping stone for some kind of fraud, other virtual machines running on the physical machine can be attacked, or some information about the physical machine can be extracted It seems to be a threat. Therefore, when such takeover is performed, it is desirable to detect that.

  The present invention has been made in view of such a situation, and a virtualization apparatus, a virtualization apparatus control method, and a virtualization apparatus control for detecting that a virtual machine to be booted on a physical machine may be hijacked Provide a program.

To solve the problems described above, the present invention provides a virtualization apparatus having a CPU with virtualization support functions for performing parallel processing of the virtual machine efficiently, are entered in the kernel operating in CPU a processing request storing unit pattern processing request is stored in advance, a processing request detection unit that detects a processing request input to the kernel, the processing request detection unit detects the processing request, to operate the kernel virtual machine A process determination unit that determines whether the request is a process request from a virtual machine, and the process request that is determined by the process determination unit to be a process request from a virtual machine is a process request that is predetermined as a virtual machine operation pattern whether, based on the process and the process of determining the request determination unit based on the pattern of the request storage unit that is stored in the processing request, that by the processing request determination unit determination result , Characterized in that it and a warning unit that outputs a warning.

In addition, the present invention accepts a process storage unit that stores process identification information for identifying a virtual machine, a virtual machine activation request, activates the virtual machine on the kernel in response to the activation request, A process management unit that stores process identification information to be identified in the process storage unit, and when the process request detection unit detects a process request , the process determination unit includes process identification information that identifies the process that has input the process request. Determining whether the processing request detected by the processing request detection unit is a processing request from a virtual machine operating in the kernel by determining whether the processing is stored in a process storage unit; To do.

The present invention also efficiently performs a CPU with virtualization support feature, the pattern of processing requests are entered into the kernel operating in the CPU is stored in advance and the processing request storing concurrent operation of the virtual machine part a virtualization apparatus control method of the virtualization apparatus equipped with a first step of detecting a processing request input to kernel processing request detected in the first step, the virtual machine operating in kernel The second step of determining whether or not the processing request is a processing request, and whether or not the processing request determined as a processing request from the virtual machine in the second step is a processing request predetermined as a virtual machine operation pattern as to whether or not a third step of determining, based on the pattern of the processing request storage unit that is stored in the processing request, based on the determination result in the third step A fourth step of outputting a warning, characterized in that it comprises a.

The present invention also efficiently performs a CPU with virtualization support feature, the pattern of processing requests are entered into the kernel operating in the CPU is stored in advance and the processing request storing concurrent operation of the virtual machine Department to computer virtualization apparatus equipped with, mosquitoes: a first step of detecting an input processing request to the kernels, the processing request detected in the first step, whether or not the processing request from the virtual machine operating in kernel A second processing step for determining whether or not the processing request determined to be a processing request from the virtual machine in the second step is a processing request predetermined as a virtual machine operation pattern. a third step of determining, based on the pattern of the storage unit that has stored the processing request, based on the determination result in the third step, outputting a warning That the fourth step, a virtualization apparatus control program for causing execution.

  As described above, according to the present invention, a virtualization apparatus including a CPU having a virtualization support function that efficiently performs parallel operations of virtual machines can be executed from a virtual machine that operates on a kernel that operates on the CPU. Multiple processing requests that are defined to be input to the kernel are stored in advance, processing requests that are input from the virtual machine to the kernel are detected, and whether processing requests that match the detected processing requests are stored in advance If it is determined that the virtual machine is not stored, a warning is output. Therefore, it is possible to detect that a virtual machine to be activated on the physical machine may be hijacked.

It is a block diagram which shows the structural example of the virtualization apparatus by one Embodiment of this invention. It is a figure which shows the example of the process request input into the kernel by one Embodiment of this invention. It is a figure which shows the example of the process request input into the kernel by one Embodiment of this invention. It is a figure which shows the example of data of the process information memorize | stored in the process memory | storage part by one Embodiment of this invention. It is a figure which shows the example of data memorize | stored in the process request memory | storage part by one Embodiment of this invention. It is a flowchart which shows the operation example of the virtualization apparatus by one Embodiment of this invention.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram illustrating the configuration of the virtualization apparatus 100 according to the present embodiment. The virtualization apparatus 100 is a computer apparatus including hardware 110, and includes, as the hardware 110, for example, a CPU 111, an HD 113, a memory 114, and a NIC 115. The CPU 111 is a central processing unit having a VT (Virtualization Technology) 112 that is a virtualization support function for more efficiently performing parallel operations of a plurality of OSs in a plurality of virtual machines. As the VT 112, for example, Intel VT (Intel is a registered trademark) or AMD-V (AMD is a registered trademark) can be applied. The VT 112 operates in response to a processing request from a program such as a KVM (Kernel-based Virtual Machine) based on a virtualization technology in which the OS kernel itself is a hypervisor of a virtual machine.

An HD (Hard Disk) 113 is a magnetic disk in which data is stored, and is an auxiliary storage device. The memory 114 is a semiconductor memory that stores data, and is a main storage device. A NIC (Network Interface Card) 115 is an expansion card that performs network communication. In addition to this, the virtualization apparatus 100 may include various elements as hardware 110.
Here, an example will be described in which the CPU 111 includes the VT 112 as a virtualization support function at the hardware level. However, the other hardware 110 elements may have a virtualization support function at the hardware level. good.

  The kernel 120 operates on such hardware 110, and processes such as application programs operate on the kernel 120. The kernel 120 is a program that is the core of the OS. In the present embodiment, description will be made assuming a Linux (registered trademark) kernel, but another OS kernel may be used. The kernel 120 has a function of a file system 121 that manages computer resources, data, and the like in units of files, and publishes system calls for making processing requests for such files to processes. The system call is an interface between the kernel 120 and a process operating on the kernel 120.

  Here, a process calls a system call of the kernel 120, and a process inputs a processing request to the kernel 120. 2 and 3 are diagrams showing examples of processing requests input to the kernel 120. FIG. Examples of processing requests include “read” for reading data from a file, “write” for writing data to the file, and “ioctl” for controlling the device. The kernel 120 accepts input of such processing requests from processes operating on the kernel 120 and operates the hardware 110 in accordance with the input processing requests. Processing requests include, for example, reading and writing files, issuing control commands to various hardware elements including the VT 112, creating new processes and threads, and securing memory used in the processes.

  For example, the process A indicated by symbol a in FIG. 1 inputs a read processing request for reading the data of the file “/ tmp” via a system call, or the process B indicated by symbol b via a system call. Thus, a write processing request for writing data to the file “/ usr / harada” can be input. The kernel 120 accesses the hardware 110 in response to the processing request, and performs processing such as file reading and writing.

  A process D indicated by a symbol d and a process E indicated by a symbol e are virtual machines. For the kernel 120, the virtual machine is one process similar to other application programs. The processing request input to the kernel 120 by such a virtual machine is for its own image file (file “/ data / imgD” for process D, file “/ data / imgE” for process E). There are those that perform reading and writing (read or write) and those that perform control (ioctl) for the file “/ dev / kvm” accessing the VT 112. Here, the processing request input to the kernel 120 by the virtual machine can basically be patterned to some extent, such as reading / writing with respect to its own image file and processing request to the VT 112. That is, a pattern of processing requests made by the virtual machine is determined and stored in advance, and the virtual machine operates according to the pattern by detecting that the processing request other than the determined pattern is input to the kernel 120. You can detect that you are not. When such an operation is performed, the virtual machine may have been hijacked. In order to perform such detection processing, the kernel 120 includes a processing request detection unit 122. This functional unit can be provided as a patch program for the kernel 120, for example.

  The processing request detection unit 122 detects a processing request input to the kernel 120 via a system call from the process, and notifies the processing request determination unit 143 of the detected processing request. Here, the process request includes a process ID for identifying the process request source process.

  When the virtual machine is activated on the kernel 120, the process F operating on the kernel 120 activates the virtual machine according to a command input from the user, and manages the statuses of the activated virtual machines. The management program includes a process storage unit 141, a process management unit 142, a process determination unit 143, a processing request storage unit 144, a processing request determination unit 145, and a warning unit 146.

  The process storage unit 141 stores a process ID that identifies a process of a virtual machine that is activated and managed by the process management unit 142. The virtual machine is a predetermined process for inputting a processing request for the VT 112 to the kernel. FIG. 4 is a diagram illustrating a data example of process information stored in the process storage unit 141. The process storage unit 141 stores a VM (Virtual Machine) name, an image file path, an OS, a memory, a CPU, a status, and a process ID in association with each other. The VM name is the name of the virtual machine. The image file path is information for identifying a location where a virtual machine image file is stored in the file system. The OS is information indicating the type of OS operating in the corresponding virtual machine. The memory is information indicating the capacity of the memory resource allocated to the corresponding virtual machine. The CPU is information indicating the number of CPU resources allocated to the corresponding virtual machine. The status is information indicating the operating state of the corresponding virtual machine, and is associated with information such as “stopped” or “running”, for example. The process ID is identification information for identifying a virtual machine process in the kernel 120.

  The process management unit 142 accepts a virtual machine activation request, activates the virtual machine on the kernel 120 in response to the accepted activation request, and stores a process ID for identifying the activated virtual machine in the process storage unit 141. . In addition, when the process management unit 142 receives a virtual machine stop request and stops the virtual machine according to the received stop request, the process management unit 142 displays the status stored in the process management unit 142 in association with the stopped virtual machine. Update to “Stop”.

  When the process determination unit 143 is notified by the processing request detection unit 122 that the processing request input to the kernel 120 has been detected, the process ID identifying the process that has input the processing request is sent to the process management unit 142. It is determined whether or not it is stored. That is, it is determined whether or not the process that has input the processing request is a virtual machine. The process determination unit 143 notifies the processing request determination unit 145 of the determination result.

  The processing request storage unit 144 stores in advance a plurality of processing requests that are determined to be input to the kernel 120 from a virtual machine that operates on the kernel 120 that operates on the CPU 111. The plurality of predetermined processing requests are, for example, reading / writing with respect to the image file of the virtual machine itself, processing requests to the VT 112, and the like as described above. FIG. 5 is a diagram illustrating an example of a plurality of processing requests that are predetermined by the virtual machine to be input to the kernel 120. The processing request storage unit 144 stores a definition file in which such processing requests are described. In the definition file, for example, a processing request can be expressed and stored using a wild card (*) symbol.

  The processing request determination unit 145 matches the processing request when the determination result of the process determination unit 143 based on the processing request detected by the processing request detection unit 122 indicates that the process that has input the processing request is a virtual machine. It is determined whether or not the processing request is stored in the processing request storage unit 144. That is, it is determined whether or not the processing request is predetermined as a virtual machine operation pattern.

  The warning unit 146 is determined by the process storage unit 141 that the process ID for identifying the process that has input the processing request detected by the processing request detection unit 122 is stored in the process storage unit 141, and the processing request determination unit When it is determined by 145 that a processing request that matches the processing request detected by the processing request detection unit 122 is not stored in the processing request storage unit 144, a warning is output. Here, for example, outputting a warning may output a warning text on the display of the virtualization apparatus 100, or may output a log file including the warning text and store it in a storage area. Then, a warning message may be sent by e-mail with a predetermined e-mail address as a destination. In addition, the warning unit 146 outputs a warning to the kernel 120, and the kernel 120 does not execute processing according to the processing request input to the VT 112 in response to the warning output from the warning unit 146. Anyway. Alternatively, for example, a dialog for selecting whether or not to execute processing according to the processing request can be displayed on the display of the virtualization apparatus 100. In this case, the kernel 120 executes the processing request if the selection is made to execute the processing request, and executes the processing request if the selection is made not to execute the processing request. Instead, the process may be stopped.

  Next, an operation example of the virtualization apparatus 100 according to the present embodiment will be described. FIG. 6 is a flowchart showing an operation example in which the virtualization apparatus 100 outputs a warning. When a processing request is input to the kernel 120 by any process (step S1), the processing request detection unit 122 detects the input processing request (step S2). The process request detection unit 122 notifies the process determination unit 143 of the detected process request (step S3). The process determination unit 143 determines whether or not the process ID included in the processing request is stored in the process storage unit 141 (step S4).

  If the process determination unit 143 determines that the process ID included in the processing request is not stored in the process storage unit 141 (step S4: NO), the process ends. On the other hand, when the process determination unit 143 determines that the process ID included in the processing request is stored in the process storage unit 141 (step S4: YES), the processing request determination unit 145 is stored in the processing request storage unit 144. It is determined whether or not the processing request detected in step S2 is stored in the processing request storage unit 144 (step S5).

  When the process request determination unit 145 determines that the process request detected in step S2 is stored in the process request storage unit 144 (step S5: YES), the process ends. On the other hand, when the processing request determination unit 145 determines that the processing request detected in step S2 is not stored in the processing request storage unit 144 (step S5: NO), the warning unit 146 outputs a warning (step S6).

In this way, the administrator of the virtualization apparatus 100 can know that the virtual machine is performing an unintended operation, for example, by taking over a virtual machine that operates on the kernel 120.
In this embodiment, the process of the virtual machine management program including the process storage unit 141 and the process management unit 142 includes a process determination unit 143, a processing request storage unit 144, a processing request determination unit 145, and a warning unit 146. Although an example has been described, a process determination unit 143, a processing request storage unit 144, a processing request determination unit 145, and a warning unit 146 are provided separately from the process of the virtual machine management program including the process storage unit 141 and the process management unit 142. It is good also as a structure which starts the process with which it is provided.

  It should be noted that the program for realizing the function of the processing unit in the present invention is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system and executed to manage the virtual machine. May be performed. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system having a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

100 Virtualization device 110 Hardware 111 CPU
112 VT
113 HD
114 Memory 115 NIC
120 Kernel 121 File System 122 Processing Request Detection Unit 130 System Call 141 Process Storage Unit 142 Process Management Unit 143 Process Determination Unit 144 Processing Request Storage Unit 145 Processing Request Determination Unit 146 Warning Unit

Claims (4)

A virtualization apparatus including a CPU having a virtualization support function for efficiently performing parallel operations of virtual machines,
A processing request storing unit pattern of processing requests are entered into kernel operating is stored in advance in the CPU,
A processing request detection unit that detects a processing request input before Symbol kernel,
A process determination unit that determines whether the processing request detected by the processing request detection unit is a processing request from a virtual machine operating in the kernel;
Said process determining unit by processing the determined processing request as a request from the virtual machine, whether the predetermined processing request as a pattern of operation of the virtual machine, pre Symbol processing request storage unit in the storage and determining processing request determination unit based on the pattern of which do that processing request,
A warning unit which on the basis of the by that determination result to the processing request determining unit and outputs a warning,
A virtualization apparatus comprising: A process storage unit storing process identification information for identifying the virtual machine;
A process management unit that accepts a startup request for the virtual machine, starts a virtual machine on the kernel in response to the startup request, and stores process identification information for identifying the virtual machine in the process storage unit;
With
Said process determination unit determines when the processing request detection unit detects the processing request, the process identification information for identifying the process entered the processing request, whether stored in said process storage unit Thus, the virtualization apparatus according to claim 1 , wherein it is determined whether the processing request detected by the processing request detection unit is a processing request from a virtual machine operating in the kernel . A CPU with virtualization support functions for performing parallel processing of the virtual machine efficiently, with a processing request storage unit in which the pattern of processing requests are entered into kernel operating is stored in advance in the CPU virtual Virtualization device control method for virtualization apparatus,
A first step of detecting the processing request inputted before Symbol kernel,
A second step of determining whether or not the processing request detected in the first step is a processing request from a virtual machine operating in the kernel;
Whether or not the processing request determined as a processing request from the virtual machine in the second step is a processing request predetermined as a virtual machine operation pattern is stored in the processing request storage unit. A third step of determining based on the processing request pattern
A fourth step of outputting a warning based on the determination result in the third step ;
The virtualization apparatus control method characterized by including . A CPU with virtualization support functions for performing parallel processing of the virtual machine efficiently, with a processing request storage unit in which the pattern of processing requests are entered into kernel operating is stored in advance in the CPU virtual Computer
A first step of detecting the processing request inputted before Symbol kernel,
A second step of determining whether or not the processing request detected in the first step is a processing request from a virtual machine operating in the kernel;
Whether or not the processing request determined as a processing request from the virtual machine in the second step is a processing request predetermined as a virtual machine operation pattern is stored in the processing request storage unit. A third step of determining based on the processing request pattern
A fourth step of outputting a warning based on the determination result in the third step ;
Virtualization device control program for executing

Images