KR20080079124A - Apparatus and method for controlling access to system resource - Google Patents

Abstract

An apparatus and a method for controlling access to system resources are provided to improve system stability for system resource access control according to a virtual machine monitor and prevent system resources from being improperly used by malware. An apparatus(100) for controlling access to system resources includes a tag generating module(150), a resource management module(130) and an access control module(140). When a virtual machine requests access to system resources, the tag generating module generates a predetermined tag corresponding to the request. The resource management module manages the generated tag and information on the system resources. The access control module controls access of the virtual machine to the system resources by using the tag and the information.

Description

Apparatus and method for controlling access to system resource

1 is a diagram illustrating an apparatus for controlling access to system resources according to an embodiment of the present invention.

2 is a flowchart illustrating an access request and a virtual resource registration for a physical resource according to an embodiment of the present invention.

3 is a flowchart illustrating an access request for a virtual resource according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100: access control device 110: physical device

120: virtual machine monitor 30: resource management module

140: access control module 150: tag generation module

160a, b, n: virtual machine 170a, b, n: virtual resource

The present invention relates to an apparatus and method for controlling access to system resources, and more particularly, to identify system resources that virtual machines want to use in a virtual machine monitor to use only resources requested by a predetermined number of machine devices, The present invention relates to an apparatus and method for controlling access to system resources for distributing resources according to importance of system resources shared between machines.

Virtual Machine Architecture logically partitions a physical machine such that the underlying hardware of the machine is time-shared and appears as one or more independently operating virtual machines. Each virtual machine can function as a self-contained platform, running its own operating system (OS) and application software. Software running on a virtual machine is called guest software.

Guest software is expected to behave as if it is running on a dedicated computer, not in a virtual machine. That is, a guest computer is thought to control various events and to access hardware resources on a computer (eg, a physical machine). The hardware resources of a physical machine may include one or more processors (CPUs), resources that reside on the processor (eg, control registers, cache, etc.), memory, and other resources (eg, I / O devices) that reside on the physical machine. Can be.

Events may include interrupt handling, exception handling, platform events (eg, initialization (INIT) or system management interrupt (SMI), etc.).

The virtual machine monitor can change the guest software state in and out of the physical machine's devices, memory and registers as needed.

Virtual machine monitors can improve virtual machine performance by allowing direct access to underlying physical machines. This means that when an operation is performed in guest software, in a non-privileged mode that restricts software access to the physical machine, or on a physical machine where the operation wants the virtual machine monitor to remain in control. It is particularly suitable when not using.

The virtual machine monitor regains control whenever guest behavior can affect the correct execution of a virtual machine device or any of a non-running virtual machine. Typically, the virtual machine device inspects such operations to determine what is wrong before the operation is transferred to the underlying physical machine or emulates the operation for the guest. For example, a virtual machine monitor may take control when a guest accesses an input / output device, when the guest attempts to change the device configuration (eg, by changing a control register value), or when the guest attempts to access a specific area of memory. You may need to get it back.

Korean Patent Laid-Open Publication No. 10-2006-0108711 "virtual machine management using activity information" relates to virtual machine management using information on activities of virtual machine (s), and more specifically, to activities of virtual machine (s). Relocating resources between virtual machine (s) based, at least in part, on activity monitors, resource managers that monitor activities of virtual machines, and virtual machine monitors can also reallocate resources allocated to virtual ATLS It includes.

However, in the related art, access control is performed through a virtual machine monitor targeting a limited resource among system resources. At this time, the access control of the physical resource is not made, there is a problem that the control and distribution of the physical resource is not executed as intended or there is a risk of information disclosure on the resource due to a malicious virtual machine.

In addition, it does not distinguish which virtual resource the communication channel used by the virtual machine in the virtual machine monitor layer ultimately means. This does not mean that communication channel access control controls resource access.

The present invention has been invented to solve the above problems, the access control to the system resources by first controlling the access to the system resources in the virtual machine monitor before the access control is made in the virtual machine providing the virtual resources This is to save the processor occupancy time and to solve the limitation that the access control in the virtual machine does not work as intended when the virtual machine malfunctions.

In addition, the virtual machine monitor identifies a plurality of system resources that a predetermined number of virtual machines want to use, and uses only the system resources required by each virtual machine, and system resources according to the importance of the virtual machines using shared resources. This is to distribute security to ensure the security and stability of the virtual machine.

The objects of the present invention are not limited to those mentioned above, and other matters not mentioned will be clearly understood by those skilled in the art from the following description.

An apparatus for controlling access to system resources according to an embodiment of the present invention includes a tag generation module for generating a predetermined tag corresponding to the access request when a request for access to system resources from a virtual machine, generated information about the generated tag, and system resources is used. It includes a resource management module for managing the and access control module for controlling access to the system resources of the virtual machine using the tag and the usage information.

The method for controlling access to system resources according to an embodiment of the present invention includes generating a predetermined tag corresponding to the access request when a request for access to system resources from a virtual machine, and managing usage information on the generated tags and system resources. And controlling access to system resources of the virtual machine using the tag and the usage information.

Specific details of other embodiments are included in the detailed description and the drawings.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

1 illustrates an apparatus for controlling access to system resources according to an embodiment of the present invention.

Apparatus 100 for accessing system resources according to an embodiment of the present invention is a place for performing comprehensive access control on system resources from external intrusion, security of a virtual system based on access control to system resources Do this.

As shown, the apparatus 100 for access control to system resources according to an embodiment of the present invention includes a predetermined number of virtualized virtual devices from the physical device 110, the virtual machine monitor 120, and the virtual machine monitor 120. Machine 160a, b, n.

First, the physical device 110 includes conventional hardware resources such as processors, memory, input / output devices, and network cards, which are referred to as physical resources.

The physical resource may further include one or more processors and resources residing on the processor, for example, a control register, a cache. Events for these physical resources may include interrupt processing, exception processing, platform events (eg, INIT or System Management Interrupt (SMI)).

Processors and memory are provided from virtual machine monitor 120 to virtual machines 160a, b, n as Exclusive Shared Resources in the form of virtualized processors and virtualized memory, and allocation of these resources is also subject to access control. It can be included in system resources.

The virtual machine monitor 120 may include a resource management module 130, an access control module 140, and a tag generation module 150 as a place for performing access control on system resources.

Here, the system resources include the aforementioned physical resources and virtual resources 1, 2, n (170a, 170b, 170n). Virtual resources 1, 2, and n (170a, 170b, 170n) are used to share resources when a virtual machine of any of a plurality of virtual machines (160a, b, n) is allowed to access a physical resource. By registering as the virtual resources 1, 2, n (170a, 170b, 170n) means a resource virtualized physical resources.

The resource management module 130 included in the virtual machine monitor 120 is a module that records usage information on system resources and manages system resources based on the recorded usage information.

The usage information on the system resources recorded in the module includes information on the types of physical resources among the system resources and the virtual machines that provide the physical resources to the virtual resources 1, 2, and n (170a, 170b, 170n), and virtual resources 1, 2 It may include information of the virtual machines 1, 2, n (160a, 160b, 160n) using the physical resources through, n (170a, 170b, 170n), the type and physical of the physical resources requested to access the system resources It may include whether to register the virtual resources 1, 2, n (170a, 170b, 170n) for the resource.

That is, the usage information on the system resource may include the usage status of the system resource and the state information of the system resource.

The access control module 140 requests the access to system resources from the virtual machines 160a and bn based on the system resource usage information and the system resource access policy of the resource management module 130. Module to control access. The system resource access policy is a policy set by a user based on normal access control models (Data Type & Enforcement, Chinese wall, Role Based Access control, etc.). That is, the system resource access policy is recorded in the access control module 140.

The tag generation module 150 generates a predetermined tag corresponding to the access request when requesting access to system resources from the virtual machine.

The predetermined tag generated by the tag generation module 150 may be divided into a communication channel tag indicating a purpose of using a communication channel between virtual machines and a device tag for a physical resource that the virtual machine intends to use.

Herein, the communication channel tag uses a communication channel between virtual machines when using a communication channel for sharing virtual resources 1, 2, n (170a, 170b, 170n) between at least two virtual machines 160a and b among a plurality of virtual machines. It is a tag of a predetermined method for grasping the purpose. The communication channel tag does not specify the virtual machine 160b with which the virtual machine 160a wishes to communicate, but refers to information about the virtual resource 170b provided by the virtual machine 160b.

That is, the resource management module 130 finds the virtual machine 160b including the virtual resource 170b based on the communication channel tag generated between the virtual machines 160a and 160b, and the access control module 140 searches for the virtual machine. By determining whether to allow access to 160b to determine a communication channel connection with the virtual machine 160a, anonymity for the virtual machine 160b providing the virtual resource 170b is guaranteed.

The device tag may be assigned to any one of an interrupt handler (Handler) registration request, an input / output space access request, and a direct memory access (DMA) use request from the virtual machines 160a, b, and n for a physical resource (for example, an input / output device). When a request for or a request for using a physical resource other than these occurs, the virtual machine monitor 120 is a tag generated to determine which input / output device these requests are accessed.

These tags are newly generated and recorded in the resource management module 130 whenever there is a request for access to system resources of the virtual machines 160a, b and n, and the use of the resources from the virtual machines 160a, b and n. When this is completed, the used system resources are deleted from the resource management module 130 and the virtual machine information, types of physical resources requested for access among the system resources, and virtual resources 1, 2, n for the physical resources (170a, 170b). , 170n) may be registered.

2 is a flowchart illustrating access control and virtual resource registration for a physical resource according to an embodiment of the present invention.

The access control and the virtual resource 1, 2, n (170a, 170b, 170n) registration for the physical resource according to an embodiment of the present invention request access to the physical resource from a predetermined number of virtual machines (160a, b, n) It shows that the virtual resources 1, 2, n (170a, 170b, 170n) is registered in the virtual machine through the permission to access.

The physical resource according to the embodiment of the present invention refers to the hardware resources included in the physical device 110, the virtual resources 1, 2, n (170a, 170b, 170n) means a resource virtualized resources, These two resources belong to system resources.

First, the virtual machine monitor 120 determines whether there is a request for access to a physical resource from any one of the plurality of virtual machines 160a, b, and n (S200).

When the physical resource according to an embodiment of the present invention is an input / output device, any virtual machine requesting access to the corresponding device should access the input / output device using its own input / output device driver. In S200, there may be a request for registering an interrupt handler, an access request for an input / output space, a DMA request, and a system resource use request for using an input / output device other than the case. That is, the access request step (S200) for the physical resource is to determine whether there is a request for them.

When such an access request is determined (S200), it is determined what resource the physical resource requested for access from the virtual machine is (S210).

If it is determined what is the requested resource (S210), the tag generation module 150 generates a device tag corresponding to the resource requested by the virtual machine (S220).

Since the device tag has been described in detail with reference to FIG. 1, the detailed description thereof will be omitted.

When the device tag is generated in the tag generation module 150 (S220), in the access control module 140, the virtual machine that requests access to the input / output device based on the usage information of the system resource, the system resource access policy, and the device tag is the corresponding device. It is determined whether the access to (S230).

When requesting access to a physical resource, access control according to an embodiment of the present invention generates a device tag when a request for access to a physical resource is generated and permits or denies access based on a corresponding tag, a system resource access policy, and the request content. .

If access to the input / output device of the virtual machine is allowed, it is determined whether the virtual machine requesting the first access (S240). The first access is determined by the access control module 140 based on the virtual machine information previously stored in the resource management module 130 and records the virtual machine information and the system resource usage status.

That is, when the virtual machine requesting the access to the input / output device (physical resource) is the first access, the resource management module 130 records the usage status of the requested physical resource and the virtual machine information (S250).

From the request for access to the physical resource step (S200) to the usage status recording step for the physical resource (S250) shows the access control of the virtual machine to the physical resource, the subsequent steps are the virtual machine is allowed access to the physical resource 1, 2, n (160a, 160b, 160n) shows the access control in the process of registering virtual resources 1, 2, n (170a, 170b, 170n) for sharing.

First, it is determined whether there is a request to register a virtual resource for a physical resource (S260).

When registration to the virtual resource is requested, it is determined whether the physical resource can be shared (S270).

In this case, in order to determine whether the physical resources can be shared, the virtual machines 1, 2, and n (160a, 160b, 160n) that have requested virtual resource registration for any physical resource should have access to the physical resources, and system resources. The access policy must be satisfied.

Satisfying the system resource access policy may be to determine whether only one virtual machine among the plurality of virtual machines 160a, 160b, 160n is exclusively accessed or shared with any physical resource. In the virtual machine 1, 2, n (160a, b, n) aspect is to determine whether you have a security level or privilege to access the requested resource.

Satisfaction with the system resource access policy is performed by the access control module 140.

In other words, if there is any virtual machine 1 (160a) that satisfies the system resource access policy among the virtual machines 1, 2, n (160a, 160b, 160n) that can access the physical resource, the physical resource for which virtual resource registration is requested. The resource is registered as the virtual resource 1 170a (S280). At this time, the registered virtual resource 1 (170a) is to be a virtual resource 1 (170a) of the virtual machine 1 (160a) requesting a virtual resource registration of the physical resource, the virtual resource 1 (170a) registered to another virtual machine 2, It is shared with n (160b, 160n).

3 is a flowchart illustrating access control for a virtual resource according to an embodiment of the present invention.

Access control for the virtual resources 1, 2, n (170a, 170b, 170n) according to an embodiment of the present invention is registered in accordance with the access control and virtual resource registration for the physical resource of FIG. Access control is achieved by using 2, n (170a, 170b, 170n) with a communication channel between a plurality of virtual machines 1, 2, n (160a, 160b, 160n).

The access control for the virtual resources 1, 2, n (170a, 170b, 170n) is the virtual machine 1, 2, which wants to access the virtual resource of any one of the virtual resources 1, 2, n (170a, 170b, 170n). When the virtual machine monitor 120 provides a communication channel corresponding to the request when the virtual machine access request of any one of the n (160a, 160b, 160n) is made by controlling the communication channel provided to the virtual machine.

First, the virtual machine monitor 120 requests the virtual machine monitor 120 to access the virtual resource 170b included in the virtual machine 160b from any virtual machine 160a (S300).

As described above, the request for access to the virtual resource 170b requests the virtual machine monitor 120 to create a communication channel so that the virtual machine 160a can access the virtual resource 170b.

When a communication channel for accessing the virtual resource 170b is generated, the tag generation module 150 generates a communication channel tag (S310).

In this case, the generated communication channel tag is a tag corresponding to the virtual resource 170b that the virtual machine 160a requests to access.

When a tag corresponding to the virtual resource 170b is generated in the communication channel, the resource management module 130 searches for the virtual machine 160b including the virtual resource 170b based on the system resource usage information and the system resource access policy. (S320).

Since the system resource usage information for searching for the virtual machine 160b has been described above with reference to FIG. 1, a detailed description thereof will be omitted.

When the search for the virtual machine 160b including the virtual resource 170b is completed, it is determined whether the virtual machine 160b exists (S330). This step S330 also determines whether the virtual machine 160b exists based on the system resource usage information and the system resource access policy. Herein, when the virtual machine 160b does not exist, the access control module 140 rejects the communication channel creation request, and when the virtual machine 160b exists, the access control module 140 returns to the virtual resource 170b based on the requested communication channel. Proceed with processing the access request.

If the virtual machine 160b exists (when access to the virtual resource 170b is allowed), the access control module 140 requests the resource management module 130 for status information of the virtual resource 170b (S340).

The state information of the virtual resource 170b is included in the above-described system resource usage information, and may be information about a usage state of the corresponding resource and a virtual machine including the corresponding virtual resource.

The access control module 140 determines whether the virtual machine 160a that has requested the state information of the virtual resource 170b is accessible to the corresponding resource based on the system resource usage information and the system resource access policy (S350). In this case, the system resource access policy may be a policy corresponding to simultaneous access to the virtual resource 170b.

The generation of the communication channel requested for access to the virtual resource 170b is allowed according to the determination result of the accessibility (S360). With the permission of the communication channel creation, the resource management module 130 records the virtual machine 160a information for using the virtual resource 170b.

That is, the access control for virtual resource sharing according to an embodiment of the present invention determines the communication channel creation decision requested for resource sharing before the access to the virtual resource, thereby reducing the processor occupancy time when the resource access is not allowed. You can save.

Those skilled in the art will appreciate that the present invention can be embodied in other specific forms without changing the technical spirit or essential features of the present invention. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. The scope of the present invention is indicated by the scope of the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and the equivalent concept are included in the scope of the present invention. Should be interpreted.

According to the apparatus and method for controlling access to system resources as described above, the effect of the present invention is to increase the stability of the system with respect to access control of system resources by a reliable and stable virtual machine monitor and by malware. The advantage is that system resources can be prevented from being abused.

In addition, it is possible to accurately understand the system resources to be used by the virtual machine to use only the resources requested by each virtual machine, and to allocate the virtual resources according to the importance of the virtual machines using the shared virtual resource.

In addition, since the access control in the virtual machine monitor is performed from the access request step of the virtual machine, the CPU occupancy time can be shortened when access to the system resources of the virtual machine is not allowed.

Claims (5)

A tag generation module for generating a predetermined tag corresponding to the access request when requesting access to system resources from a virtual machine; A resource management module for managing usage information on the generated tag and the system resource; And And an access control module for controlling access to the system resources of the virtual machine by using the tag and the usage information. The method of claim 1, The tag is, Apparatus for controlling access to system resources, including the information of the virtual machine, the type of physical resources requested for access among the system resources, and whether the virtual resources are registered with the physical resources. The method of claim 1, The usage information, A type of a physical resource among the system resources and information of a virtual machine providing the physical resource as a virtual resource; And Access control device for a system resource including the information of the virtual machine using the physical resource through the virtual resource. Generating a predetermined tag corresponding to the access request when requesting access to system resources from a virtual machine; Managing usage information on the generated tag and the system resource; And And controlling access to the system resource of the virtual machine using the tag and the usage information. The method of claim 4, wherein The tag is, And information on the virtual machine, a type of a physical resource requested for access among the system resources, and whether a virtual resource is registered with the physical resource.

Images