WO2015101148A1 - 一种实现虚拟机自省的方法和装置 - Google Patents

一种实现虚拟机自省的方法和装置 Download PDF

Info

Publication number
WO2015101148A1
WO2015101148A1 PCT/CN2014/093427 CN2014093427W WO2015101148A1 WO 2015101148 A1 WO2015101148 A1 WO 2015101148A1 CN 2014093427 W CN2014093427 W CN 2014093427W WO 2015101148 A1 WO2015101148 A1 WO 2015101148A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
checked
virtual machine
read
copy
Prior art date
Application number
PCT/CN2014/093427
Other languages
English (en)
French (fr)
Inventor
涂彬
陈海波
夏虞斌
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP14876189.3A priority Critical patent/EP3079057B1/en
Publication of WO2015101148A1 publication Critical patent/WO2015101148A1/zh
Priority to US15/199,200 priority patent/US10007785B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/565—Static detection by checking file integrity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45591—Monitoring or debugging support
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the present invention relates to the field of information technology, and in particular, to a method and apparatus for implementing virtual machine introspection.
  • VMI Virtual Machine Introspection
  • the VMI system can be run in a VMM (Virtual Machine Monitor).
  • the VMM can enhance the security of the VM from outside the VM through the VMI system to protect the VM.
  • the VMM can monitor the internal running state of the VM outside the VM through the VMI system.
  • the VMI system can directly scan the VM's memory, disk, and monitor network behavior to perform security check on the VM.
  • the specific security detection step may include: the VMI system may obtain the memory data to be checked from the VM; and perform security check on the obtained memory data to be checked.
  • the VM may also be accessing the memory data to be checked.
  • the VMI system acquires the memory data to be checked after completing the part, the VM is local to the local The memory data corresponding to the memory data to be checked is modified, and the memory data acquired by the VMI system is inconsistent with the memory data of the VM locality, which in turn causes the VMI system to fail to perform security check on the memory data in the VM accurately.
  • the invention provides a method and device for realizing virtual machine introspection, and solves the problem that the VMI system cannot accurately perform security check on data in the VM.
  • a method for implementing virtual machine introspection including:
  • the security check is performed on the copy.
  • the data to be checked includes lock data, and the lock data is used to indicate whether the data to be checked is currently being accessed;
  • the method further includes:
  • the reading starts to read the to-be-checked data, saves a copy of the read data to be inspected, and stores the read storage address of the to-be-checked data into a hardware transaction memory, so that the hardware transaction memory can be
  • the storage address monitors the data to be inspected that has been read, including:
  • the transaction memory is configured to enable the hardware transaction memory to monitor the read data to be inspected according to the storage address.
  • the performing security check on the copy includes:
  • the method further includes :
  • the method further includes:
  • a method for implementing virtual machine introspection including:
  • a determining unit configured to determine data to be inspected in the virtual machine
  • a reading unit configured to read the to-be-checked data determined by the determining unit, save a copy of the read data to be inspected, and store the stored storage address of the to-be-checked data into the hardware transaction memory;
  • a monitoring unit configured to monitor, by using the hardware transaction memory, whether the read data to be checked corresponding to the storage address is modified
  • An ending unit configured to stop reading the to-be-checked data and delete the copy when the monitoring unit detects that the read data to be inspected is modified
  • a security checking unit configured to perform a security check on the copy when the reading unit reads that the data to be checked is completed and the monitoring unit does not monitor that the read data to be inspected is modified.
  • the copy saved by the reading unit includes lock data, and the lock data is used to represent the current data to be checked determined by the determining unit Whether it is being accessed;
  • the device also includes:
  • a determining unit configured to determine, after the determining unit determines the data to be checked in the virtual machine, whether the lock corresponding to the lock data is in a released state, where the release state is used to indicate that the data to be checked is not currently accessed;
  • the reading unit is configured to: if the lock corresponding to the lock data is in the release state, start reading the data to be checked, save a copy of the read data to be checked, and read the read data.
  • the storage address of the data to be checked is stored in the hardware transaction memory, so that the hardware transaction memory can monitor the read data to be inspected according to the storage address.
  • the security checking unit is specifically configured to check integrity of the copy saved by the reading unit; and/or And determining, according to the copy saved by the reading unit, whether malware exists in a system in which the virtual machine runs.
  • the apparatus further includes:
  • a sending unit configured to: when the security check unit completes a security check on the copy saved by the reading unit, if the copy does not pass the security check performed by the security check unit, The virtual machine sends a security check failure message, so that the virtual machine performs corresponding processing according to the security check failure message sent by the sending unit.
  • the apparatus further includes:
  • An obtaining unit configured to acquire, when the monitoring unit detects that the read data to be checked is modified, obtain a storage address of the to-be-checked data to be modified;
  • the sending unit is further configured to: when the acquiring unit acquires a storage address of the modified data in the read data to be checked, send an access conflict message to the virtual machine, where the access conflict message includes the The storage address of the data to be checked that is modified, so that the virtual machine determines whether the process of modifying the modified data to be stored is a security process.
  • the method and the device for implementing the virtual machine introspection provided by the present invention can monitor whether the data to be checked that has been read is modified by the hardware transaction memory during the process of reading the data to be checked, if the data to be checked is read. During the process, if the modified data is not detected in the read data to be checked, the copy is consistent with the data to be checked in the virtual machine. At this time, the copy may be checked for security. During the process of taking the data to be inspected, the read to be checked is monitored. If the modified data exists in the data, the data to be checked is stopped and the copy is deleted, that is, the security check is not performed on the data to be checked, thereby increasing the accuracy of the security check.
  • the present invention also records that, before reading the data to be checked, first determining whether the lock of the data to be checked is in a released state, and reading the data to be checked only when the lock is in a released state. In this way, when the data to be checked is started to be read, no other process accesses the data to be checked, which reduces the number of occurrences of the access conflict, thereby reducing the readiness that has been read during the reading process.
  • Checking the probability that the data is modified; further, the lock data corresponding to the lock may also be read, that is, the copy includes the lock data, such that after the lock data is read, the lock data is virtual
  • the storage address in the machine is stored in the hardware transaction memory, and the hardware transaction memory also monitors the lock data.
  • the read pending check is not detected. If there is modified data in the data, it can be explained that the copy is consistent with the data to be checked in the virtual machine, and it can also be explained that in the process of reading the data to be checked, In other processes accessing the data to be examined, then more stringent to ensure consistency with the copy of the virtual machine to be examined data.
  • the present invention also describes that if the read data to be inspected is modified during the reading, the storage address of the modified data in the read data to be checked is acquired, and The virtual machine sends an access conflict message, and the virtual machine can immediately locate the location of the conflicting access according to the storage address of the modified data in the access conflict message, and determine whether the process of modifying the modified data is safe.
  • the process in this way, speeds up the virtual machine to determine the location of the conflicting access, thereby improving the efficiency of checking out malware, thereby increasing the security of the virtual machine.
  • FIG. 1 is a flowchart of a method for implementing virtual machine introspection according to an embodiment of the present invention
  • FIG. 2 is a flowchart of another method for implementing virtual machine introspection according to the embodiment
  • FIG. 3 is a schematic structural diagram of a virtual device for implementing a virtual machine introspection device according to an embodiment of the present invention
  • FIG. 4 is a schematic structural diagram of another virtual device for implementing a virtual machine introspection device according to an embodiment of the present disclosure
  • FIG. 5 is a schematic structural diagram of a physical device of an apparatus for implementing virtual machine introspection according to an embodiment of the present invention.
  • the security protection of the virtual machine can be implemented by the VMI (Virtual Machine Introspection) technology.
  • VMI Virtual Machine Introspection
  • the VMI system may also be accessing the memory data to be checked.
  • the VMI system is After the memory data of the to-be-checked memory data is modified by the virtual machine, the memory data obtained by the VMI system is inconsistent with the local memory data of the virtual machine. This causes the VMI system to fail to accurately check the memory data in the virtual machine.
  • some embodiments are provided below for specific explanation.
  • This embodiment provides a method for implementing virtual machine introspection. As shown in FIG. 1 , the method may include:
  • the data to be checked may be the memory data in the memory of the virtual machine.
  • the stored address of the data to be checked in the virtual machine is automatically stored in the hardware transaction memory, and a copy of the read data to be checked can also be stored in the hardware.
  • transactional memory In transactional memory.
  • the hardware transaction memory can monitor the data corresponding to the storage address stored in the local area, and can monitor whether the data is modified or the like. In this embodiment, since the hardware transaction memory stores the storage address of the read data to be checked, Therefore, the hardware transaction memory can monitor whether the data to be checked that has been read is modified.
  • the security check is performed on the copy of the data to be checked.
  • the data to be checked In the process of reading the data to be checked, if the data to be checked that has been read is not modified, it indicates that the data in the copy of the data to be checked is consistent with the data to be checked in the virtual machine. A copy of the data to be checked is checked for security.
  • the read data to be checked can be monitored through the hardware transaction memory. If the data to be checked is read, the read data is not detected. If the data to be checked exists in the data to be checked, the copy is consistent with the data to be checked in the virtual machine. In this case, the copy of the data to be checked may be checked for security. If the modified data is detected in the read data to be checked, the data to be checked is stopped and the copy of the data to be checked is deleted, that is, the security check is not performed on the check data, thereby increasing the accuracy of the security check.
  • This embodiment provides another method for implementing virtual machine introspection.
  • the method is to further expand and optimize the method shown in FIG. 1.
  • the method may include:
  • step 203 Determine whether the lock corresponding to the lock data is in a released state. If the lock is in the released state, step 203 is performed, and if the lock is not in the released state, step 202 is performed.
  • the release state can be used to indicate that the data to be checked is not currently accessed.
  • a lock is set, and the lock can be stored in the virtual machine to be checked in the form of lock data.
  • the state of the lock of the data to be checked may be used to indicate whether the data to be checked is being accessed by a process in the virtual machine system.
  • the state of the lock is a release state.
  • the state of the lock is a locked state.
  • the state of the lock is first determined, and if the lock is in a released state. The data to be checked can be accessed, and if the lock is in the locked state, the data to be checked cannot be accessed.
  • the lock is currently in the released state, when a process in the virtual machine system accesses the data to be checked, the lock needs to be acquired, and after the process acquires the lock, the state of the lock is The release state is switched to the locked state. After the process of accessing the data to be checked by the process, the process may release the lock, and the state of the lock may be switched from the locked state to the released state. The change can be changed by the value of the lock data corresponding to the lock stored in the virtual machine. Embodiment.
  • the VMI system detects that the lock is currently in the locked state, it indicates that a process in the current virtual machine system is accessing the data to be checked. If the VMI system reads the data to be checked, the process may be The check data will be modified, so that the data read by the virtual machine system is inconsistent with the data to be checked, which may result in inaccurate security check of the virtual machine. Therefore, if the VMI system detects the lock If the lock is in the locked state, the virtual machine may not be checked for security, but the state of the lock may be continuously monitored until the state of the lock is detected to be in the released state, that is, the security check may be performed.
  • the VMI system may determine, by using the value of the lock data, whether the lock corresponding to the lock data is in a released state.
  • This embodiment is not limited to the principle and implementation of the lock, and is a prior art and is well known to those skilled in the art, and details are not described herein again.
  • the VMI system checks that the current state of the lock is the release state, it indicates that no process accesses the data to be checked. At this time, the VMI system can read the data to be checked and read the data to be checked. The storage address is stored in the hardware transaction memory and a copy of the data to be checked that has been read is saved.
  • the hardware transaction memory may be set in the VMM, and the hardware transaction memory may include a read set, which may be used to store a storage address of data that the VMI system has read.
  • the storage address of the data to be checked that is read by the VMI system in the virtual machine is automatically stored in the read set, and
  • the VMI system may also store a copy of the data to be checked that has been read in the hardware transaction memory.
  • the storage address of the to-be-checked data refers to the storage address of the data to be checked in the virtual machine, and details are not described herein.
  • step 204 Monitor, by the hardware transaction memory, whether the data to be checked that has been read is modified. If reading If the data to be inspected that has been read is not detected, the process proceeds to step 205. If the data to be checked that has been read is detected to be modified during the process of reading, step 207 is performed.
  • the hardware transaction memory can monitor the data corresponding to the storage address in the read set, specifically whether the data is modified.
  • the storage address of the data to be checked that has been read may be automatically stored in the read set, after which, Since the read address stores the stored address of the data to be checked that has been read, the hardware transaction memory can monitor whether the read data to be checked is modified.
  • the VMI system can also read lock data of the data to be checked, and the lock data can be stored in the memory of the virtual machine, such that the lock data is after the VMI system reads the lock data.
  • the storage address in the virtual machine is stored in the read set, and the page in the copy of the data to be checked includes the lock data, and the hardware transaction memory also monitors the lock data, since the VMI system starts reading When the lock data is retrieved, the lock data is in a released state. Therefore, in the process of reading the data to be checked, the hardware transaction memory can not only monitor whether the data to be checked is modified, but also monitor the lock. Whether the state of the data has changed, that is, whether it is switched from the released state to the locked state, at this time, the lock data is also included in the copy.
  • the method for monitoring whether the data to be inspected has been read by the hardware transaction memory is not limited, and is not known to those skilled in the art.
  • step 205 Perform a security check on the copy of the data to be inspected. If the copy of the data to be checked passes the security check, the process ends, or after the preset time, step 201 is performed again. If the copy of the data to be checked fails the security check, step 206 is performed.
  • the security check of the copy of the data to be checked may be, but is not limited to, including:
  • the VMI system checks the integrity of the copy of the data to be checked; and/or, the VMI system determines whether malware is present in the system in which the virtual machine is running based on the copy of the data to be checked.
  • the integrity of the VMI system to check the copy of the data to be checked may be, but is not limited to, including: the VMI system may check whether the data in the copy of the data to be checked is complete by using a check code, and the specific checking method is a technician in the field. Well-known techniques are not described here.
  • the VMI system determines, according to the copy of the data to be checked, whether malware exists in the system running the virtual machine, but is not limited to include: because if the virtual machine system runs malware, it may remain in the data of the virtual machine.
  • the lower identifier for example, can be reflected by a certain piece of data. Therefore, the VMI system can check the copy of the data to be checked to determine whether the copy of the data to be checked includes the identifier left by the malware, and if so, There is malware in the virtual machine system.
  • the method for determining whether the malware exists in the system in which the virtual machine is running according to the copy of the data to be checked by the VMI system is not limited, and is a technology well known to those skilled in the art, and details are not described herein again.
  • the method for performing the security check on the copy of the data to be checked by the VMI system is not limited, and is a technology well known to those skilled in the art, and is not limited to the above-listed methods, and may be specifically set according to actual needs.
  • the virtual machine may stop running according to the security check failure message after receiving the security check failure message. If the VMI system checks that the data in the copy of the data to be checked is incomplete, the virtual machine may repair the incomplete data in the data to be checked according to the security check failure message after receiving the security check failure message. .
  • the corresponding processing performed by the virtual machine according to the security check failure message is not limited, and is a technology that is well known to those skilled in the art, and may be set according to actual needs, and details are not described herein again.
  • step 201 In the process of reading, if the hardware transaction memory detects that the read data to be checked is modified, it indicates that the copy of the data to be checked is inconsistent with the data to be checked that has been read. At this time, the VMI system cannot be accurate. The copy is security checked, so the VMI system stops reading the data to be checked and deletes the copy. After this, the VMI system can also restart the security check step. To perform step 201.
  • the lock is first acquired, and the corresponding lock data changes or changes. Therefore, after the VMI system reads the lock data, the hardware transaction memory is It will be monitored to end the security check process, thus ensuring more consistent consistency between the copy and the data to be checked in the virtual machine.
  • the VMI system reading the lock data may include: copying the lock data, and then acquiring the copied lock data, not acquiring the lock data, therefore, the VMI system does not change after reading the lock data.
  • the state of the lock does not change the code of the lock data, and thus some malware cannot temporarily stop the intrusion operation by modifying the data after determining that the VMI system is currently performing a security check on the virtual machine according to the lock data.
  • the VMI system can obtain the modified data from the data to be inspected that has been read, and then obtain the storage address of the modified data in the virtual machine.
  • an access conflict message may be sent to the virtual machine to notify the virtual machine that the data to be checked has an access conflict.
  • the access conflict message may include a storage address of the modified data; the virtual machine may quickly locate the location where the access conflict occurs according to the storage address of the modified data in the fast access conflict message; and may also be based on the location Determine whether the process of modifying the modified data is a secure process.
  • the data to be checked that has been read can be monitored through the hardware transaction memory. If the data to be checked is read, the read pending is not detected. If the modified data exists in the check data, the copy of the data to be checked is consistent with the data to be checked in the virtual machine. In this case, the copy of the data to be checked may be checked for security. In the case that the modified data is detected in the read data to be checked, the reading of the data to be checked is stopped and the copy of the data to be checked is deleted, that is, the data to be inspected is not processed. Security checks, thus increasing the accuracy of security checks.
  • the present invention also records that, before reading the data to be checked, first determining whether the lock of the data to be checked is in a released state, and reading the data to be checked only when the lock is in a released state, so that When the data to be checked is started to be read, no other process accesses the data to be checked, which reduces the number of occurrences of the access conflict, thereby reducing the data to be checked that has been read during the reading process.
  • the probability of the modification; further, the lock data corresponding to the lock may be read, that is, the copy of the data to be checked includes the lock data, so that after the lock data is read, the lock data is virtualized
  • the storage address in the machine is stored in the hardware transaction memory, and the hardware transaction memory also monitors the lock data.
  • the read data to be checked is not detected. If the modified data exists, not only the copy of the data to be checked is consistent with the data to be checked in the virtual machine, but also the process of reading the data to be checked. There is no other processes accessing the data to be examined, then more stringent to ensure the consistency of the data to be examined and a copy of the virtual machine to be examined data.
  • the present invention also describes that if the data to be inspected that has been read in the process of reading is modified, the storage address of the modified data in the read data to be checked is acquired, and an access conflict message is sent to the virtual machine.
  • the virtual machine can immediately locate the location of the conflicting access according to the storage address of the modified data in the access conflict message, and determine whether the process of modifying the modified data is a security process, thereby speeding up the virtual machine to determine the conflict.
  • the location of the access increases the efficiency of checking out malware, which in turn increases the security of the virtual machine.
  • the embodiment provides a device for implementing virtual machine introspection. As shown in FIG. 3, the method may include:
  • a determining unit 31 configured to determine data to be inspected in the virtual machine
  • the reading unit 32 is configured to read the to-be-checked data determined by the determining unit 31, save a copy of the read data to be inspected, and store the stored storage address of the to-be-checked data into the hardware transaction memory;
  • the monitoring unit 33 is configured to monitor, by using a hardware transaction memory, the read corresponding to the storage address Whether the data to be checked is modified;
  • the ending unit 34 is configured to stop reading the data to be inspected and delete the copy when the monitoring unit 33 detects that the read data to be inspected is modified;
  • the security checking unit 35 is configured to perform a security check on the copy of the data to be checked when the reading unit 32 reads that the data to be checked is completed and the monitoring unit 33 does not detect that the read data to be inspected is modified.
  • the read data to be checked can be monitored through the hardware transaction memory. If the data to be checked is read, the read data is not detected. If the data to be checked exists in the data to be checked, the copy of the data to be checked is consistent with the data to be checked in the virtual machine. In this case, the copy may be checked for security. If the modified data is detected in the data to be checked, the data to be checked is stopped and the copy of the data to be checked is deleted, that is, the security check is not performed on the data to be checked, thereby increasing the accuracy of the security check. Sex.
  • This embodiment provides another device for implementing virtual machine introspection.
  • the device is a further extension to the device shown in FIG. 3. As shown in FIG. 4, the device may include:
  • a determining unit 41 configured to determine data to be inspected in the virtual machine
  • the reading unit 42 is configured to read the data to be inspected determined by the determining unit 41, save a copy of the data to be inspected that has been read, and store the stored storage address of the data to be inspected into the hardware transaction memory;
  • the monitoring unit 43 is configured to monitor, by using a hardware transaction memory, whether the read data to be checked corresponding to the storage address is modified;
  • the ending unit 44 is configured to: when the monitoring unit 43 detects that the read data to be inspected is modified, stop reading the data to be inspected and delete the copy of the data to be inspected;
  • the security check unit 45 is configured to perform a security check on the copy of the data to be checked when the read unit 42 reads the data to be checked and the monitoring unit 43 does not detect that the read data to be checked is modified.
  • the copy of the data to be checked saved by the reading unit 42 includes lock data.
  • the lock data is used to indicate whether the data to be checked determined by the determining unit 41 is currently being accessed;
  • the device also includes:
  • the determining unit 46 is configured to determine, after the determining unit 41 determines the data to be checked in the virtual machine, whether the lock corresponding to the lock data is in a released state, where the release state is used to indicate that the data to be checked is not currently accessed;
  • the reading unit 42 is specifically configured to: if the lock corresponding to the lock data is in the release state, start reading the data to be checked, save the copied copy of the data to be checked, and store the read data to be checked.
  • the address is stored in the hardware transaction memory so that the hardware transaction memory can monitor the read data to be inspected according to the storage address.
  • the security checking unit 45 is specifically configured to check the integrity of the copy of the data to be checked saved by the reading unit 42; and/or determine the running of the virtual machine according to the copy of the data to be checked saved by the reading unit 42. Whether there is malware in the system.
  • the device further includes:
  • the sending unit 47 is configured to: when the security checking unit 45 completes the security check on the copy of the data to be checked saved by the reading unit 42, if the copy of the data to be checked does not pass the security check performed by the security checking unit 45 And sending a security check failure message to the virtual machine, so that the virtual machine performs corresponding processing according to the security check failure message sent by the sending unit.
  • the device further includes:
  • the obtaining unit 48 is configured to: when the monitoring unit 43 detects that the read data to be checked is modified, acquire the storage address of the modified data to be checked;
  • the sending unit 47 is further configured to: when the obtaining unit 48 acquires the storage address of the modified data in the read data to be checked, send an access conflict message to the virtual machine, where the access conflict message includes the modified storage of the to-be-checked data.
  • An address, such that the virtual machine determines whether the process of modifying the modified data to be stored is a security process.
  • the read data to be checked can be monitored through the hardware transaction memory. If the data to be checked is read, the read data is not detected. If there is modified data in the data to be checked, the copy of the data to be checked and the virtual The data to be checked in the machine is consistent. At this time, the copy of the data to be checked may be checked for security. If the modified data is detected in the data to be checked after the data to be checked is read, Stop reading the data to be checked and delete the copy of the data to be checked, that is, do not perform security check on the check data, thus increasing the accuracy of the security check.
  • the present invention also records that, before reading the data to be checked, first determining whether the lock of the data to be checked is in a released state, and reading the data to be checked only when the lock is in a released state, so that It is ensured that when the data to be checked is started to be read, no other process accesses the data to be checked, which reduces the number of occurrences of the access conflict, thereby reducing the data to be checked that has been read during the reading process.
  • the storage address is stored in the hardware transaction memory, and the hardware transaction memory also monitors the lock data. If the modified data is not detected in the read data to be checked during the process of reading the data to be checked, Not only can the copy of the data to be checked be consistent with the data to be checked in the virtual machine, but also the process of reading the data to be checked does not exist. He said the process of accessing the data to be examined, then more stringent to ensure the consistency of the data to be examined and a copy of the virtual machine to be examined data.
  • the present invention also describes that if the data to be inspected that has been read in the process of reading is modified, the storage address of the modified data in the read data to be checked is acquired, and an access conflict message is sent to the virtual machine.
  • the virtual machine can immediately locate the location of the conflicting access according to the storage address of the modified data in the access conflict message, and determine whether the process of modifying the modified data is a security process, thus speeding up the virtual machine to determine the conflicting access.
  • the location which in turn increases the efficiency of checking out malware, which in turn increases the security of the virtual machine.
  • the embodiment also provides a computer 1.
  • the computer 1 includes: at least one processor 15, such as a CPU (Central Processing Unit), at least one output interface 16 or other user interface 17,
  • the memory 18 is at least one communication bus 19.
  • Communication bus 19 is used to implement connection communication between the above components.
  • the computer 1 optionally includes other user interfaces 17, including a display, keyboard or pointing device (eg, a mouse, trackball, touchpad or tactile display).
  • the memory 18 may include a high speed RAM (Random Access Memory), and may also include a non-volatile memory such as at least one disk memory.
  • the memory 18 can optionally include at least one storage device located remotely from the aforementioned processor 15.
  • memory 18 stores elements, executable modules or data structures, or a subset thereof, or their extension set:
  • the operating system 180 includes various system programs for implementing various basic services and processing hardware-based tasks.
  • the application 181 can include, but is not limited to, including:
  • a determining unit configured to determine data to be inspected in the virtual machine
  • a reading unit configured to read the to-be-checked data determined by the determining unit, save a copy of the read data to be inspected, and store the stored storage address of the to-be-checked data into the hardware transaction memory;
  • a monitoring unit configured to monitor, by using the hardware transaction memory, whether the read data to be checked corresponding to the storage address is modified
  • An ending unit configured to stop reading the to-be-checked data and delete the copy when the monitoring unit detects that the read data to be inspected is modified
  • a security checking unit configured to perform a security check on the copy when the reading unit reads that the data to be checked is completed and the monitoring unit does not monitor that the read data to be inspected is modified.
  • the copy saved by the reading unit includes lock data, and the lock data is used to indicate whether the data to be checked determined by the determining unit is currently being accessed;
  • the application 181 can also include:
  • a determining unit configured to determine, after the determining unit determines the data to be checked in the virtual machine, whether the lock corresponding to the lock data is in a released state, where the release state is used to represent the to-be-checked The data is currently not accessed;
  • the reading unit is configured to: if the lock corresponding to the lock data is in the release state, start reading the data to be checked, save a copy of the read data to be checked, and read the read data.
  • the storage address of the data to be checked is stored in the hardware transaction memory, so that the hardware transaction memory can monitor the read data to be inspected according to the storage address.
  • the security checking unit is specifically configured to check integrity of the copy saved by the reading unit; and/or determine a system in which the virtual machine runs according to the copy saved by the reading unit. Whether there is malware in the middle.
  • application 181 may further include:
  • a sending unit configured to: when the security check unit completes a security check on the copy saved by the reading unit, if the copy does not pass the security check performed by the security check unit, The virtual machine sends a security check failure message, so that the virtual machine performs corresponding processing according to the security check failure message sent by the sending unit.
  • application 181 may further include:
  • An obtaining unit configured to acquire, when the monitoring unit detects that the read data to be checked is modified, obtain a storage address of the to-be-checked data to be modified;
  • the sending unit is further configured to: when the acquiring unit acquires a storage address of the modified data in the read data to be checked, send an access conflict message to the virtual machine, where the access conflict message includes the The storage address of the data to be checked that is modified, so that the virtual machine determines whether the process of modifying the modified data to be stored is a security process.
  • the processor 15 by calling a program or instruction stored in the memory 18, the processor 15 is configured to:
  • the security check is performed on the copy.
  • the data to be checked includes lock data, and the lock data is used to indicate whether the data to be checked is currently being accessed;
  • the processor 15 is further configured to determine, after the determining the data to be checked in the virtual machine, whether the lock corresponding to the lock data is in a released state, where the release state is used to indicate that the data to be checked is not currently access;
  • the processor 15 is configured to: if the lock corresponding to the lock data is in the release state, start reading the data to be checked, save a copy of the read data to be checked, and read the read data.
  • the storage address of the data to be checked is stored in the hardware transaction memory, so that the hardware transaction memory can monitor the read data to be inspected according to the storage address.
  • processor 15 is specifically configured to check the integrity of the copy; and/or,
  • the processor 15 is further configured to: after the security check on the copy, send a security check failure message to the virtual machine if the copy fails the security check, so that The virtual machine performs corresponding processing according to the security check failure message.
  • the processor 15 is further configured to: when it is detected that the read data to be checked is modified, obtain a storage address of the to-be-checked data to be modified;
  • the data to be inspected in the virtual machine is determined; the data to be checked is read, the copy of the data to be inspected is saved, and the storage address of the data to be checked that has been read is stored in the hardware transaction.
  • the hardware transaction memory can monitor the read data to be checked according to the storage address; when it is detected that the read data to be checked is modified, Stop reading the data to be inspected and delete the copy; when the data to be checked is read and the read data to be checked is not modified, the security check is performed on the copy.
  • the copy is consistent with the data to be checked in the virtual machine. In this case, the copy may be checked for security. If the data to be checked is read, If the modified data is detected in the data to be checked that has been read, the reading of the data to be checked is stopped and the copy is deleted, that is, the security check is not performed on the data to be checked, thereby increasing the accuracy of the security check. Sex.
  • the present invention also records that, before reading the data to be checked, first determining whether the lock of the data to be checked is in a released state, and reading the data to be checked only when the lock is in a released state. In this way, when the data to be checked is started to be read, no other process accesses the data to be checked, which reduces the number of occurrences of the access conflict, thereby reducing the readiness that has been read during the reading process.
  • Checking the probability that the data is modified; further, the lock data corresponding to the lock may also be read, that is, the copy includes the lock data, such that after the lock data is read, the lock data is virtual
  • the storage address in the machine is stored in the hardware transaction memory, and the hardware transaction memory also monitors the lock data.
  • the read pending check is not detected. If there is modified data in the data, it can be explained that the copy is consistent with the data to be checked in the virtual machine, and it can also be explained that in the process of reading the data to be checked, In other processes accessing the data to be examined, then more stringent to ensure consistency with the copy of the virtual machine to be examined data.
  • the present invention also describes that if the read data to be inspected is modified during the reading, the storage address of the modified data in the read data to be checked is acquired, and The virtual machine sends an access conflict message, and the virtual machine can immediately locate the location of the conflicting access according to the storage address of the modified data in the access conflict message, and determine whether the process of modifying the modified data is safe.
  • the process in this way, speeds up the virtual machine to determine the location of the conflicting access, thereby improving the efficiency of checking out malware, thereby increasing the security of the virtual machine.
  • the present invention can be implemented by means of software plus necessary general hardware, and of course, by hardware, but in many cases, the former is a better implementation. .
  • the technical solution of the present invention which is essential or contributes to the prior art, can be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer.
  • a hard disk or optical disk, etc. includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种实现虚拟机自省的方法和装置，涉及信息技术领域，解决了VMI系统无法准确的对VM中的内存数据进行安全检查的问题。本发明提供的方法具体可以包括：确定虚拟机中的待检查数据；开始读取待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得硬件事务内存能够根据存储地址对已读取的待检查数据进行监测；当监测到已读取的待检查数据被修改时，则停止读取待检查数据并删除副本；当读取待检查数据完毕并且未监测到已读取的待检查数据被修改时，则对副本进行安全检查。可应用于虚拟机自省中。

Description

一种实现虚拟机自省的方法和装置 技术领域
本发明涉及信息技术领域，尤其涉及实现虚拟机自省的方法和装置。
背景技术
在增强计算机安全的诸多技术中，虚拟机自省(Virtual Machine Introspection，VMI)技术可以较好的对VM(Virtual Machine，虚拟机)进行安全保护。VMI系统可以是运行在VMM(Virtual Machine Monitor，虚拟机监控器)中的，VMM可以通过VMI系统从VM外部增强VM的安全性能，以实现对VM的保护。具体的，VMM可以通过VMI系统在VM外部监控VM内部的运行状态，如，VMI系统可以直接扫描VM的内存、磁盘以及监控网络行为等以对VM进行安全检查。在使用VMI技术后，由于VMI系统本身运行在VM外部，因此即使恶意软件已经感染了VM，也无法干扰VMI系统的运行。
具体的安全检测步骤可以包括：VMI系统可以从VM中获取待检查内存数据；对获取到的待检查内存数据进行安全检查。
但是，在VMI系统对VM中的内存数据进行安全检查的同时，VM可能也正在对待检查内存数据进行访问，此时，若VMI系统在获取完成部分待检查内存数据后，VM对本地的与所述部分待检查内存数据对应的内存数据进行了修改，则导致VMI系统获取到的内存数据，与VM本地的内存数据不一致，进而导致VMI系统无法准确的对VM中的内存数据进行安全检查。
发明内容
本发明提供一种实现虚拟机自省的方法和装置，解决了VMI系统无法准确的对VM中的数据进行安全检查的问题。
为达到上述目的，本发明采用如下技术方案：
第一方面，提供了一种实现虚拟机自省的方法，包括：
确定虚拟机中的待检查数据；
开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测；
当监测到所述已读取的待检查数据被修改时，则停止读取所述待检查数据并删除所述副本；
当读取所述待检查数据完毕并且未监测到所述已读取的待检查数据被修改时，则对所述副本进行安全检查。
结合第一方面，在第一方面的第一种实现方式中，所述待检查数据包括锁数据，所述锁数据用于表征所述待检查数据当前是否正在被访问；
在所述确定虚拟机中的待检查数据之后，所述方法还包括：
判断所述锁数据对应的锁是否处于释放状态，所述释放状态用于表征所述待检查数据当前未被访问；
所述开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测，包括：
若所述锁数据对应的锁处于所述释放状态，则开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测。
结合第一方面或第一方面的第一种实现方式，在第二种实现方式中，所述对所述副本进行安全检查，包括：
检查所述副本的完整性；和/或，
根据所述副本判断所述虚拟机运行的系统中是否存在恶意软件。
结合第一方面或第一方面的第一种实现方式或第一方面的第二种实现方式，在第三种实现方式中，在所述对所述副本进行安全检查之后，所述方法还包括：
若所述副本未通过所述安全检查，则向所述虚拟机发送安全检查未通过 消息，以使所述虚拟机根据所述安全检查未通过消息进行相应处理。
结合第一方面或第一方面的第一种实现方式至第一方面的第三种实现方式中任一种实现方式，在第四种实现方式中，所述方法还包括：
当监测到所述已读取的待检查数据被修改时，则获取被修改的待检查数据的存储地址；
向所述虚拟机发送访问冲突消息，所述访问冲突消息包括所述被修改的待检查数据的存储地址，以使得所述虚拟机确定修改所述被修改的待存储数据的进程是否为安全进程。
第二方面，提供了一种实现虚拟机自省的方法，包括：
确定单元，用于确定虚拟机中的待检查数据；
读取单元，用于读取所述确定单元确定的所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中；
监测单元，用于通过所述硬件事务内存监测所述存储地址所对应的已读取的待检查数据是否被修改；
结束单元，用于当所述监测单元监测到所述已读取的待检查数据被修改时，则停止读取所述待检查数据并删除所述副本；
安全检查单元，用于当所述读取单元读取所述待检查数据完毕并且所述监测单元未监测到所述已读取的待检查数据被修改时，则对所述副本进行安全检查。
结合第二方面，在第二方面的第一种实现方式中，所述读取单元保存的所述副本包括锁数据，所述锁数据用于表征所述确定单元确定的所述待检查数据当前是否正在被访问；
所述装置还包括：
判断单元，用于在所述确定单元确定虚拟机中的待检查数据之后，判断所述锁数据对应的锁是否处于释放状态，所述释放状态用于表征所述待检查数据当前未被访问；
所述读取单元，具体用于若所述锁数据对应的锁处于所述释放状态，则开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测。
结合第二方面或第二方面的第一种实现方式，在第二种实现方式中，所述安全检查单元，具体用于检查所述读取单元保存的所述副本的完整性；和/或，根据所述读取单元保存的所述副本判断所述虚拟机运行的系统中是否存在恶意软件。
结合第二方面或第二方面的第一种实现方式或第二方面的第二种实现方式，在第三种实现方式中，所述装置还包括：
发送单元，用于在所述安全检查单元完成对所述读取单元保存的所述副本进行的安全检查时，若所述副本未通过所述安全检查单元进行的所述安全检查，则向所述虚拟机发送安全检查未通过消息，以使得所述虚拟机根据所述发送单元发送的所述安全检查未通过消息进行相应处理。
结合第二方面或第二方面的第一种实现方式至第二方面的第三种实现方式中任一种实现方式，在第四种实现方式中，所述装置还包括：
获取单元，用于当所述监测单元监测到所述已读取的待检查数据被修改时，则获取被修改的待检查数据的存储地址；
所述发送单元，还用于在所述获取单元获取所述已读取的待检查数据中被修改数据的存储地址时，向所述虚拟机发送访问冲突消息，所述访问冲突消息包括所述被修改的待检查数据的存储地址，以使得所述虚拟机确定修改所述被修改的待存储数据的进程是否为安全进程。
本发明提供的实现虚拟机自省的方法和装置，在读取所述待检查数据的过程中可以通过硬件事务内存监控已读取的待检查数据是否被修改，若在读取所述待检查数据的过程中，未监测到已读取的待检查数据中存在被修改数据，则说明所述副本与虚拟机中的待检查数据一致，此时，可以对所述副本进行安全检查，若在读取所述待检查数据的过程中，监测到已读取的待检查 数据中存在被修改数据，则停止读取所述待检查数据并删除所述副本，即不对所述待检查数据进行安全检查，这样，增加安全检查的准确性。
另外，本发明还记载了在读取所述待检查数据之前，首先判断所述待检查数据的锁是否处于释放状态，只有在所述锁处于释放状态时，才读取所述待检查数据，这样，保证了在开始读取所述待检查数据时，没有其他进程对所述待检查数据进行访问，减少了访问冲突的发生次数，进而降低了在所述读取过程中已读取的待检查数据被修改的概率；进一步的，还可以读取所述锁对应的锁数据，即所述副本包括所述锁数据，这样，在读取完成所述锁数据后，所述锁数据在虚拟机中的存储地址便被存储到硬件事务内存中，所述硬件事务内存还对所述锁数据进行监测，若在读取所述待检查数据的过程中，未监测到已读取的待检查数据中存在被修改数据，则不仅可以说明所述副本与虚拟机中的待检查数据一致，而且还可以说明在读取所述待检查数据的过程中，不存在其他进程访问所述待检查数据，进而更加严格的保证了所述副本与虚拟机中的待检查数据的一致性。
再有，本发明还记载了若在所述读取的过程中所述已读取的待检查数据被修改，则获取所述已读取的待检查数据中被修改数据的存储地址，并向所述虚拟机发送访问冲突消息，所述虚拟机可以根据访问冲突消息中的所述被修改数据的存储地址立即定位到发生冲突访问的位置，并确定修改所述被修改数据的进程是否为安全进程，这样，加快了虚拟机确定发生冲突访问的位置，进而提高了检查出恶意软件的效率，进而增加了虚拟机的安全性。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本实施例提供的一种实现虚拟机自省的方法的流程图；
图2为本实施例提供的另一种实现虚拟机自省的方法的流程图；
图3为本实施例提供的一种实现虚拟机自省的装置的虚拟装置结构示意图；
图4为本实施例提供的另一种实现虚拟机自省的装置的虚拟装置结构示意图；
图5为本实施例提供的一种实现虚拟机自省的装置的实体装置结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
近年来，随着个人电脑、移动计算设备，以及云计算的普及，计算机安全越来越成为人们关注的焦点。人们在各种计算设备中保存了大量关键数据，包括电子邮件、私人照片、银行账号与密码、社交网络账号等等，这使得计算设备成为了黑客的攻击目标。各种恶意软件，如病毒、木马、间谍软件、欺诈广告等，数量越来越大，威胁越来越强。
现有技术中，可以通过VMI(Virtual Machine Introspection，虚拟机自省)技术来实现对虚拟机的安全保护。但是，在通过VMI实现对虚拟机的安全保护过程中，在VMI系统对虚拟机中的内存数据进行安全检查的同时，虚拟机可能也正在对待检查内存数据进行访问，此时，若VMI系统在获取完成部分待检查内存数据后，虚拟机对本地的与所述部分待检查内存数据对应的内存数据进行了修改，则导致VMI系统获取到的内存数据，与虚拟机本地的内存数据不一致，进而导致VMI系统无法准确的对虚拟机中的内存数据进行安全检查。为了解决该问题，下面提供一些实施例进行具体说明。
本实施例提供一种实现虚拟机自省的方法，如图1所示，可以包括：
101、确定虚拟机中的待检查数据。
其中，待检查数据可以为虚拟机的内存中的内存数据。
102、开始读取该待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得硬件事务内存能够根据该存储地址对已读取的待检查数据进行监测。
在读取该待检查数据时，已读取的待检查数据在虚拟机中的存储地址会被自动存储到硬件事务内存中，另外，还可以将已读取的待检查数据的副本存储到硬件事务内存中。
硬件事务内存可以对存储于本地的存储地址对应的数据进行监控，可以监控这些数据是否被修改等，在本实施例中，由于硬件事务内存中存储有已读取的待检查数据的存储地址，因此硬件事务内存可以监控已读取的待检查数据是否被修改。
103、当监测到已读取的待检查数据被修改时，则停止读取该待检查数据并删除该待检查数据的副本。
在读取的过程中，若已读取的待检查数据被修改，则说明该待检查数据的副本中的数据与虚拟机中的待检查数据不一致，由于，在数据不一致的情况下无法对该待检查数据的副本进行正确的安全检查，因此，在读取待检查数据的过程中，若硬件事务内存监测到已读取的待检查数据被修改，则不对该待检查数据的副本进行安全检查，并停止读取待检查数据并删除该待检查数据的副本。
值得说明的是，本实施例提供的数据不一致是指已读取的待检查数据与虚拟机中的待检查数据不一致，之后不再赘述。
104、当读取待检查数据完毕并且未监测到已读取的待检查数据被修改时，则对该待检查数据的副本进行安全检查。
在读取待检查数据的过程中，若已读取的待检查数据未被修改，则说明该待检查数据的副本中的数据与虚拟机中的待检查数据一致，此时，可以对 该待检查数据的副本进行安全检查。
本实施例中，在读取待检查数据的过程中可以通过硬件事务内存监控已读取的待检查数据是否被修改，若在读取该待检查数据的过程中，未监测到已读取的待检查数据中存在被修改数据，则说明所述副本与虚拟机中的待检查数据一致，此时，可以对该待检查数据的副本进行安全检查，若在读取待检查数据的过程中，监测到已读取的待检查数据中存在被修改数据，则停止读取待检查数据并删除该待检查数据的副本，即不对待检查数据进行安全检查，这样，增加安全检查的准确性。
本实施例提供另一种实现虚拟机自省的方法，该方法是对图1所示的方法的进一步扩展和优化，如图2所示，可以包括：
201、确定虚拟机中的待检查数据。
202、判断锁数据对应的锁是否处于释放状态。若所述锁处于所述释放状态，则执行步骤203，若所述锁未处于所述释放状态，则执行步骤202。
其中，该释放状态可以用于表征待检查数据当前未被访问。
为了避免虚拟机中的待检查数据同时被多个进程访问，因此设置了锁，锁可以通过锁数据的形式存储于待检查虚拟机中。待检查数据的锁的状态可以用于表征该待检查数据是否正在被虚拟机系统中的进程访问，当没有虚拟机系统中的进程访问所述待检查数据时，锁的状态为释放状态，当有虚拟机系统中的进程访问该待检查数据时，锁的状态为加锁状态，在虚拟机系统中的某一进程访问待检查数据之前，首先确定锁的状态，若所述锁处于释放状态，则可以对所述待检查数据进行访问，若所述锁处于加锁状态，则不能对所述待检查数据进行访问。
若所述锁当前处于释放状态，则当虚拟机系统中的某一进程访问所述待检查数据时，需要获取所述锁，在该进程获取所述锁之后，所述锁的状态便会从释放状态切换为加锁状态，当所述某进程访问所述待检查数据结束后，所述某进程可以释放所述锁，所述锁的状态便可以从加锁状态切换为释放状态，该状态变化可以通过存储于虚拟机中的与所述锁对应的锁数据的数值变 化体现。
若VMI系统监测到所述锁当前处于加锁状态，则说明当前虚拟机系统中的某进程正在访问所述待检查数据，若此时VMI系统读取所述待检查数据，由于某一进程可能会对待检查数据进行修改，因此会出现虚拟机系统读取的数据与所述待检查数据不一致的情况，进而导致无法准确的对虚拟机进行安全检查，由此，若VMI系统监测到所述锁当前处于加锁状态，则可以不对虚拟机进行安全检查，而是继续监测所述锁的状态，直到检测到所述锁的状态切换为释放状态时，即可以执行安全检查。
作为本实施例的一种实施方式，VMI系统可以通过所述锁数据的数值判断锁数据对应的锁是否处于释放状态。
本实施例对所述锁的原理及实现方式不作限定，为现有技术，且为本领域技术人员熟知的技术，在此不再赘述。
203、开始读取该待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中。
若VMI系统检查到所述锁当前的状态为释放状态，则说明不存在任何进程访问该待检查数据，此时，VMI系统可以读取该待检查数据，并将已读取的待检查数据的存储地址存储到硬件事务内存中，并保存已读取的待检查数据的副本。
硬件事务内存可以是设置于VMM中的，硬件事务内存中可以包括读取集合，该读取集合可以用于存储所述VMI系统已读取的数据的存储地址。本实施例中，在所述VMI系统读取所述待检查数据的过程中，VMI系统已读取的待检查数据在虚拟机中的存储地址便被自动存储于所述读取集合中，另外，在VMI系统读取待检查数据的过程中，VMI系统还可以将已读取的待检查数据的副本存储于硬件事务内存中。
值得说明的是，本实施例提供的所述待检查数据的存储地址均是指待检查数据在虚拟机中的存储地址，在后续内容中不再赘述。
204、通过硬件事务内存监测已读取的待检查数据是否被修改。若在读取 的过程中未监测到已读取的待检查数据被修改，则执行步骤205，若在读取的过程中监测到已读取的待检查数据被修改，则执行步骤207。
硬件事务内存可以对读取集合中的存储地址对应的数据进行监测，具体可以是监测这些数据是否被修改过。
作为本实施例的一种实施方式，在VMI系统读取所述待检查数据的过程中，可以自动将已读取的待检查数据的存储地址存储于所述读取集合中，在此之后，由于读取集合中存储有已读取的待检查数据的存储地址，因此硬件事务内存可以监测已读取的待检查数据是否被修改。
进一步的，VMI系统还可以读取待检查数据的锁数据，所述锁数据可以存储于所述虚拟机的内存中，这样，在VMI系统在读取完成所述锁数据后，所述锁数据在虚拟机中的存储地址便被存储到读取集合中，且该待检查数据的副本中页包括所述锁数据，硬件事务内存还对所述锁数据进行监测，由于，在VMI系统开始读取锁数据时，所述锁数据是处于释放状态的，因此，在读取所述待检查数据的过程中，硬件事务内存不仅可以监测所述待检查数据是否被修改，还可以监测所述锁数据的状态是否发生了改变，即是否从释放状态切换到加锁状态，此时，所述副本中也包括所述锁数据。
本实施例对硬件事务内存监测已读取的待检查数据是否被修改的方法不作限定，为本领域技术人员熟知的技术，在此不再赘述。
205、对该待检查数据的副本进行安全检查。若该待检查数据的副本通过安全检查，则流程结束，或者，在预设时间之后，再执行步骤201，若该待检查数据的副本未通过安全检查，则执行步骤206。
进一步的，对该待检查数据的副本进行安全检查可以但不限于包括：
VMI系统检查该待检查数据的副本的完整性；和/或，VMI系统根据该待检查数据的副本判断所述虚拟机运行的系统中是否存在恶意软件。
具体的，VMI系统检查该待检查数据的副本的完整性可以但不限于包括：VMI系统可以通过校验码检查该待检查数据的副本中的数据是否完整，具体的检查方法为本领域技术人员熟知的技术，在此不再赘述。
VMI系统根据该待检查数据的副本判断所述虚拟机运行的系统中是否存在恶意软件可以但不限于包括：由于，若虚拟机系统中运行有恶意软件，则可能会在虚拟机的数据中留下标识，如，可以通过某段数据体现出，因此，VMI系统可以对该待检查数据的副本进行检查，判断该待检查数据的副本中是否包括恶意软件留下的标识，若有，则说明虚拟机系统中存在恶意软件。本实施例对VMI系统根据该待检查数据的副本判断虚拟机运行的系统中是否存在恶意软件的方法不作限定，为本领域技术人员熟知的技术，在此不再赘述。
本实施例对VMI系统对该待检查数据的副本进行安全检查的方法不作限定，为本领域技术人员熟知的技术，不限于上述列举的方法，具体可以根据实际需要进行设定。
206、向虚拟机发送安全检查未通过消息，以使该虚拟机根据安全检查未通过消息进行相应处理。
作为本实施例的一种实施方式，若VMI系统检查出虚拟机运行的系统中存在恶意软件，则虚拟机在接收到所述安全检查未通过消息之后，可以根据安全检查未通过消息停止运行所述恶意软件；若VMI系统检查出该待检查数据的副本中的数据不完整，则虚拟机在接收到安全检查未通过消息之后，可以根据安全检查未通过消息修复待检查数据中的不完整数据。
本实施例对虚拟机根据所述安全检查未通过消息进行的相应处理不作限定，为本领域技术人员熟知的技术，且可以根据实际需要进行设定，在此不再赘述。
流程结束。
207、停止读取待检查数据并删除该待检查数据的副本。
在读取的过程中，若硬件事务内存监测到已读取的待检查数据被修改，则说明该待检查数据的副本与已读取的待检查数据不一致，此时，由于VMI系统无法准确的对该副本进行安全检查，因此VMI系统停止读取待检查数据并删除所述副本。在此之后，VMI系统还可以重新启动安全检查步骤，即可 以执行步骤201。
由于，在虚拟机系统中的某进程访问待检查数据时，首先会获取所述锁，此时相应的锁数据或发生变化，因此，在VMI系统读取所述锁数据后，硬件事务内存便会监测到，进而结束安全检查进程，这样，更加严格的保证了所述副本与虚拟机中的待检查数据的一致性。
值得说明的是，VMI系统读取所述锁数据可以包括：复制锁数据，然后获取复制的锁数据，并不是获取所述锁数据，因此，VMI系统读取所述锁数据之后并不会改变所述锁的状态，也不会改变锁数据的代码，进而使得某些恶意软件无法在根据锁数据判断出VMI系统当前正在对虚拟机进行安全检查之后，以修改数据来暂时停止侵害操作。
208、获取被修改的待检查数据的存储地址。
本实施例中，VMI系统可以从已读取的待检查数据中获取被修改数据，然后，再获取被修改数据在虚拟机中的存储地址。
209、向该虚拟机发送访问冲突消息，以使得该虚拟机确定修改所述被修改的待存储数据的进程是否为安全进程。
作为本实施例的一种实施方式，在读取的过程中，若已读取的待检查数据被修改，则可以向虚拟机发送访问冲突消息以告知虚拟机待检查数据发生了访问冲突，所述访问冲突消息可以包括所述被修改数据的存储地址；虚拟机可以根据快速的访问冲突消息中的所述被修改数据的存储地址快速的定位发生访问冲突的位置；并还可以根据所述位置确定修改所述被修改数据的进程是否为安全进程。
本实施例中，在读取待检查数据的过程中可以通过硬件事务内存监控已读取的待检查数据是否被修改，若在读取待检查数据的过程中，未监测到已读取的待检查数据中存在被修改数据，则说明该待检查数据的副本与虚拟机中的待检查数据一致，此时，可以对该待检查数据的副本进行安全检查，若在读取待检查数据的过程中，监测到已读取的待检查数据中存在被修改数据，则停止读取待检查数据并删除该待检查数据的副本，即不对待检查数据进行 安全检查，这样，增加安全检查的准确性。
另外，本发明还记载了在读取所述待检查数据之前，首先判断所述待检查数据的锁是否处于释放状态，只有在所述锁处于释放状态时，才读取该待检查数据，这样，保证了在开始读取所述待检查数据时，没有其他进程对所述待检查数据进行访问，减少了访问冲突的发生次数，进而降低了在读取过程中已读取的待检查数据被修改的概率；进一步的，还可以读取所述锁对应的锁数据，即该待检查数据的副本包括所述锁数据，这样，在读取完成所述锁数据后，所述锁数据在虚拟机中的存储地址便被存储到硬件事务内存中，所述硬件事务内存还对所述锁数据进行监测，若在读取待检查数据的过程中，未监测到已读取的待检查数据中存在被修改数据，则不仅可以说明该待检查数据的副本与虚拟机中的待检查数据一致，而且还可以说明在读取待检查数据的过程中，不存在其他进程访问该待检查数据，进而更加严格的保证了该待检查数据的副本与虚拟机中的待检查数据的一致性。
再有，本发明还记载了若在读取的过程中已读取的待检查数据被修改，则获取已读取的待检查数据中被修改数据的存储地址，并向虚拟机发送访问冲突消息，该虚拟机可以根据访问冲突消息中的被修改数据的存储地址立即定位到发生冲突访问的位置，并确定修改所述被修改数据的进程是否为安全进程，这样，加快了虚拟机确定发生冲突访问的位置，进而提高了检查出恶意软件的效率，进而增加了虚拟机的安全性。
下面提供一些虚拟装置实施例，该虚拟装置实施例分别于上述提供的相应的方法实施例相对应。
本实施例提供一种实现虚拟机自省的装置，如图3所示，可以包括：
确定单元31，用于确定虚拟机中的待检查数据；
读取单元32，用于读取确定单元31确定的所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中；
监测单元33，用于通过硬件事务内存监测所述存储地址所对应的已读取 的待检查数据是否被修改；
结束单元34，用于当所述监测单元33监测到所述已读取的待检查数据被修改时，则停止读取所述待检查数据并删除所述副本；
安全检查单元35，用于当读取单元32读取该待检查数据完毕并且监测单元33未监测到已读取的待检查数据被修改时，则对该待检查数据的副本进行安全检查。
本实施例中，在读取待检查数据的过程中可以通过硬件事务内存监控已读取的待检查数据是否被修改，若在读取该待检查数据的过程中，未监测到已读取的待检查数据中存在被修改数据，则说明该待检查数据的副本与虚拟机中的待检查数据一致，此时，可以对所述副本进行安全检查，若在读取待检查数据的过程中，监测到已读取的待检查数据中存在被修改数据，则停止读取该待检查数据并删除该待检查数据的副本，即不对所述待检查数据进行安全检查，这样，增加安全检查的准确性。
本实施例提供另一种实现虚拟机自省的装置，该装置是对图3所示的装置的进一步扩展，如图4所示，可以包括：
确定单元41，用于确定虚拟机中的待检查数据；
读取单元42，用于读取确定单元41确定的待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中；
监测单元43，用于通过硬件事务内存监测所述存储地址所对应的已读取的待检查数据是否被修改；
结束单元44，用于当监测单元43监测到已读取的待检查数据被修改时，则停止读取该待检查数据并删除该待检查数据的副本；
安全检查单元45，用于当读取单元42读取该待检查数据完毕并且监测单元43未监测到已读取的待检查数据被修改时，则对该待检查数据的副本进行安全检查。
进一步的，所述读取单元42保存的该待检查数据的副本包括锁数据，所 述锁数据用于表征确定单元41确定的待检查数据当前是否正在被访问；
所述装置还包括：
判断单元46，用于在确定单元41确定虚拟机中的待检查数据之后，判断锁数据对应的锁是否处于释放状态，该释放状态用于表征所述待检查数据当前未被访问；
读取单元42，具体用于若锁数据对应的锁处于所述释放状态，则开始读取待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测。
进一步的，安全检查单元45，具体用于检查读取单元42保存的该待检查数据的副本的完整性；和/或，根据读取单元42保存的该待检查数据的副本判断虚拟机运行的系统中是否存在恶意软件。
进一步的，所述装置还包括：
发送单元47，用于在安全检查单元45完成对读取单元42保存的该待检查数据的副本进行的安全检查时，若该待检查数据的副本未通过安全检查单元45进行的所述安全检查，则向该虚拟机发送安全检查未通过消息，以使得该虚拟机根据所述发送单元发送的所述安全检查未通过消息进行相应处理。
进一步的，所述装置还包括：
获取单元48，用于当监测单元43监测到已读取的待检查数据被修改时，则获取被修改的待检查数据的存储地址；
发送单元47，还用于在获取单元48获取已读取的待检查数据中被修改数据的存储地址时，向该虚拟机发送访问冲突消息，该访问冲突消息包括被修改的待检查数据的存储地址，以使得该虚拟机确定修改所述被修改的待存储数据的进程是否为安全进程。
本实施例中，在读取待检查数据的过程中可以通过硬件事务内存监控已读取的待检查数据是否被修改，若在读取该待检查数据的过程中，未监测到已读取的待检查数据中存在被修改数据，则说明该待检查数据的副本与虚拟 机中的待检查数据一致，此时，可以对该待检查数据的副本进行安全检查，若在读取待检查数据的过程中，监测到已读取的待检查数据中存在被修改数据，则停止读取待检查数据并删除该待检查数据的副本，即不对待检查数据进行安全检查，这样，增加安全检查的准确性。
另外，本发明还记载了在读取所述待检查数据之前，首先判断待检查数据的锁是否处于释放状态，只有在所述锁处于释放状态时，才读取所述待检查数据，这样，保证了在开始读取所述待检查数据时，没有其他进程对所述待检查数据进行访问，减少了访问冲突的发生次数，进而降低了在所述读取过程中已读取的待检查数据被修改的概率；进一步的，还可以读取所述锁对应的锁数据，即该待检查数据的副本包括锁数据，这样，在读取完成所述锁数据后，该锁数据在虚拟机中的存储地址便被存储到硬件事务内存中，硬件事务内存还对该锁数据进行监测，若在读取待检查数据的过程中，未监测到已读取的待检查数据中存在被修改数据，则不仅可以说明该待检查数据的副本与虚拟机中的待检查数据一致，而且还可以说明在读取待检查数据的过程中，不存在其他进程访问所述待检查数据，进而更加严格的保证了该待检查数据的副本与虚拟机中的待检查数据的一致性。
再有，本发明还记载了若在读取的过程中已读取的待检查数据被修改，则获取已读取的待检查数据中被修改数据的存储地址，并向虚拟机发送访问冲突消息，虚拟机可以根据访问冲突消息中的被修改数据的存储地址立即定位到发生冲突访问的位置，并确定修改所述被修改数据的进程是否为安全进程，这样，加快了虚拟机确定发生冲突访问的位置，进而提高了检查出恶意软件的效率，进而增加了虚拟机的安全性。
下面提供一些实体装置实施例，该实体装置实施例分别于上述提供的相应的方法实施例和虚拟装置实施例相对应。
本实施例还提供一种计算机1，如图5所示，该计算机1包括：至少一个处理器15，例如CPU(Central Processing Unit，中央处理器)，至少一个输出接口16或者其他用户接口17，存储器18，至少一个通信总线19。通信总线 19用于实现上述组件之间的连接通信。该计算机1可选的包含其他用户接口17，包括显示器，键盘或者点击设备(例如，鼠标，轨迹球(trackball)，触感板或者触感显示屏)。存储器18可能包含高速RAM(Random Access Memory，随机存取存储器)，也可能还包括非不稳定的存储器(non-volatile memory)，例如至少一个磁盘存储器。存储器18可选的可以包含至少一个位于远离前述处理器15的存储装置。
在一些实施方式中，存储器18存储了如下的元素，可执行模块或者数据结构，或者他们的子集，或者他们的扩展集:
操作系统180，包含各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
应用程序181中可以但不限于包括：
确定单元，用于确定虚拟机中的待检查数据；
读取单元，用于读取所述确定单元确定的所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中；
监测单元，用于通过所述硬件事务内存监测所述存储地址所对应的已读取的待检查数据是否被修改；
结束单元，用于当所述监测单元监测到所述已读取的待检查数据被修改时，则停止读取所述待检查数据并删除所述副本；
安全检查单元，用于当所述读取单元读取所述待检查数据完毕并且所述监测单元未监测到所述已读取的待检查数据被修改时，则对所述副本进行安全检查。
进一步的，所述读取单元保存的所述副本包括锁数据，所述锁数据用于表征所述确定单元确定的所述待检查数据当前是否正在被访问；
所述应用程序181还可以包括：
判断单元，用于在所述确定单元确定虚拟机中的待检查数据之后，判断所述锁数据对应的锁是否处于释放状态，所述释放状态用于表征所述待检查 数据当前未被访问；
所述读取单元，具体用于若所述锁数据对应的锁处于所述释放状态，则开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测。
进一步的，所述安全检查单元，具体用于检查所述读取单元保存的所述副本的完整性；和/或，根据所述读取单元保存的所述副本判断所述虚拟机运行的系统中是否存在恶意软件。
进一步的，所述应用程序181还可以包括：
发送单元，用于在所述安全检查单元完成对所述读取单元保存的所述副本进行的安全检查时，若所述副本未通过所述安全检查单元进行的所述安全检查，则向所述虚拟机发送安全检查未通过消息，以使得所述虚拟机根据所述发送单元发送的所述安全检查未通过消息进行相应处理。
进一步的，所述应用程序181还可以包括：
获取单元，用于当所述监测单元监测到所述已读取的待检查数据被修改时，则获取被修改的待检查数据的存储地址；
所述发送单元，还用于在所述获取单元获取所述已读取的待检查数据中被修改数据的存储地址时，向所述虚拟机发送访问冲突消息，所述访问冲突消息包括所述被修改的待检查数据的存储地址，以使得所述虚拟机确定修改所述被修改的待存储数据的进程是否为安全进程。
在本发明实施例中，通过调用存储器18中存储的程序或指令，处理器15用于：
确定虚拟机中的待检查数据；
确定虚拟机中的待检查数据；
开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测；
当监测到所述已读取的待检查数据被修改时，则停止读取所述待检查数据并删除所述副本；
当读取所述待检查数据完毕并且未监测到所述已读取的待检查数据被修改时，则对所述副本进行安全检查。
进一步的，所述待检查数据包括锁数据，所述锁数据用于表征所述待检查数据当前是否正在被访问；
所述处理器15，还用于在所述确定虚拟机中的待检查数据之后，判断所述锁数据对应的锁是否处于释放状态，所述释放状态用于表征所述待检查数据当前未被访问；
所述处理器15，具体用于若所述锁数据对应的锁处于所述释放状态，则开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测。
进一步的，所述处理器15，具体用于检查所述副本的完整性；和/或，
根据所述副本判断所述虚拟机运行的系统中是否存在恶意软件。
进一步的，所述处理器15，还用于在所述对所述副本进行安全检查之后，若所述副本未通过所述安全检查，则向所述虚拟机发送安全检查未通过消息，以使所述虚拟机根据所述安全检查未通过消息进行相应处理。
进一步的，所述处理器15，还用于当监测到所述已读取的待检查数据被修改时，则获取被修改的待检查数据的存储地址；
向所述虚拟机发送访问冲突消息，所述访问冲突消息包括所述被修改的待检查数据的存储地址，以使得所述虚拟机确定修改所述被修改的待存储数据的进程是否为安全进程。
本实施例中，确定虚拟机中的待检查数据；开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测；当监测到所述已读取的待检查数据被修改时，则 停止读取所述待检查数据并删除所述副本；当读取所述待检查数据完毕并且未监测到所述已读取的待检查数据被修改时，则对所述副本进行安全检查。采用上述方案后，在读取所述待检查数据的过程中可以通过硬件事务内存监控已读取的待检查数据是否被修改，若在读取所述待检查数据的过程中，未监测到已读取的待检查数据中存在被修改数据，则说明所述副本与虚拟机中的待检查数据一致，此时，可以对所述副本进行安全检查，若在读取所述待检查数据的过程中，监测到已读取的待检查数据中存在被修改数据，则停止读取所述待检查数据并删除所述副本，即不对所述待检查数据进行安全检查，这样，增加安全检查的准确性。
另外，本发明还记载了在读取所述待检查数据之前，首先判断所述待检查数据的锁是否处于释放状态，只有在所述锁处于释放状态时，才读取所述待检查数据，这样，保证了在开始读取所述待检查数据时，没有其他进程对所述待检查数据进行访问，减少了访问冲突的发生次数，进而降低了在所述读取过程中已读取的待检查数据被修改的概率；进一步的，还可以读取所述锁对应的锁数据，即所述副本包括所述锁数据，这样，在读取完成所述锁数据后，所述锁数据在虚拟机中的存储地址便被存储到硬件事务内存中，所述硬件事务内存还对所述锁数据进行监测，若在读取所述待检查数据的过程中，未监测到已读取的待检查数据中存在被修改数据，则不仅可以说明所述副本与虚拟机中的待检查数据一致，而且还可以说明在读取所述待检查数据的过程中，不存在其他进程访问所述待检查数据，进而更加严格的保证了所述副本与虚拟机中的待检查数据的一致性。
再有，本发明还记载了若在所述读取的过程中所述已读取的待检查数据被修改，则获取所述已读取的待检查数据中被修改数据的存储地址，并向所述虚拟机发送访问冲突消息，所述虚拟机可以根据访问冲突消息中的所述被修改数据的存储地址立即定位到发生冲突访问的位置，并确定修改所述被修改数据的进程是否为安全进程，这样，加快了虚拟机确定发生冲突访问的位置，进而提高了检查出恶意软件的效率，进而增加了虚拟机的安全性。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本发明可借助软件加必需的通用硬件的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘，硬盘或光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应所述以权利要求的保护范围为准。

Claims (10)

  1. 一种实现虚拟机自省的方法，其特征在于，包括：
    确定虚拟机中的待检查数据；
    开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测；
    当监测到所述已读取的待检查数据被修改时，则停止读取所述待检查数据并删除所述副本；
    当读取所述待检查数据完毕并且未监测到所述已读取的待检查数据被修改时，则对所述副本进行安全检查。
  2. 根据权利要求1所述的实现虚拟机自省的方法，其特征在于，所述待检查数据包括锁数据，所述锁数据用于表征所述待检查数据当前是否正在被访问；
    在所述确定虚拟机中的待检查数据之后，所述方法还包括：
    判断所述锁数据对应的锁是否处于释放状态，所述释放状态用于表征所述待检查数据当前未被访问；
    所述开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测，包括：
    若所述锁数据对应的锁处于所述释放状态，则开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测。
  3. 根据权利要求1或2所述的实现虚拟机自省的方法，其特征在于，所述对所述副本进行安全检查，包括：
    检查所述副本的完整性；和/或，
    根据所述副本判断所述虚拟机运行的系统中是否存在恶意软件。
  4. 根据权利要求1至3中任一项所述的实现虚拟机自省的方法，其特征在于，在所述对所述副本进行安全检查之后，所述方法还包括：
    若所述副本未通过所述安全检查，则向所述虚拟机发送安全检查未通过消息，以使所述虚拟机根据所述安全检查未通过消息进行相应处理。
  5. 根据权利要求1至4中任一项所述的实现虚拟机自省的方法，其特征在于，所述方法还包括：
    当监测到所述已读取的待检查数据被修改时，则获取被修改的待检查数据的存储地址；
    向所述虚拟机发送访问冲突消息，所述访问冲突消息包括所述被修改的待检查数据的存储地址，以使得所述虚拟机确定修改所述被修改的待存储数据的进程是否为安全进程。
  6. 一种实现虚拟机自省的装置，其特征在于，包括：
    确定单元，用于确定虚拟机中的待检查数据；
    读取单元，用于读取所述确定单元确定的所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中；
    监测单元，用于通过所述硬件事务内存监测所述存储地址所对应的已读取的待检查数据是否被修改；
    结束单元，用于当所述监测单元监测到所述已读取的待检查数据被修改时，则停止读取所述待检查数据并删除所述副本；
    安全检查单元，用于当所述读取单元读取所述待检查数据完毕并且所述监测单元未监测到所述已读取的待检查数据被修改时，则对所述副本进行安全检查。
  7. 根据权利要求6所述的实现虚拟机自省的装置，其特征在于，所述读取单元保存的所述副本包括锁数据，所述锁数据用于表征所述确定单元确定的所述待检查数据当前是否正在被访问；
    所述装置还包括：
    判断单元，用于在所述确定单元确定虚拟机中的待检查数据之后，判断所述锁数据对应的锁是否处于释放状态，所述释放状态用于表征所述待检查数据当前未被访问；
    所述读取单元，具体用于若所述锁数据对应的锁处于所述释放状态，则开始读取所述待检查数据，保存已读取的待检查数据的副本，并将已读取的待检查数据的存储地址存储到硬件事务内存中，以使得所述硬件事务内存能够根据所述存储地址对已读取的待检查数据进行监测。
  8. 根据权利要求6或7所述的实现虚拟机自省的装置，其特征在于，所述安全检查单元，具体用于检查所述读取单元保存的所述副本的完整性；和/或，根据所述读取单元保存的所述副本判断所述虚拟机运行的系统中是否存在恶意软件。
  9. 根据权利要求6至8中任一项所述的实现虚拟机自省的装置，其特征在于，所述装置还包括：
    发送单元，用于在所述安全检查单元完成对所述读取单元保存的所述副本进行的安全检查时，若所述副本未通过所述安全检查单元进行的所述安全检查，则向所述虚拟机发送安全检查未通过消息，以使得所述虚拟机根据所述发送单元发送的所述安全检查未通过消息进行相应处理。
  10. 根据权利要求6至9中任一项所述的实现虚拟机自省的装置，其特征在于，所述装置还包括：
    获取单元，用于当所述监测单元监测到所述已读取的待检查数据被修改时，则获取被修改的待检查数据的存储地址；
    所述发送单元，还用于在所述获取单元获取所述已读取的待检查数据中被修改数据的存储地址时，向所述虚拟机发送访问冲突消息，所述访问冲突消息包括所述被修改的待检查数据的存储地址，以使得所述虚拟机确定修改所述被修改的待存储数据的进程是否为安全进程。
PCT/CN2014/093427 2013-12-30 2014-12-10 一种实现虚拟机自省的方法和装置 WO2015101148A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP14876189.3A EP3079057B1 (en) 2013-12-30 2014-12-10 Method and device for realizing virtual machine introspection
US15/199,200 US10007785B2 (en) 2013-12-30 2016-06-30 Method and apparatus for implementing virtual machine introspection

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310746868.1 2013-12-30
CN201310746868.1A CN104750536B (zh) 2013-12-30 2013-12-30 一种实现虚拟机自省的方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/199,200 Continuation US10007785B2 (en) 2013-12-30 2016-06-30 Method and apparatus for implementing virtual machine introspection

Publications (1)

Publication Number Publication Date
WO2015101148A1 true WO2015101148A1 (zh) 2015-07-09

Family

ID=53493171

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/093427 WO2015101148A1 (zh) 2013-12-30 2014-12-10 一种实现虚拟机自省的方法和装置

Country Status (4)

Country Link
US (1) US10007785B2 (zh)
EP (1) EP3079057B1 (zh)
CN (1) CN104750536B (zh)
WO (1) WO2015101148A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3239883A1 (de) * 2016-04-28 2017-11-01 Siemens Aktiengesellschaft Erkennen einer abweichung eines sicherheitszustandes einer recheneinrichtung von einem sollsicherheitszustand
RU2628923C1 (ru) * 2016-05-20 2017-08-22 Акционерное общество "Лаборатория Касперского" Система и способ распределения файлов между виртуальными машинами, входящими в распределённую систему виртуальных машин, для выполнения антивирусной проверки
CN107608756B (zh) * 2017-08-24 2020-10-13 武汉大学 一种基于cpu硬件特性的虚拟机自省触发方法及系统
US11720385B2 (en) * 2019-06-17 2023-08-08 National Technology & Engineering Solutions Of Sandia, Llc Automated platform to assess commercial off the shelf (COTS) software assurance
CN110781016B (zh) * 2019-10-30 2021-04-23 支付宝(杭州)信息技术有限公司 一种数据处理方法、装置、设备及介质
EP4229785A4 (en) * 2020-10-13 2024-08-28 Bedrock Systems Inc FORMALLY VERIFIED SECURE COMPUTER BASE WITH ACTIVE POLICY AND SECURITY APPLICATION

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101814049A (zh) * 2010-03-23 2010-08-25 北京大学 一种内存泄漏探测方法
CN101853175A (zh) * 2009-03-31 2010-10-06 甲骨文美国公司 虚拟化环境中促进的自检
CN102541691A (zh) * 2011-12-27 2012-07-04 北京人大金仓信息技术股份有限公司 面向内存数据库oltp应用的日志检查点恢复方法

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7392541B2 (en) * 2001-05-17 2008-06-24 Vir2Us, Inc. Computer system architecture and method providing operating-system independent virus-, hacker-, and cyber-terror-immune processing environments
US7788699B2 (en) * 2002-03-06 2010-08-31 Vir2Us, Inc. Computer and method for safe usage of documents, email attachments and other content that may contain virus, spy-ware, or malicious code
US6954829B2 (en) * 2002-12-19 2005-10-11 Intel Corporation Non-speculative distributed conflict resolution for a cache coherency protocol
US8010491B2 (en) 2003-02-28 2011-08-30 Microsoft Corporation Method for managing multiple file states for replicated files
US7617258B2 (en) 2003-05-13 2009-11-10 International Business Machines Corporation System for real-time healing of vital computer files
US7984304B1 (en) * 2004-03-02 2011-07-19 Vmware, Inc. Dynamic verification of validity of executable code
US9660808B2 (en) * 2005-08-01 2017-05-23 Schneider Electric It Corporation Communication protocol and method for authenticating a system
US8549198B2 (en) * 2009-03-27 2013-10-01 Schneider Electric It Corporation Communication protocol
CN102147843A (zh) * 2011-05-16 2011-08-10 湖南大学 一种基于内核不变量保护的rootkit入侵检测和系统恢复方法
US8984478B2 (en) * 2011-10-03 2015-03-17 Cisco Technology, Inc. Reorganization of virtualized computer programs

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101853175A (zh) * 2009-03-31 2010-10-06 甲骨文美国公司 虚拟化环境中促进的自检
CN101814049A (zh) * 2010-03-23 2010-08-25 北京大学 一种内存泄漏探测方法
CN102541691A (zh) * 2011-12-27 2012-07-04 北京人大金仓信息技术股份有限公司 面向内存数据库oltp应用的日志检查点恢复方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3079057A4 *

Also Published As

Publication number Publication date
CN104750536B (zh) 2018-08-21
US10007785B2 (en) 2018-06-26
EP3079057A1 (en) 2016-10-12
EP3079057B1 (en) 2018-06-06
CN104750536A (zh) 2015-07-01
EP3079057A4 (en) 2017-01-18
US20160314297A1 (en) 2016-10-27

Similar Documents

Publication Publication Date Title
WO2015101148A1 (zh) 一种实现虚拟机自省的方法和装置
US11645390B2 (en) Cloud-based method to increase integrity of a next generation antivirus (NGAV) security solution in a virtualized computing environment
US10146571B2 (en) Apparatus for hardware accelerated runtime integrity measurement
KR101835250B1 (ko) 트랜잭셔널 메모리를 사용한 비인가 메모리 수정 및 액세스의 검출
US10353831B2 (en) Trusted launch of secure enclaves in virtualized environments
TWI667588B (zh) 用以偵測未經授權之記憶體存取的計算裝置、方法及機器可讀儲存媒體（二）
JP5951879B2 (ja) オペレーティングシステムに対する悪意ある活動のレポート
US10121004B2 (en) Apparatus and method for monitoring virtual machine based on hypervisor
JP6367490B2 (ja) プロセッサトランザクショナルメモリサポートを用いるメモリアクセス保護
TW201419156A (zh) 擷取輕型虛擬機器管理員中錯誤條件的方法、系統及設備
US8910161B2 (en) Scan systems and methods of scanning virtual machines
JP7144642B2 (ja) フォレンジクスのための動作ベースのｖｍリソースキャプチャ
US9542557B2 (en) Snoop-based kernel integrity monitoring apparatus and method thereof
US20150199343A1 (en) Optimized file processing for linked clone virtual machines
EP3048550B1 (en) Measurement method, electronic device and measurement system
US9679134B1 (en) Systems and methods for detecting display-controlling malware
US8429322B2 (en) Hotplug removal of a device in a virtual machine system
US9785492B1 (en) Technique for hypervisor-based firmware acquisition and analysis
US11663332B2 (en) Tracking a virus footprint in data copies
US11755745B2 (en) Systems and methods for monitoring attacks to devices
US9696940B1 (en) Technique for verifying virtual machine integrity using hypervisor-based memory snapshots
KR102019483B1 (ko) 이동식 저장 장치 및 그의 보안 방법
CN112199673A (zh) 权限提升行为的检测方法、装置及可读存储介质
KR20220016726A (ko) 필터 드라이버를 이용한 시스템 내 은닉 프로세스 탐지 장치, 방법, 컴퓨터 판독 가능한 기록 매체 및 컴퓨터 프로그램
EP2972848A1 (en) Durable program execution

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14876189

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2014876189

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2014876189

Country of ref document: EP