CAJ | 학술논문

针对云计算中客户虚拟机内核完整性面临的威胁，该文提出了一种保护虚拟机内核完整性的技术—CTVM。该技术在KVM虚拟机环境中实现了虚拟化可信执行环境的创建，使多个客户虚拟机同时拥有可信计算功能，能对客户虚拟机提供启动完整性度量；在此基础上利用硬件辅助虚拟化技术，通过为客户虚拟机构造隔离的地址空间，使客户虚拟机中不可信模块与内核运行在逻辑隔离的地址空间。从这两个方面实现对客户虚拟机的启动和运行时的完整性保护。最后，以某国产服务器为实验平台实现了CTVM原型系统，系统测试与分析验证了技术的可用性，系统性能损耗在可接受的范围内。
침대운계산중객호허의궤내핵완정성면림적위협，해문제출료일충보호허의궤내핵완정성적기술—CTVM。해기술재KVM허의궤배경중실현료허의화가신집행배경적창건，사다개객호허의궤동시옹유가신계산공능，능대객호허의궤제공계동완정성도량；재차기출상이용경건보조허의화기술，통과위객호허의궤구조격리적지지공간，사객호허의궤중불가신모괴여내핵운행재라집격리적지지공간。종저량개방면실현대객호허의궤적계동화운행시적완정성보호。최후，이모국산복무기위실험평태실현료CTVM원형계통，계통측시여분석험증료기술적가용성，계통성능손모재가접수적범위내。
For the kernel integrity threats of virtual machine in cloud computing environment, an integrity protecting technology of virtual machine kernel, cloud trusted virtual machine(CTVM ), is proposed. In the CTVM, the virtual trusted execution environment in kernel-based virtual machine(KVM) is created, the multiple virtual machines are endowed with a trusted computing function at the same time, and the guest virtual machines are provided with integrity measurement ability. By utilizing hardware virtualization technology, the untrusted kernel modules are isolated from operating system kernel through constructing isolated address space in guest virtual machines, so as to protect the booting integrity and runtime integrity of guest virtual machines. Finally, with a domestic server as the experimental platform, CTVM prototype system is presented. System test and analysis show that the system performance loss is within the acceptable range.