【摘要】 通用操作系统存在大量后门和漏洞等安全威胁,使得应用程序中处理的敏感信息的机密性难以得到完备的保护。该文设计并实现了敏感内存管理(sensitive memory manager,SMM)系统,在应用程序配合下对存放敏感信息的内存进行保护,阻止攻击者利用系统内核窃取敏感信息的企图。该系统基于虚拟化技术,通过为被保护进程的用户态和内核态设置不同影子页表的方式,使得应用程序能够访问的敏感信息不会被操作系统内核访问。有效性评测和性能评测表明:该系统提供的内存保护粒度更小,带来的性能损耗更小。更多还原

【Abstract】 The threats of backdoors and vulnerabilities in general-purpose operating systems complicate protection of sensitive information.This paper describes a sensitive memory management system(SMM)which protects sensitive information memory and prevents attackers from obtaining sensitive information by compromising the operating system kernel.Virtualization is used to set up different shadow page tables for the user-mode and the kernel-mode of the protected process and then controls access to the sensitive information so that only the proper applications can access the information and not the operating systems kernel.Tests show that the memory is protected with finer granularity and lower overhead than previous methods.更多还原