【作者】 杨凯；

【导师】 邹德清；

【作者基本信息】 华中科技大学 ， 信息安全， 2011， 硕士

【摘要】 在传统情况下,恶意软件在系统中的运行级别通常和强制访问控制系统的运行级别是一样的,都是处在操作系统的内核级,这样恶意软件就可以对强制访问控制系统等安全系统进行攻击,破坏安全软件的正常运行或关闭安全软件的策略检查。由于操作系统的内核的漏洞是不可避免,因此这个问题在传统架构下是无法解决。最近云计算已经成为工业界和学术界研究的热点之一,虚拟化作为云计算平台实施的必备的技术之一,在现代的计算机系统中使用越来越广泛,从个人系统到网页服务器和数据中心,从客户端到服务器端,都可以看到虚拟化的身影。由于虚拟机管理程序可以提供一个小且安全的可信计算基,具有良好的隔离性和高特权性,很多研究者利用虚拟机监视器的安全特性来解决传统架构下安全问题。在虚拟域内访问控制系统保护机制研究的解决方案中,访问控制系统可以分为三个部分:安全策略管理模块,安全服务器模块和策略执行模块。安全策略管理模块和安全服务器模块是放在安全的操作系统中,利用虚拟机管理程序的隔离性和安全操作系统的安全性来保证它们的安全。为了加快客户操作系统和安全操作系统之间的安全策略决策信息交换,在客户操作系统中添加了策略决策缓存模块。为了实现主动防御和降低系统的性能开销,策略执行模块被放在客户操作系统中。策略决策缓存模块和策略执行模块的安全是通过内存保护机制来保障的。虚拟域内访问控制系统保护机制的原型系统SEVD(Security-Enhanced Virtual Domain,简称SEVD)是在Xen虚拟化平台上实现的。测试结果表明SEVD系统能够有效保护客户操作系统中访问控制系统的安全,能够抵御流行的Rookit攻击;在性能方面,与SELinux访问控制系统相比,性能开销也是没有增加;在功能方面,实现了虚拟环境下安全策略集中配置,有效降低了安全策略管理的复杂度。更多还原

【Abstract】 In traditional framework, Mandatory access control (MAC) systems run in kernel mode. Rootkits and other kernel-level attacks, which are also run in kernel mode, can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system is comprised since malwares are running in ring0 level.Recently, cloud computing is becoming the hottest pot of research in academia and industry. Virtualization, as one of the essential techniques in cloud computing, is increa-singly utilized in modern computer systems, ranging from PCs to web servers and data centers,from client to server.. Apart from applications for testing and energy conserva-tion, hypervisors are also becoming a popular target for implementing many security systems, since they provide a small and easy-to-secure trusted computing base.In our solution, access control system is separated into three parts: Policy Manage-ment (PM), Security Server (SS) and Policy Enforcement (PE). PM and SS reside in se-curity domain to protect them against malware and the isolation feather of hypervisor can make them away from attacks. Access Vector Cache (AVC) is added between SS and PE in Guest OS, in order to speed up communication between the Guest OS and security domain. The policy enforcement module is remained in the Guest OS for performance. The security of AVC and PE can be assured by memory protection mechanism.Prototype system SEVD (Security-Enhanced Virtual Domain, SEVD for short) is im-plemented and evaluated by modified Xen hypervisor, results shows that SEVD can se-cure the security of access control system in Guest OS and avoid popular rootkits attacks while it have no overhead comparing with SELinux. Our system also can centralized se-curity policy for virtual domains in virtual machine environment.更多还原