【摘要】 为了防止内核级Rootkit对内核完整性造成破坏,描述基于Xen的隔离保护方法,Xen是一种微内核结构的虚拟机,直接运行在硬件之上,操作系统内核在Xen的域里运行,而域又可分为权限域Dom0和非权限域DomU,域间相互隔离,利用这个特性,强制将动态加载模块隔离在DomU里运行,并通过Xen的事件通道和授权表两个域间通信机制模拟出模块与内核之间函数调用。将监视模块加入中间层就可以达到监控所有模块对内核的操作。更多还原

【Abstract】 To prevent kernel-level Rootkit damage the integrity of kernel, describes a Xen-based isolation protection approach. Xen is a macro-kernel structural virtual machine, which runs directly on top of the hardware. Operating system kernel can run inside the Domain of Xen,Domains can be divided into two categories: privilege domain Dom0 and non-privilege domain DomU, which will be mutual isolated between each other. Takes the advantage of the isolated feature, Loadable Kernel Modules will be forced to run inside an isolated DomU,and function call between module and core kernel will be simulated by a middle layer which can be achieved by Xen’s inter-domain communication interface: Event Channel and Grant Table. Monitor modules can be added into the middle layer to monitor all operations from modules to kernel.更多还原