CN106203082A - The system and method efficiently isolating kernel module based on virtualization hardware characteristic - Google Patents

Abstract

The present invention provides a system and method for efficiently isolating kernel modules based on the characteristics of virtualized hardware, which designs a safe and efficient strong isolation mechanism for untrusted kernel modules, and can meet the current requirements for security and functions sexual needs. Compared with the existing solutions, the present invention has better performance, stronger isolation and higher backward compatibility. The mechanism proposed by the present invention is easy to be deployed in the current mainstream cloud computing platform, and then can bring considerable social and economic benefits. In the mechanism proposed by the present invention, when the untrusted kernel module needs to call the function of the kernel core, or the kernel core needs to call the function in the untrusted kernel module, a set of safe and efficient control flow based on virtualization hardware characteristics is established Transition mechanisms such that no further attack surface is exposed during this transition.

Description

System and method for efficiently isolating kernel modules based on virtualization hardware characteristics

technical field

The invention belongs to the technical field of cloud computing platform system security, and specifically relates to a safe and efficient malicious kernel module prevention mechanism capable of finding a balance between security and performance.

Background technique

At first the technical terms involved in the present invention are explained:

Kernel - all code and data running in kernel mode

Kernel core - included in the kernel file, the code and data loaded into the kernel state when the system starts

Kernel module - independent of the kernel file, code and data dynamically inserted into the kernel state during system operation

During the running of the system, the code and data running in the kernel mode are composed of the kernel core and the kernel module.

In cloud computing platforms, virtualization technology is usually used to efficiently integrate servers and improve the utilization of hardware including processors and memory. At the same time, virtualization technology is usually used to isolate virtual machines to prevent malicious virtual machines from accessing private data stored in memory and disks in other virtual machines. However, within the virtual machine, as the operating system has more and more functions, the amount of code in the kernel of the operating system is also increasing, and the number of loopholes in the code in the kernel is also increasing. In the exposure of vulnerabilities and attacks against the kernel, the kernel module bears the brunt. The kernel module includes codes that are not programmed into the kernel core but run in the kernel, such as drivers. At the same time, in recent years, kernel malware rootkits have also become popular, and the research on rootkits in academia and industry has never stopped. In general, rootkits are also a special kind of kernel module. They install it in the kernel space by deceiving users, and modify some special data structures in the kernel through a series of means to achieve specific purposes, such as by modifying System call table or interrupt processing table to intercept some sensitive system calls and interrupt processing; or to hide some specific processes by modifying the process list.

Since the kernel module is at the highest authority level of the entire system, upper layer protection software including antivirus software cannot solve the problems caused by malicious modules. A common method is to use virtualization technology to isolate untrusted kernel modules in the virtual machine kernel, because the virtual machine monitor is at a higher level of authority than the virtual machine operating system, so it can control the virtual machine kernel Memory access rights, so as to distinguish between untrusted kernel modules and kernel core access to different memory through the control of memory access rights. However, isolating the kernel module through virtualization technology is likely to cause a large performance loss, because the memory access control in the virtual machine requires the intervention of the virtual machine monitor, especially when there is some kind of untrusted kernel module and the kernel core. Interaction, such as mutual function calls and data access, needs to switch and jump between different memory contexts, and these switches and jumps need to be intercepted by the virtual machine monitor, for example, by generating an exception, Trapped into the virtual machine monitor, etc., these frequent virtual machine traps can easily cause a large performance overhead. On the other hand, since the runtime semantics in a virtual machine are agnostic to the virtual machine, there is a semantic gap in detecting and monitoring virtual machine memory access for a virtual machine monitor, and further work is needed to Solve related problems.

In addition, how to effectively and reasonably decouple untrusted kernel modules from the kernel core is also a relatively big challenge. Some previous program analysis systems can obtain the control flow related to certain data through data flow analysis, so as to separate the relevant code in the program. Data theft from the trusted kernel. However, these systems do not take into account the relatively large degree of coupling between the untrusted kernel module and the kernel core. In a general kernel module, it will call the interface provided by the kernel core and access some kernel data structures. At the same time The kernel core also calls the interface provided by the kernel module, such as calling a function of a driver module. Therefore, how to effectively isolate the untrusted kernel module reasonably without affecting its own functionality is also a problem that needs to be solved urgently.

Intel processors proposed hardware virtualization support a long time ago, including CPU virtualization, memory virtualization and I/O virtualization, and the hardware support of memory virtualization is mainly utilized in the present invention. In a virtualization environment, memory virtualization is implemented through two-level page table mapping, as shown in Figure 1. The two-level page table mechanism of memory virtualization Each guest virtual address (GVA, Guest Virtual Address) in the guest virtual machine will first be mapped to a guest physical address (GPA, Guest Physical Address), and then in the virtual machine monitor (VMM, Virtual MachineMonitor), each client physical address will be mapped to a host physical address (HPA, host physical address). That is to say, a page table (called EPT in Intel) will be maintained in the virtual machine monitor VMM. This page table will map the physical addresses in all guest virtual machines. Only the mappings that exist in the page table The client address will be reflected in the real physical memory. The page table is accessed through a hardware page table pointer register called EPT Pointer (EPTP). In theory, we can operate the memory allocation in the client by operating EPT (that is, changing the mapping between GPA and HPA), but in normal mode, modifying the mapping relationship of addresses in EPT is performed by the virtual machine monitor VMM Operationally, switching between different EPTPs in the virtual machine will cause the virtual machine to sink, resulting in relatively large performance overhead.

Therefore, how to simultaneously meet the three requirements of safety, functionality and performance has become a technical problem to be solved urgently by those skilled in the art.

Contents of the invention

Aiming at the defects in the prior art, the object of the present invention is to design a system based on virtualized hardware features to efficiently isolate kernel modules as a security mechanism, which can be easily deployed in the machines of the existing cloud computing platform, and It can meet the increasing needs of users in terms of security, functionality and performance.

A system for efficiently isolating kernel modules based on virtualization hardware features provided by the present invention includes a kernel segmentation module, a memory isolation module, and a secure communication module;

The kernel segmentation module is used to divide the kernel core source code and the untrusted kernel module source code into two independent contexts, which are respectively the untrusted kernel module context and the kernel core context;

A memory isolation module, configured to deploy the two independent contexts in two isolated physical memories;

The secure communication module is used to switch the control flow from the untrusted kernel module context to the kernel core context when the untrusted kernel module needs to call the function provided by the kernel core, and the kernel core calls the function that the untrusted kernel module needs to call After that, switch the control flow back to the untrusted kernel module context; and, when the kernel core needs to call the function provided by the untrusted kernel module, switch the control flow from the kernel core context to the untrusted kernel module context, by the untrusted After the kernel module of the letter calls the function that the kernel core needs to call, the control flow is switched back to the kernel core context.

Preferably, the memory isolation module is used to establish two sets of mutually independent page tables for the untrusted kernel module context and the kernel core context, and perform access control on the access of the two isolated physical memory during operation .

Preferably, the kernel segmentation module is used for performing data dependency analysis and control flow analysis on kernel core source code and untrusted kernel module source code;

Through the secure communication module, the following function calls and data access are compiled into the kernel core context:

- Functions provided by the kernel core that untrusted kernel modules need to call;

- Data in the kernel core that untrusted kernel modules need to access;

Compile the following function calls and data accesses into an untrusted kernel module context through the secure communication module:

- Functions provided by untrusted kernel modules that the kernel core needs to call;

- Data in untrusted kernel modules that the kernel core needs to access.

Preferably, in the secure communication module, switching between the untrusted kernel module context and the kernel core context is realized by switching between the two sets of mutually independent page tables.

Preferably, it also includes an extended page table pointer replacement module;

The extended page table pointer replacement module is used to create a plurality of page tables and the page table pointer registers EPTP corresponding to the plurality of page tables in the virtual machine monitor, form the page table pointer register EPTP into an EPTP array, and combine the EPTP array The first address is filled in the field in the virtual machine control structure VMCS, which is recorded as the EPTP_LIST_ADDR field; in the non-root mode of the guest virtual machine, switch the current page table to the configured address corresponding to the address stored in the EPTP_LIST_ADDR field page table.

A method for efficiently isolating a kernel module based on virtualization hardware characteristics provided by the present invention includes a kernel segmentation step, a memory isolation step, and a secure communication step;

Kernel segmentation step: split the kernel core source code and the untrusted kernel module source code into two independent contexts, namely the untrusted kernel module context and the kernel core context;

Memory isolation step: deploying the two independent contexts in two isolated physical memories;

Secure communication steps: When the untrusted kernel module needs to call the function provided by the kernel core, switch the control flow from the untrusted kernel module context to the kernel core context, and after the kernel core calls the function that the untrusted kernel module needs to call, Switch the control flow back to the untrusted kernel module context; and, when the kernel core needs to call the function provided by the untrusted kernel module, switch the control flow from the kernel core context to the untrusted kernel module context, and the untrusted After the kernel module calls the functions that the kernel core needs to call, it switches the control flow back to the kernel core context.

Preferably, the memory isolation step: establish two sets of mutually independent page tables for the untrusted kernel module context and the kernel core context, and perform access control on the access of the two isolated physical memory during operation.

Preferably, the kernel segmentation step: by performing data dependency analysis and control flow analysis to the kernel core source code and untrusted kernel module source code;

With a secure communication step, the following function calls and data accesses are compiled into the kernel core context:

- Functions provided by the kernel core that untrusted kernel modules need to call;

- Data in the kernel core that untrusted kernel modules need to access;

With a secure communication step, the following function calls and data accesses are compiled into the untrusted kernel module context:

- Functions provided by untrusted kernel modules that the kernel core needs to call;

- Data in untrusted kernel modules that the kernel core needs to access.

Preferably, in the secure communication step, switching between the untrusted kernel module context and the kernel core context is realized by switching between the two sets of mutually independent page tables.

Preferably, the step of replacing the extended page table pointer is also included;

Extended page table pointer replacement steps: create multiple page tables and page table pointer registers EPTP corresponding to the multiple page tables in the virtual machine monitor, form the page table pointer register EPTP into an EPTP array, and set the first address of the EPTP array Fill in the domain in the virtual machine control structure VMCS, which is recorded as the EPTP_LIST_ADDR domain; in the non-root mode of the guest virtual machine, switch the current page table to the configured page table corresponding to the address stored in the EPTP_LIST_ADDR domain .

Compared with the prior art, the present invention has the following beneficial effects:

1. The present invention can effectively divide and isolate untrustworthy kernel modules, and prevent untrustworthy kernel modules from accessing and tampering with key data in the kernel core.

2. The present invention utilizes the memory hardware virtualization feature in the Intel processor and the hardware extension of EPTP Switching to propose a safe and efficient switching mechanism based on hardware characteristics between the untrusted kernel and the kernel core, which can be safely and efficiently used in untrusted kernels and kernel cores. The conversion of the control flow between the kernel module of the letter and the kernel core greatly reduces the performance loss.

3. The architecture corresponding to the present invention can be deployed in an existing cloud computing platform.

Description of drawings

Other characteristics, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

FIG. 1 is a schematic diagram of memory hardware virtualization utilized in the present invention.

Fig. 2 is a system architecture diagram in the present invention.

Fig. 3 is a schematic diagram of an untrusted kernel module partitioning system in the present invention.

Fig. 4 is a schematic diagram of communication between an untrusted kernel module and a kernel core in the present invention.

detailed description

The present invention will be described in detail below in conjunction with specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but do not limit the present invention in any form. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

In particular, the present invention provides a system for efficiently isolating kernel modules based on virtualization hardware characteristics, which belongs to the field of cloud computing platform system security technology, and realizes the isolation of untrustworthy kernel module contexts. Safe and efficient switching of hardware features. The present invention utilizes the hardware features provided in the Intel server hardware virtualization extension to design a safe and efficient strong isolation mechanism for untrustworthy kernel modules, and can meet the current requirements for security and functionality. Compared with the existing solutions, the present invention has better performance, stronger isolation and higher backward compatibility. The mechanism proposed by the present invention is easy to be deployed in the current mainstream cloud computing platform, and then can bring considerable social and economic benefits. In the mechanism proposed by the present invention, when the untrusted kernel module needs to call the function of the kernel core, or the kernel core needs to call the function in the untrusted kernel module, a set of safe and efficient control flow based on virtualization hardware characteristics is established Transition mechanisms such that no further attack surface is exposed during this transition.

Specifically, the system for efficiently isolating kernel modules based on virtualization hardware features includes a kernel segmentation module, a virtualization-based memory isolation module, and a secure communication module between untrusted kernel modules and kernel cores.

FIG. 2 shows an overall architecture diagram of the present invention. First, the kernel segmentation module receives the kernel core source code and the untrusted kernel module source code, and divides the kernel core source code and the untrusted kernel module source code into two independent contexts, namely the untrusted kernel module context and the kernel core context; the context Includes code and data.

Afterwards, through the memory isolation module based on virtualization, the two independent contexts are deployed in two isolated physical memories. The isolation process of the physical memory adopts the memory hardware virtualization support provided by Intel, and through the EPT Divide, establish two sets of independent EPTs for the untrusted kernel module context and the kernel core context, and control access to these two isolated physical memory accesses at runtime, preventing untrusted kernel modules from directly reading Access or modify sensitive data in the kernel core.

In addition, in order to maintain the original functionality of all kernel modules and kernel cores including untrusted kernel modules, we use the secure communication module to wrap the calls to the kernel core in the original untrusted kernel modules Form a springboard function, switch the control flow to the kernel core context through the context switching function in the springboard function, the kernel core directly calls the function called in the untrusted kernel module, and makes the control flow return to the untrusted kernel module context, Moreover, when the kernel core needs to call the interface function provided by the untrusted kernel module, it also provides the context switching function through the security communication module to switch the control flow to the untrusted kernel module context, and the untrusted kernel module calls the interface function. Finally let control flow back to the kernel core context.

Figure 3 shows the process of the kernel split module. We first pass the kernel core source code and untrusted kernel module source code into the kernel split module as parameters, and perform data dependency analysis and control flow analysis on the corresponding source code in the kernel split module, and find What function interfaces in the kernel core are called in the untrusted kernel module, and what related data are accessed, or what interface functions of the untrusted kernel module are called in the kernel core, what related data is accessed, etc. Then replace scripts with automated function calls, replace these function calls and data access with springboard functions provided in the communication module, and finally compile the corresponding code segments and data segments into mutually independent program segments through a compiler (such as GCC) .

When the kernel segmentation module is completed, it will enter the memory isolation module based on virtualization, which will deploy the program segments where the kernel core and untrusted kernel modules are located in two mutually isolated physical memory areas, through Intel memory hardware virtualization The provided EPT support creates two EPTs for two different memory areas, and switches between the two EPTs in the secure communication module to realize context switching between the untrusted kernel module and the kernel core.

Figure 4 shows the communication mechanism between the untrusted kernel module and the kernel core. Through the process of function replacement in the kernel split module, we will remove the possible dependencies between the untrusted kernel module and the kernel core, including function calls and data The access operation is replaced by the springboard function provided by the secure communication module. The function of this springboard function is to switch the EPT configured by the virtual machine monitor first to achieve the purpose of switching the context. For example, when the untrusted kernel module needs to When calling a function in the kernel core or accessing data in the kernel core, switch to the EPT corresponding to the kernel core through the springboard function, then call the corresponding function and data access operation in the kernel core, and finally switch to an untrusted kernel module The corresponding EPT returns the result. vice versa.

In order to minimize the performance loss caused by virtual machine sinking caused by memory isolation and context switching during operation, our system uses a virtualization hardware extension mechanism of Intel processors: EPTP Switching (Extended Page Table Pointer Replacement) . This is a function provided by the hardware that can run in the virtual machine. The function of this function is to change the value of the EPT Pointer without sinking into the virtual machine monitor. We can create a series of EPTs and their corresponding EPTPs in the virtual machine monitor to form an EPTP array, and then fill the first address of the array into a specific field EPTP_LIST_ADDR in the virtual machine control structure VMCS (Virtual Machine ControlStructure) middle. In the non-root mode (non-root mode) of the guest virtual machine, call the relevant instructions and set the register to the corresponding value to realize the operation of EPTP switching, and efficiently switch the current EPTP to Configure an EPTP stored in EPTP_LIST_ADDR before. Therefore, after the virtual machine monitor has configured the corresponding EPT, in the springboard function of the secure communication module, only one VMFUNC instruction needs to be called, and the index of the corresponding EPT is passed in, which can achieve the effect of switching the context corresponding to the EPT. , without causing the virtual machine to sink. This is the safe and efficient switching between the kernel module and the kernel core based on the characteristics of virtualized hardware.

In a preferred embodiment, the specific deployment process of the system for efficiently isolating kernel modules based on virtualization hardware features provided by the present invention includes kernel segmentation, virtualization-based memory isolation initialization, runtime memory access monitoring, untrusted These four phases are hardware-based efficient switching between kernel modules and kernel cores. The present invention will be described in detail below through specific implementation examples.

The example concrete steps of the present invention are as follows:

Step 1. Before deploying the entire system, it is necessary to perform source code-level program analysis on the source code of the kernel core and untrusted kernel modules, and obtain the dependencies between the untrusted kernel modules and the kernel core through data dependency and control flow analysis , and replace all function call dependencies and data access dependencies with springboard function packages provided by the communication module through automatic scripts, and finally divide the processed data and code into different program segments through compiler (GCC) compilation options.

Step 2, the virtual machine kernel core invokes a system call provided by the system, and passes in the prepared program segment information, and the virtual machine monitor deploys the two program segments in different mutually isolated memory areas according to the provided program segment information, and Create a set of EPTs for the two memory regions respectively.

Step 3. During operation, the virtual machine monitor will perform permission access control on the memory areas corresponding to the two EPTs. When the code in the untrusted kernel module directly accesses the data in the EPT corresponding to the kernel core, it will generate An abnormality sinks into the virtual machine monitor, and the memory isolation module in the virtual machine monitor checks the access, and if it is determined to be an illegal access, the operation of the untrusted kernel module is terminated.

Step 4: During the operation of the untrusted kernel module and the kernel core, if the untrusted kernel module needs to call the function of the kernel kernel or access related data, enter the springboard function provided by the communication module. The springboard function passes the VMFUNC instruction to the EPT pointer index of the kernel core, quickly switches to the EPT memory space of the kernel core, and the kernel core calls and accesses the corresponding functions and data, and finally passes the VMFUNC instruction to the untrusted kernel The EPT pointer index for the module to return the result to the untrusted kernel module. vice versa.

Those skilled in the art know that, in addition to realizing the system provided by the present invention and its various devices in a purely computer-readable program code mode, the system provided by the present invention and its various devices can be completely programmed with logic gates, logic gates, The same functions can be realized in the form of switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system provided by the present invention and its various devices can be considered as a hardware component, and the devices included in it for realizing various functions can also be regarded as the structure in the hardware component; Means for implementing various functions can be regarded as either a software module implementing a method or a structure within a hardware component.

Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. In the case of no conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims (10)

1. the system efficiently isolating kernel module based on virtualization hardware characteristic, it is characterised in that include that kernel is split Module, internal memory isolation module, secure communication module；

Kernel segmentation module, for kernel core source code and incredible kernel module source code be divided into two sections independent upper and lower Literary composition, the most incredible kernel module context, kernel core context；

Internal memory isolation module, for being deployed in described two sections of independent contexts in two physical memories kept apart；

Secure communication module, for when incredible kernel module needs the function calling the offer of kernel core, flowing control Be switched to kernel core context by incredible kernel module context, kernel core calling incredible kernel module needs After function to be called, control stream is switched back to incredible kernel module context；Further, need to adjust in kernel core During the function provided with incredible kernel module, control stream is switched to incredible kernel module by kernel core context Context, incredible kernel module, after calling the function that kernel core needs call, switch back to kernel by control stream Core context.

The system efficiently isolating kernel module based on virtualization hardware characteristic the most according to claim 1, its feature exists In, internal memory isolation module, for for incredible kernel module context, that kernel core context sets up two sets is the most independent Page table, and the access of the physical memory operationally kept apart said two conducts interviews control of authority.

The system efficiently isolating kernel module based on virtualization hardware characteristic the most according to claim 1, its feature exists In, kernel segmentation module, for by carrying out data dependence analysis to kernel core source code and incredible kernel module source code And control flow analysis；

By secure communication module, following function call and data access are compiled in kernel core context:

-incredible kernel module needs the function that the kernel core called provides；

-incredible kernel module needs the data in the kernel core accessed；

By secure communication module, following function call and data access are compiled in incredible kernel module context:

-kernel core needs the function that the incredible kernel module called provides；

-kernel core needs the data in the incredible kernel module accessed.

The system efficiently isolating kernel module based on virtualization hardware characteristic the most according to claim 2, its feature exists In, in secure communication module, realize incredible kernel by the page table the most independent at described two sets switches over Switching between module context and kernel core context.

The system efficiently isolating kernel module based on virtualization hardware characteristic the most according to claim 1, its feature exists In, also include extending page table pointers replacement module；

Extension page table pointers replacement module, for creating multiple page table and the plurality of page table each in monitor of virtual machine Corresponding page table pointers depositor EPTP, forms EPTP array by page table pointers depositor EPTP, by the first address of EPTP array Filling out the territory in virtual machine control structure VMCS, this territory is designated as EPTP_LIST_ADDR territory；Non-root mode at guest virtual machine In, current page table is switched to the configured good page table being stored in EPTP_LIST_ADDR territory corresponding to address.

6. the method efficiently isolating kernel module based on virtualization hardware characteristic, it is characterised in that include that kernel is split Step, internal memory isolation step, secure communication step；

Kernel segmentation step: kernel core source code and incredible kernel module source code are divided into two sections of independent contexts, It is respectively incredible kernel module context, kernel core context；

Internal memory isolation step: described two sections of independent contexts are deployed in two physical memories kept apart；

Secure communication step: when incredible kernel module needs the function calling the offer of kernel core, control is flowed by not Believable kernel module context is switched to kernel core context, kernel core calling incredible kernel module needs to adjust Function after, control stream is switched back to incredible kernel module context；Further, need to call not in kernel core During the function that believable kernel module provides, control stream is switched to incredible kernel module by kernel core context upper and lower Literary composition, incredible kernel module, after calling the function that kernel core needs call, switch back to kernel core by control stream Context.

The method efficiently isolating kernel module based on virtualization hardware characteristic the most according to claim 6, its feature exists In, internal memory isolation step: set up the page that two sets are the most independent for incredible kernel module context, kernel core context Table, and the access of the physical memory operationally kept apart said two conducts interviews control of authority.

The method efficiently isolating kernel module based on virtualization hardware characteristic the most according to claim 6, its feature exists In, kernel segmentation step: by kernel core source code and incredible kernel module source code are carried out data dependence analysis and control Flow point processed is analysed；

By secure communication step, following function call and data access are compiled in kernel core context:

-incredible kernel module needs the function that the kernel core called provides；

-incredible kernel module needs the data in the kernel core accessed；

By secure communication step, following function call and data access are compiled in incredible kernel module context:

-kernel core needs the function that the incredible kernel module called provides；

-kernel core needs the data in the incredible kernel module accessed.

The method efficiently isolating kernel module based on virtualization hardware characteristic the most according to claim 7, its feature exists In, in secure communication step, realize incredible kernel by the page table the most independent at described two sets switches over Switching between module context and kernel core context.

The method efficiently isolating kernel module based on virtualization hardware characteristic the most according to claim 6, its feature exists In, also include extending page table pointers replacement step；

Extension page table pointers replacement step: create multiple page table in monitor of virtual machine and the plurality of page table is the most corresponding Page table pointers depositor EPTP, by page table pointers depositor EPTP form EPTP array, the first address of EPTP array is filled out Territory in virtual machine control structure VMCS, this territory is designated as EPTP_LIST_ADDR territory；In the non-root mode of guest virtual machine, will Current page table is switched to the configured good page table being stored in EPTP_LIST_ADDR territory corresponding to address.