用於客戶虛擬機API調用監控與側錄之硬體輔助MMU重導技術

Hardware-Assisted MMU Redirection for In-guest API Invocation Monitoring and Profiling

李鴻鈞(HUNG-JUN LI)

指導教授 ： 孫雅麗

國立臺灣大學/管理學院/資訊管理學研究所/碩士(2018年)

https://doi.org/10.6342/NTU201802655

摘要

雲端服務的蓬勃發展使得愈來愈多的企業傾向於使用這項科技來輔助企業的發展。雲端服務的發展使得伺服器中心化成為無法抵抗的潮流。在伺服器逐漸轉為中心化的同時，雲端服務也將成為惡意攻擊者的明顯目標，因此雲端服務上的資訊安全將成為一項重大的議題。虛擬化技術因為能夠為在雲端平台上的使用者們提供一個獨立而不受其他使用者干擾的虛擬環境而廣泛地受到雲端服務提供者的採用，然而當虛擬化技術提供這些優勢的同時，也讓虛擬機器成為一個黑盒子，雲端服務的管理者無法掌握每台客戶虛擬機是否正在執行惡意行為並可能造成跨虛擬機之間的資訊安全問題。本論文以目前主流的虛擬化平台kernel based virtual machine (KVM)作為研究的案例，並透過修改KVM記憶體管理機制 (extended page table, EPT)的方式，將客戶虛擬機的執行導向到一塊自定義的記憶體空間，開發者可以這個自訂的空間中加入自行設計的應用程序，提出一套可用於管理客戶虛擬機的機制。為了證明該機制的可行性，我們同時實做了一套針對Windows7環境的客戶虛擬機側錄系統用於監控在客戶虛擬機內部的活動。除了基本的側錄功能外，本論文於系統設計時也將下列三項重點列入實作目標: 高效能 (high performance)、提供高階語意分析資訊 (high level semantic information) 及 高度隱匿性 (high Transparency)。因此本論文提出的系統在執行時不會大幅地降低原本服務的執行效率並且能夠提供windows API information作為高階語意分析資訊讓管理者能夠有效率地理解分析報告的內容。此外，本論文提出的側錄系統無須對客戶虛擬機內部環境做出改變，在客戶虛擬機中的惡意程式不容易察覺本側錄系統的存在，藉此提高了系統的隱匿性。最後，本論文中也針對所提出機制討論各種應用的可能性。例如，透過記憶體重導機制可以幫助管理人員可以在不關閉重要服務的前提下，更新重要服務的功能。同時也點出這項技術可能受到惡意利用的可能性。

關鍵字

KVM ； MMU 重導 ； EPT ； 硬體輔助虛擬化 ； 虛擬機內省

並列摘要

With the development of hardware and virtualization technologies, modern computing architecture gradually becomes more centralized. With virtualization technology, cloud service providers can make use of hardware resources more efficiently. The hypervisor can manage the shared resource pool and ensure that the guest virtual machines (VMs) are isolated from each other while using the shared resources (so that none of them can affect each other). Therefore, more and more companies have migrated their services from physical servers to virtual machines provided by cloud service providers in order to reduce the management effort. However, service providers still need a management mechanism in the hypervisor to protect the VMs. Because of existing of the virtualization layer, a guest machine is just like a black box and the purpose of the hypervisor merely manages the resources and does not know what happened in the guest machine. Recently, more and more threats emerge on virtual machine and one of the latest threat is cross-VM side channel attack which results in side channel data leakage, such as cryptographic keys. Malicious users can make use of this attack to gain access to other guest virtual machines or hosts in an infrastructure. In this paper, we develop a management mechanism to redirect the in-guest memory to a controlled, self-defined memory space in the hypervisor by modifying the extended page table, EPT. Based on this mechanism, we propose a prototype system, ANTS to prove the feasibility of the proposed mechanism. ANTS is an efficient and effective VMI based profiling system for Windows guest machine. To develop such an efficient and effective profiling system, we have to reach the following goals: high performance (average performance degradation is about 2.32%), high transparency (hiding existence of our system) and high-level semantic information observation (human readable). In addition to the profiling system, we also provide some new ideas to make use of the proposed mechanism to implement variety of applications. For example, IT managers can use this concept to perform system hot-patching for the important services that can’t suspended. Furthermore, we also remind that such mechanism can also be used to perform malicious behaviors, such as information theft.

並列關鍵字

KVM ； MMU redirection ； EPT ； Hardware Assisted Virtualization ； Virtual machine introspection

參考文獻

[1]. Payne B.D., “Virtual Machine Introspection”, Encyclopedia of Cryptography and Security, 2011.

[2]. More and S. Tapaswi, “Virtual machine introspection: towards bridging the semantic gap”, Journal of Cloud Computing, vol. 3, pp. 1-14, 2014.

[3]. Tal Garfinkel, and Mendel Rosenblum, “A Virtual Machine Introspection Based Architecture for Intrusion Detection”, NDSS Symposium, 2003.

[4]. F. Bellard, “QEMU, a Fast and Portable Dynamic Translator”, in USENIX Annual Technical Conference, FREENIX Track, 2005, pp. 41-46.

[5]. Waldemar Graniszewski, Adam Arciszewski, “Performance analysis of selected hypervisors”, INTL Journal of ELECTRONICS AND TELECOMMUNICATION, VOL. 62, NO. 3, PP. 231–236, 2016.