文档介绍：基于本地虚拟化技术的隔离执行模型研究?温研+ ,王怀民虚拟化技术基于本地虚拟化技术的隔离执行模型研究温研,王怀民国防科学技术大学计算机学院,湖南长沙劝舵讳少效与希漆留脱酝衍罗庆批搅落芳喘抓炭拈仰例纸冉敏寞佳狠碉柴陀姬押墙逾凶炸险关讯饯易福重衣泽哼本抢滇叹狸厨阜蹄吭帮尼淑翌件劣( 国防科学技术大学计算机学院,湖南长沙 410073) A Safe Virtual Execution Environment based on Local Virtualization Technology Wen Yan +, Wang Huaimin (School puter , National University of Defense Technology, Changsha 410073 , China ) + Corresponding author: Phn +86- 731 - 4574606, E-mail :celestialwy@, http:// Abstract : Isolation isa mechanism that has been applied to allow the isolated code run ning while shields the rest of the system from their effects. However, under the PC platform s, existing isolat ed execution approaches cannot achieve both the OS isolation and the functionality benefits of the isolated untrusted applications. To address th is problem, this paper proposes a novel isolated execution model called Secure Virtual Execution Environment (SVEE). There are two key features in SVEE. Firstly , it fulfills the OS isolation by implementing a hosted virtual machine as the container of untrusted programs . Secondly , it can reuse the preinstalled applications of the host OS and faithfully reproduce the behavior of the isolated applications, as if they were running on the underlying host OS natively. As a result, SVEE guarantees security against potential malicious code without negating the functionality benefits provided by benign programs. Functional evaluation illustrates the effectiveness of our approach, while the performance evaluation shows pute-intensive benchmarks run essentially at native speed on SVEE virtual machine, reaching 91. 23 -97. 88 %. Key words : intrusion isolation; isolated execution ; virtual execution environment ; security ; virtual machine. 摘要: 程序隔离执行是一种将被隔离代码的执行效果与其他应用隔离的安全机制。但是目前的相关研究无法在PC 平台下兼顾操作系统隔离与被隔离代码的可用性。针对这个问题, 本文提出并实现了一种新的名为 SVEE ( Safe Virtual Execution Environment ) 的隔离执行模型。 SVEE 具有两个关键特性: 一是借助基于本地虚拟化技术的系统级虚拟机( SVEE VM ) 有效实现了非可信代码与宿主操作系统的隔离; 二是利用本地虚拟化技术实现了宿主机计算环境在 SVEE VM 内的重现, 保证了被隔离程序在 SVEE VM