Method, apparatus, and system for triggering virtual machine introspection

Patent metadata

Field	Value
Publication number	US-9785770-B2
Application number	US-201414572515-A
Country	US
Kind code	B2
Filing date	Dec 16, 2014
Priority date	Dec 26, 2013
Publication date	Oct 10, 2017
Grant date	Oct 10, 2017

Abstract

The present invention discloses a method, an apparatus, and a system for triggering virtual machine introspection, so as to provide a timely and effective security check triggering mechanism. In the present invention, data that needs to be protected is determined; the data that needs to be protected is monitored; and when it is determined that the data that needs to be protected is modified, virtual machine introspection is triggered. The present invention avoids a performance loss and a security problem that are brought about by regularly starting a virtual machine introspection system to perform a security check, and therefore, the present invention is more applicable.

First claim

What is claimed is:

1. A method for triggering virtual machine introspection, comprising:
determining data that needs to be protected;
storing, in a read set of a hardware transactional memory, a memory address corresponding to the determined data that needs to be protected;
monitoring whether a write operation is executed on the data that needs to be protected and corresponds to the memory address stored in the read set; and
controlling a transaction processing program of the hardware transactional memory to trigger virtual machine introspection, when it is determined that a write operation is executed on data that needs to be protected.

2. The method according to claim 1 , wherein before monitoring the data that needs to be protected, the method further comprises saving a copy of the data that needs to be protected,
wherein triggering virtual machine introspection comprises locating a memory address of modified data, and
wherein after triggering virtual machine introspection, the method further comprises restoring the modified data according to the copy and the memory address of modified data.

3. The method according to claim 1 , wherein after triggering virtual machine introspection, the method further comprises canceling monitoring of the data that needs to be protected.

4. The method according to claim 1 , wherein after triggering virtual machine introspection, the method further comprises sending an alarm prompt to a virtual machine user.

5. A non-transitory computer readable medium including computer-executable instructions for execution on an apparatus for triggering virtual machine introspection, such that when the computer-executable instructions are executed by the apparatus a method is carried out comprising:
determining data that needs to be protected;
storing in a read set of a hardware transactional memory, a memory address corresponding to the data that needs to be protected;
monitoring whether a write operation is executed on the data that needs to be protected and corresponds to the memory address stored in the read set; and
controlling a transaction processing program of the hardware transactional memory to trigger virtual machine introspection, when it is determined that the write operation is executed on the data that needs to be protected.

6. The non-transitory computer readable medium according to claim 5 , further including computer-executable instructions comprising:
saving a copy of the data that needs to be protected;
restoring a modified data according to the saved copy of the data that needs to be protected and the memory address of the modified data, wherein the modified data is the data that needs to be protected on which a write operation has been executed; and
wherein the triggering locates the memory address of the modified data.

7. The non-transitory computer readable medium according to claim 5 , further including computer-executable instructions comprising, when the virtual machine introspection is trigged, cancelling monitoring of the data that needs to be protected.

8. The non-transitory computer readable medium according to claim 5 , further including computer-executable instructions comprising, after the virtual machine introspection is triggered, sending an alarm prompt to a virtual machine user.

9. A system for triggering virtual machine introspection, comprising:
a hardware transactional memory configured to monitor data that needs to be protected; and
a non-transitory computer readable medium including computer-executable instructions for execution on an apparatus for triggering virtual machine introspection such that when the computer-executable instructions are executed by the apparatus a method is carried out comprising:
determining data that needs to be protected;
storing, in a read set of a hardware transactional memory, a memory address corresponding to the determined data that needs to be protected;
monitoring whether a write operation is executed on the data that needs to be protected and corresponds to the memory address stored in the read set; and
controlling a transaction processing program of the hardware transactional memory to trigger virtual machine introspection, when it is determined that a write operation is executed on data that needs to be protected.

10. The system according to claim 9 , further including computer-executable instructions comprising:
saving a copy of the data that needs to be protected;
locating a memory address of modified data; and
restoring the modified data according to the copy saved by the saving instruction and the memory address of the modified data.

11. The system according to claim 9 , further including computer-executable instructions comprising cancelling, when the virtual machine introspection is triggered, monitoring of the data that needs to be protected.

12. The system according to claim 9 , further including computer-executable instructions comprising, when the virtual machine introspection is triggered, sending an alarm prompt to a virtual machine user.

Assignees

• Huawei Tech Co Ltd

Inventors

• Tu Bin
• Chen Haibo
• Xia Yubin

Classifications

• G06F21/54

  by adding security routines or objects to programs · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title