CN104484606A - Verification method for memory information confidentiality of virtualization platform - Google Patents

Abstract

The invention relates to the technical field of cloud computing, in particular to a method for verifying the confidentiality of memory information of a virtualization platform. Firstly, a virtualization platform is installed on a host machine, and a virtual machine A with a large enough memory is established; then logging in, assigning all the available memories in the virtual machine A to be a same value, checking the residual memories, and reading out the values in the memories; deleting the virtual machine A, and creating a virtual machine B with the same memory size on the same host machine; and logging in the virtual machine B, reading the value in the memory and printing. Finally, comparing the two values before and after, if the printed values in the virtual machine B have continuous same values, proving that the information is not completely cleared, which has a defect in the confidentiality of the memory information, otherwise, proving to be perfect. The invention provides a method for verifying the confidentiality of memory information of a virtualization platform; the method can be used for verifying the confidentiality of the memory information of the seed virtualization platform.

Description

A method for verifying the confidentiality of memory information in a virtualization platform

technical field

The invention relates to the technical field of cloud computing, in particular to a method for verifying the confidentiality of memory information on a virtualization platform.

Background technique

In the cloud platform, since resources are shared and allocated and released on demand, resources allocated to a user today may be allocated to another user tomorrow. This feature is particularly evident in memory management. A certain block of memory was allocated to virtual machine a of user A yesterday. Today, user A no longer needs virtual machine a and deletes virtual machine a. Then user B created virtual machine b on the same host today.

In the above situation, user A will have a security concern: after the virtual machine a is deleted, some remaining information may remain. At this time, whether the virtual machine b created on the same host machine may be allocated To the memory in the same area as virtual machine a, whether the virtualization platform has taken corresponding measures to ensure that the memory of the virtual machine is completely cleared before being released or redistributed to other virtual machines, so as to ensure the privacy of user A's information.

Contents of the invention

The technical problem solved by the present invention is to provide a method for verifying the confidentiality of memory information of a virtualization platform, which provides support for data security verification of virtualization technology and selection of a virtualization platform.

The technical scheme that the present invention solves the problems of the technologies described above is:

Specifically include the following steps:

Step 1: Install a virtualization platform on a host machine, create a virtual machine A, the memory of virtual machine A should be large enough, try to allocate all the possible memory on the host machine;

Step 2: Log in to virtual machine A, and assign all the available memory in virtual machine A to the same value;

Step 3: Check the remaining memory of the virtual machine, read out the value in the memory and print and verify to ensure that the writing is successful;

Step 4: Delete virtual machine A, and create virtual machine B with the same memory size as virtual machine A on the same host;

Step 5: Log in to virtual machine B, read out the value in the memory and print it;

Step 6: Compare the memory value printed in virtual machine B with the memory value printed in virtual machine A. If the value in step 5 is consistent with the value assigned in step 2, it proves that the virtualization platform is in When the memory is released or redistributed, the information is not completely cleared. This virtualization platform has defects in the confidentiality of memory information. Otherwise, it proves that the mechanism of the virtualization platform in terms of memory information confidentiality is perfect.

The memory of the created virtual machine is large enough, which means that the memory of the virtual machine is allocated in an exclusive way, rather than the Balloon mode and other modes where the memory size of the virtual machine is variable. After the virtual machine is created, the operating system level shows that the memory is used. State, cannot be occupied by other processes;

Allocating all the possible memory on the host as much as possible refers to killing the processes on the host that have nothing to do with the operation of the virtual machine, and after creating the virtual machine, the remaining available memory of the operating system is reduced to a level less than 100 megabytes.

Assigning all the available memory in the virtual machine to the same value refers to applying for memory allocation and writing the memory as an easily identifiable value, such as 0xFFFFFFFF representing all 1 values, or 0xAAAAAAAA representing 1010 values.

The creation of virtual machine B with the same memory as virtual machine A refers to creating a virtual machine whose memory occupies the available memory of the host machine, so that the areas allocated by virtual machine B and virtual machine A completely overlap or nearly completely overlap.

The value printed in the virtual machine B has the same value consecutively, which means that the memory assigned in the virtual machine A appears in the virtual machine B, and the remaining information in these areas has not been completely cleared.

The beneficial effects of the scheme of the present invention are as follows:

1. The method of the present invention can fully prove whether a virtualization platform is credible in terms of memory information registration, and can check whether the redistributed memory has been cleared by utilizing the characteristics of overlapping areas in the memory redistribution of large memory virtual machines;

2. The method of the present invention is a universal and neutral method, without relying on any specific virtualization platform tools, and only reads and writes from the perspective of the underlying memory, which is neutral and credible.

Description of drawings

Below in conjunction with accompanying drawing, the present invention is further described:

Accompanying drawing 1 is flow chart of the present invention;

Detailed ways

As shown in accompanying drawing 1, there are multiple implementation modes of the present invention, here is to illustrate one of the implementation methods by using C pre-research to read and write memory as an example under the CentOS virtual machine, the flow chart is shown in Figure 1, and the specific implementation process as follows:

1. Create a virtual machine A to occupy the available memory of the host machine

2. Log in to virtual machine A and perform the following operations

The virtual machine memory assignment program is as follows: #This program assigns 12G of memory to 0xFFFFFFFF

Program into an executable program and execute

Can see memory usage

Shut down virtual machine A.

3. Create a virtual machine B with the same memory size as virtual machine A

4. Log in to virtual machine B and perform the following operations

The virtual machine memory output program is as follows# Output memory to standard output

5. Compare the results of the two

Virtual machine B reads all 0, while virtual machine A writes all 0xFFFFFFFF, that is, it has been verified that the memory information in virtual machine A has been cleared before reallocation. The mechanism of this virtualization platform in terms of memory information confidentiality is perfect.

Claims (5)

1. a method for verifying the confidentiality of memory information in a virtualization platform, characterized in that: specifically comprise the steps: Step 1: Install a virtualization platform on a host machine, create a virtual machine A, the memory of virtual machine A should be large enough, try to allocate all the possible memory on the host machine; Step 2: Log in to virtual machine A, and assign all the available memory in virtual machine A to the same value; Step 3: Check the remaining memory of the virtual machine, read out the value in the memory and print and verify to ensure that the writing is successful; Step 4: Delete virtual machine A, and create virtual machine B with the same memory size as virtual machine A on the same host; Step 5: Log in to virtual machine B, read out the value in the memory and print it; Step 6: Compare the memory value printed in virtual machine B with the memory value printed in virtual machine A. If the value in step 5 is consistent with the value assigned in step 2, it proves that the virtualization platform is in When the memory is released or redistributed, the information is not completely cleared. This virtualization platform has defects in the confidentiality of memory information. Otherwise, it proves that the mechanism of the virtualization platform in terms of memory information confidentiality is perfect. 2. The method for verifying the confidentiality of memory information of a virtualization platform according to claim 1, characterized in that: said created virtual machine memory is sufficiently large refers to adopting an exclusive mode to allocate virtual machine memory instead of Balloon mode In the mode where the memory size of the virtual machine is variable, after the virtual machine is created, the operating system level shows that the memory is used and cannot be occupied by other processes; Allocating all the possible memory on the host as much as possible refers to killing the processes on the host that have nothing to do with the operation of the virtual machine, and after creating the virtual machine, the remaining available memory of the operating system is reduced to a level less than 100 megabytes. 3. the method for verifying the confidentiality of virtualization platform memory information according to claim 1, characterized in that: all the available memory in the virtual machine is assigned to a same value and refers to applying for memory allocation, and the memory is written as An easily identifiable value, such as 0xFFFFFFFF for a value of all 1s, or 0xAAAAAAAA for a value of 1010. 4. the method for verifying the confidentiality of virtualization platform memory information according to claim 2, characterized in that: all the available memory in the virtual machine is assigned a same value and refers to applying for memory allocation, and the memory is written as An easily identifiable value, such as 0xFFFFFFFF for a value of all 1s, or 0xAAAAAAAA for a value of 1010. 5. The method for verifying the confidentiality of memory information of a virtualization platform according to any one of claims 1 to 4, characterized in that: creating a virtual machine B with memory as large as virtual machine A refers to creating a memory occupying A virtual machine that is full of the available memory of the host machine makes the areas of memory allocated by virtual machine B and virtual machine A completely overlap or nearly completely overlap.