基于Xen虚拟技术的内核完整性保护方法

运用Xen虚拟技术，提出了新的内核完整性的保护方法。新方法在Xen内核中增加引用监控模块，同时对内核整体做校验，并保存该校验值。当内核启动时，会对内核重新做校验值，看该值是否与存储的校验值匹配；当内核运行时，对某些资源的修改必须经过引用监控模块的验证。两者相结合，从而达到阻止恶意代码修改内核的目的。与传统的防御恶意代码的方法相比，传统方法只能检测出内核完整性已被破坏，不能阻止恶意代码对内核的修改。

A new approach of kernel integrity protection based on Xen

Based on the concept of the Xen virtual machine a new approach of protecting the kernel integrity is proposed.It is importing the monitor module into the Xen kernel.This algorithm verifies the whole kernel,saves its checksum values and makes sure the checksum match with the stored value when the kernel is started up.Before the kernel makes resources modification as a client operating system the verification by the monitor module is necessary to prohibit the malicious code to modify the kernel of the encrypt...