The Hypervisor-based Protection Mechanism for VMWare Virtualization Platform

[[abstract]]近年來在雲端技術蓬勃發展下，為了配合大量運算及機房節能環保的需求，伺服器虛擬化解決方案因此大行其道，但因伺服器虛擬化技術之導入，整體虛擬化系統之建構與網路架構也因此與傳統伺服器之佈署架構產生很大的差異，例如：虛擬化架構中實體伺服器之CPU 記憶體及網路卡等設備可以邏輯單位方式切割資源給虛擬機器來使用，伺服器虛擬化雖然提升了營運與成本上的效益，但同時也在整體系統資源之運用及網路架構上產生了風險。 虛擬化技術產生了虛擬交換器（Virtual Switch）的概念 虛擬交換器是由虛擬平台所模擬並架構於虛擬伺服器之Hypervisor核心層用以傳送虛擬機器間的網路流量。另外這也說明了如果在虛擬平台中還以傳統架構佈署端點防護軟體將會造成實體伺服器運作之負擔及資源大量負荷。在虛擬交換器中的封包資料是不透明的，無法監看及控管，也因此造成資訊安全上的漏洞，並造成系統運作效能上的問題，有鑑於此，虛擬伺服器平台提供商提出了VMsafe API技術，使得第三方資訊安全防護廠商可以開發資安系統與之介接，本論文探討以架構虛擬伺服器之核心層資訊安全解決方案，並說明以此架構在整體虛擬化架構中的資訊安全作法是最切合需求的，系統經實作證明並與傳統資安佈署架構比較後，確實能達成預期的目標。[[abstract]]Virtualization technology has brought a virtual switch (Virtual Switch) concept a virtual switch is constructed by the virtual system simulation and virtual servers in order to pass the Hypervisor core layer network traffic between virtual machines In addition，it also shows if the virtual platform to deploy traditional endpoint protection software architecture will result in the physical hardware and resources of a large burden on the operation of the load In the virtual switch in the packet data is opaque you can not monitor and control and thus resulting in information security vulnerabilities and performance issues caused by operation of the system this virtual server platform provider released the VMsafe API technology that enables third-party vendors can develop information security information security systems interfacing with the core layer This paper discusses the virtual server's core architecture-level information security solutions and explain how this architecture in the overall virtualization architecture is the most suitable information security practices demand the system has been implemented and proven architecture with the traditional department-owned Ambrose for comparison it is indeed able to reach the desired goa