Abstract: This paper presents XHydra, a Xen-based virtual machine (VM) security architecture, which focuses on the problems of Xen??s administrative VM with bloated services and a large aggregate TCB (trusted computing base). XHydra separates Dom0 into single-purpose mini-service domains with least privilege and isolated runtime environment, based on the modularity and isolated principles used in micro-kernels. And, this architecture manages the separated mini-service domains and bi-directional shields between DomU and mini-service domains, and bridges the device channel, the device communication between DomU and mini-service domain is supported through an ingenious service monitor called Hydravisor. Finally, this paper gives a prototype XHydra based on Xen4.4, which improves the security of virtualization platform and proves that XHydra is a feasible architecture. Experiments show that, for the benchmark tests about disk performance and network performance of the prototype system, the proposed approach just incurs about 3% performance overhead compared to Xen.

Key words: Xen, security virtual machine, least privilege, service separation, Dom0 virtualization, XHydra

摘要： 针对开源虚拟化平台Xen的管理虚拟机Dom0服务臃肿和可信计算基庞大等问题，提出了一种基于Xen的安全虚拟机架构XHydra。该架构采用微内核的设计思想和最小特权安全理论，将Dom0分离成多个功能独立、相互隔离且具有最小特权的迷你服务域，并设计了一个服务监视器进行管理。服务监视器通过构建用户虚拟机与迷你服务域之间设备通信的专用通道，实现用户虚拟机和迷你服务域之间的双向隔离。最后基于Xen4.4开发了XHydra的原型系统，提高了平台的安全性，验证了架构的可行性。同时，针对虚拟化平台的存储性能和网络性能进行基准测试，实验结果表明所提方案性能相对于原始Xen仅降低了3%。

关键词: Xen, 安全虚拟机, 最小特权, 服务分离, Dom0虚拟化, XHydra