Mandatory access control method and apparatus, and physical host
AssigneeHuawei Technologies Co., Ltd.
InventorBin Duan
Life of this patent
Estimating the term…
Abstract
A mandatory access control method and apparatus, and a physical host are disclosed. The method includes obtaining, by a virtual machine monitor (VMM) from at least one virtual machine, M input/output access instructions delivered by a user, where each of the M access instructions includes an access subject and an access object. According to the subject and the object of each of the M access instructions, the VMM determines N access instructions that comply with a preset mandatory access rule. The VMM accesses a physical device corresponding to the object of each of the N access instructions.
Claims16
A mandatory access control method, comprising:
- obtaining, by a virtual machine monitor (VMM) from a front-end driver of a kernel mode of at least one virtual machine by using an input/output (IO) ring, M access instructions delivered by a user, wherein each of the M access instructions comprises an access subject and an access object, and M is a positive integer;
- determining, by the VMM according to the subject and the object of each of the M access instructions, N access instructions that comply with a preset mandatory access rule, wherein the preset mandatory access rule comprises a subject security rule, an object security rule, and a security determining rule, and wherein N is a positive integer less than or equal to M;
- and
- accessing, by the VMM, a hardware layer device corresponding to the object of each of the N access instructions.
A mandatory access control apparatus, wherein the apparatus is applied to a physical host, a virtual machine runs on the physical host, and the apparatus comprises:
- at least one processor;
- and
- a non-transitory computer-readable storage medium coupled to the at least one processor and storing programming instructions for execution by the at least one processor, the programming instructions instruct the at least one processor to:
- obtain, from a front-end driver of a kernel mode of at least one virtual machine by using an input/output (IO) ring, M access instructions delivered by a user, wherein each of the M access instructions comprises an access subject and an access object, and M is a positive integer;
- determine, according to the subject and the object of each of the M access instructions, N access instructions that comply with a preset mandatory access rule, wherein the preset mandatory access rule comprises a subject security rule, an object security rule, and a security determining rule, and wherein N is a positive integer less than or equal to M;
- and
- access a hardware layer device corresponding to the object of each of the N access instructions.
A physical host, comprising a hardware layer, a virtual machine monitor (VMM) running on the hardware layer, and at least one virtual machine running on the VMM, wherein the VMM is configured to:
- obtain, from a front-end driver of a kernel mode of the at least one virtual machine by using an input/output (IO) ring, M access instructions delivered by a user, wherein each of the M access instructions comprises an access subject and an access object, and M is a positive integer;
- determine N access instructions that comply with a preset mandatory access rule, wherein the preset mandatory access rule comprises a subject security rule, an object security rule, and a security determining rule, and wherein N is a positive integer less than or equal to M;
- and
- access a hardware layer device corresponding to the object of each of the N access instructions.
Dependencies are inferred from the claim text.