vTCM:一种基于物理可信计算环境虚拟化的虚拟可信密码模块

虚拟机的信任问题是虚拟机安全的关键问题之一,可信密码模块作为计算机信任的源头,其在虚拟机上的应用也引起了越来越多的关注。提出了虚拟可信密码模块(virtual trusted cryptography module, vTCM)方案,该方案将现有可信密码模块(trusted cryptography module, TCM)方案扩展为可切换vTCM场景的vTCM物理环境来支持少量物理vTCM场景,通过vTCM场景的虚拟化调度,从而支持多个虚拟机的TCM访问,为每个虚拟机分配一个绑定的vTCM实例,并使这些实例可以轮流在物理vTCM场景中运行,以使vTCM的安全性分析可以借助TCM结论,增强vTCM的安全性。这一方案在vTCM的管理,包括vTCM迁移等操作上,也体现出了其优势。给出了该方案在KVM虚拟化平台下的实现方法,实现结果表明,该方案不但可行,并且对现有的虚拟机机制有良好的兼容性。     

一种支持多域访问的可信云终端设计

为了通过单台物理终端同时运行不同安全等级业务系统、多域访问不同安全等级云服务,综合利用虚拟机技术和可信计算技术,提出了一种可信云计算环境下的多域访问终端解决方案.该方案通过可信密码模块(TCM)虚拟化和信任链传递机制实现可信环境的构建,利用Hypervisor多级安全访问控制框架和多域通信管理保证多级安全云服务的隔离和多域并发访问.实验结果表明:该方案是可行和有效的,可以为多域访问提供基础平台的支撑,同时可信机制给系统带来的性能损耗相对较小,可以满足实际应用过程中的性能需求.     

不可信系统平台下的敏感信息管理系统

通用操作系统存在大量后门和漏洞等安全威胁,使得应用程序中处理的敏感信息的机密性难以得到完备的保护。该文设计并实现了敏感内存管理(sensitive memory manager,SMM)系统,在应用程序配合下对存放敏感信息的内存进行保护,阻止攻击者利用系统内核窃取敏感信息的企图。该系统基于虚拟化技术,通过为被保护进程的用户态和内核态设置不同影子页表的方式,使得应用程序能够访问的敏感信息不会被操作系统内核访问。有效性评测和性能评测表明:该系统提供的内存保护粒度更小,带来的性能损耗更小。     

一种基于KVM的vTPM虚拟机动态迁移方案

针对当前KVM平台上的带虚拟可信平台模块的vTPM虚拟机无法实现动态迁移的问题,提出并实现了一种基于KVM的vTPM虚拟机动态迁移方案。在分析KVM架构与vTPM虚拟化特征的基础上,将vTPM虚拟机的动态迁移与KVM上原生态普通虚拟机的动态迁移过程相融合,保证了迁移前后系统安全状态的一致性和迁移过程中vTPM实例数据的安全性。实验结果表明,与普通虚拟机的动态迁移相比,利用该方案实现了用户无感知的vTPM虚拟机动态迁移过程,在保证虚拟机迁移后vTPM设备可用性的基础上,迁移中平均停机时间不超过50 ms,性能损失仅为15%。     

基于自定义主体和身份的窗体验证

综合了数据库技术、面向对象设计技术、操作系统权限管理、NET框架中基于代码访问安全性和基于角色访问安全性等多方面技术,提出采用自定义主体Principal和身份Identity实现基于窗体的验证思想,构建了一个灵活方便的安全权限管理系统。该系统可以用于多数WEB系统中,作为通用的安全权限管理模块。     

企业新风

红帽发布企业虚拟化3.0方案红帽公司正式宣布红帽企业虚拟化3.0正式上市,该产品大幅扩展了其在服务器和桌面虚拟化管理工具及基于内核的虚拟机管理程序方面的实力。红帽企业虚拟化3.0实现了Linux和Windows负载下新型企业虚拟化管理特性、性能     

基于虚拟机的安全技术研究

由于虚拟机的高隔离性以及对系统、应用的透明性,使得很多安全技术是基于虚拟机实现的.提出一种基于Xen的安全架构,可将现有安全程序移植到该架构上,并保证其功能性,如文件、内存扫描以及主动防御技术.由于大量减少处于被保护虚拟机中的安全程序组件,使得安全程序本身具有更高的安全性,同时利用半虚拟化I/O技术将系统开销降低到最小,具有实用性.该框架还可将其他基于虚拟机的安全技术整合进来,且不需要修改现有的操作系统及应用程序,因此具有较强的适用性.     

一种高效虚拟化多级网络安全互联机制

面向工业控制网络环境的高安全级别信息系统网络,结合物理网闸和虚拟防火墙的思想,提出一种基于Xen共享内存的高效虚拟化多级网络安全互联机制,依照信息系统安全需求与不同的应用业务需求,企业可以使用不同安全策略的虚拟机模版,利用虚拟机间共享内存机制模拟物理网闸的专用传输介质,从而提升安全隔离性能,并能够保证较高的安全性。为网闸的发展提供了新的思路。     

基于虚拟化的不可信模块运行监控

为了监控内核模块rootkit的行为,提出一种基于硬件辅助虚拟化的虚拟机内核模块隔离框架,采用两套硬件辅助页表技术实现不可信模块与内核的隔离运行,并使用一种基于栈帧基地址链的方法保护内核堆栈的完整性.在KVM(基于内核的虚拟机)全虚拟化环境下实现了虚拟机内核模块隔离运行的原型系统Hyper-ISO(超级隔离).实验结果表明:Hyper-ISO可以实时监控不可信模块与内核之间的控制转移过程、不可信模块对内核代码与数据的访问序列,并保护内核堆栈在模块运行期间不被模块恶意修改.     

红帽发布企业虚拟化3.0方案

红帽公司正式宣布红帽企业虚拟化3．0正式上市,该产品大幅扩展了其在服务器和桌面虚拟化管理工具及基于内核的虚拟机管理程序方面的实力。红帽企业虚拟化3．0实现了Linux和Windows负载下新型企业虚拟化管理特性、性能和扩展能力方面的平衡,而且成本远低于专有替代方案。     

Markedness and its Interpretation in Language Use

Language markedness is a common phenomenon in languages, and is reflected from hearing, vision and sense, i.e. the variation in the three aspects such as phonology, morphology and semantics. This paper focuses on the interpretation of markedness in language use following the three perspectives, i.e. pragmatic interpretation, psychological interpretation and cognitive interpretation, with an aim to define the function of markedness.     

Features of Women's language

Language is a means of verbal communication. People use language to communicate with each other. In the society, no two speakers are exactly alike in the way of speaking. Some differences are due to age, gender, statue and personality. Above all, gender is one of the obvious reasons. The writer of this paper tries to describe the features of women＇s language from these perspectives： pronunciation, intonation, diction, subjects, grammar and discourse. From the discussion of the features of women＇s language, more attention should be paid to language use in social context. What＇s more, the linguistic phenomena in a speaking community can be understood more thoroughly.     

An Analysis of Catherine＇s Character——Wuthering Heights

Wuthering Heights, Emily Bronte＇s only novel, was published in December of 1847 under the pseudonym Ellis Bell. The book did not gain immediate success, but it is now thought one of the finest novels in the English language. Catherine is the key character of this masterpiece, because everybody and everything center on her though she had a short life. We can understand this masterpiece better if we know Catherine well.     

Lower Paleozoic oil relationships within Williston Basin, Canada

The Williston Basin is a significant petroleum province, containing oil production zones that include the Middle Cambrian to Lower Ordovician, Upper Ordovician, Middle Devonian, Upper Devonian and Mississippian and within the Jurassic and Cretaceous. The oils of the Williston Basin exhibit a wide range of geochemical characteristics defined as "oil families", although the geochemical signature of the Cambrian Deadwood Formation and Lower Ordovician Winnipeg reservoired oils does not match any "oil family". Despite their close stratigraphic proximity, it is evident that the oils of the Lower Palaeozoic within the Williston Basin are distinct. This suggests the presence of a new "oil family" within the Williston Basin. Diagnostic geochemical signatures occur in the gasoline range chromatograms, within saturate fraction gas chromatograms and biomarker fingerprints. However, some of the established criteria and cross-plots that are currently used to segregate oils into distinct genetic families within the basin do not always meet with success, particularly when applied to the Lower Palaeozoic oils of the Deadwood and Winnipeg Formation.     

低渗透非均质砂岩油藏启动压力梯度研究

理论推导与室内实验相结合,建立了低渗透非均质砂岩油藏启动压力梯度确定方法。首先借助油藏流场与电场相似的原理,推导了非均质砂岩油藏启动压力梯度计算公式。其次基于稳定流实验方法,建立了非均质砂岩油藏启动压力梯度测试方法。结果表明:低渗透非均质砂岩油藏的启动压力梯度确定遵循两个等效原则。平面非均质油藏的启动压力梯度等于各级渗透率段的启动压力梯度关于长度的加权平均;纵向非均质油藏的启动压力梯度等于各渗透率层的启动压力梯度关于渗透率与渗流面积乘积的加权平均。研究成果可用于有效指导低渗透非均质砂岩油藏的合理井距确定,促进该类油藏的高效开发。     

On Tragic Consciousness In The Works By Ernest Hemingway

As an American modern novelist who were famous in the literary world, Hemingway was not a person who always followed the trend but a sharp observer. At the same time, he was a tragedy maestro, he paid great attention on existence, fate and end-result. The dramatis personae's tragedy of his works was an extreme limit by all means tragedy on the meaning of fearless challenge that failed. The beauty of tragedy was not produced on the destruction of life, but now this kind of value was in the impact activity. They performed for the reader about the tragedy on challenging for the limit and the death.     

Design and analysis of generic LBS application developing platform

Location based services is promising due to its novel working style and contents.A software platform is proposed to provide application programs of typical location based services and support new applications developing efficiently. The analysis shows that this scheme is easy implemented, low cost and adapt to all kinds of mobile nework system.     

Achieving Unusual States of Matter Under High Pressure

正The periodicity of the elements and the non-reactivity of the inner-shell electrons are two related principles of chemistry,rooted in the atomic shell structure.Within compounds,Group I elements,for example,invariably assume the+1 oxidation state,and their chemical properties differ completely from those of the p-block elements.These general rules govern our understanding of chemical structures and reactions.Using first principles calcula-     

Exchange-Correlation and Electronic Excitation Energies from Pairing Matrix Fluctuations

We have developed an adiabatic connection to formulate the ground-state exchange-correlation energy in terms of pairing matrix linear fluctuations.This formulation of the exchange-correlation energy opens a new channel for density functional approximations based on the many-body perturbation theory.We illustrate the potential of such approaches with an approximation based on the particle-particle Random Phase Approximation(pp-RPA).This re-     

Density Functional Theory for the Response of Periodic Systems to Electric Fields Based on the Vector Potential Approach

正The electronic and nuclear(structural/vibrational)response of 1D-3D nanoscale systems to electric fields gives rise to a host of optical,mechanical,spectral,etc.properties that are of high theoretical and applied interest.Due to the computational difficulty of treating such large systems it is convenient to model them as infinite and periodic(at least,in first approximation).The fundamental theoretical/computational problem in doing so is that