CSR: Small: Detecting Flaws in Virtual Devices by Conformance Checking

越来越多的大规模计算活动，包括关键的企业、金融和公共服务，正在向云计算过渡。云计算基于虚拟机技术，虚拟机技术强制在云服务提供商的客户机之间进行分离。对云计算服务的信任取决于虚拟机实现的安全性，而虚拟设备是虚拟机实现的构建块。本项目设计的软件工具可以在虚拟机平台内自动检测虚拟设备实现中的缺陷。物理设备的不可访问状态在虚拟设备代码的符号执行中表示为符号值，允许在对每个设备进行一组测试事件后对虚拟设备和物理设备状态进行比较，而不需要干扰物理设备状态的测量。本项目通过检测虚拟设备中隐藏的缺陷和漏洞，降低威胁虚拟机和云服务安全的潜在攻击风险。作为开源软件工具的发布允许其他研究人员和实践者在结果的基础上进行构建。此外，该项目还将研究与教育和外展活动结合起来，包括开设一门关于虚拟环境中故障排除的新课程，从代表性不足的群体中招募学生参与者，以及参加与信息技术和安全有关的社区组织。

Increasingly, all large-scale computing activities, including critical enterprise, financial, and public services, are being transitioned to cloud computing. Cloud computing is based on the technology of virtual machines, which enforces separation between the clients of a cloud service provider. Trust in cloud computing services depends on the security of the virtual machine implementation, of which virtual devices are building blocks. This project designs software tools that can automatically detect flaws in virtual device implementations, within a virtual machine platform. The inaccessible state of physical devices is represented as symbolic values in symbolic execution over the virtual device code, allowing for comparison of virtual and physical device states after subjecting each to a set of test events, without requiring measurements that interfere with the physical device state. By detecting hidden flaws and vulnerabilities in virtual devices, this project reduces the risk of potential attacks that threaten the security of virtual machines and cloud services. The release of software tools as open source allows other researchers and practitioners to build on the results. In addition, the project integrates the research with educational and outreach activities, including a new course on troubleshooting in virtualized environment, recruitment of student participants from underrepresented groups, and participation in community organizations related to information technology and security.