近几年来，云计算已经成为了信息产业界最热门的词汇之一。同时，作为云计算关键支撑技术之一的虚拟化技术也取得了令人瞩目的发展。然而，在虚拟云计算环境下，传统安全问题仍然存在，并且危害更大。这些问题随着云计算的广泛应用呈现越来越严重的态势。其中，软件安全一直是信息安全中的一项中心议题，是很多其它安全问题的根本，因此不容小觑。软件安全通常被分为相辅相成的两个方面：一是防止软件的执行对操作系统或其它程序造成破坏，二是保护软件的执行免受来自外界环境的攻击。传统上，沙盒机制可以被用于解决软件安全问题，但它们在虚拟化环境下却呈现出一些重要缺陷：一是传统沙盒的定义只关注软件安全的第一方面，而忽略了第二方面；二是已有沙盒机制在设计、实现上存在缺陷，容易被攻击者绕过甚至利用；三是运行于操作系统内的沙盒在虚拟云计算环境中部署和适用时存在困难。

In recent years, cloud computing has become one of the most heated terms in the information industry. Meanwhile, as a key supportive technique of cloud computing, virtualization technology has achieved incredible development. However, legacy security issues still exist in virtual cloud computing environment and become more harmful, and the wide adoption of cloud computing renders these problems increasingly serious. Among them, software security has always been a central topic that underlies many other security problems and deserves great attention. Software security can usually be divided into two complementary aspects: the first is to prevent software execution from causing damage to operating systems or other applications, while the second is to protect the execution of software against attacks from the external environment. Conventionally, sandbox mechanisms can be used to resolve software security issues. However, they suffer from several notable deficiencies under the virtualized environment: firstly, the definition of conventional sandbox only pays attention to the first aspect of software security, and ignores the second aspect; secondly, existing sandbox mechanisms could be bypassed or even exploited by attackers due to some flaws in their design and implementation; finally, it is inherently difficult to deploy and adapt sandboxes that run inside the operating systems for virtual cloud computing environment. Therefore, it is an urgent task to resolve software security issues under virtualized environment.