Nothing Special   »   [go: up one dir, main page]

CN110383256A - 一种内核完整性保护方法及装置 - Google Patents

一种内核完整性保护方法及装置 Download PDF

Info

Publication number
CN110383256A
CN110383256A CN201880016634.2A CN201880016634A CN110383256A CN 110383256 A CN110383256 A CN 110383256A CN 201880016634 A CN201880016634 A CN 201880016634A CN 110383256 A CN110383256 A CN 110383256A
Authority
CN
China
Prior art keywords
memory
running space
processing module
space
running
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201880016634.2A
Other languages
English (en)
Other versions
CN110383256B (zh
Inventor
肖福洲
尹友展
夏登洲
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from PCT/CN2018/075086 external-priority patent/WO2019148447A1/zh
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Publication of CN110383256A publication Critical patent/CN110383256A/zh
Application granted granted Critical
Publication of CN110383256B publication Critical patent/CN110383256B/zh
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1416—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights
    • G06F12/1425—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being physical, e.g. cell, word, block
    • G06F12/1441—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being physical, e.g. cell, word, block for a range
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1458—Protection against unauthorised use of memory or access to memory by checking the subject access rights
    • G06F12/1491—Protection against unauthorised use of memory or access to memory by checking the subject access rights in a hierarchical protection system, e.g. privilege levels, memory rings
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1416—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6281—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database at program execution time, where the protection is within the operating system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/10—Providing a specific technical effect
    • G06F2212/1052—Security improvement
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/15—Use in a specific computing environment
    • G06F2212/152—Virtualized environment, e.g. logically partitioned system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/65—Details of virtual memory and virtual address translation
    • G06F2212/651—Multi-level translation tables

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Mathematical Physics (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

本发明实施例涉及一种内核完整性保护方法及装置，该方法包括：第一运行空间中运行的第一处理模块向第二运行空间中运行的第二处理模块发送请求消息，所述请求消息用于请求进行内存访问，所述内存访问涉及对预设寄存器的访问和/或对预设内存空间的访问；第二运行空间中运行的第二处理模块响应于所述请求消息，获取所述内存访问对应的事件的信息，并将所述信息发送给所述第一运行空间中运行的第一处理模块；所述第一运行空间中运行的第一处理模块根据所述信息对所述事件进行处理，从而能够做到动态对内核完整性实施度量，进而实现实时的入侵终止。

Description

PCT国内申请，说明书已公开。

Claims (18)

  1. PCT国内申请，权利要求书已公开。
CN201880016634.2A 2018-02-02 2018-11-26 一种内核完整性保护方法及装置 Active CN110383256B (zh)

Applications Claiming Priority (5)

Application Number Priority Date Filing Date Title
CNPCT/CN2018/075086 2018-02-02
PCT/CN2018/075086 WO2019148447A1 (zh) 2018-02-02 2018-02-02 数据保护方法和数据保护装置
CN201810173059 2018-03-02
CN2018101730599 2018-03-02
PCT/CN2018/117500 WO2019148948A1 (zh) 2018-02-02 2018-11-26 一种内核完整性保护方法及装置

Publications (2)

Publication Number Publication Date
CN110383256A true CN110383256A (zh) 2019-10-25
CN110383256B CN110383256B (zh) 2022-01-14

Family

ID=67478570

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201880016634.2A Active CN110383256B (zh) 2018-02-02 2018-11-26 一种内核完整性保护方法及装置

Country Status (4)

Country Link
US (1) US12032494B2 (zh)
EP (1) EP3726390B1 (zh)
CN (1) CN110383256B (zh)
WO (1) WO2019148948A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113486356A (zh) * 2021-06-30 2021-10-08 佛山职业技术学院 一种控制中断源的运行方法、装置、终端设备及存储介质
CN113536387A (zh) * 2020-04-15 2021-10-22 青岛海信移动通信技术股份有限公司 一种检测内核数据完整性的终端和方法
WO2022105610A1 (zh) * 2020-11-20 2022-05-27 华为技术有限公司 一种数据保护的方法、装置、存储介质和计算机设备
CN117009108A (zh) * 2023-02-24 2023-11-07 荣耀终端有限公司 消息处理方法、设备及存储介质
WO2024027356A1 (zh) * 2022-07-30 2024-02-08 华为技术有限公司 电子装置和安全访问软件的方法

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112541166B (zh) 2019-09-20 2024-09-06 杭州中天微系统有限公司 一种方法、系统和计算机可读存储介质
CN112347468A (zh) * 2020-11-05 2021-02-09 中国电子信息产业集团有限公司 内存数据更新方法、装置、设备及存储介质
CN116635855A (zh) * 2020-12-20 2023-08-22 华为技术有限公司 基于执行上下文管理可执行代码对数据内存的访问的装置和方法
KR102526681B1 (ko) * 2021-07-13 2023-05-02 한국전자통신연구원 가상 머신 보안 위협 방지 장치 및 방법
US20240220666A1 (en) * 2022-12-30 2024-07-04 Intel Corporation Hardware access control at software domain granularity

Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120054544A1 (en) * 2010-08-24 2012-03-01 International Business Machines Corporation Non-Disruptive Hardware Change
CN102667722A (zh) * 2009-10-21 2012-09-12 Arm有限公司 数据处理系统中的硬件资源管理
CN103140837A (zh) * 2010-09-24 2013-06-05 Arm有限公司 数据处理装置的除错
CN103765380A (zh) * 2011-07-01 2014-04-30 英特尔公司 用于事件的安全排队的方法和系统
US20140359749A1 (en) * 2013-05-31 2014-12-04 Catbird Networks, Inc. Systems and methods for dynamic network security control and configuration
CN104956342A (zh) * 2013-02-05 2015-09-30 Arm有限公司 使用存储器保护单元来支持客户操作系统的虚拟化
CN105453029A (zh) * 2013-08-23 2016-03-30 Arm有限公司 处理用于数据存取的存取属性
CN107111511A (zh) * 2016-03-25 2017-08-29 深圳前海达闼云端智能科技有限公司 访问控制的方法、装置和系统
CN107111715A (zh) * 2014-12-16 2017-08-29 英特尔公司 将可信执行环境用于代码和数据的安全性
CN107211019A (zh) * 2015-02-20 2017-09-26 英特尔公司 用于基于自动检测安全环境来处理数据的方法和装置
US20170286335A1 (en) * 2016-04-04 2017-10-05 Qualcomm Incorporated Interconnect Distributed Virtual Memory Message Preemptive Responding

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8276201B2 (en) * 2007-03-22 2012-09-25 International Business Machines Corporation Integrity protection in data processing systems
CN101788958A (zh) 2010-02-04 2010-07-28 杭州晟元芯片技术有限公司 一种存储器数据保护的方法
CN202694329U (zh) 2012-02-24 2013-01-23 深圳市江波龙电子有限公司 一种无线存储设备
US9195518B1 (en) 2012-03-27 2015-11-24 Vmware, Inc. System and method for communicating production virtual machine access events to a service appliance in a virtualized environment
CN102750202B (zh) 2012-06-06 2015-07-08 宇龙计算机通信科技(深圳)有限公司 数据保护方法和装置
JP6322967B2 (ja) 2013-11-19 2018-05-16 日本電気株式会社 データ保護装置、方法、および、プログラム
CN103699498B (zh) 2013-11-25 2016-08-31 南京大学 一种应用程序关键数据保护系统及其保护方法
US9823869B2 (en) * 2014-01-08 2017-11-21 Nvidia Corporation System and method of protecting data in dynamically-allocated regions of memory
US10922402B2 (en) * 2014-09-29 2021-02-16 Vmware, Inc. Securing secret data embedded in code against compromised interrupt and exception handlers
CN105787360B (zh) 2016-03-02 2019-01-04 杭州字节信息技术有限公司 一种嵌入式系统内存安全访问控制的技术实现方法
US11379385B2 (en) * 2016-04-16 2022-07-05 Vmware, Inc. Techniques for protecting memory pages of a virtual computing instance
US10824572B2 (en) * 2016-09-09 2020-11-03 Cylance Inc. Memory space protection

Patent Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102667722A (zh) * 2009-10-21 2012-09-12 Arm有限公司 数据处理系统中的硬件资源管理
US20120054544A1 (en) * 2010-08-24 2012-03-01 International Business Machines Corporation Non-Disruptive Hardware Change
CN103140837A (zh) * 2010-09-24 2013-06-05 Arm有限公司 数据处理装置的除错
CN103765380A (zh) * 2011-07-01 2014-04-30 英特尔公司 用于事件的安全排队的方法和系统
CN104956342A (zh) * 2013-02-05 2015-09-30 Arm有限公司 使用存储器保护单元来支持客户操作系统的虚拟化
US20140359749A1 (en) * 2013-05-31 2014-12-04 Catbird Networks, Inc. Systems and methods for dynamic network security control and configuration
CN105453029A (zh) * 2013-08-23 2016-03-30 Arm有限公司 处理用于数据存取的存取属性
CN107111715A (zh) * 2014-12-16 2017-08-29 英特尔公司 将可信执行环境用于代码和数据的安全性
CN107211019A (zh) * 2015-02-20 2017-09-26 英特尔公司 用于基于自动检测安全环境来处理数据的方法和装置
CN107111511A (zh) * 2016-03-25 2017-08-29 深圳前海达闼云端智能科技有限公司 访问控制的方法、装置和系统
US20170286335A1 (en) * 2016-04-04 2017-10-05 Qualcomm Incorporated Interconnect Distributed Virtual Memory Message Preemptive Responding

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113536387A (zh) * 2020-04-15 2021-10-22 青岛海信移动通信技术股份有限公司 一种检测内核数据完整性的终端和方法
CN113536387B (zh) * 2020-04-15 2024-06-04 青岛海信移动通信技术有限公司 一种检测内核数据完整性的终端和方法
WO2022105610A1 (zh) * 2020-11-20 2022-05-27 华为技术有限公司 一种数据保护的方法、装置、存储介质和计算机设备
CN113486356A (zh) * 2021-06-30 2021-10-08 佛山职业技术学院 一种控制中断源的运行方法、装置、终端设备及存储介质
CN113486356B (zh) * 2021-06-30 2024-05-07 佛山职业技术学院 一种控制中断源的运行方法、装置、终端设备及存储介质
WO2024027356A1 (zh) * 2022-07-30 2024-02-08 华为技术有限公司 电子装置和安全访问软件的方法
CN117009108A (zh) * 2023-02-24 2023-11-07 荣耀终端有限公司 消息处理方法、设备及存储介质

Also Published As

Publication number Publication date
CN110383256B (zh) 2022-01-14
EP3726390A4 (en) 2021-02-17
EP3726390B1 (en) 2024-04-24
US20210049112A1 (en) 2021-02-18
US12032494B2 (en) 2024-07-09
WO2019148948A1 (zh) 2019-08-08
EP3726390A1 (en) 2020-10-21

Similar Documents

Publication Publication Date Title
CN110383256A (zh) 一种内核完整性保护方法及装置
US10528726B1 (en) Microvisor-based malware detection appliance architecture
KR101946982B1 (ko) 가상 머신에서 멀웨어 탐지를 위한 프로세스 평가
CA3006003C (en) Dual memory introspection for securing multiple network endpoints
US10216927B1 (en) System and method for protecting memory pages associated with a process using a virtualization layer
US9424430B2 (en) Method and system for defending security application in a user's computer
US10726127B1 (en) System and method for protecting a software component running in a virtual machine through virtual interrupts by the virtualization layer
US9507935B2 (en) Exploit detection system with threat-aware microvisor
US8458791B2 (en) Hardware-implemented hypervisor for root-of-trust monitoring and control of computer system
US11522904B2 (en) Self-healing architecture for resilient computing services
CN107977573B (zh) 用于安全的盘访问控制的方法和系统
US20160191550A1 (en) Microvisor-based malware detection endpoint architecture
US20140053272A1 (en) Multilevel Introspection of Nested Virtual Machines
EP3287932B1 (en) Data protection method and device
US9183391B2 (en) Managing device driver cross ring accesses
US20230289204A1 (en) Zero Trust Endpoint Device
US11893107B2 (en) Apparatus and method for preventing security threat to virtual machine
CN106909838A (zh) 一种拦截系统调用的方法及装置
WO2019148447A1 (zh) 数据保护方法和数据保护装置
US20220171833A1 (en) Device Protection Using Configuration Lockdown Mode
CN118395415A (zh) 一种增强移动设备操作系统虚拟内核安全的方法

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant