Method and system for protecting data structure in Linux kernel initialization based on TPM (Trusted Platform Module)

Abstract

The invention provides a method and system for protecting a data structure in Linux kernel initialization based on a TPM (Trusted Platform Module). A mirror image main body of a Linux kernel, and a kernel page table, a GDT (Globe Descriptor Table) and an IDT (Interrupt Descriptor Table) (containing a system calling table) which are loaded during the process of the Linux kernel initialization are subjected to protecting operations based on the TPM, such as trusted verification, trusted data binding, trusted digital signature, and the like, so that the common opportunities of loading the Linux kernel during the initialization process by RootKit are avoided, the method is very suitable for the trusted initialization of the Linux kernel and the trusted initialization of a virtual machine under a present cloud computing environment, the method has an important practical significance in constructing a trusted cloud platform, and the market prospect and the application value are excellent.

Description

technical field [0001] The invention relates to a trusted operating system kernel, in particular to a data structure protection method and system in TPM-based Linux kernel initialization. Background technique [0002] In the cloud computing mode, the Linux operating system provides users with a large number of services on the customer service side in the form of images, but at the same time, the key data structures of the Linux kernel itself are attacked by malicious RootKits more than ever before, and these RootKit It is concealed, persistent, and simple, so it will be more difficult to check and completely remove these RootKits. [0003] In order for the Linux operating system to work normally, the Linux kernel must track thousands of objects. These objects themselves are intricately intertwined with data structures such as queues, linked lists, and trees. There are a large number of tables that store some fixed attributes of these objects. Therefore, for RootKit attacker...

AI Technical Summary

Problems solved by technology

The disadvantages of these detection tools are poor real-time performance and the large amount of code in the tool itself. Malicious code injection or dynamic data structure modification at runtime cannot be detected in time, and all detection is based on software, which is not conducive to preventing replay attacks.

Images