A kernel data access control method and system

Abstract

The invention discloses a kernel data access control method and system. The method comprises the following steps of: 1) establishing a protection list which is used for recording an address area for protecting kernel data, and establishing a module list which is used for recording credible kernel modules; 2) storing an access interval corresponding to a code section which is allowed to modify to-be-protected kernel data to a core method module, wherein the address interval corresponding to the code section is called as a credible code area; 3) judging whether a received instruction is legal or not by the core method module, when a data address operated by the instruction is an address in the protection list, if the instruction is sent by a module in the module list and an address of the instruction belongs to the credible code area, considering that the instruction is legal, and otherwise, considering that the instruction is illegal; and 4) determining whether to execute the instruction or not by an exception handling module according to the judging result of the core method module: if the instruction is legal, allowing to execute the instruction, and otherwise, stopping executing the instruction. According to the method, the safety and reliability of operation systems can be improved.

Description

technical field [0001] The invention relates to a kernel data access control method and system, in particular to a module whitelist-based kernel data access control method and system, belonging to the field of computer operating system security. Background technique [0002] With the development of hacking technology, the Trojan horse has caused a huge threat to the security of the operating system. With the help of DKOM attack, the Trojan horse can delete the specified process or module structure from the process list or module list, so as to achieve the purpose of hiding malicious processes or modules. In other types of DKOM attacks, the Trojan horse modifies the system call table or interrupt descriptor table, and replaces the address of the normal system call service program or interrupt service program with a malicious function address. Trojans can also elevate the privileges of malicious processes by replacing the process's user credentials with those of the superuser...

AI Technical Summary

Problems solved by technology

[0004] The Sentry architecture protects kernel data through the designed access control method, but if the Trojan horse is a Loadablekernel module (LKM) type Trojan horse (LKM Trojan horse is the most common type of Trojan horse), and the attack code is placed in the LKM initialization code segment (that is, the module initialization function), Sentry cannot detect

Images