Shared library isolation protection method and system based on hardware virtualization technology

Abstract

The invention discloses a shared library isolation protection method based on the hardware virtualization technology. The method includes a novel application address space model is provided, and the memory mapping relationship between an application and a shared library can be more accurately and clearly described; according to the address space model, an isolation mechanism based on the hardware virtualization technology is provided, and the shared library can be efficiently placed in the other isolated address space; an isolated address space interactive control mechanism is provided, the address space is switched when the shared library is in normal interaction with other modules, and at the same time, malicious code execution and data access behaviors occurring during the operation of the shared library are detected. Accordingly, a corresponding system is also provided. The method is suitable for safety isolation and protection of a series of standard and commercial shared libraries, and can avoid the security threats caused by application vulnerabilities to the shared libraries.

Description

technical field [0001] The invention belongs to the technical field of isolation in system security research, and more specifically relates to a shared library isolation protection method and system based on hardware virtualization technology. Background technique [0002] In modern operating systems, the dynamic link library is loaded into the address space when the program starts or runs and provides function interface services. This approach provides a dynamic and isolated approach to code reuse. Compared with the static linking method, this method is easier to use and more efficient because it does not increase the size of the binary file and is independent of the application. Modern operating systems provide mandatory memory isolation mechanisms for user space and kernel space to ensure the security of kernel code and data. However, there is no similar security mechanism in user space. All shared libraries and applications are in the same address space, and the secur...

AI Technical Summary

Problems solved by technology

[0005] In view of the above defects or improvement needs of the prior art, the present invention provides a shared library isolation and protection method and system based on hardware virtualization technology, the purpose of which is to solve the high overhead and poor versatility existing in the existing isolation method question

Images