Process communication method, device, electronic device and readable storage medium

Abstract

The embodiment of the present invention provides a process communication method, device, electronic device and readable storage medium. The method includes: in response to receiving a communication request from any process, determining the requesting process and the responding process indicated by the communication request; allocating physical memory to the requesting process in a trusted execution environment built based on physical memory protection as communication memory, and refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information, after the requesting process accesses the communication memory to write communication data, refreshing the configuration information in the privileged mode physical memory protection register to the second configuration information, so that the responding process reads the communication data in the communication memory and writes the response data, and again executing the operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information, so that the requesting process reads the response data in the communication memory. Improve the security of inter-process communication.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a process communication method, device, electronic device and readable storage medium. Background Art

[0002] With the development of computer technology, users' demand for privacy protection and confidential computing is increasing, and it is necessary to isolate specific software and other processes securely. Currently, it is often necessary to isolate low-privilege processes by running processes at high privilege levels.

[0003] However, with the development of software technology, the functions of operating systems are becoming more and more abundant. The kernel code of macro-kernel operating systems represented by Linux has exploded. Due to the complexity of the operating system, its potential risks are increasing. The security mechanism that relies on the operating system for isolation cannot guarantee the security of high-security level processes, and thus cannot meet the security requirements of communication between different processes. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a process communication method, device, electronic device and readable storage medium to meet the security requirements of communication between different processes. The specific technical solution is as follows:

[0005] In a first aspect of the implementation of the present invention, a process communication method is first provided, the method is applied to a monitoring end included in a process communication system, the process communication system also includes at least two processes, the method includes:

[0006] In response to receiving a communication request from any process, determining a requesting process and a responding process indicated by the communication request;

[0007] In a trusted execution environment built based on physical memory protection, physical memory is allocated to the requesting process as communication memory, and configuration information in a privileged mode physical memory protection register is refreshed to first configuration information, where the first configuration information is used to indicate that the access right of the requesting process to the communication memory is allowed access;

[0008] After the requesting process accesses the communication memory to write the communication data, the configuration information in the privileged mode physical memory protection register is refreshed to the second configuration information, so that the responding process reads the communication data in the communication memory and writes the response data, wherein the second configuration information is used to indicate that the access right of the responding process to the communication memory is allowed to access;

[0009] The operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information is performed again, so that the requesting process reads the response data in the communication memory.

[0010] In a second aspect of the implementation of the present invention, a process communication device is further provided, the device is applied to a monitoring end included in a process communication system, the process communication system also includes at least two processes, and the device includes:

[0011] A first determining module, configured to, in response to receiving a communication request from any process, determine a requesting process and a responding process indicated by the communication request;

[0012] A first allocation module is used to allocate physical memory to the requesting process in a trusted execution environment built based on physical memory protection as communication memory, and refresh the configuration information in the privileged mode physical memory protection register to first configuration information, wherein the first configuration information is used to indicate that the access right of the requesting process to the communication memory is allowed access;

[0013] A refresh module, configured to refresh the configuration information in the privileged mode physical memory protection register to second configuration information after the requesting process accesses the communication memory to write the communication data, so that the responding process reads the communication data in the communication memory and writes the response data, wherein the second configuration information is used to indicate that the access right of the responding process to the communication memory is allowed to access;

[0014] The execution module is used to re-execute the operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information, so that the request process reads the response data in the communication memory.

[0015] In a third aspect of the present invention, there is also provided an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0016] Memory, used to store computer programs;

[0017] The processor is used to implement the method described in the first aspect when executing the program stored in the memory.

[0018] In a fourth aspect of the implementation of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the method described in the first aspect above.

[0019] In a fifth aspect of the implementation of the present invention, there is also provided a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method described in the first aspect above.

[0020] The process communication method provided by an embodiment of the present invention determines the requesting process and the responding process indicated by the communication request in response to receiving a communication request from any process; allocates physical memory to the requesting process in a trusted execution environment built based on physical memory protection as communication memory, and refreshes the configuration information in the privileged mode physical memory protection register to the first configuration information, the first configuration information being used to characterize that the access right of the requesting process to the communication memory is allowed access; after the requesting process accesses the communication memory to write communication data, refreshes the configuration information in the privileged mode physical memory protection register to the second configuration information, so that the responding process reads the communication data in the communication memory and writes the response data, the second configuration information being used to characterize that the access right of the responding process to the communication memory is allowed access; and performs the operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information again, so that the requesting process reads the response data in the communication memory. In this way, by allocating physical memory to processes that need to communicate in a trusted execution environment, a two-layer nested combination architecture based on PMP and SPMP can be implemented. Physical memory is allocated for process communication through the two-layer nested combination architecture, and the access rights to the allocated communication memory are transferred through the SPMP register during the communication process, so that at the same time, only one requesting process or responding process has access to the communication memory, avoiding unnecessary and malicious modifications to shared memory, improving the security of inter-process communication, meeting the security requirements of communication between different processes, and ensuring the orderliness of communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0022] Figure 1 A flowchart of a process communication method according to an embodiment of the present invention;

[0023] Figure 2 Schematic diagram of the structure of a process communication device in an embodiment of the present invention;

[0024] Figure 3 Schematic diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The technical solutions in the embodiments of the present invention will be described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0026] Figure 1FIG. 1 is a flowchart of a process communication method in an embodiment of the present invention. The method can be applied to a monitoring end included in a process communication system. The process communication system can also include at least two processes, such as Figure 1 As shown, the method includes:

[0027] Step 101: In response to receiving a communication request from any process, determine a requesting process and a responding process indicated by the communication request.

[0028] Step 102: Allocate physical memory for the requesting process in a trusted execution environment built based on physical memory protection as communication memory, and refresh the configuration information in the privileged mode physical memory protection register to first configuration information, wherein the first configuration information is used to characterize that the access right of the requesting process to the communication memory is allowed access.

[0029] Step 103: After the requesting process accesses the communication memory to write the communication data, the configuration information in the privileged mode physical memory protection register is refreshed to the second configuration information, so that the responding process reads the communication data in the communication memory and writes the response data, and the second configuration information is used to characterize that the access right of the responding process to the communication memory is allowed access.

[0030] Step 104: Re-execute the operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information, so that the requesting process reads the response data in the communication memory.

[0031] The process communication system in the embodiment of the present invention may adopt an open source instruction set architecture (RISC-V). The process in the embodiment of the present invention may be system software or an application, and may belong to fields with high security requirements and communication requirements such as cloud services or mobile social networks. The embodiment of the present invention does not limit the specific type of the process. Exemplarily, the embodiment of the present invention can be applied to multi-terminal communication of confidential programs in cloud scenarios. In cloud scenarios, cloud service providers provide privacy computing services to users. A single user may create several confidential computing programs (i.e., processes), and these processes may have the need to communicate with each other. A single cloud server often runs hundreds or thousands of confidential computing programs. A large number of confidential computing programs running on the entire cloud server may have the need to communicate in groups. They act as different forms of producer-consumer models (request process-response process) in groups of 2, 3 or more to communicate. Among them, the above-mentioned monitoring end can be a hardware and software device running at a higher security level, such as a security monitor.

[0032] The communication request is used to indicate communication with other processes. The request process refers to the process that sends the communication request, and the response process refers to other processes that the request process needs to communicate with. Specifically, the communication request may carry the process identifiers of the request process and the response process, and the embodiment of the present invention may determine the request process and the response process through the process identifiers in the communication request.

[0033] Among them, the above-mentioned physical memory protection (PMP) is a protection mechanism provided by RISC-V, which can build a secure area through PMP registers. The above-mentioned trusted execution environment (TEE) refers to the use of hardware and software to create a fully trusted execution environment isolated from the operating system. The physical memory can be isolated through the PMP register to build TEE. TEE uses a security monitor running at the highest privilege level to build a secure area, so that unauthorized privileged software such as operating systems, system management programs, and other untrusted applications cannot access the area. This isolation mechanism prevents any attempt to change application code or tamper with data, thereby effectively resisting external threats. Specifically, when building a trusted execution environment, a large block of continuous physical memory can be allocated to the monitoring end through a contiguous memory allocator (CMA), and a group of PMP registers can be associated with it to obtain a trusted execution environment. Furthermore, the monitoring end in the embodiment of the present invention can also manage the allocation and recovery of this continuous physical memory through a partner system.

[0034] Furthermore, the embodiment of the present invention can allocate physical memory to the requesting process in the trusted execution environment constructed based on PMP. Specifically, the size and address of the physical memory allocated to the requesting process can be determined according to the memory size of the trusted execution environment and the actual requirements of the communication request, and the embodiment of the present invention does not limit this.

[0035] Among them, privileged mode physical memory protection (S-mode Physical Memory Protection, SPMP) provides several privileged mode physical memory protection registers in each central processing unit (CPU) core to limit the memory access rights to the specified continuous physical memory range. Accordingly, the above privileged mode physical memory protection register refers to the register provided by SPMP, namely: SPMP register.

[0036] Furthermore, the embodiment of the present invention can allocate communication memory to the requesting process in the trusted execution environment (i.e., the above-mentioned continuous physical memory) constructed by the monitoring end, and the communication memory can be used as the shared memory of the communication request to transmit relevant data in the process communication. Specifically, after allocating physical memory to the requesting process, the access rights to the communication memory can be configured for the requesting process in the SPMP register to allow access. Specifically, the memory access rights to the specified continuous physical memory interval can be restricted in the SPMP register, and the embodiment of the present invention can refresh the memory address of the communication memory, the process ID (eid) of the requesting process, and the allowed access rights into the SPMP register. Specifically, the above-mentioned refresh operation refers to overwriting the original data, that is, deleting the original data in the SPMP register and writing the first configuration information. Furthermore, the above-mentioned refresh operation can be implemented by a pre-written transfer code or transfer instruction (transfer instruction).

[0037] The above-mentioned access permission refers to readable, writable and executable. Among them, readable means that the content can be read, writable means that the content can be written, and executable means that the content can be run.

[0038] Furthermore, by refreshing the configuration information in the SPMP register to the first configuration information, the ownership of the communication memory can be set to be exclusive to the requesting process, and accordingly, the requesting process can access the communication memory and write communication data according to actual communication requirements. Afterwards, the embodiment of the present invention can refresh the configuration information in the SPMP to the second configuration information, transfer the ownership of the communication memory from the requesting process to the responding process, so that the responding process can access the communication memory, read the communication data to respond, and write the response data.

[0039] Furthermore, the configuration information in the SPMP can be refreshed to the first configuration information again, thereby transferring the ownership of the communication memory from the responding process to the requesting process again, so that the requesting process reads the response data therein by accessing the communication memory. At this point, the process communication flow is completed.

[0040] The SPMP register in the above steps 102 to 104 may be an idle SPMP register selected from all SPMP registers to avoid affecting the operation or communication of other processes.

[0041] Furthermore, in the above step 103, the monitoring end of the embodiment of the present invention can also provide a calling interface for the process. After the requesting process writes the communication data to the communication memory, the requesting process can initiate a calling request to the monitoring end through the calling interface. Accordingly, when the monitoring end receives the calling request from the requesting process, it will execute the operation of refreshing the configuration information in the SPMP register to the second configuration information. The responding process writes the response data in the same way, which will not be repeated here.

[0042] Optionally, in the embodiment of the present invention, after the request process reads the response data in the communication memory, the following steps may also be included:

[0043] Step 105: Release the communication memory, and delete the configuration information in the privileged mode physical memory protection register.

[0044] The release operation can be implemented by a memory destruction instruction (e.g., a destroy instruction). Accordingly, the deletion operation refers to restoring the configuration information in the SPMP register to a default value or an initial value. This step can release the resources of the monitoring terminal and improve the resource utilization of the monitoring terminal.

[0045] To sum up, in an embodiment of the present invention, by responding to receiving a communication request from any process, the requesting process and the responding process indicated by the communication request are determined; physical memory is allocated to the requesting process in a trusted execution environment built based on physical memory protection as communication memory, and the configuration information in the privileged mode physical memory protection register is refreshed to the first configuration information, the first configuration information is used to characterize that the access right of the requesting process to the communication memory is allowed access; after the requesting process accesses the communication memory to write communication data, the configuration information in the privileged mode physical memory protection register is refreshed to the second configuration information, so that the responding process reads the communication data in the communication memory and writes the response data, the second configuration information is used to characterize that the access right of the responding process to the communication memory is allowed access; the operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information is performed again, so that the requesting process reads the response data in the communication memory. In this way, by allocating physical memory to processes that need to communicate in a trusted execution environment, a two-layer nested combination architecture based on PMP and SPMP can be implemented. Physical memory is allocated for process communication through the two-layer nested combination architecture, and the access rights to the allocated communication memory are transferred through the SPMP register during the communication process, so that at the same time, only one requesting process or responding process has access to the communication memory, avoiding unnecessary and malicious modifications to shared memory, improving the security of inter-process communication, meeting the security requirements of communication between different processes, and ensuring the orderliness of communication.

[0046] Optionally, the operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information may specifically include:

[0047] S21. Allocate a privileged mode physical memory protection register for the communication memory as a communication register, wherein the communication register includes an authority register and an address register.

[0048] S22: Refresh the first configuration information into the permission register, and refresh the memory size and the starting address of the communication memory into the address register.

[0049] Specifically, the SPMP registers usually include two types of registers, one of which is used to configure the protected memory address, which may include the memory size and starting address of the protected memory, and may be recorded as an address register. The other is used to configure the access rights of a process to the protected memory, and may be recorded as a permission register.

[0050] Accordingly, the embodiment of the present invention can select a group of idle SPMP registers including permission registers and address registers according to all SPMP registers provided by the RISC-V architecture and allocate them to the communication memory as communication registers. Furthermore, the embodiment of the present invention can refresh the first configuration information into the permission register, and refresh the memory size and starting address of the communication memory into the address register. Specifically, the permission register can contain 8 data bits, and different data bits can represent different meanings. For example, the lower 2 bits can be used to represent the controlled process identifier, and the upper 3 bits can be used to represent the access rights (for example: 000 represents the access right as inaccessible, and 111 represents the access right as allowed access). Alternatively, the lower 3 bits can also be used to represent the access rights, and the meaning of each data bit in the above-mentioned SPMP register can also be set according to actual needs, and the embodiment of the present invention does not limit this.

[0051] In the embodiment of the present invention, a privileged mode physical memory protection register is allocated to the communication memory as a communication register, and the communication register includes an authority register and an address register; the first configuration information is refreshed into the authority register, and the memory size and the starting address of the communication memory are refreshed into the address register. In this way, the access rights of the requesting process to the communication memory can be configured by writing the first configuration information and the memory size and the starting address of the communication memory into the SPMP register.

[0052] Optionally, after the above-mentioned operation of allocating physical memory to the requesting process in the trusted execution environment constructed based on physical memory protection as the communication memory, the embodiment of the present invention may further include:

[0053] S31. Send mapping instructions to the requesting process and the responding process respectively, so that the requesting process and the responding process perform memory mapping on the communication memory, so as to map the communication memory to a virtual memory based on a page table.

[0054] Specifically, after obtaining the communication memory, the embodiment of the present invention can send a mapping instruction to the request process and the response process, so that the two can map the communication memory to the virtual memory through the page table structure based on the association relationship. Among them, the above-mentioned page table refers to a special data structure, which is used to store the mapping relationship between the virtual memory and the physical memory. Specifically, since the process actually accesses the corresponding physical memory by accessing the virtual memory, the above-mentioned communication memory is the physical memory, so in the embodiment of the present invention, the request process and the response process can perform memory mapping on the communication memory, and implement address translation through the page table. Specifically, the above-mentioned memory mapping operation can be implemented by a memory mapping instruction (for example: mmap instruction). The embodiment of the present invention decouples the application memory access permission from the page table configuration permission, and the memory access operation needs to pass the page table check, PMP check and SPMP check at the same time, which effectively reduces the risk of the page table being attacked and has higher security. In addition, the present invention realizes the transfer of ownership of the shared memory by configuring the SPMP register on the monitoring end, which has higher efficiency than the shared memory remapping adopted in the related art.

[0055] In the embodiment of the present invention, the requesting process and the responding process can map the communication memory to the virtual memory based on the page table to implement the address translation operation, thereby facilitating the requesting process and the responding process to access the communication memory.

[0056] It should be noted that most of the current trusted execution environment technologies still rely solely on page tables to restrict memory access, but the page table itself is located in the memory, and it is impossible to decouple the restriction information in the page table from the memory access permissions of the memory, which poses a risk of being attacked. After the SPMP register is introduced, the embodiment of the present invention separates the permissions for memory access operations, that is, the page table is responsible for address translation, and the monitoring end controls the process memory access permissions through the SPMP register. The SPMP register is used to decouple page table control from memory access permissions, further improving the security of process communication and effectively alleviating attacks on page tables in existing trusted execution environment technologies.

[0057] Optionally, the embodiment of the present invention may further include:

[0058] S41. In response to receiving a security isolation request from any process, determine a target process indicated by the security isolation request.

[0059] S42: Use the pre-allocated privileged mode physical memory protection register as the running register, and divide the physical memory for the target process in the trusted execution environment built based on the physical memory protection as the running memory.

[0060] S43: write the address information and permission information of the running memory into the running register context, and copy the application corresponding to the target process to the running memory.

[0061] The security isolation request may be sent by any process, and may be sent by a process with higher security requirements. The security isolation request is used to request to run in a secure environment. Furthermore, the security isolation request may carry the process ID of the process sending the request, so that the embodiment of the present invention can determine the target process indicated by the security isolation request based on the process ID.

[0062] Furthermore, the embodiment of the present invention can pre-allocate SPMP registers as running registers, and allocate physical memory as running memory for the target process, and write the address information and permission information of the running memory into the running register, so that the SPMP register is associated with the physical memory. And copy the application (code) corresponding to the target process to the running memory. Among them, the address information of the running memory includes the memory size and starting address of the running memory, and the permission information is used to indicate that other processes are not allowed to access the running memory, so as to achieve secure isolation of the target process through the SPMP register. Of course, it can also be other access permissions pre-set according to isolation requirements, and the embodiment of the present invention does not limit this.

[0063] Furthermore, through the above operations, the embodiment of the present invention can nest and divide the trusted execution environment isolated by PMP using SPMP registers to realize a two-layer nested combination architecture of PMP and SPMP. Accordingly, the process running in the running memory can be called an enclave.

[0064] The embodiment of the present invention determines the target process indicated by the security isolation request in response to receiving a security isolation request from any process; uses the pre-allocated privileged mode physical memory protection register as the running register, and divides the physical memory for the target process in the trusted execution environment built based on physical memory protection as the running memory; writes the address information and permission information of the running memory into the running register context, and copies the application corresponding to the target process to the running memory. In this way, the double-layer nested combination architecture of PMP and SPMP can provide the ability to create large-scale secure enclaves, which can further adapt to the needs of confidential computing in cloud scenarios.

[0065] Optionally, the embodiment of the present invention may further include:

[0066] During the running of any target process, in response to the running request of any other target process, the address information and permission information of the running memory corresponding to the other target process are written into the running register; wherein the other target process is a target process different from the target process.

[0067] Among them, the above-mentioned other target processes refer to target processes that are isolated and protected and are different from the target process. Specifically, after the above-mentioned steps S41-S43, all processes with security isolation requirements have corresponding running memory. On this basis, when switching between processes running in a trusted execution environment, the secure switching of processes can be achieved by switching the SPMP register context.

[0068] Specifically, only when the address information and permission information of the running memory corresponding to any target process are written into the running register, can the target process realize secure isolation operation in the running memory. Therefore, during the operation of the target process, the running register stores the address information and permission information of the running memory corresponding to the target process. When a running request from other target processes is received, that is, there is a process switching requirement, it is necessary to perform a context switch on the running register, that is, write the address information and permission information of the running memory corresponding to the other target process into the running register.

[0069] It should be noted that in the relevant technologies, due to the limitations of the hardware architecture and the number of PMP hardware registers defined by the open source instruction set architecture (RISC-V), the trusted execution environment based on the PMP segment isolation mechanism has the problem of insufficient scalability of the number of enclaves, making it difficult to cope with confidential computing cloud scenarios.

[0070] The embodiment of the present invention allocates SPMP registers as running registers, and can use the running registers as the register context of the monitoring end. When the process is switched, the context switch can be performed on the SPMP registers. Furthermore, through the above-mentioned architecture and memory management, a single PMP isolated physical memory area can be used to create hundreds of enclave applications, which can break the limitation of the number of PMP registers on the number of enclaves, thereby achieving a highly scalable number of enclaves that can run on a large scale, and can cope with confidential computing cloud scenarios.

[0071] Optionally, physical memory allocation in a trusted execution environment may be implemented through a buddy system, which may manage memory efficiently.

[0072] Optionally, before switching the execution register context corresponding to the target process to the address information of the execution memory corresponding to the other target process, the method further includes:

[0073] The address information of the running memory corresponding to the target process is written into the memory of the monitoring terminal.

[0074] Specifically, in order to avoid the loss of the address information and permission information of the running memory corresponding to the currently running target process, the address information and permission information of the running memory corresponding to the target process can be stored in the monitoring end memory before the context switch is performed.

[0075] In the embodiment of the present invention, by writing the address information of the running memory corresponding to the target process into the memory of the monitoring terminal, it is possible to avoid information loss and affect the subsequent running of the target process while implementing context switching.

[0076] It should be noted that the RISC-V architecture security monitor solution in the related art cannot meet the requirements of secure and efficient communication of enclaves in large-scale operation due to the limited number of enclaves, and is limited by the number of PMPs. The number of enclaves is also limited. In some scenarios where communication is based on copying and encryption, the communication efficiency is low, or some solutions allow multiple enclaves to have ownership of shared memory at the same time, resulting in the inability to meet the security of communication between enclaves.

[0077] In the embodiment of the present invention, by introducing the SPMP register, when processes use shared memory for communication, the SPMP register can be used to associate with the process, and the configuration of the shared memory permissions can be realized through the SPMP register. The ownership transfer of the shared memory can be realized by refreshing the configuration information of the SPMP register, thereby realizing a zero-copy ownership transfer mechanism based on the SPMP extension, which can realize efficient, orderly, controllable and secure access to the shared memory between enclaves.

[0078] At the same time, the related art uses a trusted execution environment system (TEEOS) running in a higher (Superior) mode to use SPMP to create an extensible TEE program, while the embodiment of the present invention does not require the support of TEEOS and can achieve process isolation protection only through PMP and SPMP.

[0079] Among them, the above-mentioned permission configuration can be achieved by configuring page table permissions. The requesting process can have SPMP read and write permissions for shared memory by default. At any time, only one owner has read and write permissions for shared memory. The ownership of shared memory is transferred from one owner to the next owner by executing the process communication method provided by the monitoring end. Under the control of the monitoring end, disordered and malicious modifications to the shared memory are avoided, ensuring the orderliness and security of communication.

[0080] Optionally. The embodiment of the present invention can also configure the SPMP register to convert the dynamic memory requested by the enclave application at runtime into secure memory, so as to realize dynamic expansion of secure memory and more flexible dynamic allocation of secure memory. At the same time, the embodiment of the present invention can also use the monitoring end as a security monitor, as part of the trusted base in the trusted execution environment, and can further perform formal proof expansion and modification on it, and ensure simplicity in software development and design, avoid redundant code, and can further provide more powerful evidence for its security through formal verification and other methods.

[0081] Figure 2 FIG. 1 is a schematic diagram of the structure of a process communication device in an embodiment of the present invention. The device is applied to a monitoring end included in a process communication system. The process communication system also includes at least two processes, such as Figure 2 As shown, the device 20 may include:

[0082] A first determining module 201 is used to determine, in response to receiving a communication request from any process, a requesting process and a responding process indicated by the communication request;

[0083] A first allocation module 202 is used to allocate physical memory to the requesting process in a trusted execution environment built based on physical memory protection as communication memory, and refresh the configuration information in the privileged mode physical memory protection register to first configuration information, wherein the first configuration information is used to indicate that the access right of the requesting process to the communication memory is allowed access;

[0084] A refresh module 203 is used to refresh the configuration information in the privileged mode physical memory protection register to second configuration information after the requesting process accesses the communication memory to write the communication data, so that the responding process reads the communication data in the communication memory and writes the response data, wherein the second configuration information is used to indicate that the access right of the responding process to the communication memory is allowed to access;

[0085] The execution module 204 is used to re-execute the operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information, so that the request process reads the response data in the communication memory.

[0086] Optionally, the refresh module includes:

[0087] A second allocation submodule is used to allocate a privileged mode physical memory protection register for the communication memory as a communication register, wherein the communication register includes an authority register and an address register;

[0088] A refresh submodule is used to refresh the first configuration information into the permission register, and refresh the memory size and the starting address of the communication memory into the address register.

[0089] Optionally, the device further comprises:

[0090] The sending module is used to send mapping instructions to the request process and the response process respectively, so that the request process and the response process perform memory mapping on the communication memory, so as to map the communication memory into a virtual memory based on a page table.

[0091] Optionally, the device further comprises:

[0092] A second determination module, configured to, in response to receiving a security isolation request of any process, determine a target process indicated by the security isolation request;

[0093] A third allocation module is used to use the pre-allocated privileged mode physical memory protection register as the running register, and to divide the physical memory for the target process in the trusted execution environment built based on the physical memory protection as the running memory;

[0094] The first writing module is used to write the address information and permission information of the running memory into the running register, and copy the application corresponding to the target process to the running memory.

[0095] Optionally, the device further comprises:

[0096] The second writing module is used to write the address information and permission information of the running memory corresponding to any other target process into the running register in response to the running request of any other target process during the running of any target process; wherein the other target process is a target process different from the target process.

[0097] Optionally, the device further comprises:

[0098] The third writing module is used to write the address information and permission information of the running memory corresponding to the target process into the memory of the monitoring terminal.

[0099] Optionally, the device further comprises:

[0100] A release module is used to release the communication memory and delete the configuration information in the privileged mode physical memory protection register.

[0101] In summary, the process communication device provided in an embodiment of the present invention determines the requesting process and the responding process indicated by the communication request in response to receiving a communication request from any process; allocates physical memory to the requesting process in a trusted execution environment built based on physical memory protection as communication memory, and refreshes the configuration information in the privileged mode physical memory protection register to the first configuration information, wherein the first configuration information is used to characterize that the access right of the requesting process to the communication memory is allowed access; after the requesting process accesses the communication memory to write communication data, the configuration information in the privileged mode physical memory protection register is refreshed to the second configuration information, so that the responding process reads the communication data in the communication memory and writes the response data, wherein the second configuration information is used to characterize that the access right of the responding process to the communication memory is allowed access; and the operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information is performed again, so that the requesting process reads the response data in the communication memory. In this way, by allocating physical memory to processes that need to communicate in a trusted execution environment, a two-layer nested combination architecture based on PMP and SPMP can be implemented. Physical memory is allocated for process communication through the two-layer nested combination architecture, and the access rights to the allocated communication memory are transferred through the SPMP register during the communication process, so that at the same time, only one requesting process or responding process has access to the communication memory, avoiding unnecessary and malicious modifications to shared memory, improving the security of inter-process communication, meeting the security requirements of communication between different processes, and ensuring the orderliness of communication.

[0102] The embodiment of the present invention further provides an electronic device, such as Figure 3 As shown, it includes a processor 9001, a communication interface 9002, a memory 9003 and a communication bus 9004, wherein the processor 9001, the communication interface 9002, and the memory 9003 communicate with each other through the communication bus 9004.

[0103] Memory 9003, used for storing computer programs;

[0104] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0105] The communication interface is used for communication between the above terminal and other devices.

[0106] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0107] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0108] In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium stores instructions. When the instructions are executed on a computer, the computer executes the process communication method described in any one of the above embodiments.

[0109] In another embodiment of the present invention, a computer program product including instructions is provided. When the computer program product is executed on a computer, the computer executes the process communication method described in any one of the above embodiments.

[0110] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0111] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0112] It should be noted that the various data-related processes in the embodiments of the present application are all carried out in compliance with the corresponding data protection laws and policies of the country where the device is located, and with the authorization given by the owner of the corresponding device.

[0113] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0114] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A process communication method, characterized in that: The method is applied to a monitoring end included in a process communication system, wherein the process communication system also includes at least two processes, and the method includes: In response to receiving a communication request from any process, determining a requesting process and a responding process indicated by the communication request; In a trusted execution environment built based on physical memory protection, physical memory is allocated to the requesting process as communication memory, and configuration information in a privileged mode physical memory protection register is refreshed to first configuration information, where the first configuration information is used to indicate that the access right of the requesting process to the communication memory is allowed access; After the requesting process accesses the communication memory to write the communication data, the configuration information in the privileged mode physical memory protection register is refreshed to the second configuration information, so that the responding process reads the communication data in the communication memory and writes the response data, wherein the second configuration information is used to indicate that the access right of the responding process to the communication memory is allowed to access; The operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information is performed again, so that the requesting process reads the response data in the communication memory.

2. The method according to claim 1, characterized in that The step of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information includes: Allocating a privileged mode physical memory protection register for the communication memory as a communication register, wherein the communication register includes an authority register and an address register; The first configuration information is refreshed into the permission register, and the memory size and the starting address of the communication memory are refreshed into the address register.

3. The method according to claim 1, characterized in that After allocating physical memory as communication memory to the requesting process in the trusted execution environment constructed based on physical memory protection, the method further includes: A mapping instruction is sent to the requesting process and the responding process respectively, so that the requesting process and the responding process perform memory mapping on the communication memory, so as to map the communication memory into a virtual memory based on a page table.

4. The method according to claim 1, characterized in that The method further comprises: In response to receiving a security isolation request from any process, determining a target process indicated by the security isolation request; Using a pre-allocated privileged mode physical memory protection register as a running register, and dividing physical memory for the target process in a trusted execution environment built based on physical memory protection as a running memory; The address information and permission information of the running memory are written into the running register, and the application corresponding to the target process is copied to the running memory.

5. The method according to claim 4, characterized in that The method further comprises: During the running of any target process, in response to the running request of any other target process, the address information and permission information of the running memory corresponding to the other target process are written into the running register; wherein the other target process is a target process different from the target process.

6. The method according to claim 5, characterized in that Before writing the address information of the running memory corresponding to the other target process into the running register corresponding to the target process, the method further includes: The address information and permission information of the running memory corresponding to the target process are written into the memory of the monitoring terminal.

7. The method according to any one of claims 1 to 6, characterized in that: After the request process reads the response data in the communication memory, the method further includes: The communication memory is released, and the configuration information in the privileged mode physical memory protection register is deleted.

8. A process communication device, characterized in that: The device is applied to a monitoring end included in a process communication system, wherein the process communication system also includes at least two processes, and the device includes: A first determining module, configured to, in response to receiving a communication request from any process, determine a requesting process and a responding process indicated by the communication request; A first allocation module is used to allocate physical memory to the requesting process in a trusted execution environment built based on physical memory protection as communication memory, and refresh the configuration information in the privileged mode physical memory protection register to first configuration information, wherein the first configuration information is used to indicate that the access right of the requesting process to the communication memory is allowed access; A refresh module, configured to refresh the configuration information in the privileged mode physical memory protection register to second configuration information after the requesting process accesses the communication memory to write the communication data, so that the responding process reads the communication data in the communication memory and writes the response data, wherein the second configuration information is used to indicate that the access right of the responding process to the communication memory is allowed to access; The execution module is used to re-execute the operation of refreshing the configuration information in the privileged mode physical memory protection register to the first configuration information, so that the request process reads the response data in the communication memory.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 1-7 when executing a program stored in a memory.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images