An RT-Thread Security Protection Method Based on PMP

Abstract

The present invention discloses an RT-Thread security protection method based on PMP. First, the RT-Thread reconstructs the thread management and context switching modules to achieve hierarchical isolation between the machine mode and the user mode and adapt to the security architecture of RISC-V. Secondly, the adapted RT-Thread system divides the memory hierarchy and sets permissions, and based on the divided memory hierarchy, creates a data structure to manage the memory area. Then, based on the divided memory hierarchy and data structure, security memory application, access, and authentication policies are designed. Finally, based on the security memory application, access, and authentication policies, a thread dynamic permission configuration and nested isolation policy are designed to complete the security protection of RT-Thread. The present invention realizes multi-level security protection for the memory area, lightweight realizes the security policy, can achieve finer-grained security protection, and enhances the system security.

Description

Technical Field

[0001] The present invention belongs to the field of embedded real-time operating system security technology, and specifically relates to an RT-Thread security protection method based on the RISC-V architecture physical memory protection (PMP) mechanism. Background Art

[0002] RISC-V is an open-source instruction set architecture (ISA) based on the Reduced Instruction Set Design (RISC) principle. Due to its modularity, flexibility, and openness, it has been widely adopted in applications such as embedded devices, the Internet of Things (IoT), and industrial control. To support system memory access permission management, RISC-V has designed three privileged modes: machine mode (M), supervisor mode (S), and user mode (U). Machine mode has the highest privileges, allowing access to all system resources and configuration of hardware registers, while user mode has the lowest privileges and is typically used to run untrusted user applications to achieve basic memory isolation and access control.

[0003] To further ensure the security of memory access and prevent untrusted applications from illegally accessing protected memory areas, RISC-V provides a physical memory protection (PMP) mechanism. PMP relies on a set of dedicated registers to configure memory area access permissions, thereby achieving memory access isolation. PMP configuration involves two types of registers: configuration registers (pmpcfg) and address registers (pmpaddr). Configuration registers store memory access permission information, including read, write, and execute permissions, address matching methods (such as NAPOT address mode), and lock bits. The purpose of the lock bit is to prevent table entries from being tampered with or to escalate privileges when switching to privileged mode. The address register is used to specify the starting address and address range of the protected memory area, thereby achieving precise memory area division and permission control.

[0004] Each PMP consists of a configuration register and an address register, defining a memory region and its access permissions. However, RISC-V hardware implementations typically support only a limited number of PMPs (typically 4 to 16), limiting the system's ability to configure complex memory isolation. This is particularly true in embedded multitasking environments, where multiple applications or threads require dynamic allocation of memory regions and configuration of access permissions. The limited number of PMPs results in insufficient memory protection flexibility and can even degrade system performance due to frequent switching of memory entry configurations.

[0005] RT-Thread is a lightweight and modular real-time operating system, widely used in resource-constrained embedded systems. It supports core functions such as multi-thread scheduling, dynamic memory management, file system, device drivers, etc. In complex embedded applications, the system usually needs to allocate independent memory areas for different threads or applications to ensure that they cannot access other threads or memory resources beyond the authorized scope. Therefore, how to use the RISC-V PMP mechanism to achieve efficient memory protection isolation in RT-Thread has become an important technical issue for improving system security. Summary of the Invention

[0006] In view of the memory security requirements of embedded systems based on the RISC-V architecture in a multi-task environment, the present invention proposes a memory protection method based on the RT-Thread real-time operating system. For the RT-Thread real-time operating system, by dynamically configuring the PMP register set, fine-grained memory area division, and access permission control policies, physical memory isolation between tasks and dynamic protection of key system resources are achieved, which can be applied to the security protection of sensitive data and programs in Internet of Things devices and highly reliable embedded systems.

[0007] The method includes:

[0008] S1. RT-Thread adapts to the RISC-V security architecture.

[0009] Native RT-Thread runs in the machine mode of RISC-V by default, and the user mode is not enabled. To support the RISC-V multi-privilege-level security architecture and implement subsequent security management mechanisms, it is necessary to reconstruct modules such as thread management and context switching to achieve hierarchical isolation between the machine mode and the user mode.

[0010] S2. Divide the memory hierarchy and set permissions for the adapted RT-Thread.

[0011] The system memory area of the adapted RT-Thread is divided into three levels according to functions and security: SEC_CTL, SEC_DATA, APP_RUN. In addition, a PMP entry is added under APP_RUN to create a sub-domain DISO_Zone.

[0012] SEC_CTL (Security Control Area), fixedly allocates continuous physical memory to store the global access control list (ACL), hash tokens of security threads, and security data of the RT-Thread system. It is configured with exclusive read / write permissions (R / W) for the machine mode (M-Mode) through PMP entries, and user-mode threads cannot access it.

[0013] SEC_DATA (Secure Data Area), which is used for secure threads to store sensitive data such as encryption keys and secure protocol stacks. It is configured as machine mode management (R / W) through PMP entries, and user mode can only access it through system calls after security authentication, with dynamic permission opening.

[0014] APP_RUN (Application Running Area) is the default running space for all threads except system threads, with the permission of user mode read / write (R / W).

[0015] DISO_Zone (Dynamic Isolation Zone) is a specific area belonging to the application running area. It is dynamically adjusted according to the system operation, and the PMP entry configuration is changed with thread switching, serving as isolation protection between user threads.

[0016] S3. Based on the divided memory hierarchy, create data structures to manage memory areas.

[0017] Define the memory area division structure zone_cfg in the divided security control area. The structure zone_cfg records the memory addresses divided in S2, including the level serial number, start and end addresses of the memory hierarchy.

[0018] Define the access control list structure acl. The structure contains the thread ID, security level, accessible memory area and permissions.

[0019] Define the token structure token, which contains the secure thread token, thread ID, random number, timestamp, etc.

[0020] S4. Based on the divided memory hierarchy and data structures, design security memory application, access and authentication policies.

[0021] Secure threads in user mode apply for and access the memory of the secure data area by calling the extended system interface function, and submit authentication parameters such as thread ID, timestamp and random number for authentication. The RT-Thread kernel processes the request through interrupts, blocking direct operation of the secure area in user mode.

[0022] After the interrupt is triggered, the kernel queries the acl entries in the security control area to verify whether the thread has access permission. If it is a secure thread, extract the pre-stored token hash value and validity period in the security control area, compare it with the hash value calculated from the submitted parameters. If it passes, allocate memory and update the newly allocated memory information in the acl entry. If the comparison fails, an exception is triggered, and the kernel closes the exception thread to recycle resources.

[0023] Ordinary threads in user mode cannot pass the authentication link when applying for secure memory, and the kernel directly rejects and triggers an exception. The memory access process is the same as the application.

[0024] S5. Design a thread dynamic permission configuration and nested isolation policy based on the security memory application, access, and authentication policies to complete the security protection of RT-Thread.

[0025] When the thread switches, the kernel updates the PMP registers in the dynamic isolation area through inline assembly according to the acl information of the currently running thread, protecting only the memory area of the current thread in the application running area to form nested isolation.

[0026] If a thread accesses the memory area of other threads in the application running area out of bounds, a hardware exception will be triggered. The kernel parses the mcause and the machine mode exception value register mtval register to locate the violation behavior, freezes the thread, and records it.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] 1. Based on the RT-Thread integrated with the RSIC-V PMP mechanism, the present invention classifies memory areas, isolates sensitive data to prevent tampering, realizes multi-level security protection for memory areas, and lightweightly implements security policies.

[0029] 2. The present invention introduces a security control access mechanism. Through precise control of thread permissions and mutual isolation between threads, finer-grained security protection can be achieved, enhancing the system security. Description of the Drawings

[0030] Figure 1 is the overall structure diagram of the method;

[0031] Figure 2 is the structure diagram of the PMP register;

[0032] Figure 3 is the schematic diagram of memory space division;

[0033] Figure 4 is the thread creation flowchart;

[0034] Figure 5 is the system memory application flowchart;

[0035] Figure 6 is the Zone nested isolation structure diagram;

[0036] Figure 7 is the system operation and security thread test effect;

[0037] Figure 8 is the user-mode thread isolation test effect. Detailed Implementation Manner

[0038] The embodiment of the present invention provides a PMP-based RT-Thread security protection method, referring toFigure 1 As shown in the figure, the method specifically includes:

[0039] S1. Adapt the security architecture of RT-Thread to RISC-V

[0040] S1.1. Modify the assembly files context_gcc.S and interrupt_gcc.S that handle the context of RT-Thread to completely save the thread context in different modes. In the original context-saving assembly of RT-Thread, change the saving of the interrupt enable status bit MPIE in the machine mode status register mstatus before interrupt to the saving of the entire mstatus register.

[0041] S1.2. During the context recovery process, change the default loading of mstatus to the machine mode to completely restore the status of the mstatus register saved in the thread stack before, so that it can completely save and restore the thread context in both machine and user modes.

[0042] S1.3. Modify functions such as thread stack initialization and thread initialization. In the thread stack initialization function, during the stack initialization process, the kernel needs to modify the privilege mode bit MPP of the mstatus register according to the thread security level. The MPP of the kernel thread is set to 0b11, and the MPP of the secure thread and ordinary thread is set to 0b00. In the thread initialization function, call functions such as acl registration and token generation created. The acl registration function is used to register the access control list of the thread, and the token generation function generates the key required for secure thread authentication through SM3. These data will be stored in the security control area.

[0043] S2. Divide the memory hierarchy and permissions

[0044] S2.1. As Figure 2 shown in the figure, write the permissions and protection modes to bits 0 to 4 of the pmpcfg register, and write the protected area to the pmpaddr register. Divide the memory space into: SEC_CTL (security control area), SEC_DATA (secure data area), APP_RUN (application running area), which correspond to pmp0, pmp1, pmp3 respectively, as specifically Figure 3 shown in the figure.

[0045] S2.2. Set the memory size of the security control area to 4K, which is used to store core data related to system management such as the global access control list and secure thread tokens. The pmp0cfg is configured to be readable and writable only in the machine mode, with the NAPOT protection mode, and the pmpaddr0 address is adjacent to the kernel area.

[0046] S2.3. Set the memory size of the secure data area to 4K to store sensitive data such as keys of secure threads. Set pmp1cfg to machine mode management (R / W). After passing authentication in user mode, it can be accessed. NAPOT protection mode. The pmpaddr1 address is after the secure control area.

[0047] S2.4. Divide a part of the remaining space into an application running area, which is the running space for user threads. Lock the pmp3cfg permission, and the permission will be dynamically opened in combination with the dynamic isolation area; the dynamic isolation area, as a sub-area of the application running area, is not set, and the pmp2cfg and pmpaddr2 settings will be dynamically updated by the system during runtime.

[0048] S3. Create data structures to manage memory areas

[0049] S3.1. In the 4K space of the secure control area, define the structure bodies zone_cfg, acl, and token respectively. The structure body zone_cfg contains the level serial number, start and end addresses of the memory hierarchy; the access control list acl records the thread ID, security level, accessible memory areas and permissions. The accessible areas are divided into ordinary areas and secure areas; in addition, the token structure body token contains the identification key, secure thread token, thread ID, random number, timestamp, etc.

[0050] S3.2. The data in zone_cfg will be pre-written according to the hierarchical settings. The identification key in token is preset by the system and used as the basis for creating secure threads. The remaining token parameters and acl will be registered and generated when RT-Thread creates a thread. Before that, the thread creation function needs to be modified. In addition to the parameters required for normal thread creation, this function also needs to support passing in the identification key, specifically as Figure 4 shown.

[0051] S3.3. When the RT-Thread system receives a thread creation request, it will verify the identification key passed in by the thread creation function. If the key passes, it proves that there is permission to create a secure thread. Call the national cryptography SM3 algorithm to generate a secure thread token in combination with the thread ID, random number, timestamp, etc., and then register the acl form; if the key fails or is not passed in, it is an ordinary thread, and only the acl form will be registered. The form of each subsequent thread is maintained by the system kernel.

[0052] S4. Secure memory application, access, and authentication policies

[0053] S4.1. As Figure 5 shown, whether it is a secure thread or an ordinary thread, when applying for ordinary memory in the application running area during operation, it can be directly obtained, and only the memory area under its name needs to be updated in the acl form belonging to it.

[0054] S4.2. Additionally, if a secure thread needs to apply for secure memory in the secure data area, it needs to call the system interface function, which needs to be extended according to the usage scenario. Here, authentication parameters such as the thread ID, timestamp, and random number are submitted during the call, and then the kernel responds to the call request.

[0055] S4.3. The kernel queries the acl entries in the security control area, extracts the pre-stored token hash value and validity period in the security control area, and calls SM3 to calculate a new hash value again based on the submitted information. The two hashes are compared. If passed, the secure memory in the secure data area is allocated to the thread, and at the same time, the acl entry is updated to add information about the newly allocated memory. If the verification fails, an exception is triggered, and the system shuts down the thread to recycle resources.

[0056] S4.4. The access policy for secure memory is the same as the application policy. The operations of the secure thread on the secure memory also need to call the system interface. By passing authentication, access data, and operation commands, the kernel executes the corresponding function according to the passed parameters. The secure thread does not directly operate on the secure memory area.

[0057] S5. Thread dynamic permission configuration and nested isolation policy

[0058] S5.1. Adjust the RT-Thread kernel thread scheduling function to call the created pmp update function before the thread switching function. According to the information of the thread to be switched, find the acl entry, and dynamically update the pmp entry in the dynamic isolation area before each entry into the next thread, and open the application running area permissions (R / W / X) of the next thread to form nested protection, as Figure 6 shown.

[0059] S5.2. When a malicious thread is running, it can only access the part of the area defined by the dynamic isolation area in the application running area. When the malicious thread accesses other areas of the application running area across the boundary, or accesses the security control area or the secure data area, a hardware exception will be immediately triggered and enter the hardware exception interrupt handling function.

[0060] S5.3. After the exception is triggered, the kernel will parse the data in the mcause and the machine mode exception value register mtval, locate the violation behavior, freeze the thread and record it.

[0061] S5.4. When a legitimate thread is running, the dynamic update pmp function will open the memory space of the application running area to which the thread belongs during thread switching. The legitimate thread can then access its own area, and the security mechanism will not cause any interference to the operation of the legitimate thread.

[0062] To demonstrate the effects achieved by the invention, in combination with the attached Figure 7 、 Figure 8Explanation is as follows.

[0063] When the RT-Thread system starts, the system will first partition the memory area and initialize the memory pool and control area according to zone_cfg, as Figure 7 shown in part A. The address range of the security control area divided is: 0x20003000 - 0x20003fff, the address range of the security data area is: 0x20004000 - 0x20004fff, and the address range of the application running area is: 0x20005000 - 0x2001f800. Then the security data area and the application running area are initialized as memory pools.

[0064] The specific test cases are Figure 7 shown in part B of [[ ]], which are control commands exported by RT-Thread, including the creation of security threads and ordinary threads and the test commands for security threads and ordinary threads.

[0065] The test process is as Figure 7 shown at C in [[ ]]. By entering secapp_init through the msh console, a security thread will be created, printing that the running mode of the security thread is the user mode, the issued token is 0x6f6e6c07a22e53a31b0ff811853fb4505710e6fdebcb9e6306712e7ee22e05647 and information such as the ID, and the security memory address area automatically allocated by the system for the security thread is: 0x20004004.

[0066] Combined with the sec_test alloc sec instruction to test the reading and writing of the security memory area of the security thread. The test routine attempts to write the data abcd into the allocated security memory 0x0x20004004. The kernel calculates the token hash again as 0x6f6e6c07a22e53a31b0ff811853fb4505710e6fdebcb9e6306712e7ee22e05647 according to the authentication information passed in by the thread, which is the same as the token issued when the thread is created, and the authentication passes and the operation can be performed. After successful writing, read the data from this address. The reading process also needs to perform an authentication operation first, and the printed result at D indicates that the test is normal and error-free.

[0067] Figure 8 Shown is the creation of an ordinary thread and the test of the access and isolation effects. After entering normal_init in the console, an ordinary thread will be created and information such as the name and running mode of the thread will be printed, as Figure 8 shown in A of [[ ]]. After the ordinary thread runs, after entering the nor_test alloc sec command as Figure 8At point B in [context], the thread attempts to apply for secure memory but the token verification fails and the operation is rejected.

[0068] Figure 8 In C of [context], the console inputs "nor_test alloc" to allocate normal memory. The memory block address 0x20008000 is successfully obtained and the address area is successfully accessed. At this time, the test routine attempts to illegally access the address area 0x2000a000, immediately triggering a system exception and printing the exception data.

Claims

1. A security protection method for RT-Thread based on PMP, characterized in that, It includes the following steps: S1. Refactor the thread management and context switching modules of RT-Thread to achieve hierarchical isolation between machine mode and user mode, and adapt to the security architecture of RISC-V; S2. Divide the memory levels of the adapted RT-Thread and set permissions; S3. Based on the divided memory levels, create data structures to manage memory areas; S4. Based on the divided memory levels and data structures, design security memory application, access, and authentication policies; S5. Based on the security memory application, access, and authentication policies, design thread dynamic permission configuration and nested isolation policies to complete the security protection of RT-Thread.

2. The RT-Thread security protection method based on PMP according to claim 1, wherein The specific implementation process of step S1 is as follows: S1.

1. Modify the assembly file for RT-Thread to handle contexts, and completely save the thread contexts in different modes. In the original context-saving assembly of RT-Thread, change the saving of the interrupt enable status bit MPIE in the machine mode status register mstatus before entering the interrupt to the saving of the entire mstatus; S1.

2. During the context recovery process, change the default loading of mstatus to the machine mode to completely restore the status of the mstatus register saved in the thread stack before, so as to completely save and restore the thread contexts in both machine and user modes; S1.

3. Modify the thread stack initialization and thread initialization functions; In the thread stack initialization function, during the stack initialization process, the kernel modifies the privilege mode bit MPP of the mstatus register before entering the interrupt according to the thread security level. The MPP of the kernel thread is set to 0b11, and the MPP of the security thread and ordinary thread is set to 0b00; in the thread initialization function, call the created acl registration and token generation functions. The acl registration function is used to register the access control list of the thread, and the token generation function generates the key required for security thread authentication through SM3.

3. The RT-Thread security protection method based on PMP according to claim 2, wherein, The specific process of dividing the memory levels and setting permissions in S2 is as follows: Divide the system memory area of the adapted RT-Thread into three levels according to functions and security: the security control area SEC_CTL, the security data area SEC_DATA, and the application running area APP_RUN, and add a PMP entry under APP_RUN to create a sub-domain, that is, the dynamic isolation area DISO_Zone; For the SEC_CTL, continuously allocate physical memory fixedly to store the global access control list ACL, the hash token of the security thread, and the security data of the RT-Thread system; configure it with exclusive read / write permissions R / W for the machine mode M-Mode through PMP entries, and user-mode threads cannot access it; The SEC_DATA is used for security threads to store encryption keys and security protocol stack data; Configure it with read / write management in the machine mode through PMP entries, and user mode can only access it through system calls after security authentication, and the permissions are dynamically opened; The APP_RUN is the default running space for all threads except system threads, and the permissions are read / write R / W in user mode; The DISO_Zone is dynamically adjusted according to the system operation, changes the PMP entry configuration with thread switching, and acts as isolation protection between user threads.

4. The RT-Thread security protection method based on PMP according to claim 3, characterized in that, The specific creation of the data structure to manage the memory area described in S3 includes: Define a memory area division structure zone_cfg in the divided security control area. The structure zone_cfg records the memory addresses divided in S2, including the level serial number of the memory hierarchy, the start and end addresses; Define an access control list structure acl, which includes thread ID, security level, accessible memory area and permissions; Define a token structure token, which includes a secure thread token, thread ID, random number and timestamp.

5. The RT-Thread security protection method based on PMP according to claim 4, characterized in that The data in the structure zone_cfg will be written in advance according to the hierarchical setting. The identification key in the token is preset by the system and used as the basis for creating a secure thread. The remaining token parameters and acl are registered and generated when RT-Thread creates a thread. Before that, modify the thread creation function. In addition to the parameters required for normal thread creation, the created function supports passing in the identification key; When RT-Thread receives a thread creation request, it verifies the identification key passed in by the thread creation function. If the key passes, it proves that there is permission to create a secure thread, and calls the national cryptography SM3 algorithm to generate a secure thread token in combination with the thread ID, random number, and timestamp, and then registers the acl form; If the key fails to pass or is not passed in, it is an ordinary thread, and only the acl form is registered. The acl form of each subsequent thread is maintained by the RT-Thread kernel.

6. The RT-Thread security protection method based on PMP according to claim 5, wherein, The design of the security memory application, access and authentication policy is as follows: The secure thread in user mode applies for and accesses the memory in the secure data area by calling the RT-Thread interface function, and submits the thread ID, timestamp and random number for authentication. The RT-Thread kernel processes the request through an interrupt, blocking the user mode from directly operating on the secure area; After the interrupt is triggered, the kernel queries the acl entry in the security control area to verify whether the thread has access permission; If it is a secure thread, extract the pre-stored token hash value and validity period in the security control area, compare it with the hash value calculated from the submitted parameters, and if it passes, allocate memory and update the newly allocated memory information in the acl entry; If the comparison fails, an exception is triggered, and the kernel closes the exception thread and reclaims resources; When an ordinary thread in user mode applies for secure memory, it cannot pass the authentication link, and the kernel directly rejects it and triggers an exception; The memory access process is the same as the application.

7. The RT-Thread security protection method based on PMP according to claim 6, wherein The design of the thread dynamic permission configuration and nested isolation policy is as follows: When the thread switches, the kernel updates the PMP register of the dynamic isolation area through inline assembly according to the acl information of the currently running thread, protecting the memory area of the current thread in the application running area to form nested isolation; If a thread accesses the memory area of other threads in the application running area out of bounds, a hardware exception is triggered. The kernel parses the mcause and the machine mode exception value register mtval to locate the violation behavior, freezes the thread and records it.

Images