Program running method and device, computer device and readable storage medium

Abstract

This application relates to a program execution method, apparatus, computer device, and readable storage medium. The method includes: obtaining signature information corresponding to a target application, wherein the target application is obtained by signing each code section contained in an initial application according to a preset encryption algorithm; loading the signature information and the target application into kernel mode, and verifying the target application in kernel mode based on a preset configuration file and a signature verification mechanism corresponding to the preset encryption algorithm, obtaining a target verification result; and determining the execution control result of the target application based on the target verification result. This method can improve operating system security.

Description

Technical Field

[0001] This application relates to the field of operating system security technology, and in particular to a program execution method, apparatus, computer device, and readable storage medium. Background Technology

[0002] With the development of BPF (Berkeley Packet Filter) technology, eBPF (extended Berkeley Packet Filter) technology emerged, used to safely extend kernel functionality without modifying kernel source code or rebooting the kernel. However, eBPF programs present security issues in the operating system.

[0003] In traditional technologies, to address the security issues of operating systems when using eBPF programs, kernel configuration options are pre-configured to verify the usage permissions of the program. When an eBPF program is loaded into kernel mode, the user permissions of the eBPF program are first identified. Only if the user has root (the highest system privilege) permissions is the eBPF program allowed to run; otherwise, the eBPF program is prohibited from running.

[0004] However, in current traditional technologies, because root privilege-based detection is relatively broad, even eBPF programs with root privileges can be tampered with, resulting in poor accuracy in identifying risks in eBPF programs, and consequently, poor operating system security. Summary of the Invention

[0005] Therefore, it is necessary to provide a program running method, apparatus, computer device, and readable storage medium to address the aforementioned technical problems.

[0006] Firstly, this application provides a method for running a program, including:

[0007] Obtain the signature information corresponding to the target application, wherein the target application is obtained by signing each code section contained in the initial application according to a preset encryption algorithm;

[0008] The signature information and the target application are loaded into the kernel state, and the target application in the kernel state is verified based on the preset configuration file and the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result;

[0009] Based on the target verification results, the execution control results of the target application are determined.

[0010] In one embodiment, before obtaining the signature information corresponding to the target application, the method further includes:

[0011] The initial application is parsed to obtain multiple code sections contained in the initial application;

[0012] Each code segment is encrypted using a preset encryption algorithm to obtain the signature information corresponding to each code segment.

[0013] The signature information is written back to the initial application to obtain the target application.

[0014] In one embodiment, loading the signature information and the target application into the kernel state, and verifying the target application in the kernel state based on a preset configuration file and a signature verification mechanism corresponding to the preset encryption algorithm to obtain a target verification result, includes:

[0015] Based on the signature information and initial license information field corresponding to the target application, a target license information field is constructed, and the target license information field and the target application are loaded into the kernel mode;

[0016] The target application is parsed to obtain the configuration information corresponding to the target application, and the configuration information is verified based on a preset configuration file to obtain the configuration verification result;

[0017] If the configuration verification result is successful, the target permission information field is verified based on the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result.

[0018] In one embodiment, constructing the target license information field based on the signature information and initial license information field corresponding to the target application includes:

[0019] Using a preset character as a separator, the signature information and initial license information fields corresponding to the target application are separated, and the signature information is embedded at the end of the initial license information field to obtain the target license information field.

[0020] In one embodiment, the configuration information includes the program type and hook points corresponding to each code section in the target application; the configuration verification based on the preset configuration file to obtain the configuration verification result includes:

[0021] Obtain a preset configuration file; the preset configuration file includes matching rule information;

[0022] Based on the matching rule information, the program type and the hook point are matched to determine the operation permissions and preset priority corresponding to each target application.

[0023] The configuration verification result corresponding to the target application is determined based on the preset priority and the operation permissions.

[0024] In one embodiment, determining the execution control result of the target application based on the target verification result includes:

[0025] If the target verification result is successful, the execution control result of the target application is determined to be allowed to run;

[0026] If the target verification result is a verification failure, the execution control result of the target application is determined to be interrupted loading.

[0027] In one embodiment, after determining the execution control result of the target application based on the target verification result, the method further includes:

[0028] During the operation of the target application, the target application is acquired at a preset period, and the target application is parsed to obtain the signature information;

[0029] Based on the signature verification mechanism corresponding to the preset encryption algorithm, the signature information corresponding to the running target application is verified to obtain the monitoring result.

[0030] If the monitoring result indicates that the signature verification fails, the operation of the target application is interrupted.

[0031] Secondly, this application also provides a program running apparatus, comprising:

[0032] The acquisition module is used to acquire the signature information corresponding to the target application, wherein the target application is obtained by signing each code section contained in the initial application according to a preset encryption algorithm;

[0033] The verification module is used to load the signature information and the target application into the kernel state, and verify the target application in the kernel state based on the preset configuration file and the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result;

[0034] The control module is used to determine the operation control result of the target application based on the target verification result.

[0035] In one embodiment, the device further includes:

[0036] The first parsing module is used to parse the initial application to obtain multiple code sections contained in the initial application;

[0037] The signature module is used to encrypt each of the code segments based on a preset encryption algorithm to obtain signature information corresponding to each of the code segments.

[0038] The write-back module is used to write the signature information back to the initial application to obtain the target application.

[0039] In one embodiment, the verification module is specifically used to construct a target license information field based on the signature information and initial license information field corresponding to the target application, and load the target license information field and the target application into the kernel state;

[0040] The target application is parsed to obtain the configuration information corresponding to the target application, and the configuration information is verified based on a preset configuration file to obtain the configuration verification result;

[0041] If the configuration verification result is successful, the target permission information field is verified based on the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result.

[0042] In one embodiment, the verification module is specifically used to separate the signature information and initial license information fields corresponding to the target application using a preset character as a separator, and to embed the signature information into the end of the initial license information field to obtain the target license information field.

[0043] In one embodiment, the configuration information includes the program type and hook points corresponding to each code section in the target application; the verification module is specifically used to obtain a preset configuration file; the preset configuration file includes matching rule information;

[0044] Based on the matching rule information, the program type and the hook point are matched to determine the operation permissions and preset priority corresponding to each target application.

[0045] The configuration verification result corresponding to the target application is determined based on the preset priority and the operation permissions.

[0046] In one embodiment, the control module is specifically used to determine that the running control result of the target application is allowed to run if the target verification result is a successful verification.

[0047] If the target verification result is a verification failure, the execution control result of the target application is determined to be interrupted loading.

[0048] In one embodiment, the device further includes:

[0049] The second parsing module is used to acquire the target application at a preset period during the operation of the target application, parse the target application, and obtain the signature information.

[0050] The signature verification module is used to verify the signature information corresponding to the target application in operation based on the signature verification mechanism corresponding to the preset encryption algorithm, and obtain the monitoring result.

[0051] An interrupt module is used to interrupt the operation of the target application if the monitoring result indicates that the signature information verification has failed.

[0052] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0053] Obtain the signature information corresponding to the target application, wherein the target application is obtained by signing each code section contained in the initial application according to a preset encryption algorithm;

[0054] The signature information and the target application are loaded into the kernel state, and the target application in the kernel state is verified based on the preset configuration file and the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result;

[0055] Based on the target verification results, the execution control results of the target application are determined.

[0056] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0057] Obtain the signature information corresponding to the target application, wherein the target application is obtained by signing each code section contained in the initial application according to a preset encryption algorithm;

[0058] The signature information and the target application are loaded into the kernel state, and the target application in the kernel state is verified based on the preset configuration file and the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result;

[0059] Based on the target verification results, the execution control results of the target application are determined.

[0060] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0061] Obtain the signature information corresponding to the target application, wherein the target application is obtained by signing each code section contained in the initial application according to a preset encryption algorithm;

[0062] The signature information and the target application are loaded into the kernel state, and the target application in the kernel state is verified based on the preset configuration file and the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result;

[0063] Based on the target verification results, the execution control results of the target application are determined.

[0064] The aforementioned program execution method, apparatus, computer device, and readable storage medium acquire the signature information corresponding to the target application. The target application is obtained by signing each code section contained in the initial application according to a preset encryption algorithm. The signature information and the target application are loaded into the kernel state, and the target application in the kernel state is verified based on a preset configuration file and a signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result. Based on the target verification result, the execution control result of the target application is determined. This method, by signing each code section of the initial application, makes the verification of the initial application more refined. Furthermore, by using a preset configuration file and signature verification mechanism in the kernel state to verify the target application, it achieves multi-dimensional verification of configuration information and program content, enriching the dimensions of verification. It can verify the content tampering of the initial application, improving the accuracy of target application risk identification and thus enhancing the security of the operating system. Attached Figure Description

[0065] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0066] Figure 1 This is a diagram illustrating the application environment of a program execution method in one embodiment.

[0067] Figure 2 This is a schematic diagram of the functional components corresponding to the program execution method in one embodiment;

[0068] Figure 3 This is a schematic diagram of the process of writing signature information to a target application in one embodiment;

[0069] Figure 4This is a schematic diagram illustrating the process of writing signature information by adding a signature section in one embodiment;

[0070] Figure 5 This is a flowchart illustrating an example of writing signature information in one embodiment;

[0071] Figure 6 This is a flowchart illustrating the verification process for a target application in one embodiment;

[0072] Figure 7 This is a schematic diagram illustrating the process of configuration verification for a target application in one embodiment;

[0073] Figure 8 This is a flowchart illustrating an example of configuration verification for a target application in one embodiment;

[0074] Figure 9 This is a flowchart illustrating the process of determining the operation control result based on the target verification result in one embodiment.

[0075] Figure 10 This is a flowchart illustrating the real-time monitoring of a running target application in one embodiment;

[0076] Figure 11 This is a flowchart illustrating an example of real-time monitoring of a target application in one embodiment;

[0077] Figure 12 This is a flowchart illustrating an example of a program execution method in one embodiment;

[0078] Figure 13 This is a structural block diagram of a program execution device in one embodiment;

[0079] Figure 14 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0080] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0081] In one embodiment, such as Figure 1 As shown, a program execution method is provided. This embodiment illustrates the method applied to a terminal. It is understood that this method can also be applied to a server, and further to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0082] Step 102: Obtain the signature information corresponding to the target application.

[0083] The target application is obtained by signing each code section contained in the initial application according to a preset encryption algorithm.

[0084] In this embodiment, the terminal obtains the target application requested by the user in user mode. The target application can be an eBPF program. This embodiment uses an eBPF program as the target application for illustration. eBPF provides a virtual machine that allows developers to write small applications (called eBPF programs). The eBPF program can be attached to various hook points in kernel mode to monitor and manipulate operating system behavior.

[0085] To perform security checks on eBPF programs and ensure operating system security, the terminal can use methods such as... Figure 2 The security components shown process the eBPF program. Specifically, taking the Linux operating system as an example, the user space of the terminal includes a signing component, a monitoring component, and an eBPF loading component, while the kernel space includes a signature verification component and a configuration component. Combined with the SM (Chinese cryptographic algorithm) hardware security component, which is an independent security hardware, the complete security components are formed.

[0086] First, users develop and write eBPF programs based on business needs. For example, users compile these programs using clang (a lightweight compiler) to generate .o files, resulting in an initial application. After the initial application (eBPF program) is compiled for the first time, a user-space signing component signs the eBPF program, resulting in a target application containing the signature information. The signing component can be implemented in software or can use an SM hardware security component to sign the eBPF program.

[0087] Furthermore, when a user submits a command to run a target application, the terminal responds to the user's command by parsing and extracting the corresponding signature information of the target application through the user-mode eBPF loading component, so that further verification processing can be performed based on the signature information.

[0088] Step 104: Load the signature information and the target application into the kernel state, and verify the target application in the kernel state based on the signature verification mechanism corresponding to the preset configuration file and the preset encryption algorithm to obtain the target verification result.

[0089] In this embodiment, the terminal receives signature information and the target application through the kernel-mode eBPF loading component, and loads both the signature information and the target application into the kernel mode. The terminal's kernel mode is pre-configured with a preset configuration file. The terminal reads the verification rules and policies in the preset configuration file. These rules and policies can perform preliminary configuration verification on the target application, determining whether the corresponding type of the target application is enabled and whether the corresponding target hook point is allowed. If the configuration verification result is a verification failure, it indicates that the current preset configuration file does not allow operating system control contained in the target application. The terminal then sends an error message and terminates the loading of the target application.

[0090] If the configuration verification result is successful, it indicates that the target application meets the requirements of the preset configuration file. The terminal then proceeds with subsequent signature verification operations. Specifically, the terminal decrypts the signature information using a signature verification mechanism corresponding to a preset encryption algorithm, obtaining the application characteristics and encrypted information contained within. The decrypted signature information is then compared with the actual characteristics of the target application to determine whether the target application has been tampered with or is legitimate. Finally, based on the comparison result, the terminal generates a target verification result. If the comparison matches, the target verification result is considered successful; otherwise, the target verification result is considered unsuccessful.

[0091] Step 106: Based on the target verification results, determine the execution control results of the target application.

[0092] In this embodiment, if the target verification result is successful, it indicates that the current target application does not pose a security risk, and thus the execution control result of the target application is determined to be allowed to run. The terminal maps the eBPF program to the kernel-mode virtual machine and hooks it to a preset hook point.

[0093] If the target verification result is a failure, it indicates that the current target application has a security risk and may have been maliciously tampered with. In this case, the terminal will refuse to load the target application and display a prompt message on the front-end page to prevent the target application from entering the kernel virtual machine.

[0094] In the above program execution method, by signing each code section of the initial application, the verification of the initial application is made more refined. In the kernel mode, the target application is verified using a preset configuration file and a signature verification mechanism. This achieves multi-dimensional verification of configuration information and program content, enriches the dimensions of verification, and can verify the content tampering of the initial application, thereby improving the accuracy of risk identification of the target application and thus improving the security of the operating system.

[0095] In one exemplary embodiment, to achieve security verification of the initial application, a signing process is required after the initial application is written, such as... Figure 3 As shown, before step 102, the method further includes steps 302 to 306. Wherein:

[0096] Step 302: Parse the initial application to obtain multiple code sections contained in the initial application.

[0097] In this embodiment, the initial application is a raw eBPF program written by the user according to business requirements. The terminal parses the initial application, which consists of multiple code sections, each containing eBPF code. For example, some code sections in the initial application may store the executable code of the initial application, while others may store global variables. By parsing the initial application, the terminal can split it into multiple code sections according to its internal structure, and subsequently perform independent encryption processing on each code section.

[0098] Step 304: Encrypt each code segment separately based on the preset encryption algorithm to obtain the signature information corresponding to each code segment.

[0099] In this embodiment, the preset encryption algorithm can be the SM national cryptographic algorithm. The SM national cryptographic algorithm can be implemented in the kernel community in a pure software manner or by using hardware encryption. This embodiment does not limit the implementation method of the preset encryption algorithm.

[0100] The terminal encrypts each code segment using a preset encryption algorithm to obtain the signature information corresponding to each code segment. Taking the SM2 national cryptographic algorithm as an example, the terminal uses the SM2 private key to sign each code segment, generating a corresponding digital signature as the signature information. Optionally, the preset encryption algorithm can also be a combination of SM3 and SM2. The terminal uses the SM3 hash algorithm to hash the code content of each separated code segment, obtaining a fixed-length hash value for each code segment. Then, it uses the SM2 private key to sign the hash value of each code segment, generating the signature information corresponding to each code segment. For example, the code sections in the initial application include kprobe_funcA, kretprobe_funcB, and xdp_funcC. The terminal encrypts kprobe_funcA, kretprobe_funcB, and xdp_funcC respectively using a preset encryption algorithm to obtain SIGN_kprobe_funcA (as the signature information of code section kprobe_funcA). Similarly, the terminal also obtains SIGN_kretprobe_funcB (as the signature information of code section kretprobe_funcB) and SIGN_xdp_funcC (as the signature information of code section xdp_funcC).

[0101] Step 306: Write the signature information back to the initial application to obtain the target application.

[0102] In this embodiment of the application, the terminal adds a corresponding signature section for each code section in the initial application. This signature section is used to store signature information, and the signature information corresponding to each code section is constructed into a structured data block, such as... Figure 4 As shown, the code sections in the initial application include kprobe_fucA, kretprobe_funcB, and xdp_funcC. The terminal writes SIGN_kprobe_funcA, SIGN_kretprobe_funcB, and SIGN_xdp_funcC back to the initial application, thus obtaining the target application containing the signature information.

[0103] In a specific embodiment, such as Figure 5As shown, the terminal first selects the eBPF target file as the initial application, parses the eBPF target file to obtain all eBPF sections, and determines whether to enable the SM hardware security component based on the preset encryption algorithm. If the preset encryption algorithm requires hardware encryption, the SM hardware security component is invoked to sign all eBPF sections; if the preset encryption algorithm does not require hardware encryption, the kernel's built-in SM security component is invoked to sign them. Finally, the terminal writes the signed content corresponding to the signature information back to the eBPF file, thus obtaining the target application.

[0104] In this embodiment, by parsing the initial application, the code sections within the initial application are separated, and then encrypted signatures are performed at the code section level of the initial application. This enables the identification of whether the target application has been maliciously tampered with at the application content level, achieving fine-grained control over the target application and improving the accuracy of application risk identification.

[0105] In one exemplary embodiment, such as Figure 6 As shown, step 104 includes steps 602 to 606. Wherein:

[0106] Step 602: Based on the signature information and initial license information field corresponding to the target application, construct the target license information field and load the target license information field and the target application into kernel mode.

[0107] In this embodiment, the kernel-mode eBPF loading component in the terminal can be an eBPF loader. The user-mode target application and its corresponding initial license information field are entered into the loader. The eBPF loader adds the target application's signature information to the initial license information field. Alternatively, the terminal can integrate the signature information and the initial license information field according to a preset combination strategy to generate an independent target license information field. Then, based on the target license information field and the target application, a bpf_attr union is constructed. The bpf_attr union contains the user-mode target license information field and the target application. Finally, the terminal loads the bpf_attr union into kernel mode using the sys_bpf function, thus loading the target license information field and the target application into kernel mode.

[0108] Step 604: Parse the target application to obtain the configuration information corresponding to the target application, and perform configuration verification on the configuration information based on the preset configuration file to obtain the configuration verification result.

[0109] In this embodiment, the terminal kernel parses the binary data of the target application to extract security-related configuration information. This configuration information may be stored in a specific code section of the target application, or recorded in a specific form as the type and hook points corresponding to the target application. The configuration component in the terminal kernel stores a user-defined preset configuration file. The terminal verifies the configuration information of the target application through this component to ensure that the loaded target application (eBPF program) meets the predetermined configuration requirements. The configuration component in the terminal kernel compares the configuration information parsed from the target application with the preset configuration file item by item. For example, the loading component verifies whether the functions declared in the target application's configuration information exceed the scope permitted by the preset configuration file, or whether the type of the target application is a type permitted by the preset configuration file. Finally, the configuration component in the terminal kernel determines the configuration verification result of the target application based on the comparison result between the configuration information and the preset configuration file.

[0110] Step 606: If the configuration verification result is successful, the target permission information field is verified based on the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result.

[0111] In this embodiment, if the configuration verification result is successful, the terminal enables the kernel-mode signature verification component. Since the user space transmits the `bpf_attr` union containing signature information and the binary data of the target application (eBPF program) to the kernel space via the `sys_bpf` system call, the kernel-mode signature verification component can access the binary data and signature information of the target application. Specifically, the signature verification component first parses and decomposes the target permission information field to obtain the signature information. Then, it verifies the signature information according to the signature verification mechanism corresponding to the preset encryption algorithm. That is, if the preset encryption algorithm is hardware encryption, the signature verification component calls the SM hardware security component to decrypt and verify the signature information, obtaining the target verification result; if the preset encryption algorithm is software encryption, the signature verification component uses kernel-mode software decryption to decrypt and verify the signature information, obtaining the target verification result. If the signature verification process finds that the signature information does not conform to expectations, indicating that the eBPF program may have been tampered with or its source is untrustworthy, the terminal kernel will take decisive measures to prohibit the loading of the eBPF program, terminate the system call, and return the corresponding error information.

[0112] In this embodiment, by using a preset configuration file and a preset encryption algorithm, the target application is verified in multiple levels and dimensions, which can improve the accuracy of the loading verification of the target application's security and ensure the security of the operating system.

[0113] In an exemplary embodiment, step 602 includes step 6021. Wherein:

[0114] Step 6021: Using a preset character as a separator, separate the signature information and initial license information fields corresponding to the target application, and embed the signature information into the end of the initial license information field to obtain the target license information field.

[0115] In this embodiment, within the `bpf_attr` union, the `license` field stores initial license information. The `license` field of `bpf_attr` has a total space of 128 bytes. The initial license information uses only the first 10 bytes of this field, leaving the remaining 118 bytes unused. The terminal then uses a null character as a preset delimiter, adding it to the end of the initial license information field within the `license` field. The signature information (e.g., a 64-byte signature generated by the SM2 algorithm) is then embedded and filled into the remaining 128 bytes of the `license` field, resulting in the target license information field carrying the signature information. This ensures that the length or structure of the `license` field remains unchanged, guaranteeing that the extended signature information is transparent to legacy systems and does not affect the original parsing function of the `license` field. Finally, when loading the target license information field, the terminal kernel still prioritizes parsing the first 10 bytes of the initial license information field, and during subsequent signature verification by the signature verification component, it can parse the signature information of the target application.

[0116] In this embodiment, the signature information and initial license information fields are separated by a preset character, and the signature information is embedded at the end of the initial license information field. This does not affect the parsing function of the license field, ensuring system compatibility and stability. It also enables the loading and verification of the signature information of the target application, improving the accuracy of the security verification of the target application.

[0117] In one exemplary embodiment, such as Figure 7 As shown, the configuration information includes the program type and hook points corresponding to each code section in the target application; step 604 includes steps 702 to 706. Wherein:

[0118] Step 702: Obtain the preset configuration file.

[0119] The preset configuration file includes matching rule information.

[0120] In this embodiment of the application, the configuration component in the terminal kernel mode provides a configuration interface " / sys / sys / bpf / config / " in the pseudo file system of the Linux system, which allows users to finely customize the allowed eBPF types and hook points to form the matching rule information of the preset configuration file.

[0121] The terminal reads a preset configuration file and extracts the matching rule information stored within it. Specifically, the matching rule information can be defined as a four-tuple, including program type, hook point, operation permission, and preset priority. The program type can be something like "BPF_PROG_TYPE_UNSPEC"; the hook point can be a specific kernel function name or a wildcard that supports fuzzy matching; the operation permission is a binary value, including allow and deny; and the preset priority can be an integer, with higher values ​​indicating higher priority. The matching rule information can also be stored in the preset configuration file as a hash table.

[0122] Step 704: Match program types and hook points based on matching rule information to determine the operation permissions and preset priorities corresponding to each target application.

[0123] In this embodiment, after the loading component parses the target application and obtains the configuration information corresponding to the target application, the loading component in the terminal kernel mode extracts the program type and hook points of the target application from the configuration information. It then matches the program type and hook points in a hash table containing matching rule information, using the program type and hook point as hash keys to determine the operation permissions and preset priorities corresponding to each hook point under each program type. Specifically, if a matching rule exists, the terminal's loading component selects the rule with the highest priority as the operation permission; if the priorities are the same, the earliest added rule is selected as the operation permission based on the loading order. If the hook point does not match any configuration rule, the terminal uses a preset default rule (e.g., the preset default rule is denial) or a global default value in the configuration file as the operation permission.

[0124] Step 706: Determine the configuration verification result corresponding to the target application based on the preset priority and operation permissions.

[0125] In this embodiment of the application, if the operation permissions of all checked hook points are allowed, the terminal determines that the configuration verification result is verified as passed; if there are hook points whose operation permissions are denied by the rules, the terminal determines that the configuration verification result is verified as failed.

[0126] In a specific implementation, such as Figure 8 As shown, in response to the administrator's setting instructions, the terminal obtains the preset configuration file through the configuration component. When the user loads the eBPF program, the terminal matches the program type and hook point of the eBPF program with the rule table of the preset configuration file. If there is a matching record, the terminal processes the operation according to the matching record; otherwise, the default operation is executed.

[0127] In this embodiment, the program type and hook points are matched by the matching rule information of the configuration component, which realizes the finer granularity of configuration verification at the level of configuration file. At the same time, it enables custom control of the matching rule information, which improves the flexibility of verifying the target application and the accuracy of risk identification.

[0128] In one exemplary embodiment, such as Figure 9 As shown, step 106 includes steps 902 to 904. Wherein:

[0129] Step 902: If the target verification result is "verification passed", determine that the target application's execution control result is "allowed to run".

[0130] Step 904: If the target verification result is verification failure, determine that the target application's execution control result is interrupted loading.

[0131] In one exemplary embodiment, during the execution of the target program, the terminal can also monitor the target program in real time, reducing the security risks to the operating system, such as... Figure 10 As shown, after step 106, the method further includes steps 1002 to 1006. Wherein:

[0132] Step 1002: During the operation of the target application, the target application is acquired according to a preset cycle, and the target application is parsed to obtain signature information.

[0133] In this embodiment, the terminal uses a monitoring component to perform real-time monitoring of the loaded target application during runtime, ensuring its integrity and security. The terminal periodically acquires relevant data from the target application at pre-set time intervals and extracts signature information from the application's data. For example, the terminal is set to acquire and extract data from the target application every 5 minutes to obtain signature information.

[0134] Step 1004: Based on the signature verification mechanism corresponding to the preset encryption algorithm, verify the signature information corresponding to the running target application to obtain the monitoring result.

[0135] In this embodiment, the terminal's monitoring component verifies the signature information of the running target application using a verification mechanism corresponding to the same preset encryption algorithm used by the signature component. This verification can be performed by either invoking the SM hardware security component or through software verification, thus obtaining a monitoring result. Specifically, the monitoring component verifies the signature information using the public key corresponding to the preset encryption algorithm. The public and private keys are generated in pairs; the private key is used to generate the signature information, and the public key is used to verify it. If the signature information is generated using the corresponding private key and the target application has not been tampered with during operation, the monitoring result is successful; conversely, if the target application has been tampered with and the signature information does not match the actual content of the target application, the monitoring result is a verification failure.

[0136] Step 1006: If the monitoring result indicates that the signature verification failed, interrupt the operation of the target application.

[0137] In this embodiment, when the signature verification of the target application fails, it indicates that the application may have been tampered with, posing a security risk. To prevent the tampered target application from causing security risks to the operating system, the terminal immediately terminates the operation of the target application.

[0138] In a specific embodiment, such as Figure 11 As shown, after the target application runs, the terminal starts a detection service to monitor all loaded eBPF programs in the current operating system. The terminal determines whether to enable the SM hardware security component based on a preset encryption algorithm. If the SM hardware security component is enabled, it calls the SM hardware security component to verify the signature information of the eBPF program; if the SM hardware security component is not enabled, it calls the kernel's built-in SM component to verify the signature information of all eBPF programs. If an eBPF program with an inconsistent signature is found, the abnormal eBPF program is terminated, an alarm is issued, and the log is logged; if no eBPF program with an inconsistent signature is found, it indicates that the operating system is normal, and the detection service continues monitoring.

[0139] In this embodiment, by periodically acquiring the target application and parsing its signature information, and then verifying it using a signature verification mechanism based on a preset encryption algorithm, the operation of the application is interrupted once the signature verification fails. This effectively protects the integrity and security of the target application during its operation, prevents the application from being maliciously tampered with and continuing to run, thus preventing security risks to the operating system and improving the security of the operating system.

[0140] In one exemplary embodiment, such as Figure 12 As shown, an example of a program execution method is provided, including:

[0141] Step 1201: Obtain the .o file (object file) generated by the clang compiler.

[0142] Step 1202: Sign all eBPF sections in the .o file based on the signing component.

[0143] Step 1203: Generate an ELF program by linking and loading libbpf in the component based on the eBPF loader.

[0144] Step 1204: Execute ELF to load the eBPF program into the kernel.

[0145] Step 1205: Determine whether the target eBPF application type and corresponding hook point can be used by configuring the component. If the target eBPF application type and corresponding hook point cannot be used, proceed to step 1206; if the target eBPF application type and corresponding hook point can be used, proceed to step 1207.

[0146] Step 1206: Prevent the loading of the current target eBPF program and return an error message.

[0147] Step 1207: Verify the eBPF program according to the signature verification component. If the verification result is that the signature verification fails, proceed to step 1206; if the verification result is that the signature verification succeeds, proceed to step 1208.

[0148] Step 1208: Allow the eBPF program to run.

[0149] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0150] Based on the same inventive concept, this application also provides a program running apparatus for implementing the program running method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more program running apparatus embodiments provided below can be found in the limitations of the program running method described above, and will not be repeated here.

[0151] In one exemplary embodiment, such as Figure 13 As shown, a program running device 1300 is provided, including: an acquisition module 1301, a verification module 1302, and a control module 1303, wherein:

[0152] The acquisition module 1301 is used to acquire the signature information corresponding to the target application, which is obtained by signing each code section contained in the initial application according to a preset encryption algorithm.

[0153] The verification module 1302 is used to load the signature information and the target application into the kernel state, and verify the target application in the kernel state based on the signature verification mechanism corresponding to the preset configuration file and the preset encryption algorithm to obtain the target verification result.

[0154] The control module 1303 is used to determine the running control result of the target application based on the target verification result.

[0155] In one embodiment, the program running device 1300 further includes:

[0156] The first parsing module is used to parse the initial application and obtain the multiple code sections contained in the initial application;

[0157] The signature module is used to encrypt each code segment separately based on a preset encryption algorithm to obtain the signature information corresponding to each code segment.

[0158] The write-back module is used to write the signature information back to the initial application, thus obtaining the target application.

[0159] In one embodiment, the verification module 1302 is specifically used to construct a target license information field based on the signature information and initial license information field corresponding to the target application, and load the target license information field and the target application into the kernel state;

[0160] The target application is parsed to obtain the corresponding configuration information, and the configuration information is verified based on the preset configuration file to obtain the configuration verification result.

[0161] If the configuration verification result is successful, the target permission information field is verified based on the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result.

[0162] In one embodiment, the verification module 1302 is specifically used to separate the signature information and initial license information fields corresponding to the target application using a preset character as a separator, and to embed the signature information into the end of the initial license information field to obtain the target license information field.

[0163] In one embodiment, the configuration information includes the program type and hook points corresponding to each code section in the target application; the verification module 1302 is specifically used to obtain a preset configuration file; the preset configuration file includes matching rule information;

[0164] Based on the matching rule information, the program type and hook points are matched to determine the operation permissions and preset priorities of each target application.

[0165] The configuration verification result corresponding to the target application is determined based on preset priority and operation permissions.

[0166] In one embodiment, the control module 1303 is specifically used to determine that the running control result of the target application is allowed to run if the target verification result is that the verification is passed;

[0167] If the target verification result is a verification failure, the execution control result of the target application is determined to be an interrupted loading.

[0168] In one embodiment, the program running device 1300 further includes:

[0169] The second parsing module is used to obtain the target application at a preset period during the operation of the target application, parse the target application, and obtain the signature information.

[0170] The signature verification module is used to verify the signature information of the target application in operation based on the signature verification mechanism corresponding to the preset encryption algorithm, and obtain the monitoring results.

[0171] The interrupt module is used to interrupt the operation of the target application if the monitoring result shows that the signature verification failed.

[0172] Each module in the aforementioned program execution device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0173] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 14As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a program execution method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0174] Those skilled in the art will understand that Figure 14 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0175] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0176] Obtain the signature information corresponding to the target application, which is obtained by signing each code section contained in the initial application according to a preset encryption algorithm;

[0177] The signature information and the target application are loaded into the kernel space, and the target application in the kernel space is verified based on the signature verification mechanism corresponding to the preset configuration file and the preset encryption algorithm to obtain the target verification result.

[0178] Based on the target verification results, the execution control results of the target application are determined.

[0179] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0180] The initial application is parsed to obtain multiple code sections contained within it;

[0181] Each code segment is encrypted separately based on a preset encryption algorithm to obtain the signature information corresponding to each code segment;

[0182] The signature information is written back to the initial application, resulting in the target application.

[0183] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0184] Based on the signature information and initial license information fields corresponding to the target application, construct the target license information field, and load the target license information field and the target application into kernel mode;

[0185] The target application is parsed to obtain the corresponding configuration information, and the configuration information is verified based on the preset configuration file to obtain the configuration verification result.

[0186] If the configuration verification result is successful, the target permission information field is verified based on the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result.

[0187] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0188] Using a preset character as a separator, the signature information and initial license information fields corresponding to the target application are separated, and the signature information is embedded at the end of the initial license information field to obtain the target license information field.

[0189] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0190] Retrieve the preset configuration file; the preset configuration file includes matching rule information;

[0191] Based on the matching rule information, the program type and hook points are matched to determine the operation permissions and preset priorities of each target application.

[0192] The configuration verification result corresponding to the target application is determined based on preset priority and operation permissions.

[0193] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0194] If the target verification result is successful, the execution control result of the target application is determined to be allowed to run;

[0195] If the target verification result is a verification failure, the execution control result of the target application is determined to be an interrupted loading.

[0196] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0197] During the execution of the target application, the target application is retrieved according to a preset cycle, parsed, and signature information is obtained.

[0198] Based on the signature verification mechanism corresponding to the preset encryption algorithm, the signature information corresponding to the target application in operation is verified to obtain the monitoring results.

[0199] If the monitoring result indicates that the signature verification failed, the operation of the target application will be interrupted.

[0200] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0201] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0202] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0203] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0204] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0205] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for running a program, characterized in that, The method includes: Obtain the signature information corresponding to the target application, wherein the target application is obtained by signing each code section contained in the initial application according to a preset encryption algorithm; the target application is an eBPF program. The signature information and the target application are loaded into the kernel state, and the target application in the kernel state is verified based on the preset configuration file and the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result; Based on the target verification results, the execution control results of the target application are determined; Loading the signature information and the target application into kernel mode includes: Using a preset character as a separator, the signature information and initial license information fields corresponding to the target application are separated, and the signature information is embedded at the end of the initial license information field to obtain the target license information field; the end of the initial license information field is empty byte space. The signature verification mechanism based on the preset configuration file and the preset encryption algorithm verifies the target application in the kernel state to obtain the target verification result, including: The kernel-mode signature verification component parses the target application to obtain the configuration information corresponding to the target application; the configuration information includes the program type and hook points corresponding to each code section in the target application; Obtain a preset configuration file; the preset configuration file includes matching rule information, the preset configuration file is the permission range set by the user for the configuration information of the target application, and the matching rule information is defined in the form of a four-tuple including user-defined program type, hook point, operation permission and preset priority; Based on the matching rule information, the program type and hook point corresponding to each code section in the target application are matched to determine the operation permissions and preset priority of each target application; The configuration verification result corresponding to the target application is determined based on the preset priority and the operation permissions; If the configuration verification result is successful, the target permission information field is parsed and decomposed to obtain the signature information. The signature information is then verified based on the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result.

2. The method of claim 1, wherein, Before obtaining the signature information corresponding to the target application, the method further includes: The initial application is parsed to obtain multiple code sections contained in the initial application; Each code segment is encrypted using a preset encryption algorithm to obtain the signature information corresponding to each code segment. The signature information is written back to the initial application to obtain the target application.

3. The method of claim 1, wherein, The step of determining the execution control result of the target application based on the target verification result includes: If the target verification result is successful, the execution control result of the target application is determined to be allowed to run; If the target verification result is a verification failure, the execution control result of the target application is determined to be interrupted loading.

4. The method of claim 1, wherein, After determining the execution control result of the target application based on the target verification result, the method further includes: During the operation of the target application, the target application is acquired at a preset period, and the target application is parsed to obtain the signature information; Based on the signature verification mechanism corresponding to the preset encryption algorithm, the signature information corresponding to the running target application is verified to obtain the monitoring result. If the monitoring result indicates that the signature verification fails, the operation of the target application is interrupted.

5. A program execution device characterized by comprising: The device includes: The acquisition module is used to acquire the signature information corresponding to the target application, wherein the target application is obtained by signing each code section contained in the initial application according to a preset encryption algorithm; The verification module is used to load the signature information and the target application into the kernel state, and verify the target application in the kernel state based on the preset configuration file and the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result; The control module is used to determine the operation control result of the target application based on the target verification result; The verification module is specifically used to separate the signature information and initial license information fields corresponding to the target application using a preset character as a separator, and to embed the signature information into the end of the initial license information field to obtain the target license information field; the end of the initial license information field is empty byte space; The verification module is specifically used for The kernel-mode signature verification component parses the target application to obtain the configuration information corresponding to the target application; the configuration information includes the program type and hook points corresponding to each code section in the target application; Obtain a preset configuration file; the preset configuration file includes matching rule information, the preset configuration file is the scope of permission set by the user for the target application configuration information, the matching rule information is defined in the form of a four-tuple including user-defined program type, hook point, operation permission and preset priority; Based on the matching rule information, the program type and hook point corresponding to each code section in the target application are matched to determine the operation permissions and preset priority of each target application; The configuration verification result corresponding to the target application is determined based on the preset priority and the operation permissions; If the configuration verification result is successful, the target permission information field is parsed and decomposed to obtain the signature information. The signature information is then verified based on the signature verification mechanism corresponding to the preset encryption algorithm to obtain the target verification result.

6. The apparatus of claim 5, wherein, The device further includes: The first parsing module is used to parse the initial application to obtain multiple code sections contained in the initial application; The signature module is used to encrypt each of the code segments based on a preset encryption algorithm to obtain signature information corresponding to each of the code segments. The write-back module is used to write the signature information back to the initial application to obtain the target application.

7. The apparatus of claim 5, wherein, The control module is specifically used to determine that the running control result of the target application is allowed to run if the target verification result is that the verification is passed; If the target verification result is a verification failure, the execution control result of the target application is determined to be interrupted loading.

8. The apparatus according to claim 5, characterized in that, The device further includes: The second parsing module is used to acquire the target application at a preset period during the operation of the target application, parse the target application, and obtain the signature information. The signature verification module is used to verify the signature information corresponding to the target application in operation based on the signature verification mechanism corresponding to the preset encryption algorithm, and obtain the monitoring result. An interrupt module is used to interrupt the operation of the target application if the monitoring result indicates that the signature information verification has failed.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images