A processor security measurement apparatus and method

Abstract

The application discloses a security measurement device and method of a processor, relates to the technical field of electronics, and is used for providing security of the processor during operation. The security measurement device comprises a processor (101) used for operating instructions in a memory (105), an access controller (103) used for controlling a processor tracker (102) to access a first storage area in the memory (105), and the processor (101) cannot access the first storage area; the processor tracker (102) is used for obtaining first address information of a first instruction in the instructions in the memory (105) and storing the first address information in the first storage area; and a security protection system (104) is used for obtaining the first address information from the first storage area and measuring security of the first instruction based on the first address information.

Description

Technical Field

[0001] This application relates to the field of electronic technology, and more particularly to a security measurement device and method for a processor. Background Technology

[0002] With the development of communication technology and the widespread adoption of mobile terminals, coupled with the openness and flexibility of mobile terminals themselves, system security issues have gradually emerged. Therefore, there is a need to design mobile terminals with security measurement functions. Security measurement typically refers to measuring the integrity of a system and / or information, and system integrity includes at least the integrity of the system image. Currently, the integrity of the mobile terminal system image is mainly guaranteed during the boot process through secure boot verification signatures, but there are no measures yet for verifying the integrity of the image during system runtime.

[0003] Currently, integrity verification applied to server system runtime is typically implemented using a Trust Platform Module (TPM) or a Trust Platform Control Module (TPCM). Both TPM and TPCM employ a hash algorithm to perform hash calculations on the program being measured, then compare the hash result with a predefined hash value (e.g., multiple valid hash values). If the hash result matches the predefined hash value, the runtime image of the system is considered intact. The difference between TPM and TPCM lies in that TPM reports the hash calculation result to a trusted server for verification, while TPCM typically performs verification locally based on the trusted server's configuration rules.

[0004] However, the aforementioned security measurement methods are vulnerable to bypass attacks. For example, a hacker could bypass the original system image and run a fake system image, thus compromising system integrity. Since the original system image remains unchanged, the security measurement module would still consider it intact. Therefore, improving system security remains a challenge. Summary of the Invention

[0005] This application provides a processor security measurement device and method, which improves processor operational security by measuring the security of instructions executed during processor operation. To achieve the above objective, this application adopts the following technical solution.

[0006] In a first aspect, a security measurement device for a processor is provided, comprising: a processor for executing instructions in memory; an access controller for controlling a processor tracker to access a first storage region in memory, wherein the first storage region may be an access region pre-assigned to the processor tracker by the access controller, and the processor cannot access the first storage region; a processor tracker for obtaining first address information of a first instruction (which may be a sequence of instructions, i.e., including multiple ordered instructions) in memory and storing the first address information in the first storage region, for example, the access controller performs access authentication on the step of the processor tracker storing the first address information in the first storage region, and allows it to store the first address information in the first storage region after successful authentication; and a security protection system for obtaining the first address information from the first storage region and measuring the security of the first instruction based on the first address information.

[0007] In the above technical solution, during the operation of the processor, a processor tracker is used to track and capture the first address information of the first instruction executed by the processor. After access authentication by the access controller, the processor tracker stores the first address information in the first storage area of ​​the memory. Since the first instruction is the instruction currently being executed by the processor and the processor cannot access the first storage area, hackers cannot tamper with the information in the first storage area through the processor. In this way, after the security protection system obtains the first address information from the first storage area, it can measure the security of the first instruction based on the first address information, thereby improving the accuracy and effectiveness of security measurement and ensuring the security of processor operation.

[0008] In one possible implementation of the first aspect, the security protection system, processor, processor tracker, and access controller are located in a system-on-a-chip (SoC). In the above possible implementations, by integrating the various units of the security measurement device into the SoC, end-to-end communication latency can be reduced, the area of ​​the security measurement device can be reduced, and the cost can be lowered.

[0009] In one possible implementation of the first aspect, the security protection system is further configured to: determine that the first instruction is secure when the first address information is within a legal address range (e.g., the legal address range includes multiple address information, and the first address information is consistent with one of the multiple address information); or determine that the first instruction is insecure when the first address information is not within a legal address range (e.g., the legal address range includes multiple address information, and the first address information is inconsistent with each of the multiple address information).

[0010] In another possible implementation of the first aspect, the security protection system is further configured to: determine that the first instruction is secure when the first address information is within the legal address range and the first instruction is consistent with the second instruction within the legal address range; or determine that the first instruction is insecure when the first address information is not within the legal address range or the first instruction is inconsistent with the second instruction within the legal address range.

[0011] The legal address range can be pre-set, or the processor can send the legal address range to the security protection system during startup so that the security protection system 104 can obtain the legal address range. The above two possible implementations provide a simple and effective way to determine the security of the first instruction. The first instruction is the instruction of the processor's current instruction, so by measuring the security of the first instruction, the security of the processor's operation can be guaranteed.

[0012] In one possible implementation of the first aspect, the first instruction includes an instruction for a monitoring thread; the security protection system is further configured to send an interrupt message to the processor, which instructs the processor to start the monitoring thread. This interrupt message may be a non-maskable interrupt message, meaning it cannot be disabled. Upon receiving the interrupt message, the processor immediately executes the task corresponding to the interrupt message. The processor is further configured to, upon receiving the interrupt message, start the instruction for the monitoring thread and trigger the processor tracker through the monitoring thread. The processor tracker is further configured to, based on the triggering of the monitoring thread, store the first address information in a first memory area. In the above possible implementation, the security protection system can trigger the processor tracker to store the first address information in the first memory area by sending an interrupt message to the processor. This allows the security protection system to obtain the first address information from the first memory area and measure the security of the first instruction based on the first address information, thereby improving the accuracy and effectiveness of the security measurement and ensuring the security of processor operation.

[0013] Furthermore, the security system is also used to send an interrupt message to the processor when a preset condition is met. This preset condition can be one of the following: the occurrence of a specified event, reaching a preset duration for sending the interrupt message. This specified event includes, but is not limited to, facial recognition events, fingerprint recognition events, unlocking events, payment events, data overwrite events, or first-time login events. Additionally, the preset duration can be pre-set; for example, it can be a fixed value or multiple varying values ​​(e.g., each value corresponding to a different time period).

[0014] In one possible implementation of the first aspect, the processor is further configured to: perform a security check on the processor's operating state information via a monitoring thread to obtain the check result, and send the check result to the security protection system. In the above possible implementations, provided the monitoring thread is deemed safe, the processor can also perform a security check on the processor's operating state information via the monitoring thread, thereby achieving fine-grained monitoring and detection of the processor's state information, and further ensuring the security of processor operation.

[0015] In one possible implementation of the first aspect, the memory further includes a second storage area for storing image information of the processor. This image information includes instructions executed by the processor; for example, it may include instructions corresponding to multiple applications or programs on the processor, as well as the processor's system files and boot files. The security protection system is also used to obtain the image information from the second storage area and measure its integrity. In the above possible implementations, the security protection system, by measuring the integrity of the processor's image information, can ensure the security of various software running on the processor, thereby ensuring the security of the processor's operation.

[0016] In one possible implementation of the first aspect, the security system is further configured to: perform a hash operation on the image information to obtain a hash value; compare the hash value with a preset hash value; determine that the image information is complete when the hash value matches the preset hash value; or determine that the image information is incomplete when the hash value does not match the preset hash value. In the above possible implementations, the security system reduces the difficulty of determining the integrity of the image information and increases the speed of integrity verification by calculating the hash value of the image information and determining the integrity of the image information based on whether the hash value matches the preset hash value.

[0017] In one possible implementation of the first aspect, the security protection system is further configured to: when it is determined that the processor is unsafe (e.g., the first instruction is unsafe, the processor's operating state information is unsafe, or the image information is incomplete), perform security protection operations on the processor. These security protection operations may include, but are not limited to: triggering alarms, resetting the processor, denying services requested by software, instructing the processor to stop running, instructing the processor to stop running software, prohibiting the processor from running at least some functions of the software, or preventing software from accessing data stored in memory. By performing security protection operations on the processor, the security of the processor can be guaranteed.

[0018] Secondly, a security measurement method for a processor is provided. This method includes: the processor executing instructions in memory; an access controller controlling a processor tracker to access a first storage region in memory, the first storage region being an access region pre-assigned to the processor tracker by the access controller, which the processor cannot access; the processor tracker obtaining the first address information of a first instruction (which can be a sequence of instructions, i.e., multiple ordered instructions) in memory from the instructions executed by the processor, and storing the first address information in the first storage region. For example, the access controller performs access authentication on the processor tracker's step of storing the first address information in the first storage region, and allows it to store the first address information in the first storage region after successful authentication; a security protection system obtains the first address information from the first storage region and measures the security of the first instruction based on the first address information.

[0019] In one possible implementation of the second aspect, the security of the first instruction is measured based on the first address information, including: determining that the first instruction is secure when the first address information is within a legal address range (for example, the legal address range includes multiple address information, and the first address information is consistent with one of the multiple address information); or determining that the first instruction is insecure when the first address information is not within a legal address range (for example, the legal address range includes multiple address information, and the first address information is inconsistent with each of the multiple address information).

[0020] In one possible implementation of the second aspect, the security of the first instruction is measured based on the first address information, including: determining that the first instruction is secure when the first address information is within the legal address range and the first instruction is consistent with a second instruction within the legal address range; or determining that the first instruction is insecure when the first address information is not within the legal address range or the first instruction is inconsistent with a second instruction within the legal address range.

[0021] In one possible implementation of the second aspect, the instructions in memory include instructions for a monitoring thread. The method further includes: the security system sending an interrupt message to the processor, which instructs the processor to start the monitoring thread. This interrupt message can be a non-maskable interrupt message, meaning it cannot be disabled. Upon receiving the interrupt message, the processor immediately executes the task corresponding to the interrupt message. Upon receiving the interrupt message, the processor starts the instructions for the monitoring thread and triggers a processor tracker through the monitoring thread. Based on the triggering of the monitoring thread, the processor tracker stores first address information in a first storage area. Further, the security system is also used to: send the interrupt message to the processor when a preset condition is met. The preset condition can be one of the following: a specified event occurs, and a preset duration for sending the interrupt message is reached. The specified event includes, but is not limited to: a face recognition event, a fingerprint recognition event, an unlocking event, a payment event, a data overwrite event, or a first login event. Additionally, the preset duration can be preset; for example, it can be a fixed value or multiple varying values ​​(e.g., each value corresponds to a different time period).

[0022] In one possible implementation of the second aspect, the method further includes: the processor performing a security check on the processor's operating state information through a monitoring thread to obtain the check result, and then sending the check result to the security protection system. That is, if the monitoring thread is determined to be safe, the processor can also perform a security check on the processor's operating state information through the monitoring thread, thereby achieving fine-grained monitoring and detection of the processor's state information.

[0023] In one possible implementation of the second aspect, the memory further includes a second storage area for storing image information of the processor. The image information includes instructions executed by the processor. For example, the image information may include instructions corresponding to multiple applications or programs on the processor, as well as system files and boot files of the processor. The method further includes: a security protection system obtaining the image information from the second storage area and measuring the integrity of the image information.

[0024] In one possible implementation of the second aspect, the security protection system measures the integrity of the mirror information by: performing a hash operation on the mirror information to obtain a hash value; comparing the hash value with a preset hash value; determining that the mirror information is complete when the hash value matches the preset hash value; or determining that the mirror information is incomplete when the hash value does not match the preset hash value.

[0025] In one possible implementation of the second aspect, the method further includes: when the security protection system determines that the processor is unsafe (e.g., the first instruction is unsafe, the processor's running state information is unsafe, or the image information is incomplete), it performs security protection operations on the processor. These security protection operations may include, but are not limited to: triggering an alarm, resetting the processor, denying the services requested by the software, instructing the processor to stop running, instructing the processor to stop running the software, prohibiting at least some functions of the software running on the processor, or preventing the software from accessing data stored in memory.

[0026] Thirdly, an electronic device is provided, including the security measurement device mentioned in the first aspect or any of its implementations, and the memory. Optionally, the electronic device is a terminal device.

[0027] Understandably, any of the security measurement methods provided above are used to perform the functions of the corresponding security measurement devices provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects of the corresponding security measurement devices provided above, and will not be repeated here. Attached Figure Description

[0028] Figure 1 A schematic diagram illustrating the integrity verification of a system image provided in an embodiment of this application;

[0029] Figure 2 A schematic diagram illustrating an attack on the integrity of a system image, provided as an embodiment of this application;

[0030] Figure 3 A schematic diagram of the hardware architecture of a security measurement device provided in an embodiment of this application;

[0031] Figure 4 A schematic diagram of software running on a processor, provided for an embodiment of this application;

[0032] Figure 5 A flowchart illustrating a security measurement method provided in an embodiment of this application;

[0033] Figure 6 A flowchart illustrating another security measurement method provided in an embodiment of this application;

[0034] Figure 7 This is a flowchart illustrating another security measurement method provided in an embodiment of this application. Detailed Implementation

[0035] In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, a and b, a and c, b and c, or a, b, and c, where a, b, and c can be single or multiple.

[0036] The embodiments of this application use terms such as "first" and "second" to distinguish objects with similar names, functions, or roles. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or order of execution. Furthermore, the words "exemplary" or "for example" in this application are used to indicate that they are examples, illustrations, or descriptions. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0037] In this embodiment, security measurement typically refers to measuring the integrity of the system and / or information, where system integrity includes at least the integrity of the system image. Security measurement can include integrity checks during system startup and integrity checks during system operation; this embodiment primarily relates to integrity checks during system operation.

[0038] In one embodiment, integrity verification during server system operation is typically implemented using a Trusted Platform Module (TPM) or a Trusted Platform Control Module (TPCM). Taking TPM as an example... Figure 1 As shown, during processor operation, TPM mainly performs security measurement by initiating trust chain measurement and remote authentication. That is, TPM measures the security of each level of image step by step according to the system startup process. The image can be stored in memory, and the location of the image in memory can be indicated by the program counter (PC) pointer. For each level of image, the security is achieved by calculating the hash value of the image and reporting the hash value to the trusted server for verification. Figure 1The following explanation uses the processor as the central processing unit (CPU) as an example.

[0039] Both TPM and TPCM use a hash algorithm to perform hash calculations on the program being measured. The hash result is then compared to a predefined hash value (e.g., multiple valid hash values). If the hash result matches the predefined hash value, the system image is considered complete. The only difference between TPM and TPCM is that TPM reports the hash calculation result to a trusted server for verification, while TPCM performs verification locally based on the trusted server's configuration.

[0040] However, the aforementioned security measurement methods are vulnerable to bypass attacks. For example, ... Figure 2 As shown, the hacker does not modify the original system image, but instead bypasses it to run a fake system image, thereby compromising the system's integrity. However, since the original system image remains unchanged, the security measurement module considers the system image to be intact. Based on this, embodiments of this application provide a processor security measurement device and method, further... Figure 1 and Figure 2 Based on the existing implementation, this method optimizes the system by tracking and capturing the processor's current execution instructions during operation and measuring the legality of the instruction address. This ensures that the processor's actual execution instructions are also legal, thereby improving the security of the system during operation.

[0041] Please refer to Figure 3 This illustration shows a hardware architecture diagram of the security measurement device 100 provided in an embodiment of this application. The security measurement device 100 may be located within an electronic device or may be the electronic device itself. This electronic device includes, but is not limited to, personal computers, server computers, handheld or laptop devices, mobile devices (such as mobile phones, tablets, personal digital assistants, media players, etc.), wearable devices, in-vehicle devices, consumer electronic devices, minicomputers, mainframe computers, mobile robots, drones, etc. A typical form of this electronic device is a terminal device, such as the mobile phone described. Specifically, the security measurement device 100 may be a chip or chipset or a circuit board carrying a chip or chipset, which can operate under necessary software drivers.

[0042] like Figure 3As shown, the security measurement device 100 includes a processor 101, a processor tracker 102, an access controller 103, and a security protection system 104. The processor 101, processor tracker 102, and access controller 103 can be integrated into a System of Chip (SoC); the security protection system 104 may or may not be integrated into the SoC. Figure 3 The example of the security protection system 104 integrated into the SoC is provided for illustration, but is not intended to limit the scope. Furthermore, the security measurement device 100 may also include a memory 105, which may or may not be integrated into the SoC. Figure 3 The example given is that the memory 105 is not integrated into the SoC.

[0043] The processor 101 may include at least one processing unit, including but not limited to a CPU, a Network Processing Unit (NPU), a Graphics Processing Unit (GPU), an Application-Specific Integrated Circuit (ASIC), or a Field-Programmable Gate Array (FPGA). The processor 101 may run an operating system and application software required for at least one function based on the operating system. For example, the operating system may include Linux, Unix, or Windows. The application software required for the at least one function may include kernel-mode software and user-mode software. The kernel-mode software may refer to software running at the kernel layer, and the user-mode software may refer to software running at the application layer. For example,... Figure 4 As shown, the kernel-mode software may include at least one thread. For example, the at least one thread may include a monitoring thread for monitoring the running status information of the processor 101, and may also include one or more threads for various drivers such as audio drivers or display drivers. Figure 4 These are collectively referred to as other kernel threads; the user-mode software may include at least one process, for example, this at least one process may include one or more processes of multiple applications such as video applications, instant messaging applications, or shopping applications. Figure 4 The following discussion uses application processes 1 to n as examples, where n is a positive integer.

[0044] Processor tracer 102 can be a microprocessor or logic circuit used to track the operation of processor 101. It is a hardware unit used to track the state of processor 101. For example, processor tracer 102 can be coupled to processor 101, specifically to the kernel of the operating system running on processor 101, to obtain the instructions executed by processor 101. Specifically, it can obtain a single instruction or a sequence of instructions (i.e., multiple ordered instructions) executed by processor 101, and store this single instruction or sequence of instructions in memory 105. Optionally, when processor 101 is an Advanced Reduced Instruction Set Machine (ARM) architecture, processor tracer 102 can be called Coresight; when processor 101 is an Intel x86 CPU, processor tracer 102 can be called a processor trace (PT). Exemplarily, processor tracer 102 can be a small processor system, independent of processor 101, used to implement the function of tracking the operation of processor 101.

[0045] Access controller 103 is typically coupled to the memory controller of memory 105 (e.g., Dynamic Random Access Memory (DRAM)). It may be a controller for access control of processor 101 and processor tracker 102 (e.g., access checking and authentication of all read and write operations to external DRAM). Access controller 103 may include logic circuitry, such as a hardware circuit structure including a large number of logic gates for implementing access control.

[0046] For example, the access controller can allocate different access address spaces to processor 101 and processor tracker 102, with each access address space corresponding to a different storage region in memory 105. Subsequently, when processor 101 or processor tracker 102 accesses memory 105, access controller 103 can perform access authentication to ensure that processor 101 and processor tracker 102 can only access memory within their respective allowed access address spaces. For instance, when processor 101 or processor tracker 102 needs to access a specific storage region in memory 105, it can access that storage region through access controller 103. Access controller 103 can determine whether the address that processor 101 or processor tracker 102 needs to access is within the corresponding allowed access address space. If the address is within the access address space, processor 101 or processor tracker 102 can be allowed to access the storage region; if the address is not within the corresponding access address space, processor 101 or processor tracker 102 can be prohibited from accessing the storage region.

[0047] The security protection system 104 can be a security measurement module, such as a TPCM (Through-Terminal Monitoring System) or other modules used for security detection. The TPCM can be controlled by a TPM (Telematics Management Device) in the server or can run independently. For example, the security protection system 104 may include a processor (such as a CPU), and may optionally include memory (such as ROM and RAM), a hash acceleration engine, and one or more timers and watchdogs. The memory may store program instructions, which the processor executes to enable the security protection system 104 to perform corresponding security protection functions. Therefore, the security protection system 104 can be understood as a small processor-like entity, independent of the processor 101, used for security measurement functions. During the operation of the processor 101, the security protection system 104 can perform security checks on the software running on the processor 101 to ensure that the software is functioning correctly. For example, it can perform security checks on the instructions loaded by the processor 101 and the data acquired to ensure that the instructions loaded by the processor 101 and the data acquired are not rewritten or are rewritten correctly, thus preventing the relevant data from being tampered with. When the security protection system 104 detects that the software running on the processor 101 has been tampered with, it can perform security protection operations on the processor 101. These security protection operations may include, but are not limited to: triggering an alarm, resetting the processor 101, denying services requested by the software, instructing the processor 101 to stop running, instructing the processor 101 to stop running the software, disabling at least some functions of the software running on the processor 101, or preventing the software from accessing data stored in the memory 105. For example, the security protection system 104 can access all storage areas in the memory 105, and can also query and set the access control configuration of the access controller 103. For instance, the security protection system 104 can query and modify the register configuration of the access controller 103 to configure the allocation rules for the access address space of the access controller 103.

[0048] The memory 105 can be the main memory of the security measurement device, and may include, but is not limited to, random access memory (RAM) and read-only memory (ROM). The memory 105 can store instructions and data. The processor 101 or the security protection system 104 can execute various functional applications and data processing of the security measurement device by loading instructions and acquiring data. Specifically, the read-only memory can store the startup key data that needs to be loaded when the processor 101 or the security protection system 104 starts. The random access memory can store the instruction code, such as the operating system or application, to be run by the processor 101 or the security protection system 104, as well as the data required for operation, and may also include various intermediate calculation results, data, or configuration data generated by the running process. The RAM can include various types of volatile memory, such as static random-access memory (SRAM), DRAM, or synchronous dynamic random-access memory (SDRAM), and non-volatile memory.

[0049] In this embodiment, processor 101 is used to execute instructions in memory 105; processor tracker 102 is used to obtain the first address information of the first instruction in memory 105 and store the first address information in a first storage area in memory 105; access controller 103 is used to control processor tracker 102 to access the first storage area in memory 105. The first storage area may be a storage area pre-allocated to processor tracker 102 by access controller 103. Processor 101 cannot access the first storage area. For example, when processor tracker 102 writes the first address information to the first storage area, access controller 103 is used to authenticate the access of processor tracker 102 (i.e., the operation of writing the first address information to the first storage area) and allow processor tracker 102 to store the first address information in the first storage area after authentication; security protection system 104 is used to obtain the first address information from the first storage area and measure the security of the first instruction based on the first address information.

[0050] The first instruction mentioned above can be a single instruction or a sequence of instructions (i.e., multiple ordered instructions). For example, the processor tracer 102 can be equipped with an address cache space that can cache 4KB of address information, so that the processor tracer 102 can obtain one or more instructions in real time and store them in the address cache space.

[0051] For example, the security protection system 104 described above can access all storage areas in the memory 105, thereby allowing the security protection system 104 to obtain the first address information by accessing the first storage area in the memory 105. When the security protection system 104 measures the security of the first instruction based on the first address information, it can be implemented in the following two possible ways, as described in detail below.

[0052] In a first possible implementation, the security protection system 104 is further configured to: determine that the first instruction is secure when the first address information is within the legal address range. For example, if the legal address range includes multiple address information and the first address information is consistent with one of these multiple address information, it can be understood that the first address information is within the legal address range, thereby determining that the first instruction is secure; or, determine that the first instruction is insecure when the first address information is not within the legal address range. For example, if the legal address range includes multiple address information and the first address information is inconsistent with each of these multiple address information, it can be understood that the first address information is not within the legal address range, thereby determining that the first instruction is insecure.

[0053] In a second possible implementation, the security protection system 104 is further configured to: determine that the first instruction is secure when the first address information is within the legal address range and the first instruction is consistent with the second instruction within the legal address range. For example, if the legal address range includes multiple address information, and the first address information is consistent with one of the multiple address information (the instruction in that address information is the second instruction), and the instruction in the first address information is the first instruction, and the first instruction is consistent with the second instruction, then the first instruction can be determined to be secure. Alternatively, if the first address information is not within the legal address range, or the first instruction is inconsistent with the second instruction within the legal address range, determine that the first instruction is insecure. For example, if the legal address range includes multiple address information, the instruction in the first address information is the first instruction, and the instructions in the multiple address information are multiple second instructions, and the first address information is inconsistent with all of the multiple address information, and the first instruction is inconsistent with all of the multiple second instructions, then the first instruction can be determined to be insecure.

[0054] In the two possible implementations described above, the legal address range can be pre-set, or the processor 101 can send the legal address range to the security protection system 104 during the startup process, so that the security protection system 104 can obtain the legal address range. The sending of the legal address range can be a one-time event, that is, it is only sent during the first startup of the operating system, and there is no need to send it again afterward. In addition, when the security protection system 104 determines that the first instruction is unsafe according to any of the two possible implementations described above, the security protection system 104 is also used to perform security protection operations on the processor 101. The security protection operations here may include, but are not limited to: triggering an alarm, resetting the processor 101, denying the service requested by the software, instructing the processor 101 to stop running, instructing the processor 101 to stop running the software, prohibiting at least some functions of the software run by the processor 101, or preventing the software from accessing the data stored in the memory 105, etc.

[0055] Furthermore, the first instruction includes instructions for the monitoring thread. That is, the processor 101 can be used to run instructions for the monitoring thread; the processor tracker 102 can be used to obtain the address information of the instructions for the monitoring thread and store the address information in the first storage area; the access controller 103 is used to authenticate the processor tracker 102's operation of storing the address information in the first storage area, and allows the processor tracker 102 to store the address information in the first storage area after successful authentication; the security protection system 104 can be used to obtain the address information of the instructions for the monitoring thread from the first storage area and measure its security.

[0056] In this embodiment, the action of the processor tracker 102 storing the address information of the monitoring thread's instructions in the first storage area can be triggered by the security protection system 104 via an interrupt. Specifically, the security protection system 104 is further configured to send an interrupt message to the processor 101, which instructs the processor 101 to start the monitoring thread (also known as scheduling or running the monitoring thread); the processor 101 is further configured to, upon receiving the interrupt message, start the instruction of the monitoring thread and trigger the processor tracker 102 through the monitoring thread; the processor tracker 102 is further configured to, based on the triggering of the monitoring thread, store the first address information in the first storage area, that is, store the address information of the monitoring thread's instructions in the first storage area.

[0057] The process by which processor 101 triggers processor tracer 102 through the monitoring thread may include: processor 101 writing to a specified register through the monitoring thread, for example, setting the value of the specified register to 1 through the monitoring thread. The initial value of the specified register can be 0 by default, and the specified register can be configured in advance. Processor tracer 102 determines whether it has been triggered by detecting the value of the specified register. If the value of the specified register is detected as 1, it is determined that it has been triggered; if the value of the instruction register is detected as not being 1, it is determined that it has not been triggered. Alternatively, processor 101 sends a trigger message to processor tracer 102 through the monitoring thread. This trigger message instructs processor tracer 102 to store the acquired address information in a first memory area, so that when processor tracer 102 receives the trigger message, it can determine that it has been triggered. Alternatively, processor 101 executes relevant instructions of processor tracer 102 through the monitoring thread to trigger processor tracer 102.

[0058] Furthermore, the interrupt information sent by the security protection system 104 to the processor 101 can be a nonmaskable interrupt (NMI) message, meaning that the interrupt information cannot be disabled, and the processor 101 will immediately execute the task corresponding to the interrupt information upon receiving it. In practical applications, the interrupt information can also be replaced with other nonmaskable messages, which can be used to instruct the processor 101 to start a monitoring thread. The processor 101 will also immediately execute the task corresponding to the message upon receiving it.

[0059] In one possible implementation, the security protection system 104 can also be used to send an interrupt message to the processor 101 when a preset condition is determined to be met. This preset condition can be one of the following: the occurrence of a specified event, or the completion of a preset duration for sending the interrupt message. The specified event includes, but is not limited to, face recognition events, fingerprint recognition events, unlocking events, payment events, data rewriting events, or first login events. Furthermore, the preset duration can be set in advance; for example, it can be a fixed value or multiple varying values ​​(e.g., each value corresponds to a different time period). This embodiment of the application does not impose specific limitations on this.

[0060] Optionally, the aforementioned monitoring thread can be any thread in the kernel corresponding to the processor 101, or it can be a thread in the kernel used to monitor the running status information of the processor 101. When the monitoring thread is a thread in the kernel used to monitor the running status information of the processor, the processor 101 is also used to perform a security check on the running status information of the processor 101 through the monitoring thread to obtain the check result, and send the check result to the security protection system 104.

[0061] The running status information may include coarse-grained status information related to the operation of the processor 101, such as one or more information including memory consumption status, page table status, and register read / write status. And / or, the running status information may also include fine-grained status information related to the operation of the processor 101, such as one or more information including page table range, health status of each execution stack, local variables, global variables, and critical registers.

[0062] Specifically, after the processor 101 starts the monitoring thread, the monitoring thread can acquire one or more runtime status information of the processor 101 and perform security checks on each runtime status information to obtain the check result. For example, if the runtime status information includes critical registers, the monitoring thread can determine whether the value of the critical register is consistent with a preset value. If they are consistent, the critical register is safe; if they are inconsistent, the critical register is unsafe. Alternatively, if the runtime status information also includes global variables, the monitoring thread can determine whether the address range accessed by the global variable is within a preset access address range. If it is within the preset access address range, the global variable is safe; if it is not within the preset access address range, the global variable is unsafe. Subsequently, when the processor 101 determines the check results of these multiple runtime status information through the monitoring thread, the processor 101 can also send the check results to the security protection system 104. Furthermore, when the security protection system 104 receives the inspection result, if there is an insecure inspection result in the inspection result, the security protection system 104 can also perform security protection operations on the processor 101. These security protection operations are consistent with those described above, and will not be repeated here. In practical applications, if the monitoring thread is damaged by a malicious program (e.g., modified or deleted), then according to the method described above, after the security protection system 104 issues an interrupt message to the processor 101, if it determines that the first instruction corresponding to the first address information is illegal (i.e., it determines that the instruction currently being executed by the processor 101 is illegal), it can determine that the monitoring thread has been damaged, thereby determining that the processor 101 has been attacked.

[0063] Furthermore, such as Figure 3 As shown, the memory 105 may further include a second storage area for storing image information of the processor 101, which includes instructions executed by the processor 101. Specifically, the image information may include all file information on the processor 101, such as instructions corresponding to all applications or programs on the processor 101, as well as system files and boot files of the processor 101.

[0064] Furthermore, the security protection system 104 can access all storage areas in the memory 105, thereby allowing the security protection system 104 to obtain the mirror information and measure its integrity by accessing the second storage area in the memory 105. Specifically, the process by which the security protection system 104 measures the integrity of the mirror information can be as follows: performing a hash operation on the mirror information to obtain a hash value; comparing the hash value with a preset hash value; determining that the mirror information is complete when the hash value matches the preset hash value, or determining that the mirror information is incomplete when the hash value does not match the preset hash value. Furthermore, if the mirror information is determined to be incomplete, the security protection system 104 can also perform the aforementioned security protection operations.

[0065] In the security measurement device provided in this application embodiment, during the operation of the processor 101, the processor tracker 102 tracks and captures the first address information of the first instruction executed by the processor 101, and the access controller 103 controls the processor tracker 102 to store the first address information in the first storage area in the memory 105. Since the first instruction is the instruction currently executed by the processor 101, and the processor 101 cannot access the first storage area, hackers cannot tamper with the information in the first storage area through the processor 101. Even if the integrity of the processor 101 is compromised by bypassing the original system image and running a fake system image, the security protection system 104 can still measure the security of the first instruction based on the first address information obtained from the first storage area, thereby improving the accuracy and effectiveness of security measurement and ensuring the security of the processor 101.

[0066] Figure 5 This is a flowchart illustrating a processor security measurement method provided in an embodiment of this application. This method can be applied to... Figure 3 In the safety measurement device shown, see Figure 5 The method includes: S201. Processor 101 executes instructions in memory 105; S202. Processor tracker 102 obtains the first address information of the first instruction in memory 105; S203. Processor tracker 102 stores the first address information in a first storage area in memory 105, wherein access controller 103 can authenticate the access of processor tracker 102 (i.e., the operation of writing the first address information in the first storage area), and after authentication, allow processor tracker 102 to store the first address information in the first storage area, and processor 101 cannot access the first storage area; S204. Security protection system 104 is used to obtain the first address information from the first storage area and measure the security of the first instruction based on the first address information.

[0067] The first instruction can be a single instruction or a sequence of instructions (i.e., multiple ordered instructions). For example, the processor tracker 102 may have an address cache space that can cache 4KB of address information, allowing the processor tracker 102 to retrieve one or more instructions in real time and store them in the address cache space. Alternatively, the first storage area may be a storage area pre-allocated to the processor tracker 102 by the access controller 103. The processor 101 cannot access the first storage area; for example, the access controller 103 may pre-send the address information corresponding to the first storage area to the processor tracker 102.

[0068] In one possible implementation, the security protection system 104 measures the security of the first instruction based on the first address information by: determining that the first instruction is secure when the first address information is within the legal address range; or determining that the first instruction is insecure when the first address information is not within the legal address range. In another possible implementation, the security protection system 104 measures the security of the first instruction based on the first address information by: determining that the first instruction is secure when the first address information is within the legal address range and the first instruction is consistent with a second instruction within the legal address range; or determining that the first instruction is insecure when the first address information is not within the legal address range or the first instruction is inconsistent with a second instruction within the legal address range.

[0069] In the two possible implementations described above, the legal address range can be pre-set, or the processor 101 can send the legal address range to the security protection system 104 during startup, so that the security protection system 104 can obtain the legal address range. Furthermore, when the security protection system 104 determines that the first instruction is unsafe according to either of the two possible implementations described above, the security protection system 104 is also used to perform security protection operations on the processor 101. These security protection operations may include, but are not limited to: triggering an alarm, resetting the processor 101, denying the service requested by the software, instructing the processor 101 to stop running, instructing the processor 101 to stop running the software, prohibiting at least some functions of the software run by the processor 101, or preventing the software from accessing data stored in the memory 105, etc.

[0070] Furthermore, the first instruction includes instructions for the monitoring thread. That is, processor 101 executes instructions for the monitoring thread; processor tracer 102 obtains the address information of the instructions for the monitoring thread; access controller 103 controls processor tracer 102 to store the address information in the first storage area. Optionally, the action of processor tracer 102 storing the address information of the instructions for the monitoring thread in the first storage area can be triggered by security protection system 104 via an interrupt.

[0071] Specifically, such as Figure 6 As shown, the method further includes the following steps: S205. The security protection system 104 sends an interrupt message to the processor 101, which instructs the processor 101 to start a monitoring thread; S206. When the processor 101 receives the interrupt message, it starts the instruction of the monitoring thread, that is, runs the monitoring thread; S207. The processor 101 triggers the processor tracker 102 through the monitoring thread, so that the processor tracker 102 stores the first address information in the first storage area based on the trigger of the monitoring thread, that is, the address information of the instruction of the monitoring thread is stored in the first storage area through the above S203. Specifically, the access controller 103 can control the processor tracker 102 to store the address information of the instruction of the monitoring thread in the first storage area.

[0072] The process by which processor 101 triggers processor tracer 102 through the monitoring thread may include: processor 101 writing to a specified register through the monitoring thread, for example, setting the value of the specified register to 1 through the monitoring thread. The initial value of the specified register can be 0 by default, and the specified register can be configured in advance. Processor tracer 102 determines whether it has been triggered by detecting the value of the specified register. For example, if the value of the specified register is detected to be set to 1, it is determined that it has been triggered; if the value of the instruction register is detected to be not 1, it is determined that it has not been triggered. Alternatively, processor 101 sends a trigger message to processor tracer 102 through the monitoring thread. This trigger message instructs processor tracer 102 to store the acquired address information in a first memory area, so that when processor tracer 102 receives the trigger message, it can determine that it has been triggered.

[0073] Furthermore, the interrupt information sent by the security protection system 104 to the processor 101 can be a nonmaskable interrupt (NMI) message, meaning that the interrupt information cannot be disabled, and the processor 101 will immediately execute the task corresponding to the interrupt information upon receiving it. In practical applications, the interrupt information can also be replaced with other nonmaskable messages, which can be used to instruct the processor 101 to start a monitoring thread. The processor 101 will also immediately execute the task corresponding to the message upon receiving it.

[0074] Optional, such as Figure 6 As shown, the method further includes the following step: S208. The security protection system 104 determines that a preset condition is met. The preset condition can be one of the following: a specified event occurs, and a preset duration for sending the interruption information is reached. The specified event includes, but is not limited to: a face recognition event, a fingerprint recognition event, an unlocking event, a payment event, a data rewriting event, or a first login event. Furthermore, the preset duration can be set in advance. For example, the preset duration can be a fixed value or multiple varying values ​​(e.g., each value corresponds to a different time period). This embodiment of the application does not impose specific limitations on this.

[0075] Furthermore, the aforementioned monitoring thread can be any thread within the kernel running the processor 101, or it can be a thread within the kernel used to monitor the running status information of the processor 101. When the monitoring thread is a thread within the kernel used to monitor the running status information of the processor, the processor 101 is also used to perform a security check on the running status information of the processor 101 through the monitoring thread to obtain the check result, and send the check result to the security protection system 104. Optionally, when the security protection system 104 receives the check result, if there is an unsafe check result in the check result, the security protection system 104 can also perform a security protection operation on the processor 101. This security protection operation is consistent with the security protection operation described above, and will not be repeated here in this embodiment.

[0076] The running status information may include coarse-grained status information related to the operation of the processor 101, such as one or more information including memory consumption status, page table status, and register read / write status. And / or, the running status information may also include fine-grained status information related to the operation of the processor 101, such as one or more information including page table range, health status of each execution stack, local variables, global variables, and critical registers.

[0077] Specifically, after the processor 101 starts the monitoring thread, the monitoring thread can obtain one or more running status information of the processor 101 and perform a security check on each running status information to obtain the check result. For example, if the running status information includes critical registers, the monitoring thread can determine whether the value of the critical register is consistent with the preset value. If they are consistent, the critical register can be determined to be safe; if they are inconsistent, the critical register can be determined to be unsafe. Alternatively, if the running status information also includes global variables, the monitoring thread can determine whether the address range accessed by the global variable is within the preset access address range. If it is within the preset access address range, the global variable can be determined to be safe; if it is not within the preset access address range, the global variable can be determined to be unsafe.

[0078] Furthermore, the memory 105 may also include a second storage area for storing image information of the processor 101, which includes instructions executed by the processor 101. Specifically, the image information may include all file information on the processor 101, such as instructions corresponding to all applications or programs on the processor 101, as well as system files and boot files of the processor 101.

[0079] Correspondingly, such as Figure 7 As shown, the method further includes: S209. The security protection system 104 obtains the image information from the second storage area and measures the integrity of the image information. Specifically, the process by which the security protection system 104 measures the integrity of the image information can be: performing a hash operation on the image information to obtain a hash value; comparing the hash value with a preset hash value; when the hash value matches the preset hash value, determining that the image information is complete, or when the hash value does not match the preset hash value, determining that the image information is incomplete; furthermore, if it is determined that the image information is incomplete, the above-mentioned security protection operation can be performed. The above step S209 can be located after S208 and before S205, and after the measurement result indicates that the image information is complete, an interrupt information is sent to the processor 101 through the above-mentioned S205.

[0080] It should be noted that the specific implementation process of steps S201-S209 above can be found in [reference needed]. Figure 3 and Figure 4 The relevant descriptions of the processor 101, processor tracker 102, access controller 103, and security protection system 104 in the device embodiments described herein will not be repeated here.

[0081] In the security measurement method provided in this application embodiment, during the operation of the processor 101, the processor tracker 102 is used to track and capture the first address information of the first instruction executed by the processor 101, and the access controller 103 controls the processor tracker 102 to store the first address information in the first storage area in the memory 105. Since the first instruction is the instruction currently executed by the processor 101, and the processor 101 cannot access the first storage area, hackers cannot tamper with the information in the first storage area through the processor 101. Therefore, after the security protection system 104 obtains the first address information from the first storage area, it can measure the security of the first instruction based on the first address information, thereby improving the accuracy and effectiveness of the security measurement, and thus ensuring the security of the processor 101.

[0082] Finally, it should be noted that the above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A security measurement device for a processor, characterized in that, The security measurement device is a chip or a chipset, and the device includes: A processor is used to execute instructions stored in memory; An access controller is used to control the processor tracker to access a first storage region in the memory, where the processor cannot access the first storage region. The processor tracker is used to obtain the first address information of the first instruction in the instruction in the memory, and store the first address information in the first memory area; The security protection system is used to obtain the first address information from the first storage area and measure the security of the first instruction based on the first address information; when the first address information is within the legal address range, the first instruction is determined to be secure; or, when the first address information is not within the legal address range, the first instruction is determined to be insecure; when the security protection system determines that the first instruction is insecure, the security protection system is also used to perform security protection operations on the processor. The first instruction includes instructions for monitoring the thread; The security protection system is also used to send interrupt information to the processor, the interrupt information being used to instruct the processor to start the monitoring thread; The processor is also configured to, upon receiving the interrupt information, initiate the instruction to start the monitoring thread and trigger the processor tracker through the monitoring thread; The processor tracker is also used to store the first address information in the first storage area based on the triggering of the monitoring thread.

2. The apparatus according to claim 1, characterized in that, The security protection system, the processor, the processor tracker, and the access controller are located in a system-on-a-chip (SoC).

3. The apparatus according to claim 1 or 2, characterized in that, The security system is also used for: When the first address information is within the legal address range and the first instruction is consistent with the second instruction within the legal address range, the first instruction is determined to be secure. or, When the first address information is not within the legal address range, or when the first instruction is inconsistent with the second instruction within the legal address range, the first instruction is determined to be insecure.

4. The apparatus according to claim 1 or 2, characterized in that, The processor is also used for: The monitoring thread performs a security check on the processor's operating status information to obtain the check results, and then sends the check results to the security protection system.

5. The apparatus according to claim 1 or 2, characterized in that, The memory further includes a second storage area for storing image information of the processor, the image information including the instructions; The security protection system is also used to obtain the image information from the second storage area and measure the integrity of the image information.

6. The apparatus according to claim 5, characterized in that, The security system is also used for: Perform a hash operation on the image information to obtain a hash value; Compare the hash value with the preset hash value; When the hash value matches the preset hash value, it is determined that the mirror information is complete; or, When the hash value is inconsistent with the preset hash value, the image information is determined to be incomplete.

7. A security measurement method for a processor, characterized in that, The method, applied to a security measurement device, which is a chip or chipset, includes a processor, an access controller, a processor tracker, and a security protection system, and comprises: The processor executes instructions from memory; The access controller controls the processor tracker to access a first storage region in the memory, which the processor cannot access; The processor tracker obtains the first address information of the first instruction in the instruction in the memory, and stores the first address information in the first storage area; The security protection system obtains the first address information from the first storage area and measures the security of the first instruction based on the first address information; when the first address information is within the legal address range, the first instruction is determined to be secure; or, when the first address information is not within the legal address range, the first instruction is determined to be insecure; when the security protection system determines that the first instruction is insecure, the security protection system also performs security protection operations on the processor. The instructions in the memory include instructions for monitoring threads, and the method further includes: The security protection system sends an interrupt message to the processor, the interrupt message being used to instruct the processor to start the monitoring thread; When the processor receives the interrupt information, it initiates the instruction to start the monitoring thread and triggers the processor tracker through the monitoring thread. The processor tracker stores the first address information in the first storage area based on the triggering of the monitoring thread.

8. The method according to claim 7, characterized in that, The method of measuring the security of the first instruction based on the first address information includes: When the first address information is within the legal address range, and the first instruction is consistent with the second instruction within the legal address range, the first instruction is determined to be secure; or, When the first address information is not within the legal address range, or when the first instruction is inconsistent with the second instruction within the legal address range, the first instruction is determined to be insecure.

9. The method according to claim 7 or 8, characterized in that, The method further includes: The processor performs a security check on its operating status information through the monitoring thread to obtain the check result, and then sends the check result to the security protection system.

10. The method according to claim 7 or 8, characterized in that, The memory further includes a second storage area for storing image information of the processor, the image information including the instructions, and the method further includes: The security protection system obtains the image information from the second storage area and measures the integrity of the image information.

11. The method according to claim 10, characterized in that, The security protection system measures the integrity of the mirrored information, including: Perform a hash operation on the image information to obtain a hash value; Compare the hash value with the preset hash value; When the hash value matches the preset hash value, it is determined that the mirror information is complete; or, When the hash value is inconsistent with the preset hash value, the image information is determined to be incomplete.

Images