A method and system for detecting integrity of an operating system

Abstract

The present invention discloses a method and system for detecting the integrity of an operating system, the method comprising: constructing a sandbox environment, the sandbox environment being used to run the operating system of a computing device; binding the kernel information, peripheral device information and running information of the operating system to the sandbox environment; in the sandbox environment, detecting whether the system boot, kernel driver, file system, self-starting service and desktop environment of the operating system are normal; determining the integrity of the operating system according to the detection results of the system boot, kernel driver, file system, self-starting service and desktop environment. By the method of the present invention, the integrity of the operating system can be determined by detecting whether the operating system is abnormal.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, system, computing device and readable storage medium for detecting the integrity of an operating system. Background Art

[0002] The operating system is a computer program that manages computer hardware and software resources. The integrity detection of the operating system is an important means to ensure the normal operation of the operating system. However, the current integrity detection scheme of the operating system has many defects.

[0003] The existing Chinese patent with authorization announcement number CN107301082A discloses an operating system integrity protection method, which uses a trusted measurement method to identify whether the operating system meets the normal operation requirements. However, since the operating system integrity detection method using trusted measurement requires the establishment of a trusted benchmark library, and the detection measurement parameters are heavily dependent on the library, the scheme has at least the following three defects. First: poor usability. The prior art heavily relies on the trusted benchmark library module, and the trusted benchmark module is equivalent to a standard operating system, which is difficult to implement and has a high workload. Second: poor compatibility and scalability. The trusted benchmark library module and the operating system core module are highly coupled. Once the operating system is upgraded, the trusted benchmark library module also needs to be upgraded, and its compatibility and scalability are poor. Third: poor reliability. The prior art is a static comparative analysis method. As long as a difference is detected, a warning is immediately issued. There is no dynamic simulation operation to determine whether the modification is reasonable, resulting in many users' correct modifications being regarded as unsafe modifications, affecting the reliability of the detection.

[0004] Therefore, a method for detecting the integrity of an operating system is needed to solve the problems existing in the prior art solutions. Summary of the invention

[0005] To this end, the present invention provides an operating system integrity detection method, system, computing device and readable storage medium to solve or at least alleviate the above problems.

[0006] According to one aspect of the present invention, there is provided a method for detecting the integrity of an operating system, which is executed in a computing device, and comprises: constructing a sandbox environment, the sandbox environment being used to run the operating system of the computing device; binding the kernel information, peripheral device information and running information of the operating system to the sandbox environment; in the sandbox environment, detecting whether the system boot, kernel driver, file system, auto-start service and desktop environment of the operating system are normal; and determining the integrity of the operating system according to the detection results of the system boot, kernel driver, file system, auto-start service and desktop environment.

[0007] Optionally, in the method for detecting the integrity of an operating system according to the present invention, the step of binding the kernel information, peripheral device information and running information of the operating system to the sandbox environment includes: binding the files in the / proc, / sys, and / dev directories of the operating system to the / proc, / sys, and / dev directories of the sandbox environment, respectively, wherein the / proc directory stores the kernel information of the operating system, the / sys directory stores the peripheral device information of the operating system, and the / dev directory stores the running information of the operating system.

[0008] Optionally, in the method for detecting the integrity of the operating system according to the present invention, the step of detecting whether the system boot of the operating system runs normally includes: binding the files in the / boot directory of the operating system to the / boot directory of the sandbox environment; checking whether the boot configuration file in the sandbox environment has syntax errors; if there are syntax errors, determining that the system boot runs abnormally.

[0009] Optionally, in the method for detecting the integrity of the operating system according to the present invention, the step of detecting whether the kernel driver of the operating system is operating normally includes: determining one or more peripheral devices corresponding to the operating system; detecting whether the driver information corresponding to each of the one or more peripheral devices is correct; if the detection result is incorrect, determining that the kernel driver is operating abnormally.

[0010] Optionally, in the method for detecting the integrity of the operating system according to the present invention, the step of detecting whether the file system of the operating system is operating normally includes: binding the files in the directory to be checked in the operating system to the directory corresponding to the sandbox environment; detecting the file permissions, file paths, and file integrity of the directory to be checked bound to the sandbox environment; if the detection result is abnormal, it is determined that the file system is operating abnormally.

[0011] Optionally, in the method for detecting the integrity of the operating system according to the present invention, the step of detecting whether the self-starting service of the operating system is running normally includes: running the self-starting service in a directory where the self-starting service is stored in a sandbox environment; detecting the running status of the self-starting service; if the detection result is abnormal, determining that the self-starting service is running abnormally.

[0012] Optionally, in the method for detecting the integrity of the operating system according to the present invention, the step of detecting whether the desktop environment of the operating system is running normally includes: running the display management service, Xserver service and / or the upper desktop environment, and detecting whether they are all running normally; if they are running normally, checking whether there is a process related to the desktop environment in the directory storing the kernel information of the operating system in the sandbox environment; if not, determining that the desktop environment is running abnormally; if it is running abnormally, determining that the desktop environment is running abnormally.

[0013] Optionally, in the method for detecting the integrity of the operating system according to the present invention, the step of determining the integrity of the operating system based on the detection results of the boot process, kernel driver, file system, auto-start service, and desktop environment includes: if the detection results of the boot process, kernel driver, file system, auto-start service, and desktop environment are all normal, then it is determined that the operating system is complete.

[0014] According to another aspect of the present invention, a system for detecting the integrity of an operating system is provided, comprising: a sandbox environment construction unit, adapted to: construct a sandbox environment, the sandbox environment is used to run the operating system of a computing device, and is also adapted to bind the kernel information, peripheral device information and running information of the operating system to the sandbox environment; a detection unit, adapted to: in the sandbox environment, detect whether the system boot, kernel driver, file system, self-starting service, and desktop environment of the operating system are normal, and is also adapted to determine the integrity of the operating system based on the detection results of the system boot, kernel driver, file system, self-starting service, and desktop environment.

[0015] According to another aspect of the present invention, there is provided a computing device, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for being executed by the at least one processor, and the program instructions include instructions for executing the method as described above.

[0016] According to another aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the method described above.

[0017] According to the method for detecting the integrity of the operating system of the present invention, by simulating the running of the five modules of the operating system, namely, system boot, kernel driver, file system, auto-start service, and desktop environment, in a sandbox environment, it is detected whether there is an abnormality in the simulated operating system, so as to determine the integrity of the operating system.

[0018] Furthermore, the feedback of the abnormal information serves as an early warning, so that the user can modify the corresponding module according to the fed-back abnormal information to avoid the inability to enter the real operating system after restart due to an incomplete operating system.

[0019] According to the detection method of the operating system integrity of the present invention, the coupling degree between the modules is low, and each module can run independently in the sandbox environment. The scalability is strong and the maintenance is simple. The sandbox environment constructed by Chroot is highly compatible with various operating system environments.

[0020] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] To achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings, which indicate various ways in which the principles disclosed herein can be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The above and other purposes, features and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout the present disclosure, the same reference numerals generally refer to the same parts or elements.

[0022] Figure 1 A schematic diagram of a computing device 100 according to one embodiment of the present invention is shown;

[0023] Figure 2 A flowchart showing a method 200 for detecting operating system integrity according to an embodiment of the present invention; and

[0024] Figure 3 A schematic diagram of an operating system integrity detection system 300 is shown. DETAILED DESCRIPTION

[0025] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0026] The operating system integrity detection method of the present invention is executed in a computing device. The computing device can be any device with storage and computing capabilities, which can be implemented as a server, workstation, etc., or as a personal computer such as a desktop computer, a notebook computer, or as a terminal device such as a mobile phone, a tablet computer, a smart wearable device, an Internet of Things device, but is not limited thereto.

[0027] Figure 1 FIG. 1 is a schematic diagram of a computing device 100 according to an embodiment of the present invention. It should be noted that: Figure 1 The computing device 100 shown is only an example. In practice, the computing device used to implement the operating system integrity detection method of the present invention can be any type of device, and its hardware configuration can be different from the above. Figure 1 The computing device 100 shown is the same as Figure 1 The computing device 100 shown is different. In practice, the computing device used to implement the operating system integrity detection method of the present invention can be Figure 1 The hardware components of the computing device 100 shown are increased or deleted, and the present invention does not limit the specific hardware configuration of the computing device.

[0028] like Figure 1 As shown, in a basic configuration 102, computing device 100 typically includes system memory 106 and one or more processors 104. A memory bus 108 may be used for communication between processor 104 and system memory 106.

[0029] Depending on the desired configuration, the processor 104 can be any type of processor, including but not limited to: a microprocessor (μP), a microcontroller (μC), a digital information processor (DSP), or any combination thereof. The processor 104 can include one or more levels of cache such as a first-level cache 110 and a second-level cache 112, a processor core 114, and registers 116. An example processor core 114 can include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 118 can be used with the processor 104, or in some implementations, the memory controller 118 can be an internal part of the processor 104.

[0030] Depending on the desired configuration, the system memory 106 can be any type of memory, including but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.) or any combination thereof. The physical memory in the computing device generally refers to the volatile memory RAM, and the data in the disk needs to be loaded into the physical memory before it can be read by the processor 104. The system memory 106 may include an operating system 120, one or more applications 122, and program data 124. In some embodiments, the application 122 may be arranged to execute instructions on the operating system by one or more processors 104 using program data 124. The operating system 120 may be, for example, Linux, Windows, etc., which includes program instructions for processing basic system services and performing tasks that depend on hardware. The application 122 includes program instructions for implementing various user-desired functions, and the application 122 may be, for example, a browser, instant messaging software, a software development tool (such as an integrated development environment IDE, a compiler, etc.), etc., but is not limited thereto. When the application 122 is installed in the computing device 100, a driver module may be added to the operating system 120.

[0031] When the computing device 100 starts running, the processor 104 reads and executes the program instructions of the operating system 120 from the memory 106. The application 122 runs on the operating system 120 and uses the interfaces provided by the operating system 120 and the underlying hardware to implement various functions desired by the user. When the user starts the application 122, the application 122 is loaded into the memory 106, and the processor 104 reads and executes the program instructions of the application 122 from the memory 106.

[0032] Computing device 100 also includes a storage device 132 including a removable storage 136 and a non-removable storage 138 , both of which are connected to storage interface bus 134 .

[0033] The computing device 100 may also include an interface bus 140 that facilitates communication from various interface devices (e.g., output devices 142, peripheral interfaces 144, and communication devices 146) to the basic configuration 102 via the bus / interface controller 130. Example output devices 142 include a graphics processing unit 148 and an audio processing unit 150. They can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 152. Example peripheral interfaces 144 may include a serial interface controller 154 and a parallel interface controller 156, which may be configured to facilitate communication with external devices such as input devices (e.g., keyboards, mice, pens, voice input devices, touch input devices) or other peripherals (e.g., printers, scanners, etc.) via one or more I / O ports 158. Example communication devices 146 may include a network controller 160, which may be arranged to facilitate communication with one or more other computing devices 162 via a network communication link via one or more communication ports 164.

[0034] A network communication link can be an example of a communication medium. Communication media can generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium. A "modulated data signal" can be a signal in which one or more of its data sets or its changes can be carried out in a manner that encodes information in the signal. As non-limiting examples, communication media can include wired media such as a wired network or a dedicated line network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable medium used herein can include both storage media and communication media.

[0035] In the computing device 100 according to the present invention, the operating system 120 includes instructions for executing the detection method of the operating system integrity of the present invention, and the instructions can instruct the processor 104 to execute the detection method of the operating system integrity of the present invention. It should be noted that the operating system targeted by the method of the present invention can be any operating system, such as Linux, Windows, and the detection method of the operating system integrity of the present invention is not limited to the specific type of operating system.

[0036] Figure 2The flowchart of the detection method 200 of the integrity of the operating system according to an embodiment of the present invention is shown. The present invention adopts the sandbox simulation technology to realize the detection of the integrity of the operating system. Sandbox is a security mechanism in the field of computer security, which provides an isolated environment for the running program. Sandbox simulation technology simulates the operation of the system on the basis of realizing the security isolation of the system and detects the system failure. The sandbox simulation environment can be realized by chroot. In the sandbox simulation environment, the modules that need to be simulated are added, such as: the boot system boot module, the kernel driver module, the file system module, the self-starting service module, and the desktop environment module, the functions of the modules are run, and the running results are monitored, so as to achieve the effect of simulating the detection of the operating system. Among them, the chroot (i.e. Change Root) mechanism can change the location of the root directory referenced when the program is executed, limit the process to the specified directory, ensure that the process can only act on the files of the specified directory and its subdirectories, limit what the user can do, and thus can enhance the security of the system.

[0037] like Figure 2 As shown, the method 200 starts at step S210 .

[0038] In step S210 , a sandbox environment is constructed, wherein the sandbox environment is used to run an operating system of a computing device.

[0039] According to one embodiment of the present invention, chroot can be used to implement a sandbox simulation environment, and the key system directory (such as / bin / etc / lib) of the operating system to be detected is copied to a temporary directory (tmp) established in the / root directory as a chroot operating environment. In this way, the information copied to the sandbox environment can be viewed in the sandbox environment. Specifically, a temporary directory can be established in the / root directory by command mkdir / root / tmp. Then, the key system directory of the operating system to be detected can be copied to the temporary directory by command cp / bin / * / root / tmp. Here, the / bin directory is taken as an example, and other key system directories can also be copied in a similar manner.

[0040] According to the operating system integrity detection method of the present invention, the operation of the operating system is simulated in a sandbox environment. If the operating system executing the method is checked, its operating environment is the existing operating environment of the operating system to be detected. No other configuration is required, and the method is easy to use.

[0041] Then, in step S220, the kernel information, peripheral device information and operation information of the operating system to be detected are bound to the sandbox environment.

[0042] Specifically, the files in the / proc, / sys, and / dev directories of the operating system to be tested are bound to the / proc, / sys, and / dev directories of the sandbox environment, respectively, wherein the / proc directory stores the kernel information of the operating system to be tested, and / proc is a pseudo file system (i.e., a virtual file system) that stores a series of special files of the current operating system kernel running status. Users can view information about the operating system hardware and currently running processes through these files, and can also change the kernel running status by changing some of these files. The / sys directory stores the peripheral device information of the operating system to be tested, and / sys exports the information of various kernel subsystems, hardware devices, and related device drivers from the kernel's device model to the user space, thereby providing a set of virtual files. The / dev directory stores the running information of the operating system to be tested. The / dev directory stores all external devices recognized by the kernel.

[0043] According to one embodiment of the present invention, the system / proc / dev / sys can be bound to the corresponding / proc / dev / sys directory in the sandbox environment through the mount--bind command, so as to monitor and check the operating system processes and access to peripherals in the sandbox environment.

[0044] According to the method for detecting the integrity of the operating system of the present invention, whether the operating system is normal is based on the detection result, and false alarms will not be caused by normal modifications to system files by users, and the reliability is high.

[0045] Then, in step S230, in the sandbox environment, it is detected whether the system booting of the operating system is normal.

[0046] According to one embodiment of the present invention, first, the files in the / boot directory of the operating system to be detected are bound to the / boot directory of the sandbox environment, and the binding can be performed by the mount--bind command. Then, check whether the boot configuration file in the sandbox environment has syntax errors. Optionally, check whether the boot configuration file grub.cfg has syntax errors by running grub-script-check. When the operating system boots up, the grub program boots up the operating system according to the configuration parameters of the boot configuration file. If there is a syntax error in the boot configuration file, the boot of the operating system will fail, resulting in the failure of the operating system to start. Here, if it is checked that there is a syntax error in the boot configuration file, it can be determined that the system boot is abnormal, and the error can be warned. The boot configuration file can also be regenerated to repair the error, and grub.cfg can be regenerated by the grub-install command. Optionally, the path and / or peripheral device information in the sandbox environment is checked. Specifically, the path or device information of the peripheral device in the sandbox environment can be checked by the grub-probe command. If the detection result is abnormal, the abnormal information is fed back. The following is an example of exception information: grub-probe: warning: disk does not exist, so falling back to partition device / dev / vda1. The feedback from the exception information indicates that the operating system did not find the device.

[0047] According to another embodiment of the present invention, an operating system boot program is executed in a sandbox environment to detect whether the boot process of the operating system is normal. When executing the operating system boot program, if there is an error in the operating system, the operating system will fail, and it can be determined that the system boot is abnormal. At this time, abnormal information of the operating system boot failure can be fed back.

[0048] According to an embodiment of the present invention, a method for checking whether there are syntax errors in the boot configuration file in the sandbox environment is written into the operating system boot detection function grub-run(), so as to detect whether the system boot of the operating system is normal by executing the operating system boot detection function echogrub-run().

[0049] Then, in step S240, in the sandbox environment, it is detected whether the kernel driver of the operating system is normal.

[0050] Specifically, in a sandbox environment, determine one or more peripheral devices corresponding to the operating system, detect whether the driver information corresponding to each peripheral device in the one or more peripheral devices is correct, and if the detection result is incorrect, determine that the kernel driver is abnormal. According to an embodiment of the present invention, the peripheral device (i.e., pci device) information and driver information of the operating system are compared, and the hardware information of all peripheral devices can be viewed through the lspci command, and each peripheral device and its associated driver information can be queried through the hwinfo command. When it is found that the driver information corresponding to the peripheral device does not exist or there is a difference in the driver information corresponding to the / sys directory, an exception can be thrown and the abnormal information is fed back. In addition, the kernel driver can also be judged whether it is abnormal by running the update-initramfs-u command, and the operation result obtained. If the operation result is abnormal, the abnormal information is fed back.

[0051] Optionally, a method for detecting peripheral device information corresponding to the operating system and driver information associated with each peripheral device is written into a kernel driver detection function initramfs-run(), so as to detect whether the kernel driver of the operating system is normal by executing the kernel driver detection function echo initramfs-run().

[0052] Then, in step S250, in the sandbox environment, it is detected whether the file system of the operating system is normal.

[0053] According to an embodiment of the present invention, the files in the directory to be checked in the operating system are bound to the directory corresponding to the sandbox environment. For example, if the key directory to be checked is / etc, the files under the / etc directory are bound to the / etc directory in the sandbox environment. The file permissions, file paths, and file integrity in the directory to be checked bound to the sandbox environment are detected. If the test result is abnormal, the file system is determined to be abnormal, and the abnormal information is fed back. Optionally, the chkdsk tool can be used in the Windows operating system, and the FSCK tool can be used in the Linux / Unix operating system to check and repair errors in the file system. If there is a permission problem with the files in the directory to be checked, or there is a missing file, the execution result will report the abnormality and print a log of the specific abnormality, so that it can be determined whether the file system is normal.

[0054] Optionally, a method for detecting file permissions, file paths, and file integrity in a directory to be checked in a sandbox environment is written into a file system detection function filesystem-run(), so as to detect whether the file system of the operating system is normal by executing a file system detection function echo filesystem-run().

[0055] Then, in step S260, in the sandbox environment, it is detected whether the self-starting service of the operating system runs normally.

[0056] According to an embodiment of the present invention, a self-starting service is run in a directory where self-starting services are stored in a sandbox environment. Here, the self-starting service refers to the self-starting service of the operating system at startup. In this step, the self-starting service file stored in the directory where the self-starting service is located is simulated. Usually, the self-starting service is stored in the " / etc / systemd / system / multi-user.target.wants / " directory. Next, the running status of the self-starting service of the operating system is detected. If the detection result is abnormal, the self-starting service is determined to be abnormal, and the abnormal information is fed back. The running status of the self-starting service can be viewed by executing the command systemctl status plus the name of the self-starting service, and the service status of the self-starting service is output. The service status can have different states such as running, failed to run, or completed. When it is judged that the running status is abnormal, an exception will be thrown.

[0057] Optionally, the self-starting service is run in the directory where the self-starting service is stored in the sandbox environment, and the method for detecting the running status of the self-starting service is written into the self-starting service detection function systemd-enable-run(), so as to detect whether the self-starting service of the operating system is normal by executing the self-starting service detection function echo systemd-enable-run().

[0058] Then, in step S270, in the sandbox environment, it is detected whether the desktop environment runs normally.

[0059] According to an embodiment of the present invention, in a sandbox environment, a display management service (DisplayManage service), an Xserver service and / or an upper desktop environment are run, and it is detected whether they are all running normally. If the operation is abnormal, it can be determined that the desktop environment is running abnormally, and the abnormal information is fed back. If all are running normally, it is checked whether there is a process related to the desktop environment in the / proc directory of the kernel information of the storage operating system in the sandbox environment, for example: dde desktop corresponding process startdde dde-desktop dde-dock, etc. If the desktop process is not started normally, that is, there is no process related to the desktop environment in the / proc directory of the kernel information, it can be determined that the desktop environment is running abnormally, and the abnormal information is fed back.

[0060] Optionally, a method for running the display management service, Xserver service and / or upper-level desktop environment and detecting whether they are all running normally, and checking whether there are processes related to the desktop environment in the directory storing the kernel information of the operating system in the sandbox environment is written into the desktop environment detection function desktop-env-run(), so as to detect whether the desktop environment of the operating system is normal by executing the desktop environment detection function echo desktop-env-run().

[0061] Then, in step S280, the integrity of the operating system is determined based on the detection results of the above-mentioned system boot, kernel driver, file system, automatic service, and desktop environment.

[0062] According to an embodiment of the present invention, after detecting the system boot, kernel driver, file system, self-start service, and desktop environment of the operating system one by one, the integrity of the operating system is reflected according to the overall detection result. If the detection results of the system boot, kernel driver, file system, self-start service, and desktop environment according to the above steps are all normal, that is, no abnormal information is received, it is determined that the operating system to be detected is complete.

[0063] The present invention also proposes a system for detecting the integrity of an operating system. Figure 3 A schematic diagram of an operating system integrity detection system 300 is shown. The system 300 includes a sandbox environment construction unit 310 and a detection unit 320.

[0064] The sandbox environment construction unit 310 is adapted to construct a sandbox environment for running the operating system of the computing device, and is also adapted to bind the kernel information, peripheral device information and running information of the operating system to the sandbox environment. For details, please refer to the description of the above steps S210-S220.

[0065] The detection unit 320 is adapted to run the system boot module 321, the kernel driver module 322, the file system module 323, the self-starting service module 324, and the desktop environment module 325 in the sandbox environment to detect whether the system boot, kernel driver, file system, self-starting service, and desktop environment of the operating system are normal, and is also adapted to determine the integrity of the operating system according to the detection results of the system boot, kernel driver, file system, self-starting service, and desktop environment. For details, please refer to the description in the above steps S230-S280.

[0066] According to the method for detecting the integrity of the operating system of the present invention, by simulating the running of the five modules of the operating system, namely, system boot, kernel driver, file system, auto-start service, and desktop environment, in a sandbox environment, it is detected whether the simulated operating system has abnormalities and serves as an early warning, so that the user can modify the corresponding modules according to the feedback abnormal information to avoid the real operating system being unable to enter the operating system after restart due to the incomplete operating system.

[0067] According to the detection method of the operating system integrity of the present invention, the coupling degree between the modules is low, and each module can run independently in the sandbox environment. The scalability is strong and the maintenance is simple. The sandbox environment constructed by Chroot is highly compatible with various operating system environments.

[0068] The various techniques described herein may be implemented in combination with hardware or software, or a combination thereof. Thus, the method and apparatus of the present invention, or some aspects or parts of the method and apparatus of the present invention may be in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, a USB flash drive, a floppy disk, a CD-ROM, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes a device for practicing the present invention.

[0069] In the case where the program code is executed on a programmable computer, the mobile terminal generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the operating system integrity detection method of the present invention according to the instructions in the program code stored in the memory.

[0070] By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media stores information such as computer readable instructions, data structures, program modules or other data. Communication media generally embody computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and include any information transfer medium. Any combination of the above is also included within the scope of readable media.

[0071] In the description provided herein, algorithms and displays are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the examples of the present invention. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to implement the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0072] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0073] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0074] Those skilled in the art will appreciate that the modules or units or components of the devices in the examples disclosed herein may be arranged in the devices described in the embodiment, or alternatively may be located in one or more devices different from the devices in the examples. The modules in the foregoing examples may be combined into one module or may be divided into multiple submodules.

[0075] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0076] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0077] In addition, some of the embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other devices that perform the functions. Therefore, a processor with necessary instructions for implementing the method or method elements forms a device for implementing the method or method elements. In addition, the elements described herein of the device embodiments are examples of devices for implementing the functions performed by the elements for the purpose of implementing the invention.

[0078] As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved, and is not intended to imply that the objects so described must have a given order in time, space, order, or in any other manner.

[0079] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative and not restrictive with respect to the scope of the present invention, and the scope of the present invention is defined by the appended claims.

Claims

1. A method for detecting the integrity of an operating system, executed in a computing device, the method comprising: Constructing a sandbox environment, wherein the sandbox environment is used to run an operating system of the computing device; Binding the kernel information, peripheral device information and running information of the operating system to the sandbox environment, comprising: binding files in the / proc, / sys and / dev directories of the operating system to the / proc, / sys and / dev directories of the sandbox environment respectively, wherein the / proc directory stores the kernel information of the operating system, the / sys directory stores the peripheral device information of the operating system, and the / dev directory stores the running information of the operating system; In the sandbox environment, detecting whether the system boot, kernel driver, file system, self-start service, and desktop environment of the operating system are running normally, wherein detecting whether the kernel driver of the operating system is running normally includes: determining one or more peripheral devices corresponding to the operating system, and detecting whether the driver information corresponding to each of the one or more peripheral devices is correct, and if the detection result is incorrect, determining that the kernel driver is running abnormally; The integrity of the operating system is determined based on the detection results of the system boot, kernel driver, file system, self-starting service, and desktop environment.

2. The method according to claim 1, wherein: The step of detecting whether the system boot of the operating system runs normally comprises: Bind the files in the / boot directory of the operating system to the / boot directory of the sandbox environment; Check whether there is a syntax error in the boot configuration file in the sandbox environment; If there is a syntax error, it is determined that the system boot operation is abnormal.

3. The method according to claim 1 or 2, wherein: The step of detecting whether the file system of the operating system is running normally includes: Binding the files in the directory to be checked in the operating system to the directory corresponding to the sandbox environment; Check the file permissions, file paths, and file integrity of the directory to be checked that is bound to the sandbox environment; If the detection result is abnormal, it is determined that the file system operates abnormally.

4. The method according to claim 1 or 2, wherein: The step of detecting whether the self-start service of the operating system is running normally includes: Run the self-starting service in the directory where the self-starting service is stored in the sandbox environment; Detecting the running status of the self-starting service; If the detection result is abnormal, it is determined that the self-starting service is running abnormally.

5. The method according to claim 1 or 2, wherein: The step of detecting whether the desktop environment of the operating system is running normally includes: Run the display management service, Xserver service and / or upper desktop environment, and check whether they are running normally; If the operation is normal, checking whether there is a process related to the desktop environment in the directory storing the kernel information of the operating system in the sandbox environment; If not, determining that the desktop environment is operating abnormally; If the operation is abnormal, it is determined that the desktop environment is operating abnormally.

6. The method according to claim 1 or 2, wherein: The step of determining the integrity of the operating system according to the detection results of the boot process, kernel driver, file system, self-starting service, and desktop environment includes: If the detection results of the boot process, kernel driver, file system, self-starting service, and desktop environment are all normal, it is determined that the operating system is complete.

7. A system for detecting the integrity of an operating system, the system comprising: A sandbox environment construction unit, adapted to: construct a sandbox environment, the sandbox environment is used to run an operating system of a computing device, and is further adapted to bind kernel information, peripheral device information and running information of the operating system to the sandbox environment, including: binding files in the / proc, / sys and / dev directories of the operating system to the / proc, / sys and / dev directories of the sandbox environment respectively, wherein the / proc directory stores the kernel information of the operating system, the / sys directory stores the peripheral device information of the operating system, and the / dev directory stores the running information of the operating system; The detection unit is suitable for: detecting whether the system boot, kernel driver, file system, auto-start service, and desktop environment of the operating system are running normally in the sandbox environment, and is also suitable for determining the integrity of the operating system based on the detection results of the system boot, kernel driver, file system, auto-start service, and desktop environment, wherein detecting whether the kernel driver of the operating system is running normally includes: determining one or more peripheral devices corresponding to the operating system, and detecting whether the driver information corresponding to each of the one or more peripheral devices is correct, and if the detection result is incorrect, determining that the kernel driver is running abnormally.

8. A computing device comprising: at least one processor; as well as A memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, and the program instructions include instructions for executing the method according to any one of claims 1 to 6.

9. A readable storage medium storing program instructions, when the program instructions are read and executed by a computing device, the computing device executes the method according to any one of claims 1 to 6.

Images