Method, System, Device, Storage Medium and Program Product for Loading Dynamic Library

Abstract

The embodiments of the present application disclose a method, system, device, storage medium and program product for loading dynamic libraries. By configuring the dynamic library decompression ability and memory monitoring ability through pre-setting dynamic library loading functions in the system of the BMC, the application programs in the BMC are enabled to have the ability to call compressed dynamic libraries and the ability to monitor the tampering risk of the dynamic libraries placed in memory. As a result, the BMC dynamic library loading method based on the binary source file structure can be converted into the BMC dynamic library loading method based on the custom compressed file structure, thereby reducing the risk of decompiling the target dynamic libraries stored in the BMC. During the process of the application program calling the target compressed dynamic library, continuous tampering risk monitoring is set for the decompressed dynamic library placed in memory, which can reduce the risk of the application program calling the tampered target compressed dynamic library, thus improving the security of the BMC for loading dynamic libraries.

Description

Technical Field

[0001] This application relates to the field of computer technology, and particularly to a method, system, device, storage medium and program product for loading a dynamic library. Background Art

[0002] A DLL (Dynamic Link Library) is also known as a dynamic library, which is a way to implement the concept of a shared function library, enabling a process to call functions of executable code that do not belong to that process.

[0003] As a commonly used means of code sharing, dynamic libraries are widely used in BMC (Baseboard Management Controller). When the BMC loads a dynamic library, it usually stores the dynamic library in the form of binary source files such as lib*.so, making it easy for the dynamic libraries stored in the BMC to be exported and decompiled. Moreover, during the process of loading the dynamic library into memory and calling it using an application, there is also a risk that the dynamic library in memory may be tampered with, so that the application may call the tampered dynamic library, posing a significant security risk. Summary of the Invention

[0004] The purpose of the embodiments of this application is to provide a method, system, device, storage medium and program product for loading a dynamic library, which can reduce the risk of decompiling the dynamic libraries stored in the BMC and the risk of the application calling the tampered dynamic library.

[0005] To solve the above technical problems, in a first aspect, the embodiments of this application provide a method for loading a dynamic library, which is applied to a Baseboard Management Controller (BMC), and includes:

[0006] Obtain a target compressed dynamic library from a computer device and store the target compressed dynamic library. The target compressed dynamic library is generated by the computer device performing a compression operation on a target dynamic library according to a custom compression algorithm;

[0007] When an application in the BMC calls the target dynamic library, according to the custom decompression algorithm matching the custom compression algorithm, use a custom dynamic library loading function to perform a decompression operation on the target compressed dynamic library to obtain the target dynamic library;

[0008] Put the target dynamic library into the memory of the BMC, and use the custom dynamic library loading function to continuously monitor whether the target dynamic library in the memory of the BMC is tampered with. The custom dynamic library loading function is obtained by configuring the dynamic library decompression ability and memory monitoring ability for the system-preinstalled dynamic library loading function;

[0009] In the case where the target dynamic library in the memory of the BMC is tampered with, decompress the target compressed dynamic library stored in the BMC again to obtain a new target dynamic library, and call the new target dynamic library through the application program in the BMC;

[0010] In the case where the target dynamic library in the memory of the BMC is not tampered with, call the target dynamic library in the memory of the BMC through the application program in the BMC.

[0011] Optionally, the continuously monitoring whether the target dynamic library in the memory of the BMC is tampered with includes:

[0012] Using the custom dynamic library loading function, continuously monitor whether there is a data modification operation on the memory area corresponding to the target dynamic library;

[0013] In response to the existence of a data modification operation on the memory area corresponding to the target dynamic library, it is determined that the target dynamic library in the memory of the BMC is tampered with;

[0014] In response to the non-existence of a data modification operation on the memory area corresponding to the target dynamic library, it is determined that the target dynamic library in the memory of the BMC is not tampered with.

[0015] Optionally, the calling the target dynamic library in the memory of the BMC through the application program in the BMC includes:

[0016] Using the custom interface calling function, determine whether the target function in the memory of the BMC is tampered with, where the target function is at least one function in the target dynamic library required to be called by the application program in the BMC, and the custom interface calling function is obtained after configuring the memory monitoring ability for the system preset interface calling function;

[0017] In the case where the target function is not tampered with, use the custom interface calling function to call the target function in the memory of the BMC in the application program.

[0018] Optionally, the custom interface calling function is obtained after configuring the memory monitoring ability for the system preset dlsym interface.

[0019] Optionally, the obtaining the target compressed dynamic library from the computer device includes:

[0020] Obtain the target encrypted dynamic library from the computer device, where the target encrypted dynamic library is generated by the computer device encrypting the target compressed dynamic library according to the encryption algorithm;

[0021] According to the decryption algorithm matched with the encryption algorithm, use the custom dynamic library loading function to decrypt the target encrypted dynamic library to obtain the target compressed dynamic library. The custom dynamic library loading function is obtained by configuring the dynamic library decompression ability, memory monitoring ability, and dynamic library decryption ability for the system-preinstalled dynamic library loading function.

[0022] Optionally, before decompressing the target compressed dynamic library, it further includes:

[0023] Use the custom dynamic library loading function to perform dynamic library verification on the target compressed dynamic library. The dynamic library verification includes at least one of dynamic library integrity verification and dynamic library correctness verification. The custom dynamic library loading function is obtained by configuring the dynamic library decompression ability, memory monitoring ability, dynamic library verification ability, and dynamic library decryption ability for the system-preinstalled dynamic library loading function;

[0024] The operation of decompressing the target compressed dynamic library includes:

[0025] Perform a decompression operation on the target compressed dynamic library that has passed the dynamic library verification.

[0026] Optionally, the custom dynamic library loading function is obtained by configuring the dynamic library decompression ability and memory monitoring ability for the system-preinstalled dlopen interface.

[0027] In a second aspect, an embodiment of the present application further provides a system for loading a dynamic library, which is applied to a baseboard management controller BMC and includes:

[0028] An acquisition module, configured to acquire a target compressed dynamic library from a computer device and store the target compressed dynamic library. The target compressed dynamic library is generated by the computer device performing a compression operation on a target dynamic library according to a custom compression algorithm;

[0029] A decompression module, configured to, when an application in the BMC calls the target dynamic library, according to a custom decompression algorithm matched with the custom compression algorithm, use a custom dynamic library loading function to perform a decompression operation on the target compressed dynamic library to obtain the target dynamic library;

[0030] A first memory monitoring module, configured to put the target dynamic library into the memory of the BMC and use the custom dynamic library loading function to continuously monitor whether the target dynamic library in the memory of the BMC is tampered with. Among them, the custom dynamic library loading function is obtained by configuring the dynamic library decompression ability and memory monitoring ability for the system-preinstalled dynamic library loading function;

[0031] The first response module is used to, when the target dynamic library in the memory of the BMC is tampered with, decompress the target compressed dynamic library stored in the BMC again to obtain a new target dynamic library, and call the new target dynamic library through the application program in the BMC; and is used to, when the target dynamic library in the memory of the BMC is not tampered with, call the target dynamic library in the memory of the BMC through the application program in the BMC.

[0032] In a third aspect, an embodiment of the present application further provides an electronic device, including a memory, a processor, and a computer program stored on the memory, and the processor executes the computer program to implement the method for loading a dynamic library as described in the first aspect.

[0033] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program / instructions are stored, and when the computer program / instructions are executed by a processor, the method for loading a dynamic library as described in the first aspect is implemented.

[0034] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program / instructions, and when the computer program / instructions are executed by a processor, the method for loading a dynamic library as described in the first aspect is implemented.

[0035] It can be seen from the above technical solutions that by configuring the dynamic library decompression ability and memory monitoring ability by presetting the dynamic library loading function for the BMC system, the application program in the BMC is enabled to have the ability to call the compressed dynamic library and the ability to monitor the tampering risk of the dynamic library placed in the memory, so that the BMC dynamic library loading method based on the binary source file structure can be converted into the BMC dynamic library loading method based on the compressed file structure, and the BMC stores the target dynamic library through a custom compressed file (i.e., the target compressed dynamic library), which can avoid the target compressed dynamic library stored in the BMC from being cracked by a general decompression algorithm, thereby reducing the risk of the target dynamic library stored in the BMC being decompiled, and during the process of the application program calling the target compressed dynamic library, continuously monitoring the tampering risk of the decompressed dynamic library placed in the memory can reduce the risk of the application program calling the tampered target dynamic library. Therefore, by configuring the custom decompression ability and tampering risk monitoring ability for the BMC system by presetting the dynamic library loading function, the security of the BMC loading the dynamic library is improved. Description of the Drawings

[0036] To more clearly illustrate the embodiments of the present application, the accompanying drawings required for use in the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0037] Figure 1 The flowchart of an embodiment of a method for loading a dynamic library provided by an embodiment of the present application;

[0038] Figure 2 The flowchart of an embodiment of a method for securely loading a dynamic library provided by an embodiment of the present application;

[0039] Figure 3 The schematic structural diagram of a system for loading a dynamic library provided by an embodiment of the present application;

[0040] Figure 4 The schematic diagram of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0041] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the protection scope of the present application.

[0042] The terms "including" and "having" in the specification and claims of the present application and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may include steps or units not listed.

[0043] With the development of Internet technology, the demand for servers by major Internet manufacturers is increasing continuously, and the security requirements for servers are also increasing continuously. As a dedicated service processor, BMC is the core of IPMI (Intelligent Platform Management Interface). BMC has an independent embedded system that starts running after being powered on and is often deployed as an independent unit on the motherboard or main circuit board of the server to monitor and manage the running state of the server. Therefore, whether BMC (i.e., the application program in BMC) can run normally will directly affect the security performance of the server.

[0044] As a way to implement the concept of shared function libraries, dynamic libraries are widely used in BMCs to support the normal operation of applications in BMCs. After the source code that needs to be shared is compiled into a dynamic library by a computer device, the BMC will put the dynamic library into memory in the form of a binary source file named lib*.so, thus realizing the loading of the dynamic library. However, the dynamic library stored in the BMC in the form of a binary source file is easily tampered with and decompiled. Moreover, due to the hardening of the BMC's hardware and the limitation of the BMC's CPU (Central Processing Unit) performance, traditional code protection methods such as "biometric" recognition technology and source code virtualization protection and shelling technology cannot be applied in the BMC, making the existing dynamic library loading method have great security risks. Among them, the "biometric" recognition technology refers to PUF (Physical Unclonable Function). Due to the imperfect silicon processing technology, each IC (Integrated Circuit Chip) produced is physically different. Among different integrated circuits, these process variations are manifested in different ways such as different path delays, transistor threshold voltages, and voltage gains. Although these variations may be random among different integrated circuits, once known, they are definite and repeatable. The PUF can utilize this inherent difference in the behavior of the IC to generate a unique encryption key for each IC, and then use this key to achieve code protection. However, it is difficult to apply the PUF in the BMC with hardened hardware because it requires setting integrated circuits that meet the conditions (i.e., the inherent difference in the behavior of the IC is not random) to generate a "silicon fingerprint" (i.e., the key). And for the source code virtualization protection and shelling technology, it will modify the source code so that some instructions of the source code run in the virtual environment it creates. However, due to the limitation of the existing BMC's CPU performance, it is difficult to support the normal implementation of the source code virtualization protection and shelling technology.

[0045] In view of the problems existing in the above related technologies, this application proposes to convert the existing BMC dynamic library loading method based on the binary source file structure into a BMC dynamic library loading method based on a custom compressed file structure, which can prevent the target compressed dynamic library stored in the BMC from being cracked by a general decompression algorithm, thereby reducing the risk of the target dynamic library stored in the BMC being decompiled. Moreover, during the process of putting the dynamic library into memory and calling it with an application, continuous tampering risk monitoring is set for the dynamic library in memory, which can reduce the risk of the application calling a tampered dynamic library. Thus, by configuring the custom decompression ability and tampering risk monitoring ability for the dynamic library loading function in the system preset of the BMC, the security of the BMC loading the dynamic library is improved.

[0046] The following will combine the accompanying drawings and, through some embodiments and their application scenarios, elaborate in detail on the method for loading a dynamic library provided by the embodiments of the present application.

[0047] In a first aspect, referring to Figure 1 as shown, it is a flowchart of the implementation of a method for loading a dynamic library provided by the embodiments of the present application, which is applied to a baseboard management controller (BMC). The method may include the following steps:

[0048] Step S101: Obtain a target compressed dynamic library from a computer device and store the target compressed dynamic library. The target compressed dynamic library is generated by the computer device through a custom compression algorithm for compressing a target dynamic library.

[0049] In specific implementation, the computer device will compile and custom-compress the source code to be shared to generate a target compressed dynamic library. After generating the target compressed dynamic library, the computer device will place the target compressed dynamic library in a storage file of the computer device, such as the system lib directory, for the BMC to read. Subsequently, the BMC will load the target compressed dynamic library in the storage file into the storage area of the BMC for the internal applications of the BMC to call. It can be understood that by applying the custom compression technology of data and its matching custom decompression technology to the dynamic library loading process of the BMC, an effective code protection method for dynamic library sharing between the computer device and the BMC can be provided without changing the original firmware of the BMC and the performance of the CPU, which can reduce the risk of the dynamic library stored in the BMC being decompiled, thereby improving the security of dynamic library loading in the BMC.

[0050] As a possible implementation manner, the BMC may obtain a target encrypted dynamic library from the computer device. The target encrypted dynamic library is generated by the computer device through an encryption algorithm for encrypting the target compressed dynamic library; according to the decryption algorithm matching the encryption algorithm, use the custom dynamic library loading function to decrypt the target encrypted dynamic library to obtain the target compressed dynamic library. The custom dynamic library loading function is obtained after configuring the dynamic library decompression ability and the dynamic library decryption ability for the system-preinstalled dynamic library loading function.

[0051] In specific implementation, after the computer device generates the target compressed dynamic library, it can further encrypt the target compressed dynamic library to generate a target encrypted dynamic library, and then place the target encrypted dynamic library into the system lib directory. The BMC then decrypts the target encrypted dynamic library in the system lib directory to obtain the target dynamic library. It can be understood that by applying the custom compression technology of data and its matching custom decompression technology, as well as the encryption technology and its matching decryption technology to the dynamic library loading process of the BMC, the risk of decompiling the dynamic library in the BMC can be further reduced without changing the original firmware of the BMC and the performance of the CPU. Among them, the encryption and decryption operations of the dynamic library will be described in detail in steps (3) and (4) of a method for securely loading a dynamic library described below, and will not be elaborated here.

[0052] Step S102: When an application in the BMC calls the target dynamic library, according to the custom decompression algorithm matching the custom compression algorithm, use the custom dynamic library loading function to decompress the target compressed dynamic library to obtain the target dynamic library.

[0053] Among them, the custom dynamic library loading function is obtained by configuring the dynamic library decompression ability for the system-preinstalled dlopen interface.

[0054] In specific implementation, when an application in the BMC needs to call a function in the target compressed dynamic library, it can use a custom dynamic library loading function (such as a custom dlopen interface) to apply for a block of heap memory for the target dynamic library (heap memory is another memory area different from the stack area, global data area, and code area, which allows the program to dynamically apply for a memory space of a certain size at runtime), and decompress the target compressed dynamic library into the heap memory according to the custom decompression algorithm. It can be understood that compressing the compiled source code can reduce the data volume of the dynamic library, thereby improving the efficiency of the BMC to load the dynamic library from the computer device into the BMC storage area. At the same time, by negotiating a set of matching custom compression algorithms and custom decompression algorithms between the computer device and the BMC to perform compression and decompression operations on the target dynamic library (i.e., the compiled source code), malicious programs can be effectively prevented from using general decompression algorithms to crack and decompile the target compressed dynamic library, thereby further improving the security of the BMC to load the dynamic library. Among them, the compression and decompression operations of the dynamic library will be described in detail in steps (2) and (5) of a method for securely loading a dynamic library described below.

[0055] As a possible implementation, the BMC can also use the custom dynamic library loading function to perform dynamic library verification on the target compressed dynamic library, and then decompress the target compressed dynamic library that passes the dynamic library verification. The dynamic library verification includes at least one of dynamic library integrity verification and dynamic library correctness verification. The custom dynamic library loading function is a system-preinstalled dynamic library loading function configured with dynamic library decryption ability and dynamic library verification ability.

[0056] In specific implementation, the BMC can first decrypt the target encrypted dynamic library in the computer device to obtain a decrypted dynamic library, and then perform dynamic library verification (such as dynamic library integrity verification and / or dynamic library correctness verification) on the decrypted dynamic library, and determine the decrypted dynamic library that passes the dynamic library verification as the target compressed dynamic library, so as to ensure the data integrity and correctness of the target compressed dynamic library obtained after decryption. Among them, the verification operation of the dynamic library will be described in detail in step (4) of a method for securely loading a dynamic library described below, and will not be elaborated here.

[0057] Step S103: Put the target dynamic library into the memory of the BMC, and use the custom dynamic library loading function to continuously monitor whether the target dynamic library in the memory of the BMC is tampered with. The custom dynamic library loading function is obtained by configuring the dynamic library decompression ability and memory monitoring ability for the system-preinstalled dynamic library loading function.

[0058] Step S104: In the case where the target dynamic library in the memory of the BMC is tampered with, re-decompress the target compressed dynamic library stored in the BMC to obtain a new target dynamic library, and call the new target dynamic library through the application program in the BMC.

[0059] Step S105: In the case where the target dynamic library in the memory of the BMC is not tampered with, call the target dynamic in the memory of the BMC through the application program in the BMC.

[0060] In specific implementation, when the custom dynamic library loading function decompresses the target compressed dynamic library to obtain the target dynamic library, the application program in the BMC can call each function in the target dynamic library according to the memory address where the target dynamic library is located. Among them, to avoid malicious programs from tampering with the target dynamic library in the memory, the memory area where the target dynamic library is located can be set to be accessible only by a specific application program in the BMC (such as the application program that currently calls the target dynamic library), and after the specific application program completes the call of the target dynamic library, the target dynamic library in this memory area is cleared.

[0061] To prevent the target dynamic library decompressed into the BMC memory from being maliciously tampered with during the process of an application in the BMC calling the target dynamic library, the BMC can place the target dynamic library into the memory of the BMC; use the custom dynamic library loading function to continuously monitor whether the target dynamic library in the memory of the BMC is tampered with, and the custom dynamic library loading function is obtained by configuring the dynamic library decompression ability and the memory monitoring ability for the system preset dynamic library loading function; in the case where the target dynamic library in the memory of the BMC is tampered with, perform a decompression operation on the target compressed dynamic library stored in the BMC again to obtain a new target dynamic library, and call the new target dynamic library through the application in the BMC; in the case where the target dynamic library in the memory of the BMC is not tampered with, call the target dynamic library in the memory of the BMC through the application in the BMC.

[0062] In specific implementation, when the application program in the BMC calls the target compression dynamic library, it can use a custom dlopen interface to apply for a block of heap memory in the BMC and use this block of heap memory as the target memory block. After decompressing the target compression dynamic library to this target memory block using the custom dlopen interface, it continuously monitors whether there is any data modification operation on the target memory block (i.e., the memory area corresponding to the target dynamic library). For example, the custom dlopen interface can perform real-time monitoring on the data (i.e., the dynamic library) in the target memory block, so as to detect whether there is any data modification operation on the target memory block according to the data change (such as the change in data size) in the target memory block. It can be understood that by detecting the data modification operation of the target memory block, the dlopen interface can timely know whether there is a risk of the target dynamic library in the target memory block being tampered with, thus realizing a security detection for the target dynamic library in the BMC. When the custom dlopen interface detects that there is no data modification operation on the target memory block, it means that the target dynamic library in the memory of the BMC has not been tampered with, and the application program in the BMC can call the target dynamic library in this target memory block. When the custom dlopen interface detects that there is a data modification operation on the target memory block, it means that the target dynamic library in the memory of the BMC has been tampered with. At this time, the target dynamic library in this target memory block can be cleared, and a new target dynamic library can be put into this target memory block for the application program to call. Among them, the target compression dynamic library in the BMC storage area can be decompressed again to obtain a new target dynamic library. Or, considering the risk that the target compression dynamic library in the BMC storage area may be cleared or tampered with, the target compression dynamic library can also be retrieved from the computer device again and decompressed to obtain a new target dynamic library. It can be understood that by setting memory monitoring for the BMC memory where the target dynamic library is placed, the risk that the application program in the BMC calls the maliciously tampered target dynamic library can be reduced, and the security of the BMC loading the dynamic library can be further improved.

[0063] As can be seen from the above technical solution, by pre-configuring the dynamic library loading function for the BMC system to configure the dynamic library decompression ability and memory monitoring ability, the application programs in the BMC are enabled to have the ability to call the compressed dynamic library and the ability to monitor the tampering risk of the dynamic library placed in memory. As a result, the BMC dynamic library loading method based on the binary source file structure can be converted into the BMC dynamic library loading method based on the compressed file structure. Moreover, the BMC stores the target dynamic library through a custom compressed file (i.e., the target compressed dynamic library), which can prevent the target compressed dynamic library stored in the BMC from being cracked by a general decompression algorithm, thereby reducing the risk of the target dynamic library stored in the BMC being decompiled. During the process of the application program calling the target compressed dynamic library, continuous tampering risk monitoring is set for the decompressed dynamic library placed in memory, which can reduce the risk of the application program calling the tampered target dynamic library. Therefore, by pre-configuring the custom decompression ability and tampering risk monitoring ability for the BMC system's dynamic library loading function, the security of the BMC loading dynamic library is improved.

[0064] The following Figure 2 is combined with Figure 2 to further illustrate the above technical solution. As

[0065] (1) The computer device compiles the source code to be shared and generates a target dynamic library.

[0066] Among them, the target dynamic library is a library that can contain code and data that can be used by multiple application programs at the same time. That is to say, the dynamic library can contain one or more functions that have been compiled, linked, and stored separately from the processes using them. By placing the executable code of the functions into the dynamic link library, the processes of the application programs can flexibly call functions that do not belong to their executable code, thereby realizing code sharing.

[0067] (2) The computer device compresses the dynamic library according to a custom compression algorithm to obtain a target compressed dynamic library.

[0068] In specific implementation, a set of matching custom compression algorithms and custom decompression algorithms can be negotiated between the computer device and the BMC. Exemplarily, the process of custom-compressing the target dynamic library by the computer device may include: obtaining the data characters of the target dynamic library, and obtaining the custom encoding corresponding to each data character through a specific method (such as a hash algorithm) according to the standard encoding of each data character. Among them, the number of bits of the custom encoding should be less than the number of bits of the standard encoding corresponding thereto, so as to be able to perform custom compression on the target dynamic library according to the custom encoding corresponding to each data character. Through the specific method for determining the custom encoding negotiated between the computer device and the BMC, a mutually matching custom compression algorithm and custom decompression algorithm can be correspondingly generated.

[0069] (3) The computer device uses the AES (Advanced Encryption Standard) symmetric encryption algorithm to encrypt the target compressed dynamic library with the public key to obtain the target encrypted dynamic library, and puts the public key and the target encrypted dynamic library into the system lib directory.

[0070] Among them, in the symmetric encryption algorithm, the keys used for encryption and decryption are the same. The key is negotiated between the receiver and the sender (i.e., the BMC and the computer storage device), and then the generated key is secretly shared between the BMC and the computer storage device. For example, the computer storage device can encrypt the key through the asymmetric encryption algorithm and then share the encrypted key with the BMC, so as to avoid the encrypted dynamic library being restored by an attacker and decompiled due to key leakage. It can be understood that the asymmetric encryption algorithm is a method for keeping the key secret, which requires two asymmetric keys: publickey (public key) and privatekey (private key). The public key and the private key are a pair. If the above key is encrypted with the public key, only the corresponding private key can decrypt it. For example, the process of encrypting the key using the asymmetric encryption algorithm may include: the BMC generates a pair of asymmetric keys and makes the public key in the pair of asymmetric keys public. After the computer device encrypts the above key with the public key in the pair of asymmetric keys and then stores it in the system lib directory, after the BMC reads the encrypted key from the system lib directory, it immediately decrypts the encrypted key with its own private key, and then uses the decrypted key to perform a decryption operation on the target encrypted dynamic library in the system lib directory.

[0071] Exemplarily, when encrypting a compressed dynamic library using the AES symmetric encryption algorithm, the target compressed dynamic library is divided into multiple groups of data, and the length of each group of data is equal (the grouping length is usually 128 bits, that is, each group of data has 16 bytes). The length of the key can be 128 bits, 192 bits, or 256 bits. Different key lengths have different recommended encryption rounds. Taking AES-128 as an example, at this time the key length is 128 bits, and the recommended encryption round is 10 rounds, that is, the round function in the encryption function needs to be executed ten times. Among them, the round functions of the 1st to 9th rounds of encryption are the same, including 4 operations: byte substitution, row shift, column mixing, and round key addition; among them, the column mixing is not performed in the last round of iteration, and before the first round of iteration, an exclusive OR encryption operation is first performed on the target compressed dynamic library and the key. After performing 10 rounds of iterative encryption on the compressed dynamic library using the round function, the target encrypted dynamic library can be obtained. It can be understood that the decryption function is the inverse operation of the encryption function, that is, one round of the decryption function is to sequentially execute reverse row shift, inverse byte substitution, round key addition, and inverse column mixing, and similar to the encryption function, the inverse column mixing is not performed in the last round of the decryption function, and before the 1st round of decryption, 1 key addition operation needs to be performed.

[0072] (4) Through the custom dlopen interface in the BMC, read the public key and the target encrypted dynamic library in the system lib directory. And perform a decryption verification operation on the target encrypted dynamic library according to the public key.

[0073] In specific implementation, to ensure the correctness and integrity of the target compressed dynamic library obtained after BMC decryption, a custom dlopen interface can be set to perform dynamic library verification on the obtained target compressed dynamic library after decrypting the target encrypted dynamic library. When the dynamic library verification includes dynamic library integrity verification, dynamic library integrity verification can be achieved through data signing (direct signing or indirect signing). Taking direct signing as an example, the computer device needs to encrypt the target compressed database with the private key in its own digital signature (this step can be executed before the AES symmetric encryption operation or can be directly used as the encryption operation), and then the BMC uses the public key corresponding to the digital signature of the computer device to decrypt the target compressed database encrypted with the private key. If the BMC decryption is successful, it indicates that the target compressed dynamic library has not been tampered with, and at this time, it can be determined that the dynamic library integrity verification (i.e., dynamic library verification) passes. When the dynamic library verification includes dynamic library correctness verification, the computer device can process some data of the target compressed dynamic library through operations such as hash operation to obtain the first additional information, and encrypt the combination of the compressed dynamic library and the first additional information, and use the encrypted ciphertext as the target encrypted dynamic library. After the BMC decrypts the target encrypted dynamic library, it will obtain the combination of the target compressed dynamic library and the first additional information. At this time, the BMC needs to process the same part of the data of the target compressed dynamic library through the same operation method to obtain the second additional information. If the first additional information and the second additional information are the same, it indicates that after the BMC decrypts the target encrypted dynamic library, it has obtained the correct target compressed dynamic library (i.e., the target compressed dynamic library is the same as the target compressed dynamic library generated by the computer device), and at this time, it can be determined that the dynamic library correctness verification (i.e., dynamic library verification) passes. It can be understood that the target compressed dynamic library that fails the dynamic library verification can be directly discarded, and the target compressed dynamic library can be re-obtained and loaded from the computer device.

[0074] (5) After the dynamic library verification passes, when the application program in the BMC calls the target dynamic library, it first applies for a block of heap memory using the custom dlopen interface, decompresses the target compressed dynamic library into the heap memory, and returns the heap memory pointer. At the same time, monitor the heap memory. If the heap memory is modified (i.e., the target dynamic library in the memory of the BMC is tampered with), then reload the dynamic library.

[0075] Among them, the heap memory pointer is used to indicate the function names of each function in the target dynamic library and the memory address of the target dynamic library.

[0076] In specific implementation, the BMC uses a custom dlopen interface to place the target dynamic library into the heap memory while monitoring the data in the heap memory (i.e., the target dynamic library) in real time. Once the data size of the heap memory changes, it is determined that there is an operation to modify the data in the heap memory, that is, the target dynamic library in the heap memory has a risk of being maliciously tampered with. The BMC then uses the custom dlopen interface to re-obtain the target dynamic library and uses the re-obtained target dynamic library to overwrite the original target dynamic library in the heap memory, thereby preventing the application in the BMC from subsequently calling the target dynamic library in the heap memory that may have been maliciously tampered with. Thus, by setting up a memory monitoring and dynamic library reloading mechanism, the security of BMC dynamic library loading is further improved.

[0077] (6) After the custom dlopen interface returns the heap memory pointer to the application, the application can, based on the heap memory pointer, obtain the function name of the target function and the memory address corresponding to the target function, where the target function is at least one function in the target dynamic library that the application in the BMC needs to call. Based on the function name and the memory block address, determine the memory area where the target function is located, and based on the memory area, call the target function.

[0078] Among them, functions can be called through system preset interfaces of the BMC such as the dlsym interface. According to the function name corresponding to the target function and the memory address of the corresponding target dynamic library, the memory address where the target function is located is returned, thereby indicating to the application the memory area where the target function is located. It can be understood that the dlopen interface is a library function used to open a new library (such as the target dynamic library) and load it into memory. After the target dynamic library is loaded into memory, the handle returned by the dlopen interface can be used as the first parameter to the dlsym interface to obtain the memory address of the target function. Using this memory address, the pointer to the target function in the dynamic library can be obtained, and then the target function in the dynamic library can be called.

[0079] As a possible implementation, the system preset interface call functions such as the dlsym interface can be custom-set to enable them to have the ability to monitor the memory area where the target function is located. Exemplarily, a custom interface call function (such as a custom dlsym interface) is used to determine whether the target function in the memory of the BMC has been tampered with. The custom interface call function is obtained after configuring the memory monitoring ability for the system preset interface call function; in the case where the target function has not been tampered with, the custom dlsym interface is used to call the target function in the memory of the BMC in the application.

[0080] In specific implementation, before calling the target function through an application, it is possible to detect whether there is a data modification operation on the memory area through a custom dlsym interface. In the case where there is a data modification operation on the memory area (i.e., the target function is tampered with), it is possible to wait for the custom dlopen interface to discover that the target dynamic library where the target function is located is tampered with, or the custom dlsym interface directly tells the dlopen interface the target dynamic library where the target function is located, so that the dlopen interface reloads the target dynamic library corresponding to the target function into the memory area of the BMC, and then the application uses the dlsym interface to call the reloaded target dynamic library; in the case where there is no data modification operation on the memory area, the application can directly call the target function in this memory area using the dlsym interface.

[0081] It can be understood that although the memory area where the target dynamic library is located is monitored using the dlopen interface as described above, since the dlopen interface may monitor the memory area periodically or may not perform the dynamic library reloading operation on the modified target dynamic library in a timely manner, the dlsym interface may still call the tampered target function. Therefore, in the process of the application calling the target function in this application, by setting a custom dlsym interface to detect whether there is a risk of the target function in the BMC memory being tampered with, it is possible to effectively avoid the dlsym interface wrongly calling the tampered target function when performing a function call, thus ensuring the safe operation of the BMC.

[0082] The method for loading a dynamic library provided in the above embodiment custom-compresses the originally generated target dynamic library through a computer device, encrypts the custom-compressed target dynamic library file, and places the generated target encrypted dynamic library into the system lib directory after it is generated. When the BMC loads the target dynamic library, it needs to decrypt the target encrypted dynamic library first, and then custom-decompress the target compressed dynamic library obtained after decryption before it can be loaded into the memory for the application to call, thereby preventing the target dynamic library from being decompiled during the BMC loading process. At the same time, a memory monitoring mechanism is set for the memory area where the target dynamic library is located. If it is determined that the target dynamic library in the memory is tampered with, the target dynamic library is reloaded. Thus, by adding operations such as custom decompression, decryption verification, memory monitoring, and reloading to the loading process of the target dynamic library, the safe loading of the BMC dynamic library is achieved.

[0083] In a second aspect, an embodiment of this application provides a system for loading a dynamic library, as Figure 3 shown, the system for loading a dynamic library includes:

[0084] An acquisition module 21, configured to acquire a target compressed dynamic library from a computer device and store the target compressed dynamic library. The target compressed dynamic library is generated by the computer device through compressing a target dynamic library according to a custom compression algorithm;

[0085] A decompression module 22, configured to, when an application in the BMC calls the target dynamic library, perform a decompression operation on the target compressed dynamic library according to a custom decompression algorithm matched with the custom compression algorithm by using a custom dynamic library loading function to obtain the target dynamic library;

[0086] A first memory monitoring module 23, configured to put the target dynamic library into the memory of the BMC and use the custom dynamic library loading function to continuously monitor whether the target dynamic library in the memory of the BMC is tampered with. The custom dynamic library loading function is obtained by configuring the dynamic library decompression capability and the memory monitoring capability for the system preset dynamic library loading function;

[0087] A first response module 24, configured to, when the target dynamic library in the memory of the BMC is tampered with, perform a decompression operation on the target compressed dynamic library stored in the BMC again to obtain a new target dynamic library, and call the new target dynamic library through an application in the BMC; and configured to, when the target dynamic library in the memory of the BMC is not tampered with, call the target dynamic library in the memory of the BMC through an application in the BMC.

[0088] Optionally, the first memory monitoring module 23 includes a first memory monitoring sub-module;

[0089] The first memory monitoring sub-module is configured to use the custom dynamic library loading function to continuously monitor whether there is a data modification operation on the memory area corresponding to the target dynamic library; in response to the existence of a data modification operation on the memory area corresponding to the target dynamic library, it is determined that the target dynamic library in the memory of the BMC is tampered with; in response to the non-existence of a data modification operation on the memory area corresponding to the target dynamic library, it is determined that the target dynamic library in the memory of the BMC is not tampered with.

[0090] Optionally, the first response module 24 includes a second memory monitoring module and a second response module;

[0091] The second memory monitoring module is configured to use a custom interface calling function to determine whether a target function in the memory of the BMC is tampered with. The target function is at least one function in the target dynamic library required to be called by an application in the BMC. The custom interface calling function is obtained by configuring the memory monitoring capability for the system preset interface calling function;

[0092] The second response module is used to, when the objective function is not tampered with, call a function using the custom interface and call the objective function in the memory of the BMC in the application program.

[0093] Optionally, the custom interface call function is obtained by configuring the memory monitoring capability for the system-preinstalled dlsym interface.

[0094] Optionally, the obtaining module 21 includes an obtaining sub-module and a decryption module;

[0095] The obtaining sub-module is used to obtain a target encrypted dynamic library from the computer device, where the target encrypted dynamic library is generated by the computer device encrypting the target compressed dynamic library according to an encryption algorithm;

[0096] The decryption module is used to, according to the decryption algorithm matching the encryption algorithm, use the custom dynamic library loading function to decrypt the target encrypted dynamic library to obtain the target compressed dynamic library, and the custom dynamic library loading function is obtained by configuring the dynamic library decompression capability, memory monitoring capability, and dynamic library decryption capability for the system-preinstalled dynamic library loading function.

[0097] Optionally, the system for loading the dynamic library further includes a dynamic library verification module, and the decompression module 22 includes a decompression sub-module;

[0098] The dynamic library verification module is used to use the custom dynamic library loading function to perform dynamic library verification on the target compressed dynamic library, and the dynamic library verification includes at least one of dynamic library integrity verification and dynamic library correctness verification, and the custom dynamic library loading function is obtained by configuring the dynamic library decompression capability, memory monitoring capability, dynamic library verification capability, and dynamic library decryption capability for the system-preinstalled dynamic library loading function;

[0099] The decompression sub-module is used to perform a decompression operation on the target compressed dynamic library that passes the dynamic library verification.

[0100] Optionally, the custom dynamic library loading function is obtained by configuring the dynamic library decompression capability for the system-preinstalled dlopen interface.

[0101] As can be seen from the above technical solution, by pre-configuring the dynamic library loading function for the BMC system to configure the dynamic library decompression ability and memory monitoring ability, the application programs in the BMC are enabled to have the ability to call the compressed dynamic library and the ability to monitor the tampering risk of the dynamic library placed in the memory. As a result, the BMC dynamic library loading method based on the binary source file structure can be converted into the BMC dynamic library loading method based on the compressed file structure. Moreover, the BMC stores the target dynamic library through a custom compressed file (i.e., the target compressed dynamic library), which can prevent the target compressed dynamic library stored in the BMC from being cracked by a general decompression algorithm, thereby reducing the risk of the target dynamic library stored in the BMC being decompiled. During the process of the application program calling the target compressed dynamic library, continuous tampering risk monitoring is set for the decompressed dynamic library placed in the memory, which can reduce the risk of the application program calling the tampered target dynamic library. Therefore, by pre-configuring the custom decompression ability and tampering risk monitoring ability for the BMC system's dynamic library loading function, the security of the BMC loading the dynamic library is improved.

[0102] The system for loading the dynamic library provided by the embodiments of the present application can implement each process implemented by the method embodiments for loading the dynamic library described in the first aspect. To avoid repetition, it will not be elaborated here.

[0103] The embodiments of the present application also provide an electronic device. Refer to Figure 4 , Figure 4 which is a schematic diagram of the electronic device proposed by the embodiments of the present application. As Figure 4 shown, the electronic device 100 includes: a memory 110 and a processor 120. The memory 110 is communicatively connected to the processor 120 through a bus. A computer program is stored in the memory 110, and this computer program can run on the processor 120, thereby implementing the steps in the method for loading the dynamic library disclosed by the embodiments of the present application.

[0104] The embodiments of the present application also provide a computer-readable storage medium, on which a computer program / instructions are stored. When the computer program / instructions are executed by a processor, the method for loading the dynamic library as disclosed by the embodiments of the present application is implemented.

[0105] The embodiments of the present application also provide a computer program product, including a computer program / instructions. When the computer program / instructions are executed by a processor, the method for loading the dynamic library as disclosed by the embodiments of the present application is implemented.

[0106] Each embodiment in this specification is described in a progressive manner. The key point of each embodiment is to illustrate the differences from other embodiments. The same or similar parts among the embodiments can be referred to each other.

[0107] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, apparatuses, or computer program products. Therefore, the embodiments of the present application can take the form of completely hardware embodiments, completely software embodiments, or embodiments combining software and hardware aspects. Moreover, the embodiments of the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memories, CD-ROMs, optical memories, etc.) containing computer-usable program code.

[0108] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of methods, systems, devices, storage media, and program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processors of general-purpose computers, special-purpose computers, embedded processors, or other programmable data processing terminal devices to generate a machine, such that the instructions executed by the processors of the computer or other programmable data processing terminal devices generate a device for implementing the functions specified in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0109] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device that implements the functions specified in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0110] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device, such that a series of operation steps are executed on the computer or other programmable terminal device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable terminal device provide steps for implementing the functions specified in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0111] Although the preferred embodiments of the present application have been described, those skilled in the art can make additional changes and modifications once they know the basic creative concepts. Therefore, the appended claims are intended to be construed as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0112] Finally, it should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or terminal device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or further includes elements inherent in such process, method, article or terminal device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or terminal device comprising the said element.

[0113] The above has introduced in detail a method, system, device, storage medium and program product for loading a dynamic library provided by the present application. Specific examples are used in this text to elaborate on the principle and implementation manner of the present application. The description of the above embodiments is only used to help understand the method and its core idea of the present application; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to the present application.

Claims

1. A method for loading a dynamic library, characterized in that, applied to a Baseboard Management Controller (BMC), the method includes: Obtain a target compressed dynamic library from a computer device and store the target compressed dynamic library. The target compressed dynamic library is generated by the computer device performing a compression operation on a target dynamic library according to a custom compression algorithm; When an application in the BMC calls the target dynamic library, according to the custom decompression algorithm matching the custom compression algorithm, use a custom dynamic library loading function to perform a decompression operation on the target compressed dynamic library to obtain the target dynamic library; Put the target dynamic library into the memory of the BMC, and use the custom dynamic library loading function to continuously monitor whether the target dynamic library in the memory of the BMC is tampered with. The custom dynamic library loading function is obtained by configuring the dynamic library decompression ability and memory monitoring ability for the system-preinstalled dynamic library loading function; In the case where the target dynamic library in the memory of the BMC is tampered with, perform a decompression operation on the target compressed dynamic library stored in the BMC again to obtain a new target dynamic library, and call the new target dynamic library through the application in the BMC; In the case where the target dynamic library in the memory of the BMC is not tampered with, call the target dynamic library in the memory of the BMC through the application in the BMC; Before continuously monitoring whether the target dynamic library in the memory of the BMC is tampered with, decompress the target compressed dynamic library and put it into the memory of the BMC through the following steps: Use a custom dlopen interface to apply for a block of heap memory in the BMC and use the heap memory as the target memory block; Use the custom dlopen interface to perform a decompression operation on the target compressed dynamic library to obtain the target dynamic library, and put the target dynamic library into the target memory block; The continuous monitoring of whether the target dynamic library in the memory of the BMC is tampered with includes: Use the custom dlopen interface to continuously monitor whether there is a data modification operation on the target memory block; When the custom dlopen interface detects that there is a data modification operation on the target memory block, determine that the target dynamic library in the memory of the BMC is tampered with; When the custom dlopen interface detects that there is no data modification operation on the target memory block, determine that the target dynamic library in the memory of the BMC is not tampered with.

2. The method according to claim 1, characterized in that, The calling of the target dynamic library in the memory of the BMC by the application in the BMC includes: Use a custom interface call function to determine whether the target function in the memory of the BMC is tampered with. The target function is at least one function in the target dynamic library required to be called by the application in the BMC. The custom interface call function is obtained by configuring the memory monitoring ability for the system-preinstalled interface call function; When the target function is not tampered with, the function is called using the custom interface, and the target function in the memory of the BMC is called in the application program.

3. The method according to claim 2, wherein, the custom interface call function is obtained by configuring the memory monitoring capability for the system-preinstalled dlsym interface.

4. The method according to claim 1, wherein, the obtaining of the target compressed dynamic library from the computer device includes: obtaining a target encrypted dynamic library from the computer device, where the target encrypted dynamic library is generated by the computer device encrypting the target compressed dynamic library according to an encryption algorithm; performing a decryption operation on the target encrypted dynamic library using the custom dynamic library loading function according to the decryption algorithm matched with the encryption algorithm to obtain the target compressed dynamic library, where the custom dynamic library loading function is obtained by configuring the dynamic library decompression capability, memory monitoring capability, and dynamic library decryption capability for the system-preinstalled dynamic library loading function.

5. The method according to claim 4, wherein, before performing the decompression operation on the target compressed dynamic library, it further includes: performing a dynamic library verification on the target compressed dynamic library using the custom dynamic library loading function, where the dynamic library verification includes at least one of dynamic library integrity verification and dynamic library correctness verification, and the custom dynamic library loading function is obtained by configuring the dynamic library decompression capability, memory monitoring capability, dynamic library verification capability, and dynamic library decryption capability for the system-preinstalled dynamic library loading function; the performing of the decompression operation on the target compressed dynamic library includes: performing a decompression operation on the target compressed dynamic library that has passed the dynamic library verification.

6. The method according to any one of claims 1-5, wherein, the custom dynamic library loading function is obtained by configuring the dynamic library decompression capability and memory monitoring capability for the system-preinstalled dlopen interface.

7. A system for loading a dynamic library, wherein, applied to a baseboard management controller (BMC), and includes: an obtaining module, configured to obtain a target compressed dynamic library from a computer device and store the target compressed dynamic library, where the target compressed dynamic library is generated by the computer device compressing a target dynamic library according to a custom compression algorithm; a decompression module, configured to, when the target dynamic library is called by an application program in the BMC, perform a decompression operation on the target compressed dynamic library using the custom dynamic library loading function according to a custom decompression algorithm matched with the custom compression algorithm to obtain the target dynamic library; a first memory monitoring module, configured to put the target dynamic library into the memory of the BMC and continuously monitor whether the target dynamic library in the memory of the BMC is tampered with using the custom dynamic library loading function, where the custom dynamic library loading function is obtained by configuring the dynamic library decompression capability and memory monitoring capability for the system-preinstalled dynamic library loading function; The first response module is used to, when the target dynamic library in the memory of the BMC is tampered with, decompress the target compressed dynamic library stored in the BMC again to obtain a new target dynamic library, and call the new target dynamic library through the application program in the BMC; The second response module is used to, when the target dynamic library in the memory of the BMC is not tampered with, call the target dynamic library in the memory of the BMC through the application program in the BMC; The decompression module is further used to decompress the target compressed dynamic library by using a custom dlopen interface to obtain the target dynamic library; The first memory monitoring module is further used to perform the following steps: Apply for a block of heap memory in the BMC by using the custom dlopen interface, use the heap memory as the target memory block, and put the target dynamic library into the target memory block; Continuously monitor whether there is a data modification operation on the target memory block by using the custom dlopen interface; When the custom dlopen interface detects that there is a data modification operation on the target memory block, it is determined that the target dynamic library in the memory of the BMC is tampered with; When the custom dlopen interface detects that there is no data modification operation on the target memory block, it is determined that the target dynamic library in the memory of the BMC is not tampered with.

8. An electronic device, including a memory, a processor, and a computer program stored on the memory, characterized in that the processor executes the computer program to implement the method for loading a dynamic library according to any one of claims 1 to 6.

9. A computer-readable storage medium, on which a computer program / instructions are stored, characterized in that when the computer program / instructions are executed by a processor, the method for loading a dynamic library according to any one of claims 1 to 6 is implemented.

10. A computer program product, including a computer program / instructions, characterized in that when the computer program / instructions are executed by a processor, the method for loading a dynamic library according to any one of claims 1 to 6 is implemented.

Images