A security reinforcement method and system for real-time operating system

Abstract

This application discloses a security reinforcement method and system for a real-time operating system. This method involves first configuring the target system to generate a symbol table and suspending all tasks in the current target system; searching the symbol table based on the name of the system function and recording the address of the system function to be stubbed; then writing a stub function to control the return value according to a preset policy; and finally, after the stub function loads and updates the symbol table, resuming all tasks in the target system. This application monitors and controls key system functions through dynamic loading, preventing malicious programs from accessing sensitive resources. It also flexibly configures security policies based on actual needs, enabling more refined access control.

Description

Technical Field

[0001] The present invention relates to the field of system security technology, and in particular to a security reinforcement method and system for a real-time operating system. Background Art

[0002] There are two main ways to run and deploy a real-time operating system and upper-level applications: one is to compile the real-time operating system and upper-level applications into a single image file and burn it to the device for execution; the other is to compile the real-time operating system and upper-level applications separately to generate multiple files (the operating system and application can be burned to the device separately, similar to Windows and Linux, and the application can be deployed, run, and stopped at will on the operating system within the scope of permissions).

[0003] RTOS security hardening refers to the operating system controlling access to upper-layer applications based on administrator-provided policy information (such as configuration files and whitelists). For example, if an upper-layer application needs to use a socket or access a file in a specific path in the file system, the RTOS will decide whether to grant access based on the administrator's policy.

[0004] The security control of the existing technical solution is mainly related to tasks, because VxWorks mainly provides task hooks and lacks hooks related to files (such as fopen, etc.) and sockets (such as socket, bind, connect, etc.). Changing the status of other tasks in the task hook can easily cause an infinite loop. For example, a task deletion hook (i.e., taskDeleteHookAdd(deleteHookCB)) is registered in the task code of a task named unknown, and a task named unknown is created again in the task deletion hook (deleteHookCB). Therefore, when the unknown task is created, the target system calls back the hook of the security task. The security hook considers the unknown task illegal and deletes the task through taskDelete. At this time, the target system calls back the deletion hook registered by the unknown task. The unknown task deletion creates the unknown task again. The target system calls back the hook of the security task, thereby generating an infinite loop and causing a greater security risk. Summary of the Invention

[0005] Based on this, the present invention provides a real-time operating system (RTOS) security hardening method and system. This method utilizes the RTOS's dynamic loading method to add hook points to system functions that require monitoring, thereby achieving host hardening. For example, this method controls application access to the file system, sockets, and underlying devices; and it obtains network data through sockets to implement intrusion prevention and intrusion monitoring.

[0006] In a first aspect, a method for strengthening security of a real-time operating system is provided, the method comprising:

[0007] Configure the target system to generate a symbol table and suspend all tasks of the current target system;

[0008] Search the symbol table according to the name of the system function and record the address of the system function that needs to be stubbed;

[0009] Write a pile function to control the return value according to a preset strategy; wherein the function name of the pile function is the same as the system function that needs to be piled;

[0010] After the stub function is loaded and the symbol table is updated, all tasks of the target system are restored.

[0011] Optionally, configure the target system to generate a symbol table and suspend all tasks on the current target system, including:

[0012] Generate a symbol table by setting the debugging options of the target system, and suspend all running tasks in the system through the API provided by the target system.

[0013] Optionally, search the symbol table based on the name of the system function and record the address of the system function that needs to be stubbed, including:

[0014] Use the symFindByName function and pass in the name of the system function to find and obtain the address of the function in the symbol table; save the queried address in the variable stub_fopenAddr.

[0015] Optionally, writing a stub function includes:

[0016] Create a stub function with the same name as the target system function, implement the security policy logic, and preset the security policy; wherein the security policy includes a file path whitelist and read and write permissions.

[0017] Optionally, control the return value according to a preset policy, including:

[0018] In the stub function, whether to allow the original system function to be called is determined according to the preset security policy; if it complies with the security policy, the original function is called and the result is returned; if it does not comply, an error or a null value is returned.

[0019] Optionally, writing a stub function to control the return value according to a preset strategy also includes:

[0020] The stub function is loaded into the memory using the dynamic loading mechanism of the target system, and the symbol table is updated so that calls to the original system function are redirected to the stub function.

[0021] In a second aspect, a security reinforcement system for a real-time operating system is provided, the system comprising:

[0022] Configuration module, used to configure the target system to generate a symbol table and suspend all tasks of the current target system;

[0023] The search module is used to search the symbol table according to the name of the system function and record the address of the system function that needs to be stubbed;

[0024] Loading module, for writing pile function, according to preset strategy control return value; Wherein, the function name of described pile function is the same name as the system function that needs pile driving;

[0025] The recovery module is used to restore all tasks of the target system after the stub function is loaded and the symbol table is updated.

[0026] In a third aspect, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the security reinforcement method for the real-time operating system described in any one of the first aspects is implemented.

[0027] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the security reinforcement method for a real-time operating system described in any one of the first aspects is implemented.

[0028] In a fifth aspect, a computer program product is provided, comprising a computer program / instruction, which, when executed by a processor, implements the security reinforcement method described in any one of the first aspects above.

[0029] The beneficial effects brought about by the technical solution provided in the embodiments of the present application include that through dynamic loading (hot patching), the real-time operating system can monitor and control key system functions, prevent malicious programs from accessing sensitive resources, and flexibly configure security policies according to actual needs, thereby achieving more refined access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other implementation drawings based on the provided drawings without inventive effort.

[0031] Figure 1 A flowchart of a method for strengthening security of a real-time operating system provided in an embodiment of the present application;

[0032] Figure 2A schematic diagram of security reinforcement provided in an embodiment of the present application;

[0033] Figure 3 VxWorks is configured to generate symbolic representations for the embodiments of the present application. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0035] In the description of the present invention, the terms "comprise", "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may also include other steps or units that are not explicitly listed but are inherent to these processes, methods, products or apparatuses, or steps or units that are added based on further optimization solutions conceived by the present invention.

[0036] The present application's technical solution adopts the mode of dynamic loading (hot patch) to the target system function that needs to be monitored.Such as to fopen function piling (pile function is fopenStub), upper application still uses fopen to obtain the file handle of a certain file, application program calls fopen, what first enters is pile function fopenStub, then in fopenStub, judge according to strategy whether the file path or the read-write operation of application access meet the requirements, if meet the requirements then fopenStub calls again and returns the return value of fopen to application, if do not meet the requirements then return NULL.Thus reach the authority of controlling user.

[0037] Please refer to Figure 1 , which shows a flow chart of a security reinforcement method for a real-time operating system provided by an embodiment of the present application. The method may include the following steps:

[0038] S1, configure the target system to generate a symbol table and suspend all tasks of the current target system.

[0039] In the embodiment of the present application, the target system is the VxWorks system, and it can also be applied to other systems that meet the requirements of implementing the security reinforcement method, such as the Tianmai operating system whose API name and parameters are the same as VxWorks.

[0040] In this step, ensure that the target system is configured correctly so that a symbol table containing the addresses of all system functions is generated during compilation. This is typically achieved by setting the compiler's debugging options. Use VxWorks APIs, such as taskSuspendAll(), to suspend all running tasks in the system. This prevents conflicts with system function calls from other tasks while the symbol table is being modified.

[0041] S2, search in the symbol table according to the name of the system function, and record the address of the system function that needs to be stubbed.

[0042] In this step, use the symFindByName function, passing in the name of the system function to be monitored (e.g., fopen), to find and obtain the function's address in the symbol table. The function address is saved in a variable, such as stub_fopenAddr, which will be used for subsequent stubbing operations.

[0043] S3, write a stub function to control the return value according to the preset strategy.

[0044] Wherein, the function name of pile function has the same name as the system function that needs pile driving.In this step, create a new function, its name is identical with the system function that needs pile driving (for example fopenStub), and realizes preset security policy logic.In pile function, according to the policy information (such as configuration file, white list etc.) that administrator provides, judge whether the access request of upper layer application is legal.If legal, then call original system function and return result; If illegal, then return error or null value.

[0045] S4, after the stub function is loaded and the symbol table is updated, all tasks of the target system are restored.

[0046] In this step, after completing the writing of the stub function and the modification of the symbol table, use the taskResumeAll() function to resume all previously suspended tasks to ensure that the system can continue to run normally.

[0047] From the above, we can see that this application uses VxWorks to dynamically load and modify the symbol table to add a hook point to the system function that needs to be monitored. When the application calls the system function, it enters the hook point and calls back the custom security control function. Figure 2 A schematic diagram of security reinforcement is given. In an optional embodiment of this application, it includes:

[0048] First, confirm (configure) VxWorks to generate a symbol table, such as Figure 3 As shown, all tasks in the current system are suspended.

[0049] Then, the system function (symFindByName) is used to find the address of the function to be stubbed in the symbol table according to the name and record it. Assuming that fopen is stubbed, the address found by symFindByName is saved in the variable stub_fopenAddr.

[0050] Then write a stub function. The function name of the stub function has the same name as the target function that needs to be stubbed. That is, to stub fopen, re-implement fopen and then control the return value according to the strategy.

[0051] Finally resume all suspended tasks.

[0052] The following is the detailed process of the above implementation process:

[0053] void*fopen(char*fileName,char*mode)

[0054] {

[0055] intn;

[0056] time_t stime;

[0057] structtm*pstTime;

[0058] void*ptr;

[0059] stub_ptr_ptr_ptr stub_func=(stub_ptr_ptr_ptr)stub_fopenAddr;

[0060] if(stub_func == NULL){

[0061] returnNULL;

[0062] }

[0063] if (fileName is in the allowed access path && read / write operation mode is within the allowed range) {

[0064] ptr=(*stub_func)(fileName,mode); / *Call the real system function to get the file handle* /

[0065] }else{

[0066] ptr=NULL; / *Access is not allowed, return NULL* /

[0067] }

[0068] returnptr;

[0069] }

[0070] Assuming that fopen is stubbed, the debug command can be used to confirm the address changes in the symbol table before and after the modification. Before stubbing, the address of fopen in the symbol table is 0x00375fd0. After stubbing, the symbol table has a new address of fopen, 0x7fb880e0, which is the address of the custom implemented fopen function.

[0071] Still taking fopen as an example, by creating a webserver task, fopen is needed to access files in the webserver request. At the same time, the customized fopen controls whether the application can be called successfully according to the time.

[0072] void*fopen(char*fileName,char*mode)

[0073] {

[0074] intn;

[0075] time_t stime;

[0076] structtm*pstTime;

[0077] void*ptr;

[0078] stub_ptr_ptr_ptr stub_func=(stub_ptr_ptr_ptr)stub_fopenAddr;

[0079] if(stub_func == NULL){

[0080] returnNULL;

[0081] }

[0082] time(&stime);

[0083] pstTime=localtime(&stime);

[0084] if (pstTime->tm_sec%4){

[0085] ptr=(*stub_func)(fileName,mode);

[0086] }else{

[0087] ptr = NULL;

[0088] }

[0089] printf("%s[%d]:task%s%02d:%02d:%02d%p=fopen(%s,%s)\r\n",__FUNCTION__,__LINE__,taskName(taskIdSelf()),

[0090] pstTime->tm_hour,pstTime->tm_min,pstTime->tm_sec,ptr,fileName,mode);

[0091] returnptr;

[0092] }

[0093] When the task receives a socket request and the system time is divisible by 4, the custom fopen function returns NULL, causing the application's fopen to fail. If the system time is not divisible by 4, the custom fopen function returns to the recorded system fopen function address, stub_func, to open the file handle. This implements access control for the application's system functions.

[0094] In an optional embodiment of the present application, the above solution may further include:

[0095] 1. Recompile the real-time operating system kernel and repackage the API for the system functions that need to be controlled.

[0096] 2. Patch the application and modify the function address that needs to be monitored in the application file.

[0097] In one embodiment of the present application, a security reinforcement system for a real-time operating system is provided, the system comprising:

[0098] Configuration module, used to configure the target system to generate a symbol table and suspend all tasks of the current target system;

[0099] The search module is used to search the symbol table according to the name of the system function and record the address of the system function that needs to be stubbed;

[0100] Loading module, for writing pile function, according to preset strategy control return value; Wherein, the function name of described pile function is the same name as the system function that needs pile driving;

[0101] The recovery module is used to restore all tasks of the target system after the stub function is loaded and the symbol table is updated.

[0102] For the specific definition of the real-time operating system security hardening system, please refer to the definition of the real-time operating system security hardening method above, and will not be repeated here. The various modules in the above-mentioned real-time operating system security hardening system can be implemented in whole or in part through software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of the above modules.

[0103] In one embodiment, an electronic device is provided, which may be a computer. The electronic device includes a processor, a memory, and a network interface connected via a system bus. The processor of the device is used to provide computing and control capabilities. The memory of the device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used for security reinforcement data of a real-time operating system. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a security reinforcement method for a real-time operating system is implemented.

[0104] In one embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the security reinforcement method for the real-time operating system are implemented.

[0105] In one embodiment of the present application, a computer program product is provided, including a computer program / instruction, which implements the steps of the above-mentioned real-time operating system security reinforcement method when executed by a processor.

[0106] The computer-readable storage medium and computer program product provided in this embodiment have similar implementation principles and technical effects to those of the above-mentioned method embodiments, and are not described in detail here.

[0107] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in M ​​forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (SyMchliMk) DRAM (SLDRAM), memory bus (RaMbus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0108] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0109] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A security reinforcement method for a real-time operating system, characterized in that: The method comprises: Configure the target system to generate a symbol table and suspend all tasks of the current target system; Search the symbol table according to the name of the system function and record the address of the system function that needs to be stubbed; Write a pile function to control the return value according to a preset strategy; wherein the function name of the pile function is the same as the system function that needs to be piled; After the stub function is loaded and the symbol table is updated, all tasks of the target system are restored; Configure the target system to generate a symbol table and suspend all tasks of the current target system, including: generating a symbol table by setting the debugging options of the target system and suspending all running tasks in the system through the API provided by the target system; Search the symbol table according to the name of the system function and record the address of the system function that needs to be stubbed, including: using the symFindByName function, passing in the name of the system function to find and obtain the address of the function in the symbol table; saving the queried address in the variable stub_fopenAddr; Writing a stub function includes: creating a stub function with the same name as the target system function, implementing security policy logic, and presetting a security policy; wherein the security policy includes a file path whitelist and read and write permissions; Controlling the return value according to a preset policy includes: in the stub function, determining whether to allow the original system function to be called according to a preset security policy; if the security policy is met, calling the original function and returning the result; if not, returning an error or a null value; Writing a stub function and controlling the return value according to a preset strategy also includes: using the dynamic loading mechanism of the target system to load the stub function into the memory, and updating the symbol table so that the call to the original system function is redirected to the stub function.

2. A security reinforcement system for a real-time operating system, characterized in that: The system comprises: Configuration module, used to configure the target system to generate a symbol table and suspend all tasks of the current target system; The search module is used to search the symbol table according to the name of the system function and record the address of the system function that needs to be stubbed; Loading module, for writing pile function, according to preset strategy control return value; Wherein, the function name of described pile function is the same name as the system function that needs pile driving; The recovery module is used to restore all tasks of the target system after the stub function is loaded and the symbol table is updated; Configure the target system to generate a symbol table and suspend all tasks of the current target system, including: generating a symbol table by setting the debugging options of the target system and suspending all running tasks in the system through the API provided by the target system; Search the symbol table according to the name of the system function and record the address of the system function that needs to be stubbed, including: using the symFindByName function, passing in the name of the system function to find and obtain the address of the function in the symbol table; saving the queried address in the variable stub_fopenAddr; Writing a stub function includes: creating a stub function with the same name as the target system function, implementing security policy logic, and presetting a security policy; wherein the security policy includes a file path whitelist and read and write permissions; Controlling the return value according to a preset policy includes: in the stub function, determining whether to allow the original system function to be called according to a preset security policy; if the security policy is met, calling the original function and returning the result; if not, returning an error or a null value; Writing a stub function and controlling the return value according to a preset strategy also includes: using the dynamic loading mechanism of the target system to load the stub function into the memory, and updating the symbol table so that the call to the original system function is redirected to the stub function.

3. An electronic device, characterized in that: The device comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the security reinforcement method according to claim 1 is implemented.

4. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the security reinforcement method according to claim 1 is implemented.

5. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the security reinforcement method as claimed in claim 1 is implemented.

Images