Optimization method, optimization device and computing equipment

Abstract

The invention discloses an optimization method, an optimization device and computing equipment. When the user mode runs the user program, the user mode process directly runs in the kernel mode, the kernel mode starts the application program and runs the application program, and the user mode process running in the kernel mode can directly use the privileged application program. The kernel mode can safely release more efficient hardware resources to the application program so as to improve the performance of the application program in a specific scene. The user mode process running in the kernel mode can directly bypass the operating system, and hardware resources can be managed and used more efficiently.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to an optimization method, an optimization device and a computing device. Background Art

[0002] As the development of chips is limited by Moore's Law, it is difficult to improve the performance of the system by improving the performance of the chip. In the case that the integrated circuit process and chip microarchitecture no longer change, how to improve the performance of the entire system or a specific application (application, APP) by optimizing the system software is an important research direction. In the related technology, there are three main methods to improve system performance, namely:

[0003] 1. Improve system performance by optimizing and improving policies and algorithms in the system. For example, Blk-switch can reconstruct the existing Linux kernel storage stack to implement low-latency and high-throughput applications running on the Linux kernel architecture. However, since the design principle of modern operating systems is the separation of mechanisms and policies, the former only focuses on optimizing policies, and it is difficult to achieve good performance improvements without innovating mechanisms.

[0004] 2. Redesign and implement the operating system according to specific goals. For example, in order to achieve lightweight system stack, customize abstraction according to the needs of application services, remove unnecessary system components, and build a highly specialized library operating system to replace the macro kernel. This approach exposes system resources to APP, allowing APP to run efficiently. However, redesigning the architecture and hardware driver adaptation will not only lead to a longer R&D cycle, but also introduce compatibility issues.

[0005] 3. Compress, bypass or partially bypass the kernel state layer through kernel bypass technology to improve APP performance. For example, performance improvement technologies based on dedicated devices / dedicated libraries, such as data plane development kit (DPDK), storage performance development kit (SPDK), remote direct memory access (RDMA) and other technologies can effectively accelerate input / output (I / O) operations such as network transmission and storage to improve APP performance. Some existing work can use virtualization technology to abstract hardware resources and provide APP with the ability to bypass the client's kernel. Some existing work can use the extended Berkeley packet filter (eBPF) program to mount specific functions into the kernel for execution, similar to the kernel bypass system. The eBPF program is also suitable for occasions such as network and storage that are sensitive to kernel performance.

[0006] It can be seen that among the three existing solutions for improving system performance, without changing the kernel technology, simply optimizing the strategy can only improve system performance to a very limited extent. Reconstructing the operating system not only takes a long development cycle, but also has poor compatibility. Kernel bypass technology can significantly improve data processing performance and throughput in APPs, but like eBPF programs, it can only be applied to scenarios such as networking and storage. Summary of the invention

[0007] In order to solve the above problems, an optimization method is provided in the embodiments of the present application, which can allow the user state process to run in the kernel state, so that the user state process running in the kernel state can directly use the privileged APP. The kernel state can safely release more efficient hardware resources to the APP to improve the performance of the APP in specific scenarios. The user state process running in the kernel state can directly bypass the operating system and can manage and use hardware resources more efficiently. In addition, the present application also provides an optimization device and a computing device corresponding to the optimization method.

[0008] To this end, the following technical solutions are adopted in the embodiments of the present application:

[0009] In a first aspect, an embodiment of the present application provides an optimization method, which is applied to user state and kernel state, and the method includes: when the user state runs an application, let the user state process run in the kernel state; the user state process refers to the process running in the user state; the application is installed in the operating system; the kernel state runs a temporary kernel state process to start the application and / or run the application, and the temporary kernel state process refers to the user state process running in the kernel state.

[0010] In this implementation, when the user state runs the user program, the user state process is directly run in the kernel state, and the kernel state starts and runs the application program to improve the performance of the computing device and enhance the user experience.

[0011] In one embodiment, when the user state runs the application, the user state process is allowed to run in the kernel state, including: when the user state runs the application, the kernel module is called; the kernel module is used to obtain the resources of the kernel state; the kernel module uses the resources of the kernel state to allow the user state process to run in the kernel state.

[0012] In this embodiment, the kernel module is a user-state data storage object DSO library code. The user-state DSO library can call kernel-state hardware, kernel space and other resources to enable user-state processes to run in kernel state.

[0013] In one embodiment, the method also includes: the kernel state responds to the temporary kernel state process using sensitive instructions as partially sensitive instructions, encapsulating the partially sensitive instructions inside the kernel state security interface; the sensitive instructions are instructions for the kernel state to run the temporary kernel state process; the partially sensitive instructions are instructions whose impact on the operating system is limited to the temporary kernel state process; the security interface is an interface that restricts the temporary kernel state process from using other resources of the kernel state.

[0014] In this implementation, some sensitive instructions refer to sensitive instructions that can limit the impact of temporary kernel state process execution on the operating system to the current process by configuring the operands of the temporary kernel state process. The operating system can encapsulate some sensitive instructions in a security interface, and encapsulate constraint logic for constraining some sensitive instructions in the security interface to ensure that some sensitive instructions only affect the state of the current process and do not affect the security of the kernel state.

[0015] In one embodiment, the method further includes: the kernel state encapsulates the sensitive data inside the security interface of the kernel state in response to the temporary kernel state process accessing the sensitive data; the sensitive data refers to data that affects the security of the operating system.

[0016] In this implementation, the operating system may encapsulate sensitive data in a security interface, and encapsulate constraint logic for constraining the sensitive data in the security interface to ensure that the sensitive data only affects the state of the current process.

[0017] In one embodiment, the method further includes: the user state monitoring the page table of the temporary kernel state process, and in response to the existence of an executable page table in the user space, intercepting the executable page table.

[0018] In this implementation, the kernel module can monitor the page table of the temporary kernel state process at all times and track the setting of the page table entry used for user space address translation. When the kernel module determines that an executable code page appears in the user space (i.e., the executable bit in the page table entry is set), it is necessary to intercept the page table entry to set the executable permission to ensure that when the page table entry has sensitive instructions, the current temporary kernel state process is killed immediately to prevent the untrusted temporary kernel state process from launching an attack.

[0019] In one embodiment, the method also includes: when the temporary kernel state process enters and exits the kernel state, the kernel of the operating system sets the EPDn field to 1 to restrict the temporary kernel state process from using the page table of the kernel of the operating system to access the kernel space; the EPD1 is used to control the address of the user virtual space for translation.

[0020] In this implementation, each time the temporary kernel state process enters or exits the kernel, the EPDn field is set to 1, becoming EPD1. EPD1 prevents the code in the temporary kernel state process from using the kernel page table to complete the access to the kernel space. At this time, the temporary kernel state process cannot pass through the kernel page table, but can access part of the kernel space through the TLB. Therefore, the kernel page can be set to a non-global page, and an ASID is reserved for the kernel to avoid TLB refresh.

[0021] In one embodiment, the method further includes: the kernel state utilizes a privileged access-prohibited PAN mechanism to isolate the data used by the temporary kernel state process from other data.

[0022] In this implementation, the kernel state can utilize the PAN mechanism to isolate the data used by the temporary kernel state process from other data, prevent illegal access, and allow only legal instructions to access private data.

[0023] In a second aspect, an embodiment of the present application provides an optimization device, comprising: a computing unit, used to allow a user state process to run in the kernel state when an application is run in the user state; the user state process refers to a process running in the user state; the application is installed in an operating system; the kernel state runs a temporary kernel state process to start the application and / or run the application, and the temporary kernel state process refers to the user state process running in the kernel state.

[0024] In one embodiment, it also includes a kernel module, and the computing unit is specifically used to call the kernel module when the application is running in the user state; the kernel module is used to obtain the resources of the kernel state; the kernel module is used to utilize the resources of the kernel state to allow the user state process to run in the kernel state.

[0025] In one embodiment, the computing unit is also used to encapsulate the partially sensitive instructions within the security interface of the kernel state in response to the temporary kernel state process using sensitive instructions as partially sensitive instructions in the kernel state; the sensitive instructions are instructions for the kernel state to run the temporary kernel state process; the partially sensitive instructions are instructions whose impact on the operating system is limited to the temporary kernel state process; the security interface is an interface that restricts the temporary kernel state process from using other resources of the kernel state.

[0026] In one embodiment, the computing unit is further used to encapsulate the sensitive data within the kernel state security interface in response to the temporary kernel state process accessing sensitive data in the kernel state; the sensitive data refers to data that affects the security of the operating system.

[0027] In one embodiment, the computing unit is further configured to monitor the page table of the temporary kernel-mode process in the user mode, and intercept the executable page table in response to the existence of an executable page table in the user space.

[0028] In one embodiment, the computing unit is also used to set the EPDn field to 1 by the kernel of the operating system when the temporary kernel state process enters and exits the kernel state, so as to restrict the temporary kernel state process from using the page table of the kernel of the operating system to access the kernel space; the EPD1 is used to control the translation of the address of the user virtual space.

[0029] In one embodiment, the computing unit is further configured to utilize a privileged access-prohibited PAN mechanism in the kernel state to isolate the data used by the temporary kernel state process from other data.

[0030] In a third aspect, an embodiment of the present application provides a computing device, comprising: at least one memory, and at least one processor, wherein the at least one processor is used to execute instructions stored in the at least one memory, so that the computing device can be implemented as each of the possible embodiments of the first aspect.

[0031] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute various possible implementation embodiments of the first aspect.

[0032] In a fifth aspect, an embodiment of the present application provides a computer program product, characterized in that the computer program product stores instructions, and when the instructions are executed by a computer, the computer implements each possible implementation embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The following is a brief introduction to the drawings required for describing the embodiments or prior art.

[0034] Figure 1 A schematic diagram of the architecture of a computing device provided in an embodiment of the present application;

[0035] Figure 2 A schematic diagram of the working process of the TLBI instruction security interface provided in the embodiment of the present application calling secure_tlbi as a security gate;

[0036] Figure 3 A schematic diagram of the spatial memory layout of a kernel-mode process provided in an embodiment of the present application;

[0037] Figure 4 A schematic diagram of the implementation process of filtering sensitive instructions by the sensitive instruction filtering module provided in an embodiment of the present application;

[0038] Figure 5 A schematic diagram of screening and handling methods for different types of sensitive instructions provided in an embodiment of the present application;

[0039] Figure 6 A schematic diagram of the encoding structure of the system instructions in the ARM64 instructions provided in the embodiments of the present application;

[0040] Figure 7 A schematic diagram of the implementation process of isolating the kernel space based on the hardware features EPDn and ASID provided in an embodiment of the present application;

[0041] Figure 8 A schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0042] Fig. 9A schematic diagram of the architecture of a computing device cluster provided in an embodiment of the present application;

[0043] Fig.10 A schematic diagram of the architecture of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0045] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0046] The terms "first" and "second" in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of the objects. For example, a first response message and a second response message are used to distinguish different response messages rather than to describe a specific order of the response messages.

[0047] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0048] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.

[0049] Based on the defects of the three main existing ways to improve system performance, the embodiments of the present application provide a computing device, an operating system based on kernel-state process APP acceleration and an optimization method. The computing device can allow user-state processes to run in kernel state, so that user-state processes running in kernel state can directly use privileged APPs. Kernel state can safely release more efficient hardware resources to APP to improve the performance of APP in specific scenarios. User-state processes running in kernel state can directly bypass the operating system and can manage and use hardware resources more efficiently. User-state processes running in kernel state can be compatible with mainstream Linux operating systems and portable operating system interface (POSIX) application program interface (API), and are suitable for Arch64 / Linux application platforms. When the processor performance remains unchanged, the computing device can improve the performance of the computing device and the user experience by optimizing the operating system.

[0050] Figure 1 Schematic diagram of the architecture of a computing device provided in an embodiment of the present application. Figure 1 As shown, the computing device 10 includes an APP 100, a user state 200, a kernel state 300, a hardware driver 400, and a hardware component 500. The computing device 100 may be a server, a computer, a base station, a portable notebook computer, and the like.

[0051] APP 100 refers to a computer program that completes one or more specific tasks. APP 100 is installed in the operating system, can interact with the user, and after receiving the user's operation instructions, creates one or more execution tasks. Each APP 100 can run in an independent process and have an independent address space.

[0052] The hardware driver 400 is an industry-standard firmware interface. The hardware driver 400 stores the most important basic input and output programs of the computer, the self-test program after startup, and the system self-starting program. The main function of the hardware driver 400 is to provide the computer with the lowest and most direct hardware settings and controls. Exemplarily, the hardware driver 400 can control the hardware component 500, wherein the hardware component 500 can include the underlying hardware such as sensors and registers. In some possible embodiments, the hardware component 500 can include a register or a sensor in a processor, or the hardware component 500 can also include a temperature sensor of a hard disk.

[0053] The smallest unit that the operating system calls the central processing unit (CPU) is a process. Multiple threads can be created in one thread. Threads have their own counters, stacks, local variables and other properties to access shared memory variables. The operating system can divide the memory space into two parts, namely kernel space and user space. Kernel space refers to the space where kernel code runs. User space refers to the space where user program code runs. When a process runs in kernel space, the process is in "kernel mode". A process in kernel mode is also called a kernel mode process. When a process runs in user space, the process is in "user mode". A process in user mode is also called a user mode process.

[0054] In CPU design, user state 200 refers to a non-privileged state. In the non-privileged state, the code executed by user state 200 is limited by hardware and cannot perform privileged operations, such as writing to the storage space of other processes, to prevent security risks to the operating system. Kernel state 300 refers to a privileged state. In the privileged state, kernel state 300 can perform privileged operations.

[0055] In operating system design, user state 200 refers to a non-privileged execution state. The kernel prohibits code in this state from performing potentially dangerous operations, such as writing system configuration files, killing other users' processes, and restarting the system. Kernel state 300 refers to a privileged execution state. The kernel can perform any operation on code in this state.

[0056] User state 200 includes glibc library 210 and kernel module 220. Glibc library 210 is the lowest level API of the operating system. Almost any other runtime library will depend on glibc library 210. In addition to encapsulating the operating system, glibc library 210 can also provide many other necessary functional services.

[0057] The kernel module 220 can be divided into a kernel space isolation module 2221 and a sensitive instruction filtering module 222 according to the execution function. Among them, the kernel space isolation module 2221 and the sensitive instruction filtering module 222 can be implemented by software, or can be implemented by hardware, or can be implemented by a combination of software and hardware. Exemplarily, the implementation method of the kernel space isolation module 2221 is introduced below, taking the kernel space isolation module 2221 as an example. Similarly, the implementation method of the sensitive instruction filtering module 222 can refer to the implementation method of the kernel space isolation module 2221.

[0058] As an example of a software functional unit, the kernel space isolation module 2221 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the kernel space isolation module 2221 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with close geographical locations. Among them, usually a region may include multiple AZs.

[0059] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0060] As an example of a hardware functional unit, the kernel space isolation module 2221 may include at least one computing device, such as a computing device, etc. Alternatively, the kernel space isolation module 2221 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0061] The multiple computing devices included in the kernel space isolation module 2221 can be distributed in the same region or in different regions. The multiple computing devices included in the kernel space isolation module 2221 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the kernel space isolation module 221 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as computing devices, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0062] It should be noted that, in other embodiments, the kernel space isolation module 2221 can be used to execute any step in the optimization method, and the sensitive instruction filtering module 222 can be used to execute any step in the optimization method. The steps that the kernel space isolation module 2221 and the sensitive instruction filtering module 222 are responsible for implementing can be specified as needed, and the kernel space isolation module 2221 and the sensitive instruction filtering module 222 respectively implement different steps in the optimization method to realize the full functions of the operating system.

[0063] Similarly, the kernel state 300 can be divided into a security interface 310 and a privileged hardware resource module 320 according to the execution function. The embodiment of the present application will not be described in detail here.

[0064] The kernel module 220 may be a data storage object (DSO) library code of the user state 200. The DSO library of the user state 200 may call the hardware, kernel space and other resources of the kernel state 300 to enable the user state process to run in the kernel state 300. In the embodiment of the present application, the kernel module 220 may take over the startup function of the APP 100 during the startup phase of the APP 100, allowing the startup function of the APP 100 to run in the kernel state 300, and may use the hardware resources efficiently. During the running phase of the APP 100, the kernel module 220 may integrate the running management of the original process running mode, as well as compatibility with the operating system and the POSIX API, so that the user state process running in the kernel state may bypass the call of the operating system, reduce up and down switching, intercept and process the system service request of the APP 100, and improve the performance of the APP 100.

[0065] It should be noted that after the user state process runs in the kernel state 300 through the kernel module 220, the user state process also becomes a kernel state process. In order to avoid ambiguity, when introducing "the user state process running in the kernel state" below, the "user state process running in the kernel state" can be referred to as a "temporary kernel state process". The "temporary kernel state process" introduced below refers to the user state process running in the kernel state 300 through the kernel module 220, and does not include the kernel state process that only runs in the kernel state.

[0066] The temporary kernel state process is completely transparent in the kernel of the operating system, and the kernel still manages the temporary kernel state process according to the ordinary process (user state process). The kernel module 220 is responsible for connecting the interaction between the temporary kernel state process and the kernel of the operating system, as follows:

[0067] 1. The kernel module 220 can take over the initialization and startup functions of the temporary kernel state process, so that the temporary kernel state process runs in the kernel state 300. For example, the kernel module 220 can intercept the setting of the page table entry so that the memory pages of the temporary kernel state process are all set as kernel pages.

[0068] 2. The kernel module 220 can intercept the system service request of the temporary kernel state process and forward it to the kernel of the operating system for processing. The system service request may include the call, interrupt, exception and signal of the operating system. When the temporary kernel state process manages and uses the privileged hardware resources, it needs to use the encapsulated security interface 310.

[0069] User state 200 can run user state processes in kernel state 300, which is to use privileged resources that can only be used in kernel state to run user state processes to improve the performance of APP 100. Although the operating system improves the performance of user state processes, it increases the security attack surface, that is, untrusted temporary kernel state processes can directly threaten the security of the kernel of the operating system. In the embodiment of the present application, the kernel module 220 can use APP safe operation technology to ensure the security of the operating system during operation.

[0070] The privileged resources that temporary kernel-state processes can use can be divided into two categories: privileged instructions and sensitive data such as page tables. Since temporary kernel-state processes can execute any sensitive instructions, it is necessary to constrain temporary kernel-state processes so that they cannot execute any sensitive instructions and prevent temporary kernel-state processes from endangering the security of the operating system.

[0071] In the process of constraining the temporary kernel-state process by the user state 200, sensitive instructions can be divided into partially sensitive instructions and fully sensitive instructions. Partially sensitive instructions refer to sensitive instructions that can limit the impact of the temporary kernel-state process execution on the operating system to the current process by configuring the operands of the temporary kernel-state process. For example, the translation lookaside buffer index (TLBI) instruction is a translation lookaside buffer (TLB) shootdown instruction that can invalidate the TLB entry of the address space identity (ASID) of any process. The operating system can configure the operands of the temporary kernel-state process so that the operating system only invalidates the ASID of the current temporary kernel-state process. Fully sensitive instructions refer to sensitive instructions that will definitely affect the entire operating system when the temporary kernel-state process is executed. For example, the halt (HLT) instruction is an instruction of the temporary kernel-state process that does not set an operand.

[0072] If some sensitive instructions can reasonably constrain temporary kernel-mode processes and only affect the current process. The operating system can allow temporary kernel-mode processes to use some sensitive instructions. In an embodiment of the present application, the operating system can encapsulate some sensitive instructions in a security interface (such as security interface 310), and encapsulate constraint logic for constraining some sensitive instructions in the security interface to ensure that some sensitive instructions only affect the state of the current process. When the operating system ensures that the temporary kernel-mode process safely executes some sensitive instructions, it allows the code of the constraint logic to be executed in the register, and uses hardware debugging technology to ensure that the constraint logic will not be bypassed.

[0073] like Figure 2 As shown, take the TLBI instruction as an example. The operating system encapsulates the TLBI instruction in the security interface 310. When the user-mode process uses the TLBI instruction, it can only call the secure_tlbi function. The secure_tlbi function encapsulates the constraint logic for the use of the TLBI instruction and the security constraint. Moreover, the TLBI instructions inside the user-mode process are always monitored by hardware breakpoints. When untrusted code bypasses the entry of secure_tlbi, the user-mode process directly executes some sensitive instructions, which will trigger a debugging exception. Among them, secure_tlbi is used as a security gate, and the specific implementation process is as follows:

[0074] Step S1, secure_tlbi clears the breakpoint of the TLBI instruction.

[0075] Step S2, secure_tlbi executes the relevant logic of the constrained TLBI instruction.

[0076] Step S3, after secure_tlbi checks the constraints of the TLBI instruction, it directly executes the TLBI instruction to trigger a debugging exception.

[0077] Step S4, after secure_tlbi completes the execution of the TLBI instruction and triggers a debugging exception, a debugging breakpoint is set for the TLBI instruction again.

[0078] Step S5, secure_tlbi detects whether the debugging breakpoint setting of the TLBI instruction is successful.

[0079] Step S6, after secure_tlbi determines that the debugging breakpoint of the TLBI instruction is successfully set, it returns the security code.

[0080] If an attacker attempts to bypass the security gate and directly execute the TLBI instruction, a debug exception will be triggered directly after the hardware breakpoint monitoring exception occurs. If the attacker attempts to jump to modify the value of the monitoring position, the security gate will be unable to detect whether the debug breakpoint setting of the TLBI instruction is successful.

[0081] The operating system can not only open some sensitive instructions to user-state processes, but also open sensitive data. When the operating system needs to constrain temporary kernel-state processes, the temporary kernel-state processes cannot execute any sensitive data to prevent the temporary kernel-state processes from endangering the security of the operating system. For example, the operating system can open some page tables for user-state processes to use. The operating system needs to constrain the behavior of user-state processes so that user-state processes cannot configure page tables to map to arbitrary physical pages. In an embodiment of the present application, the operating system can encapsulate sensitive data in a security interface (such as security interface 310), and encapsulate constraint logic for constraining sensitive data in the security interface to ensure that sensitive data only affects the state of the current process. User-state processes can only modify sensitive data through security interfaces.

[0082] The security gate call technology can not only ensure that attackers cannot use the security interface to maliciously access sensitive data, but also ensure that attackers cannot bypass the entrance of secure_tlbi, resulting in the abuse of sensitive data inside the security interface for read and write operations. Since sensitive instructions outside the security interface have been eliminated by the encoding filtering technology of sensitive instructions, the above problems will not occur in the processing of sensitive instructions. The operating system uses a binary scanning method to find and rewrite memory access instructions outside the security interface to constrain its access targets. Although this method can prevent the operating system from accessing sensitive data, it will result in a large number of memory access instructions. Each memory access instruction in the plug-in constrains the operating system access address, which will introduce a huge performance overhead. In an embodiment of the present application, the operating system can use reverse isolation technology and use hardware isolation mechanism to implement access rights that constrain memory access instructions.

[0083] When the privilege access never (PAN) mechanism of advanced RISC machines (ARM) is enabled, code at exception level (EL) 1 cannot access user pages. In other words, kernel-mode code cannot use common memory access instructions of registers such as load register (LDR) and general register (STR) to access user pages. At the same time, in order to support the operating system kernel's legal access to user data, the PAN mechanism also provides two new instructions for registers such as local descriptor table register (LDTR) and STTR. Instructions for registers such as LDTR and STTR can access user pages in kernel mode.

[0084] like Figure 3 As shown, the ordinary area (including the stack area, etc.) of the temporary kernel state process is set as the kernel page, and the area where the sensitive data is located (also called the isolation area) is set as the user page. Under the constraints of the PAN mechanism, the temporary kernel state process code cannot use instructions of registers such as LDR and STR to access sensitive data. However, the security interface can use instructions of registers such as LDTR and STTR to access sensitive data. The operating system can use binary scanning technology to find LDTR and STTR instructions in all code pages, and modify the instructions of registers such as LDTR and STTR to instructions of registers such as LDR and STR to ensure that instructions of registers such as LDTR and STTR do not appear in the user state process code. Among them, the operating system can only access sensitive data through the security interface.

[0085] When a temporary kernel state process is promoted to run in kernel state, it can execute any sensitive instructions. For example, privileged instructions. Since sensitive instructions can change the machine state, sensitive instructions need to be controlled. If the user state 200 cannot control sensitive instructions, sensitive instructions will affect the security of the entire operating system. For example, a malicious temporary kernel state process can use privileged instructions to modify the page table base register to point to a forged page table, etc. In an embodiment of the present application, the kernel module 220 of the user state 200 can set a sensitive instruction filtering module 222. The sensitive instruction filtering module 222 eliminates sensitive instructions in all code pages through binary scanning.

[0086] like Figure 4As shown, the kernel module 220 can monitor the page table of the temporary kernel state process at all times and track the settings of the page table items used for user space address translation. When the kernel module 220 determines that an executable code page appears in the user space (i.e., the executable bit in the page table item is set), it is necessary to intercept the page table item to set the executable permission. Before setting the executable permission for the page table item, the kernel module 220 uses a four-byte alignment method to read the instruction code (four-byte content) in the code page one by one, and determines whether the page table item contains sensitive instructions. When the kernel module 220 determines that the page table item contains sensitive instructions, it immediately kills the current temporary kernel state process to prevent the untrusted temporary kernel state process from launching an attack.

[0087] Some instructions in the ARM instruction set can only run in a privileged state (such as kernel state) and cannot run in user state. If these instructions run in user state, an undefined instruction exception (UID) will be triggered. These instructions can be called privileged instructions. Therefore, when APP 100 runs in kernel state, it can be granted execution permissions for privileged instructions. When APP 100 is granted execution permissions for privileged instructions, attackers will gain stronger attack capabilities, causing the operating system to face greater security threats. For example, APP 100 can read and write system registers in kernel state and modify the TTBR0_EL1 register (that is, the page table base register of the process). The attacker can make the attacked process use a forged page table to modify any physical memory of the attacked process.

[0088] like Figure 5 As shown, the operating system divides the Armv8-A64 instruction set into non-sensitive instructions, unconditional sensitive instructions and conditional sensitive instructions. When the sensitive instruction filtering module 222 detects an unconditional sensitive instruction, it can directly prevent the execution of the unconditional sensitive instruction and directly report an error after scanning the unconditional sensitive instruction.

[0089] Unconditional sensitive instructions can be DC CGDSW, AT S12E0R, TLB ALLE1, MRS <xt>, CurrentEL, etc. The sensitive instruction filtering module 222 can intercept unconditional sensitive instructions by filtering.

[0090] Conditionally sensitive instructions can be divided into three cases:

[0091] 1. Conditionally sensitive instructions can become non-sensitive instructions based on the current operating system configuration. This type of conditionally sensitive instructions can be DC CIVAC, MRS <xt>, FPCR, LDADDB, etc. At this time, APP 100 can directly execute this type of non-sensitive instructions in kernel mode without processing.

[0092] 2. Conditionally sensitive instructions can become sensitive instructions that are not executable in user mode but executable in kernel mode based on the current operating system configuration. This type of conditionally sensitive instructions can be CPP RCTX, DC CGDVAC, MRS <xt>,TC0, etc. At this time, the sensitive instruction filtering module 222 can prevent the execution of the instruction. For example, the sensitive instruction filtering module 222 can intercept this type of conditionally sensitive instruction by configuration or filtering.

[0093] 3. Conditionally sensitive instructions can be based on the current operating system configuration and become sensitive instructions that can be executed in both user mode and kernel mode, but with inconsistent behaviors. This type of conditionally sensitive instruction can be MRS <xt>, CTR_EL0, etc. At this time, the sensitive instruction filter module 222 can replace the instruction with the brk instruction. When the sensitive instruction filter module 222 executes the brk instruction, it intercepts the brk exception and simulates the user mode behavior of the instruction before returning. For example, the sensitive instruction filter module 222 can intercept this type of conditional sensitive instruction by configuration or sinking.

[0094] In an embodiment of the present application, the sensitive instruction filtering module 222 can adopt different execution schemes based on different types of sensitive instructions to ensure that the APP 100 cannot execute instructions exceeding its permissions in the kernel state, so as to protect the security of the operating system.

[0095] like Figure 6 As shown, in the encoding structure of the system instructions in the ARM64 instructions, the first ten bits of the privileged instructions are the same. The sensitive instruction filtering module 222 only needs to determine whether the content of the 22nd to 31st bits of the encoding structure is equal to 0010101011b. The sensitive instruction filtering module 222 determines that the content of the 22nd to 31st bits of the encoding structure is equal to 0010101011b, and the content of the 22nd to 31st bits is a privileged instruction, thereby improving the scanning efficiency. When the sensitive instruction filtering module 222 determines that the code page does not contain sensitive instructions, the executable permissions of the code page can be set.

[0096] In the embodiment of the present application, the kernel module 220 ensures that the temporary kernel state process does not have physical pages with executable and writable permissions at the same time, which can prevent attackers from dynamically injecting sensitive instructions into the code page. The kernel module 220 sets this constraint condition on the physical page, not on the virtual page, to prevent attackers from using executable but non-writable virtual pages to share memory. When the sensitive instruction filter module 222 performs binary scanning, it is necessary not only to close the executable permission of the scanned page, but also to close the writable permission to prevent attackers from injecting sensitive instructions outside the scanning window.

[0097] In EL0 (user state) of Arch64 platform's non-secure stage 1, there is a page table base register TTBR0_EL1 (user address space). In EL1 (kernel state) of Arch64 platform's non-secure stage 1, there is a page table base register and TTBR1_EL1 (kernel address space). TTBR0_EL1 points to the user page table that translates user space virtual addresses. TTBR1_EL1 points to the kernel page table that translates kernel space virtual addresses. The virtual pages of the kernel page table that can only be accessed by code running in EL1 are called kernel pages. The virtual pages of the kernel page table that can be accessed by code running in both EL0 and EL1 are called user pages.

[0098] In order to mitigate attacks such as ret2user, the Arch64 platform generally deploys the PAN mechanism. The PAN mechanism can be used to prevent code under EL1 from accessing user pages. When the kernel needs to access user space, the kernel needs to temporarily disable the PAN mechanism. The kernel can access user space through copy_from_user(), copy_to_user(), etc. Therefore, in most cases, user pages can only be accessed by code running under EL0.

[0099] When the untrusted temporary kernel-mode process runs in EL1, the user space virtual address translation uses TTBR0_EL1, and the kernel space virtual address translation uses TTBR1_EL1. Since the untrusted temporary kernel-mode process code runs in EL1, the untrusted temporary kernel-mode process has the access rights to the kernel page and can access the kernel space arbitrarily. Figure 7 As shown, in order to prevent the temporary kernel state process from arbitrarily accessing the kernel space, the kernel module 220 of the user state 200 can set a kernel space isolation module 2221. The kernel space isolation module 2221 is used to make the kernel space invisible when the temporary kernel state process is executed. The kernel space isolation module 2221 prevents the APP 100 from accessing the kernel space to ensure the data security of the kernel space.

[0100] The EPDn field of the Arch64 platform hardware feature is located in the control TCR_EL1 register. EPD0 is used to control the translation of kernel virtual space addresses, and EPD1 is used to control the translation of user virtual space addresses. When the EPDn field is set to 1, accessing the corresponding virtual space will trigger a "translation fault".

[0101] TLB can use ASID to distinguish virtual and real address translation items in TLB of different processes. Under the default setting of the operating system, each process has its own ASID. Each process can only access its own TLB items. Kernel pages are set as global pages and are shared by all processes without their own ASID.

[0102] In the process of isolating the kernel space by the kernel space isolation module 2221, the temporary kernel state process sets the EPDn field to 1 each time it enters and exits the kernel, becoming EPD1. EPD1 prevents the code in the temporary kernel state process from using the kernel page table to complete the access to the kernel space. At this time, the temporary kernel state process cannot pass through the kernel page table, but can access part of the kernel space through the TLB. Therefore, the kernel page can be set as a non-global page, and an ASID is reserved for the kernel to avoid TLB refresh.

[0103] The TCR_EL1 register needs to be configured when the temporary kernel state process is set to EPD1 or when the ASID is switched. The code configured by the TCR_EL1 register is stored in a specific switch page, and the specific switch page is mapped within the range of TTBR0_EL1. When all user space virtual pages are set to kernel pages, the kernel code is not constrained by the PAN mechanism and can access user data arbitrarily, which may cause the temporary kernel state process to invalidate the PAN mechanism of ARM. Therefore, the temporary kernel state process can set the EPDn field to 0 and become EPD0. EPD1 can prevent the kernel code from accessing the internal user data of the temporary kernel state process. Since the attacker can enter the kernel by directly jumping into the switch page, there is no need to go through the normal exception process. After the temporary kernel state process enters the kernel, there will be special code to check whether the stack top pointer is switched to determine whether the kernel is attacked.

[0104] In the embodiment of the present application, when APP 100 runs in a temporary kernel state process, the temporary kernel state process can improve its own performance from multiple dimensions. For example, it can eliminate the overhead of switching up and down caused by all system calls, improve the performance brought by customized management and use of resources such as page tables, and use kernel-specific hardware resources to achieve acceleration of specific application scenarios. The following are several typical application scenarios, specifically:

[0105] Temporary kernel-mode process data is isolated and protected. Specifically: applications with confidentiality requirements usually isolate private data from other data to prevent it from being read or tampered with by malicious attackers. Taking the open secure socket layer (open SSL) protocol as an example, APP 100 uses the session key as the most critical private data. Under the Arch64 / Linux platform, the kernel state does not provide a hardware isolation mechanism for user-mode processes, and isolation can only be achieved through software. For example, the kernel state uses the mprotect system call and changes the read and write permissions of the memory where the open SSL session key is located to isolate private data from other data.

[0106] However, when the kernel state uses software isolation to isolate data, it will bring non-negligible performance overhead. After the kernel state 300 upgrades the application process to the privileged state to become a temporary kernel state process, the ARM PAN mechanism can be used to isolate the private data. The ARM PAN mechanism refers to a hardware isolation mechanism that prevents the kernel from accessing user page data. The temporary kernel state process can use the characteristics of the ARM PAN mechanism to set the memory where the private data is located as a user page, allowing the PAN mechanism to prevent illegal access, and only allow legal instructions of registers such as LDTR and STTR to access private data. The hardware isolation method can not only provide complete security protection, but also the performance overhead of the hardware isolation method can be compressed to negligible. Compared with the software isolation method, the hardware isolation method has huge performance advantages.

[0107] Code generation based on just-in-time (TIT) compiler. JIT compiler is a necessary module in applications such as browsers and portable document format (PDF) readers. JIT compiler can dynamically generate binary code and execute it in the application process, which can enrich the page functions of APP 100. Therefore, JIT compiler is one of the main targets of attackers.

[0108] Attackers can exploit application vulnerabilities and inject attack code logic into the code page in the JIT compiler. After the JIT compiler is compiled and executed, the attack code can achieve the purpose of hijacking the application. In the related technical solution, software defense methods (such as mprotect) can be used to separate the writable permission and executable permission of the code page, and increase the checksum of the code page to prevent tampering by attackers. The performance overhead brought by the software defense method is too large, especially after the JIT compiler is added. After the kernel state 300 upgrades the JIT compilation to the privileged state, the PAN mechanism of ARM can be used to isolate the JITedCode code page to prevent the code page from being tampered by attackers. The instructions generated by the code page will be securely filtered to prevent malicious applications from attempting to use the JIT compiler to attack the kernel.

[0109] Management of memory and system calls. Specifically, a temporary kernel state process can manage the memory within its own process. For example, calling a function generally executes the function of a system call, which can avoid the performance overhead caused by the power level switching, and is beneficial to applications that frequently interact with the kernel state 300. For example, the user state sandbox mechanism of the browser. Exemplarily, for the sake of scalability, the browser can support the operation of third-party open software (such as plug-ins). Since the plug-in is an open software, the plug-in is an untrusted code. The browser can use the user state sandbox mechanism to prevent malicious behavior in the plug-in. The user state sandbox mechanism can monitor the files operated by the software in the sandbox, the services accessed, the resources loaded, etc. After the temporary kernel state process upgrades the user state sandbox to a kernel state sandbox, it can directly manage the memory of the plug-in, monitor the plug-in behavior, avoid the overhead caused by the system call, and more efficiently filter and discover malicious behavior in the plug-in.

[0110] In addition, the garbage collector can run in kernel state 300 to achieve efficient memory management. Kernel state 300 can allocate a piece of memory space to the garbage collector as a garbage collection memory area. The garbage collector can directly manage the physical memory mapped by the garbage collection memory area, and relieve the operating system from the responsibility of managing this physical memory. The garbage collector and kernel state 300 jointly manage the page table. The garbage collector's traversal operation on memory objects will affect the hot and cold memory pages and confuse the semantics of the original program. The garbage collector can build a least recently used (LRU) linked list of memory pages in the garbage collection memory area. When the application accesses a page, the LRU linked list will be updated. When the garbage collector accesses a page, the LRU linked list will not be updated, which can prevent the garbage collector's operation of traversing objects during the recycling process from affecting the semantics of the program.

[0111] When pages in the garbage collection memory area need to be recycled, the recycling-related API in the kernel can be directly called. During the page recycling process, when the operating system is under a large load and the number of pages that need to be recycled is relatively large, the operating system will be stuck. In the embodiment of the present application, the operating system adopts an asynchronous recycling method, similar to the kswapd kernel thread, to create a gcswapd thread for the garbage collector. The gcswapd thread only serves the garbage collector and is responsible for recycling pages in the garbage collection memory area. The memory watermark of the garbage collection memory area can be set according to the needs of the program. When the page in the garbage collection memory area reaches the watermark, the garbage collector gives priority to applying for a new memory page to the kernel of the operating system. When the garbage collector successfully applies, the garbage collection memory can be expanded and the watermark can be updated. When the garbage collector fails to apply, gcswapd can be awakened to start the memory recycling work. The garbage collector can set a fixed expansion ratio to avoid the garbage collector repeatedly applying for new pages to the kernel of the operating system.

[0112] When the operating system has insufficient available physical pages, the garbage collector can be controlled to recycle physical pages. The operating system can open a callback function registration mechanism to allow the garbage collector to register a callback function. The kernel notifies the garbage collector to recycle physical pages based on the callback function. The garbage collector checks the free page list it manages and releases the physical pages needed by the operating system.

[0113] The operating system can delegate the modification rights of the released heap page table entries to the garbage collector. There are two ways for the operating system to release the management rights of physical pages to the garbage collector:

[0114] 1. The operating system 100 can allocate continuous physical pages to the garbage collector. When the operating system operates the corresponding items of the page table, it can detect whether the physical page is allocated to the garbage collector through boundary comparison. This method can quickly detect the legitimacy of the physical page set by the garbage collector.

[0115] 2. The operating system can use a method similar to mmap allocation to allocate physical pages to the garbage collector as needed. This method will make the physical pages allocated to the garbage collector discrete, resulting in increased address matching overhead. In an embodiment of the present application, the operating system can use the hardware-assisted fast query technology of the hardware management unit (memory management unit, MMU) to completely map all physical pages into the virtual space as a page attribute identification area. The page attribute identification area is used to identify the attributes of the physical page, such as whether the physical page belongs to the garbage collector.

[0116] In one possible implementation, the operating system maps part of the page table only to the page table entries that have been assigned to the garbage collection (GC) mechanism. The GC mechanism can set the page table entries without management authority to be inaccessible, and allow the operation of accessing the page table entry to trigger a page fault. When the operating system checks whether a physical page belongs to a legal physical page of the garbage collector, it only needs to access the corresponding page in the page attribute identification area. When the operating system detects that a physical page does not belong to a legal physical page of the garbage collector, it will trigger an exception and allow the management module to intercept it. Compared with the software comparison method, the MMU's hardware-assisted fast query technology has a higher comparison efficiency.

[0117] Figure 8 Schematic diagram of a computing device provided in an embodiment of the present application. Figure 8 As shown, the computing device 800 includes a bus 810, a processor 820, a memory 830, and a communication interface 840. The processor 820, the memory 830, and the communication interface 840 communicate with each other through the bus 810. The computing device 800 can be a server, a computer, a portable notebook, a cabinet, etc. It should be understood that the present application does not limit the number of processors and memories in the computing device 800.

[0118] The bus 810 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 The bus 810 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 810 may include a path for transmitting information between various components of the computing device 800 (eg, the processor 820, the memory 830, and the communication interface 840).

[0119] The processor 820 may include any one or more processors such as a CPU, a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0120] The memory 830 may include a volatile memory, such as a random access memory (RAM). The memory 830 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0121] The memory 830 stores executable program codes, and the processor 820 executes the executable program codes to respectively implement the functions of the aforementioned kernel space isolation module 2221, sensitive instruction filtering module 222, security interface 310, and privileged hardware resource module 320, thereby implementing the optimization method. That is, the memory 830 stores instructions for executing the optimization method.

[0122] Alternatively, the memory 830 stores executable codes, and the processor 820 executes the executable codes to respectively implement the functions of the aforementioned operating system, thereby implementing the optimization method. That is, the memory 830 stores instructions for executing the optimization method.

[0123] The communication interface 840 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 800 and other devices or a communication network.

[0124] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0125] like Fig. 9 As shown, the computing device cluster includes at least one computing device 800. The memory 830 in one or more computing devices 800 in the computing device cluster may store the same instructions for executing the optimization method.

[0126] In some possible implementations, the memory 830 of one or more computing devices 800 in the computing device cluster may also store partial instructions for executing the optimization method. In other words, the combination of one or more computing devices 100 may jointly execute instructions for executing the optimization method.

[0127] It should be noted that the memory 830 in different computing devices 800 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the high-performance computing cluster 200. That is, the instructions stored in the memory 830 in different computing devices 800 can implement the functions of one or more modules in the kernel space isolation module 2221, the sensitive instruction filtering module 222, the security interface 310 and the privileged hardware resource module 320.

[0128] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.10 A possible implementation is shown. Figure 6 As shown, two computing devices 800A and computing device 800B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 830 in the computing device 800A stores instructions for executing the functions of the kernel space isolation module 2221. At the same time, the memory 830 in the computing device 800B stores instructions for executing the functions of the sensitive instruction filtering module 222, the security interface 310, and the privileged hardware resource module 320.

[0129] Fig.10 The connection method between the computing device clusters shown can be considered to be that the optimization method provided by the present application requires a large amount of data storage, so the functions implemented by the sensitive instruction filtering module 222, the security interface 310 and the privileged hardware resource module 320 are considered to be handed over to the computing device 800B for execution.

[0130] It should be understood that Fig.10 The functions of the computing device 800A shown in FIG. 8 may also be completed by multiple computing devices 800. Similarly, the functions of the computing device 800B may also be completed by multiple computing devices 800.

[0131] The present application embodiment also provides another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similar to that of Fig. 9 and Fig.10 The connection mode of the computing device cluster is different in that the memory 830 in one or more computing devices 800 in the computing device cluster may store the same instructions for executing the optimization method.

[0132] In some possible implementations, the memory 830 of one or more computing devices 800 in the computing device cluster may also store partial instructions for executing the optimization method. In other words, the combination of one or more computing devices 800 may jointly execute instructions for executing the optimization method.

[0133] It should be noted that the memory 830 in different computing devices 800 in the computing device cluster may store different instructions for executing partial functions of the computing device 800. That is, the instructions stored in the memory 830 in different computing devices 800 may implement the functions of one or more devices in the user state 200 and the kernel state 300.

[0134] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the optimization method.

[0135] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to perform the optimization method.

[0136] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.< / xt> < / xt> < / xt> < / xt>

Claims

1. An optimization method, characterized in that: The method is applied to user mode and kernel mode, and includes: When the application is run in the user state, the user state process is allowed to run in the kernel state; the user state process refers to the process running in the user state; the application is installed in the operating system; The kernel state runs a temporary kernel state process to start the application and / or run the application. The temporary kernel state process refers to the user state process running in the kernel state.

2. The method according to claim 1, characterized in that When the user state runs the application, allowing the user state process to run in the kernel state includes: When the user state runs the application, the kernel module is called; the kernel module is used to obtain the resources of the kernel state; The kernel module utilizes the resources of the kernel state to allow the user state process to run in the kernel state.

3. The method according to claim 1 or 2, characterized in that The method further comprises: The kernel state responds to the temporary kernel state process using sensitive instructions as partially sensitive instructions, and encapsulates the partially sensitive instructions inside the security interface of the kernel state; the sensitive instructions are instructions for the kernel state to run the temporary kernel state process; the partially sensitive instructions refer to instructions whose impact on the operating system is limited to the temporary kernel state process; the security interface refers to an interface that restricts the temporary kernel state process from using other resources of the kernel state.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: The kernel state encapsulates the sensitive data within the security interface of the kernel state in response to the temporary kernel state process accessing the sensitive data; the sensitive data refers to data that affects the security of the operating system.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: The user state monitors the page table of the temporary kernel state process, and in response to the existence of an executable page table in the user space, intercepts the executable page table.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: When the temporary kernel state process enters and exits the kernel state, the kernel of the operating system sets the EPDn field to 1 to restrict the temporary kernel state process from using the page table of the kernel of the operating system to access the kernel space; the EPD1 is used to control the translation of the address of the user virtual space.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: The kernel state utilizes a privileged access prohibition PAN mechanism to isolate the data used by the temporary kernel state process from other data.

8. An optimization device, characterized in that: include: A computing unit, configured to allow a user-mode process to run in the kernel mode when an application is running in the user mode; The user state process refers to a process running in the user state; The application is installed in the operating system; The kernel state runs a temporary kernel state process to start the application and / or run the application. The temporary kernel state process refers to the user state process running in the kernel state.

9. The computing device according to claim 8, wherein: Also includes kernel modules, The computing unit is specifically configured to call a kernel module when the application is run in the user state; the kernel module is configured to obtain resources in the kernel state; The kernel module is used to utilize the resources of the kernel state to allow the user state process to run in the kernel state.

10. The computing device according to claim 8 or 9, characterized in that The computing unit is further configured to encapsulate the partially sensitive instructions in the kernel state in response to the temporary kernel state process using sensitive instructions as partially sensitive instructions in the kernel state; the sensitive instructions are instructions for the kernel state to run the temporary kernel state process; the partially sensitive instructions are instructions whose impact on the operating system is limited to the temporary kernel state process; and the secure interface is an interface that limits the temporary kernel state process from using other resources in the kernel state.

11. The computing device according to any one of claims 8 to 10, wherein: The computing unit is further configured to encapsulate the sensitive data within a security interface of the kernel state in response to the temporary kernel state process accessing sensitive data in the kernel state; the sensitive data refers to data that affects the security of the operating system.

12. The computing device according to any one of claims 8 to 11, wherein: The computing unit is further configured to monitor the page table of the temporary kernel-mode process in the user mode, and intercept the executable page table in response to the existence of an executable page table in the user space.

13. The computing device according to any one of claims 8 to 12, wherein: The computing unit is further configured to set the EPDn field to 1 by the kernel of the operating system when the temporary kernel state process enters and exits the kernel state, so as to restrict the temporary kernel state process from using the page table of the kernel of the operating system to access the kernel space; the EPD1 is configured to control the translation of the address of the user virtual space.

14. The computing device according to any one of claims 8 to 13, wherein: The computing unit is further configured to utilize a privileged access prohibition PAN mechanism in the kernel state to isolate the data used by the temporary kernel state process from other data.

15. A computing device, characterized in that include: at least one memory, At least one processor, the at least one processor is configured to execute instructions stored in the at least one memory, so that the computing device performs the method according to any one of claims 1-7.

Images