Kernel security enhancement method of power operating system

Abstract

The embodiment of the invention discloses a kernel security enhancement method for a power operating system. The method comprises the steps that in the kernel starting process of the power operating system, a random number generator is used for generating random offset, the random offset and a preset kernel base address of a kernel are added, and a random offset base address is obtained; modifying a virtual address mapping table of the kernel based on the random offset base address; and based on the virtual address mapping table, applying the random offset base address to a kernel module and a data structure in the kernel to enhance the security of the kernel. According to the technical scheme provided by the embodiment of the invention, the random offset is generated in the kernel starting process, and the random offset is applied to each component (namely the kernel base address, the kernel module and the data structure) of the kernel, so that the kernel security is enhanced; and the high efficiency of the randomization process is ensured, and the influence of the randomization process on the system performance is reduced.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of power technology, and in particular to a method for enhancing kernel security of a power operating system. Background Art

[0002] In modern operating systems, kernel security is crucial, especially in critical infrastructure areas such as electricity. Taking the power operating system as an example, as technology develops, attackers are increasingly able to exploit vulnerabilities in the power operating system to attack its kernel, which can cause serious damage to the system.

[0003] Therefore, it is crucial to enhance the kernel's defense capabilities and thus enhance the kernel's security. Summary of the invention

[0004] An embodiment of the present invention provides a kernel security enhancement method for a power operating system to enhance the security of the kernel.

[0005] According to one aspect of the present invention, a method for enhancing kernel security of a power operating system is provided, which may include:

[0006] During the kernel startup process of the power operating system, a random offset is generated by using a random number generator, and the random offset is added to a preset kernel base address of the kernel to obtain a random offset base address;

[0007] Modify the kernel's virtual address mapping table based on the random offset base address;

[0008] Based on the virtual address mapping table, random offset base addresses are applied to kernel modules and data structures in the kernel to enhance the security of the kernel.

[0009] The technical solution of the embodiment of the present invention, in the process of kernel startup of the power operating system, generates a random offset by using a random number generator, and adds the random offset to the preset kernel base address of the kernel to obtain a random offset base address, thereby realizing kernel base address randomization; based on the random offset base address, the virtual address mapping table of the kernel is modified to realize kernel address randomization; based on the virtual address mapping table, the random offset base address is applied to the kernel module and data structure in the kernel to realize kernel module and data structure randomization. The above technical solution, by generating a random offset during the kernel startup process and applying the random offset to each component of the kernel (i.e., kernel base address, kernel module and data structure), enhances kernel security, and this randomization process is automatically realized by using the virtual address mapping table, ensuring the efficiency of the randomization process and reducing the impact of the randomization process on system performance, that is, effectively balancing the relationship between kernel security and system performance, and meeting the power industry's needs for high reliability and security.

[0010] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0012] Figure 1 is a flow chart of a method for enhancing kernel security of a power operating system provided according to an embodiment of the present invention;

[0013] Figure 2 is a flowchart of another method for enhancing kernel security of a power operating system provided according to an embodiment of the present invention;

[0014] Figure 3 is a flowchart of another method for enhancing kernel security of a power operating system provided according to an embodiment of the present invention;

[0015] Figure 4 is a flowchart of another method for enhancing kernel security of a power operating system provided according to an embodiment of the present invention;

[0016] Figure 5 is a flowchart of an optional example of a method for enhancing kernel security of a power operating system provided in an embodiment of the present invention;

[0017] Figure 6 is a structural block diagram of a kernel security enhancement device for a power operating system provided according to an embodiment of the present invention;

[0018] Figure 7 It is a structural schematic diagram of an electronic device for implementing the kernel security enhancement method of the power operating system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0020] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. The situations of "target", "original", etc. are similar and will not be repeated here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0021] Figure 1 This is a flow chart of a method for enhancing kernel security of an electric power operating system provided by an embodiment of the present invention. This embodiment can be applied to the case of enhancing the kernel security of an electric power operating system, and is particularly applicable to the case of enhancing kernel security using randomization technology. This method can be executed by a kernel security enhancement device for an electric power operating system provided by an embodiment of the present invention, and the device can be implemented by software and / or hardware, and the device can be integrated on an electronic device, and the electronic device can be various user terminals or servers.

[0022] See also Figure 1 The method of the embodiment of the present invention specifically includes the following steps:

[0023] S110. During the kernel startup process of the power operating system, a random number generator is used to generate a random offset, and the random offset is added to a preset kernel base address of the kernel to obtain a random offset base address.

[0024] Among them, the power operating system can be understood as an operating system used in the power field. Combined with the application scenarios that may be involved in the embodiments of the present invention, optionally, the operating system can be implemented based on the Euler operating system (openEuler); of course, it can also be implemented based on other operating systems, which is not specifically limited here.

[0025] For the kernel of the power operating system, the preset kernel base address can be understood as the preset base address for the kernel. During the kernel startup process, a random offset is generated by a random number generator, and the random offset is added to the preset kernel base address to obtain a random offset base address. Compared with the preset kernel base address, the random offset base address has randomness, that is, the kernel security is enhanced by randomizing the kernel base address.

[0026] In the embodiment of the present invention, optionally, the random number generator may be a hardware random number generator and / or a pseudo-random number generator, which depends on the actual situation and is not specifically limited here.

[0027] S120. Modify the virtual address mapping table of the kernel based on the random offset base address.

[0028] The virtual address mapping table can be understood as a table that can characterize the mapping relationship between the virtual address of the kernel and the real address (i.e., the actual address). Based on the random offset base address, the virtual address mapping table is modified, especially in real time, which helps to quickly realize kernel address randomization, thereby helping to reduce the complexity and performance overhead of manual configuration.

[0029] S130. Based on the virtual address mapping table, apply the random offset base address to the kernel module and data structure in the kernel to enhance the security of the kernel.

[0030] The kernel module can be understood as a functional module in the kernel, and the data structure can be understood as a structure of data used in the kernel. Since the virtual address mapping table is obtained by modifying the random offset base address, the random offset base address can be applied to the kernel module based on the virtual address mapping table, that is, the kernel security is enhanced by randomizing the kernel module, and the random offset base address is applied to the data structure, that is, the kernel security is enhanced by randomizing the kernel module.

[0031] The technical solution of the embodiment of the present invention, in the process of kernel startup of the power operating system, generates a random offset by using a random number generator, and adds the random offset to the preset kernel base address of the kernel to obtain a random offset base address, thereby realizing kernel base address randomization; based on the random offset base address, the virtual address mapping table of the kernel is modified to realize kernel address randomization; based on the virtual address mapping table, the random offset base address is applied to the kernel module and data structure in the kernel to realize kernel module and data structure randomization. The above technical solution, by generating a random offset during the kernel startup process and applying the random offset to each component of the kernel (i.e., kernel base address, kernel module and data structure), enhances kernel security, and this randomization process is automatically realized by using the virtual address mapping table, ensuring the efficiency of the randomization process and reducing the impact of the randomization process on system performance, that is, effectively balancing the relationship between kernel security and system performance, and meeting the power industry's needs for high reliability and security.

[0032] An optional technical solution, after the random offset is generated by the random number generator, the kernel security enhancement method further includes:

[0033] A modulo operation is performed on the random offset using the maximum value in the preset randomization range, and the random offset is updated based on the modulo operation result.

[0034] The preset randomization range can be understood as a range of pre-set randomization values, which can be flexibly adjusted according to the system requirements of the power operation system so that the power operation system can still maintain good security in different scenarios. The maximum value can be understood as the maximum value in the range.

[0035] The maximum value is used to perform a modulo operation with the random offset, and the random offset is updated based on the modulo operation result, thereby ensuring that the random offset is within the preset randomization range. final =R offset modR max , where R final Represents the updated random offset, R offset Represents the random offset before update, R max Indicates the maximum value, and mod indicates the modulo operation.

[0036] The above technical solution ensures that the random offset of the final application is within a preset randomization range through modular operation, which can prevent repeated or excessive random offsets and ensure the stability and security of system operation.

[0037] Another optional technical solution, after the random offset is generated by the random number generator, the kernel security enhancement method further includes:

[0038] When the random offset is not within the preset randomization range, the step of generating the random offset by using the random number generator is repeated.

[0039] In other words, if the generated random offset is within the preset randomization range, it is directly applied; otherwise, a new random offset is generated using a random number generator to obtain a random offset within the preset randomization range. The above technical solution can prevent repeated or excessive random offsets from occurring by limiting the random offset, thereby ensuring the stability and security of the system operation.

[0040] Figure 2It is a flow chart of another kernel security enhancement method for an electric power operating system provided in an embodiment of the present invention. This embodiment is optimized based on the above-mentioned technical solutions. In this embodiment, optionally, the random number generator includes a hardware random number generator and a pseudo-random number generator; using the random number generator to generate a random offset may include: determining the total entropy of the electric power operating system; using the hardware random number generator to generate an initial random value based on the total entropy; using the pseudo-random number generator to generate a random offset based on the initial random value. Among them, the explanations of the terms that are the same or corresponding to the above-mentioned embodiments are not repeated here.

[0041] See also Figure 2 The method of this embodiment may specifically include the following steps:

[0042] S210. During the kernel startup process of the power operating system, determine the total entropy of the power operating system.

[0043] Among them, the total entropy of the power operation system can be determined according to the entropy collected from one, two or more entropy sources in the power operation system. It should be noted that compared with the application of one entropy source, the application of two or more entropy sources to collect entropy increases the complexity of random offset generation, reduces the possibility of attackers attacking through a single entropy source, and different entropy sources show different random characteristics under different conditions, which makes the generated random offset more comprehensive and uniform, and helps to resist various attack methods.

[0044] On this basis, combined with the application scenarios that may be involved in the embodiments of the present invention, the total entropy can be determined in the following manner: obtaining entropies collected from at least two entropy sources in the power operation system, and then obtaining the total entropy of the power operation system based on the sum of all the entropies obtained, wherein the at least two entropy sources may include at least two of the central processing unit (CPU) performance, the system clock, and the input / output (I / O) event. Exemplarily, E total =E cpu +E time +E io , where E total represents the total entropy; E cpu It represents the entropy collected from the entropy source of CPU performance, or the entropy provided by the CPU performance counter; E time It represents the entropy collected from the system clock, which is the entropy source, and represents the randomness of the system clock. io It represents the entropy collected from the entropy source of I / O events, which characterizes the randomness of I / O events.

[0045] S220: Generate an initial random value based on total entropy using a hardware random number generator.

[0046] Among them, since the hardware random number generator generates random values ​​based on physical phenomena (i.e., the initial random value in this step), it is difficult to be copied or predicted, which helps to improve the security of the random offset generated subsequently, thereby helping to effectively resist external attack methods and enhance the security protection of the power operation system. Therefore, this step uses the hardware random number generator to generate the initial random value based on the total entropy. For example, R initial =f(E total ), where R initial represents the initial random value, and f represents the function of generating the initial random value from the entropy source, that is, the function represented by the hardware random number generator in this step.

[0047] On this basis, combined with the application scenarios that may be involved in the embodiments of the present invention, the initial random value can be generated in the following manner: obtain a hash function of the total entropy, and obtain a preset first weighting coefficient and a second weighting coefficient; use a hardware random number generator to generate an initial random value according to the first weighting coefficient, the total entropy to be mathematically operated with the first weighting coefficient, the second weighting coefficient, and the hash function to be mathematically operated with the second weighting coefficient. Exemplarily, R initial =α·E total +β·H(E total ), where α represents the first weighting coefficient, which is used to adjust the influence of the total entropy on the initial random value, and the range can be between 0 and 1; β represents the second weighting coefficient, which controls the influence of the hash function, and the range can be between 0 and 1; H(E total ) represents a total entropy-based hash function that is used to enhance randomness and output a random value of a fixed length.

[0048] In the above example, by setting α and β, the influence of different entropy sources on the generated initial random value can be adjusted, thereby improving the quality of the initial random value and the flexibility of the system; a hash function based on total entropy is introduced to improve the randomness of the generated initial random value, making the output result more unpredictable and reducing the risk of potential attacks.

[0049] S230: Generate a random offset based on the initial random value using a pseudo-random number generator.

[0050] Among them, the pseudo-random number generator can quickly generate a large number of random values, which is suitable for scenarios that require high-frequency calls. It can also be adaptively adjusted according to different inputs to meet specific security requirements. Therefore, here, based on the initial random value generated by the hardware random number generator, a pseudo-random number generator is used to generate a random offset.

[0051] S240, adding the random offset to the preset kernel base address of the kernel to obtain the random offset base address.

[0052] S250: Based on the random offset base address, modify the virtual address mapping table of the kernel.

[0053] S260. Based on the virtual address mapping table, apply the random offset base address to the kernel module and data structure in the kernel to enhance the security of the kernel.

[0054] The technical solution of the embodiment of the present invention realizes the effective generation of random offset by combining an entropy source, a hardware random number generator and a pseudo-random number generator.

[0055] An optional technical solution uses a pseudo-random number generator to generate a random offset based on an initial random value, including:

[0056] Collecting hash values ​​corresponding to at least two entropy sources in the power operating system, wherein the at least two entropy sources include at least two of a central processing unit performance, a system clock, and an input / output event;

[0057] A pseudo-random number generator is used to generate a random offset based on all the collected hash values ​​and the initial random value.

[0058] For example, here we take three entropy sources as an example, then the above random offset generation process can be expressed as R offset =PRNG(R initial , T, H cpu , H time , H io ), where R offset Represents random offset; PRNG represents pseudo-random number generator; R initial Represents the initial random value; T represents the current timestamp, which is used to provide an additional source of randomness; H cpu Indicates the hash value of the CPU performance counter; H time Represents the hash value of the system clock; H io A hash value representing an I / O event.

[0059] The above technical solution, by combining the initial random value and the hash value, can improve the mixing degree of the random offset, ensure the difference between the random offsets, and thus improve the security of the power operation system.

[0060] On this basis, optionally, a random offset is generated based on all the collected hash values ​​and the initial random value, including:

[0061] Generate a pseudo-random number based on all the collected hash values ​​and the initial random value;

[0062] Adjust the pseudo-random number to generate a random offset.

[0063] Among them, pseudo-random numbers are generated based on all the collected hash values ​​and the initial random value. For example, an XOR operation can be used to generate pseudo-random numbers based on all the hash values ​​and the initial random value. The application of the XOR operation can ensure the random mixing between different inputs. On this basis, optionally, the maximum value can be used in combination with the modulus operation to process the pseudo-random number so that the processed pseudo-random number is within the preset randomization range. Exemplarily, R′ offset =(R initial ⊕H cpu ⊕H time ⊕H io )mod R max , where R′ offset represents the processed pseudo-random number, that is, the pseudo-random number that is subsequently adjusted to generate the random offset; R initial ⊕H cpu ⊕H time ⊕H io Represents a directly generated pseudo-random number, and ⊕ represents an exclusive-OR operation.

[0064] Further, the pseudo-random number is adjusted to generate a random offset for the final application. offset =(R′ offset +T+K)mod R max , where K is a constant. In this example, by applying T, R offset The randomness of max , limiting R offset , which can prevent repeated or excessively large R offset , ensuring the stability and security of system operation.

[0065] Figure 3 It is a flowchart of another kernel security enhancement method for an electric power operating system provided in an embodiment of the present invention. This embodiment is optimized based on the above-mentioned technical solutions. In this embodiment, optionally, applying the random offset base address to the kernel module in the kernel may include: for the kernel module in the kernel, during the kernel module loading process, adding a weight to the random offset corresponding to the random offset base address to generate a weight offset; adding the weight offset to the original module base address of the kernel module to obtain a random module base address. Among them, the explanations of the terms that are the same or corresponding to the above-mentioned embodiments are not repeated here.

[0066] See also Figure 3 The method of this embodiment may specifically include the following steps:

[0067] S310. During the kernel startup process of the power operating system, a random number generator is used to generate a random offset, and the random offset is added to a preset kernel base address of the kernel to obtain a random offset base address.

[0068] S320. Based on the random offset base address, modify the virtual address mapping table of the kernel.

[0069] S330. For a data structure in the kernel, based on a virtual address mapping table, a random offset base address is applied to the data structure to enhance the security of the kernel.

[0070] S340. For a kernel module in the kernel, based on a virtual address mapping table, during kernel module loading, a weight is added to a random offset corresponding to a random offset base address to generate a weighted offset.

[0071] Among them, during the kernel module loading process, a random offset 2 for the kernel module application is generated by adding a weight to the random offset 1 generated by S310. Compared with using a random number generator to generate the random offset 2, the generation method of adding weights has a smaller amount of calculation and saves computing resources.

[0072] It should be noted that in order to distinguish the two random offsets in naming, random offset 1 is referred to as random offset, and random offset 2 is referred to as weight offset.

[0073] S350, adding the weight offset to the original module base address of the kernel module to obtain a random module base address to enhance the security of the kernel.

[0074] The original module base address can be understood as the original base address of the kernel module. The weight offset is added to the original module base address to obtain the random module base address, that is, the kernel security is enhanced by randomizing the kernel module, specifically, the original module base address.

[0075] The technical solution of the embodiment of the present invention generates a weight offset by adding a weight to the random offset, and then adds the weight offset to the original module base address of the kernel module to obtain the random module base address, thereby realizing the randomization of the kernel module and enhancing the kernel security.

[0076] An optional technical solution, the above kernel security enhancement method further includes:

[0077] The symbol table of the kernel module is updated based on the random module base address, so that during the operation of the kernel, the address of the function and / or variable in the kernel module is parsed based on the symbol table, and the kernel module is called based on the parsing result.

[0078] After the kernel module is loaded, the symbol table of the kernel module is updated based on the random module base address to reflect the address change under the new base address (i.e., the random module base address). In this way, during the operation of the kernel, the address of the function and / or variable in the kernel module can be correctly parsed based on the symbol table, and then the kernel module can be called based on the obtained parsing result, thereby realizing the correct calling of the kernel module without introducing significant loss in system performance.

[0079] Figure 4 It is a flow chart of another kernel security enhancement method for an electric power operating system provided in an embodiment of the present invention. This embodiment is optimized based on the above-mentioned technical solutions. In this embodiment, optionally, applying the random offset base address to the data structure in the kernel may include: for the data structure in the kernel, adding the random offset corresponding to the random offset base address to the original data base address of the data structure to obtain the random data base address; based on the random data base address, allocating a random memory address to the data structure, so that the random memory address of the data structure is different each time the kernel is started. Among them, the explanations of the terms that are the same or corresponding to the above-mentioned embodiments are not repeated here.

[0080] See also Figure 4 The method of this embodiment may specifically include the following steps:

[0081] S410. During the kernel startup process of the power operating system, a random number generator is used to generate a random offset, and the random offset is added to a preset kernel base address of the kernel to obtain a random offset base address.

[0082] S420: Based on the random offset base address, modify the virtual address mapping table of the kernel.

[0083] S430: For a kernel module in the kernel, based on a virtual address mapping table, a random offset base address is applied to the kernel module to enhance the security of the kernel.

[0084] S440. For the data structure in the kernel, based on the virtual address mapping table, add the random offset corresponding to the random offset base address to the original data base address of the data structure to obtain the random data base address.

[0085] The original data base address can be understood as the original base address of the data structure, and the random offset is added to the original data base address of the data structure to obtain the random data base address.

[0086] S450. Based on the random data base address, a random memory address is allocated to the data structure, so that the random memory address of the data structure is different each time the kernel is started, thereby enhancing the security of the kernel.

[0087] Among them, based on the random data base address, a random memory address is assigned to the data structure, so that the actual memory address of the data structure is different each time the kernel is started, thereby reducing the possibility of attackers attacking through known memory addresses, thereby enhancing kernel security. The above-mentioned actual memory address is the assigned random memory address.

[0088] On this basis, optionally, the memory layout can be audited regularly while the power operating system is running to ensure that the randomized state of the data structure remains unchanged. In practical applications, this can be achieved through kernel timer tasks or hook mechanisms to monitor whether the actual memory address of the data structure has been tampered with or restored to a fixed value. If an abnormal situation is found, appropriate protection measures can be taken to ensure the safe operation of the system.

[0089] Optionally, when certain data structures are no longer needed, appropriate memory reclamation mechanisms are implemented to ensure that allocated memory can be safely reallocated while maintaining randomization properties in the process.

[0090] The technical solution of the embodiment of the present invention allocates a random memory address to a data structure through a random data base address, thereby making the actual memory address of the data structure different each time the kernel is started, thereby reducing the possibility of an attacker attacking through a known memory address, thereby enhancing kernel security.

[0091] In order to better understand the above-mentioned technical solutions as a whole, an example of power operating system kernel security enhancement based on openEuler is given here for illustrative explanation.

[0092] For example, see Figure 5 The specific implementation process is as follows:

[0093] 1. Randomize kernel base address:

[0094] During the kernel startup process, a random offset is generated using a random number generator, and the random offset is added to the preset kernel base address to obtain the random offset base address;

[0095] The virtual address mapping table is modified in real time to apply the random offset base address to all data structures and all functional modules in the kernel, quickly implementing kernel address randomization and reducing the complexity and performance overhead of manual configuration.

[0096] 2. Randomize kernel modules:

[0097] Each time a kernel module is loaded, a weight offset is generated and applied to the original module base address of the kernel module to obtain a random module base address;

[0098] The symbol table is updated based on the random module base address, so that after the kernel module is loaded, the symbol table is used to resolve the addresses of functions and variables, so that the kernel can call the kernel module using the resolved addresses at runtime, thereby ensuring the security and functionality of the kernel module without introducing significant performance loss.

[0099] 3. Randomize data structure:

[0100] During the kernel initialization phase, a random offset base address is used to assign random memory addresses to data structures;

[0101] While the system is running, the memory layout is audited periodically to ensure that the randomized state of the data structures remains unchanged.

[0102] The above example, through a series of effective randomization steps, not only improves the kernel's anti-attack capability, but also optimizes system performance, making the randomization process maintain high efficiency while ensuring security. By comprehensively applying these technologies, this example effectively balances the relationship between kernel security and system performance, meeting the power industry's needs for high reliability and security.

[0103] Figure 6 This is a structural block diagram of a kernel security enhancement device for a power operating system provided in an embodiment of the present invention. The device is used to execute the kernel security enhancement method for a power operating system provided in any of the above embodiments. The device and the kernel security enhancement method for a power operating system in the above embodiments belong to the same inventive concept. For details not fully described in the embodiment of the kernel security enhancement device for a power operating system, reference can be made to the embodiment of the kernel security enhancement method for a power operating system. Figure 6 The device may specifically include: a random offset base address obtaining module 510, a virtual address mapping table modifying module 520 and a kernel security enhancing module 530.

[0104] The random offset base address obtaining module 510 is used to generate a random offset using a random number generator during the kernel startup process of the power operating system, and add the random offset to the preset kernel base address of the kernel to obtain the random offset base address;

[0105] A virtual address mapping table modification module 520, used to modify the virtual address mapping table of the kernel based on the random offset base address;

[0106] The kernel security enhancement module 530 is used to apply the random offset base address to the kernel modules and data structures in the kernel based on the virtual address mapping table to enhance the security of the kernel.

[0107] Optionally, the random number generator includes a hardware random number generator and a pseudo-random number generator;

[0108] The random offset base address obtaining module 510 may include:

[0109] a total entropy determination unit, used to determine the total entropy of the power operating system;

[0110] An initial random value generating unit, used for generating an initial random value based on total entropy by using a hardware random number generator;

[0111] The random offset generating unit is used to generate a random offset based on an initial random value by using a pseudo-random number generator.

[0112] On this basis, an optional total entropy determination unit is specifically used to:

[0113] Entropies collected from at least two entropy sources in the power operating system are obtained, and a total entropy of the power operating system is obtained based on a sum of all the entropies obtained, wherein the at least two entropy sources include at least two of a central processing unit performance, a system clock, and an input / output event.

[0114] Another optional initial random value generation unit is specifically used for:

[0115] Obtaining a hash function of total entropy, and obtaining a preset first weighting coefficient and a second weighting coefficient;

[0116] An initial random value is generated by using a hardware random number generator according to a first weighting coefficient, a total entropy to be mathematically operated with the first weighting coefficient, a second weighting coefficient, and a hash function to be mathematically operated with the second weighting coefficient.

[0117] Alternatively, the random offset generating unit may include:

[0118] A hash value collection subunit, used to collect hash values ​​corresponding to at least two entropy sources in the power operation system, wherein the at least two entropy sources may include at least two of a central processing unit performance, a system clock, and an input / output event;

[0119] The random offset generation subunit is used to generate a random offset based on all collected hash values ​​and an initial random value using a pseudo-random number generator.

[0120] On this basis, optionally, a random offset generation subunit is provided, which is specifically used for:

[0121] Generate a pseudo-random number based on all the collected hash values ​​and the initial random value;

[0122] Adjust the pseudo-random number to generate a random offset.

[0123] Optionally, the kernel security enhancement device further includes:

[0124] A random offset update module, for, after generating a random offset using a random number generator, performing a modulo operation on the random offset using a maximum value in a preset randomization range, and updating the random offset based on the obtained modulo operation result;

[0125] Alternatively, the repeating module is used to repeat the step of generating the random offset by using the random number generator after the random offset is generated by using the random number generator if the random offset is not within a preset randomization range.

[0126] Optionally, the kernel security enhancement module 530 may include:

[0127] A weight offset generating unit is used for adding a weight to a random offset corresponding to a random offset base address for a kernel module in the kernel during the kernel module loading process to generate a weight offset;

[0128] The random module base address obtaining unit is used to add the weight offset to the original module base address of the kernel module to obtain the random module base address.

[0129] On this basis, optionally, the kernel security enhancement device may further include:

[0130] The kernel module calling module is used to update the kernel module's symbol table based on the random module base address, so that the kernel can parse the address of the function and / or variable in the kernel module based on the symbol table during operation, and call the kernel module based on the parsing result.

[0131] Optionally, the kernel security enhancement module 530 may include:

[0132] A random data base address obtaining unit is used for adding a random offset corresponding to a random offset base address to an original data base address of the data structure in the kernel to obtain a random data base address;

[0133] The random memory address allocation unit is used for allocating random memory addresses for data structures based on random data base addresses, so that the random memory addresses of the data structures are different each time the kernel is started.

[0134] The kernel security enhancement device of the power operating system provided by the embodiment of the present invention obtains a module by a random offset base address. During the kernel startup process of the power operating system, a random number generator can be used to generate a random offset, and the random offset is added to the preset kernel base address of the kernel to obtain a random offset base address, thereby realizing kernel base address randomization; through a virtual address mapping table modification module, based on the random offset base address, the virtual address mapping table of the kernel is modified to realize kernel address randomization; through a kernel security enhancement module, based on the virtual address mapping table, the random offset base address is applied to the kernel module and data structure in the kernel to realize kernel module and data structure randomization. The above device generates a random offset during the kernel startup process and applies the random offset to each component of the kernel (i.e., the kernel base address, kernel module and data structure), thereby enhancing kernel security, and this randomization process is automatically realized by using a virtual address mapping table, thereby ensuring the efficiency of the randomization process and reducing the impact of the randomization process on system performance, that is, effectively balancing the relationship between kernel security and system performance, and meeting the power industry's requirements for high reliability and security.

[0135] The kernel security enhancement device for an electric power operating system provided in an embodiment of the present invention can execute the kernel security enhancement method for an electric power operating system provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0136] It is worth noting that in the embodiment of the kernel security enhancement device of the above-mentioned power operating system, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0137] Figure 7 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0138] like Figure 7As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0139] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0140] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the methods and processes described above, such as a kernel security enhancement method for a power operating system.

[0141] In some embodiments, the kernel security enhancement method of the power operating system may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the kernel security enhancement method of the power operating system described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the kernel security enhancement method of the power operating system by any other appropriate means (e.g., by means of firmware).

[0142] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0143] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0144] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0145] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0146] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0147] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0148] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0149] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for enhancing kernel security of a power operating system, characterized in that: include: During the kernel startup process of the power operating system, a random offset is generated by using a random number generator, and the random offset is added to a preset kernel base address of the kernel to obtain a random offset base address; Based on the random offset base address, modify the virtual address mapping table of the kernel; Based on the virtual address mapping table, the random offset base address is applied to kernel modules and data structures in the kernel to enhance the security of the kernel.

2. The method according to claim 1, characterized in that: The random number generator includes a hardware random number generator and a pseudo-random number generator; The method of generating a random offset by using a random number generator includes: determining a total entropy of the power operating system; Generate an initial random value based on the total entropy using the hardware random number generator; A random offset is generated based on the initial random value using the pseudo-random number generator.

3. The method according to claim 2, characterized in that Determining the total entropy of the power operating system includes: Obtain entropy respectively collected from at least two entropy sources in the power operating system, and obtain a total entropy of the power operating system based on a sum of all the entropies obtained, wherein at least two of the entropy sources include at least two of a central processing unit performance, a system clock, and an input / output event.

4. The method according to claim 2, characterized in that The step of generating an initial random value based on the total entropy by using the hardware random number generator includes: Obtaining a hash function of the total entropy, and obtaining a preset first weighting coefficient and a second weighting coefficient; The hardware random number generator is used to generate an initial random value according to the first weighting coefficient, the total entropy to be mathematically operated with the first weighting coefficient, the second weighting coefficient, and the hash function to be mathematically operated with the second weighting coefficient.

5. The method according to claim 2, characterized in that: The step of generating a random offset based on the initial random value using the pseudo-random number generator includes: Collecting hash values ​​corresponding to at least two entropy sources in the power operating system, wherein the at least two entropy sources include at least two of a central processing unit performance, a system clock, and an input / output event; The pseudo-random number generator is used to generate a random offset based on all the collected hash values ​​and the initial random value.

6. The method according to claim 5, characterized in that The generating a random offset based on all the collected hash values ​​and the initial random value comprises: Generate a pseudo-random number based on all the collected hash values ​​and the initial random value; The pseudo-random number is adjusted to generate a random offset.

7. The method according to claim 1, characterized in that After the random offset is generated by the random number generator, the method further includes: Using a maximum value in a preset randomization range, performing a modulo operation on the random offset, and updating the random offset based on the obtained modulo operation result; Or, When the random offset is not within the preset randomization range, the step of generating the random offset by using a random number generator is repeated.

8. The method according to claim 1, characterized in that The step of applying the random offset base address to a kernel module in the kernel comprises: For a kernel module in the kernel, during the kernel module loading process, a weight is added to the random offset corresponding to the random offset base address to generate a weighted offset; The weight offset is added to the original module base address of the kernel module to obtain a random module base address.

9. The method according to claim 8, characterized in that Also includes: The symbol table of the kernel module is updated based on the random module base address, so that during the operation of the kernel, the address of the function and / or variable in the kernel module is parsed based on the symbol table, and the kernel module is called based on the obtained parsing result.

10. The method according to claim 1, characterized in that The applying the random offset base address to a data structure in the kernel comprises: For the data structure in the kernel, adding the random offset corresponding to the random offset base address to the original data base address of the data structure to obtain a random data base address; Based on the random data base address, a random memory address is allocated to the data structure, so that the random memory address of the data structure is different each time the kernel is started.

Images