A kernel security enhancement method for a power operating system

Abstract

The embodiment of the present application discloses a kind of kernel security enhancement methods of electric power operating system.The method comprises: in the kernel starting process of electric power operating system, random offset is generated using random number generator, random offset is added with the preset kernel base address of kernel, and random offset base address is obtained;Based on random offset base address, the virtual address mapping table of kernel is modified;Based on virtual address mapping table, random offset base address is applied to the kernel module and data structure in kernel, to enhance the security of kernel.The technical scheme of the embodiment of the present application, by generating random offset in the kernel starting process, and the random offset is applied to each component of kernel (i.e.kernel base address, kernel module and data structure), the security of kernel is enhanced, and the efficiency of randomization process is ensured and the influence of randomization process on system performance is reduced.

Description

TECHNICAL FIELD

[0001] The embodiment of the present application relates to the technical field of electric power, in particular to a kernel security enhancement method of an electric power operating system. BACKGROUND

[0002] In modern operating systems, kernel security is crucial, especially in critical infrastructure fields such as electric power. Taking the electric power operating system as an example, with the development of technology, attackers are increasingly able to exploit vulnerabilities in the kernel of the electric power operating system to attack it, which can cause serious damage to the system.

[0003] Therefore, how to enhance the defense capability of the kernel and thus enhance the security of the kernel is crucial. SUMMARY

[0004] The embodiment of the present application provides a kernel security enhancement method of an electric power operating system to enhance the security of the kernel.

[0005] According to an aspect of the present application, a kernel security enhancement method of an electric power operating system is provided, which can include:

[0006] In the kernel startup process of the electric power operating system, a random offset is generated by using a random number generator, and the random offset is added to a preset kernel base address of the kernel to obtain a random offset base address;

[0007] Based on the random offset base address, the virtual address mapping table of the kernel is modified;

[0008] Based on the virtual address mapping table, the random offset base address is applied to the kernel modules and data structures in the kernel to enhance the security of the kernel.

[0009] The technical scheme of the embodiment of the present application, in the kernel startup process of the electric power operating system, a random offset is generated by using a random number generator, and the random offset is added to a preset kernel base address of the kernel to obtain a random offset base address, which realizes kernel base address randomization; based on the random offset base address, the virtual address mapping table of the kernel is modified, which realizes kernel address randomization; based on the virtual address mapping table, the random offset base address is applied to the kernel modules and data structures in the kernel, which realizes kernel module and data structure randomization. The above technical scheme generates a random offset in the kernel startup process and applies the random offset to each component of the kernel (i.e. the kernel base address, the kernel module and the data structure), which enhances the security of the kernel, and this randomization process is automatically implemented by using the virtual address mapping table, which ensures the efficiency of the randomization process and reduces the impact of the randomization process on system performance, i.e. effectively balances the relationship between kernel security and system performance, which meets the demand of the electric power industry for high reliability and security.

[0010] It should be understood that the description in this section is not intended to identify key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart of a kernel security enhancement method for a power operating system provided according to an embodiment of the present invention;

[0013] Figure 2 This is a flowchart of another kernel security enhancement method for a power operating system provided according to an embodiment of the present invention;

[0014] Figure 3 This is a flowchart of another kernel security enhancement method for a power operating system provided according to an embodiment of the present invention;

[0015] Figure 4 This is a flowchart of another kernel security enhancement method for a power operating system provided according to an embodiment of the present invention;

[0016] Figure 5 This is a flowchart of an optional example of a kernel security enhancement method for a power operating system provided according to an embodiment of the present invention;

[0017] Figure 6 This is a structural block diagram of a kernel security enhancement device for a power operating system according to an embodiment of the present invention;

[0018] Figure 7 This is a schematic diagram of the structure of an electronic device that implements the kernel security enhancement method of the power operating system according to embodiments of the present invention. Detailed Implementation

[0019] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0020] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. The same applies to "target," "original," etc., and will not be repeated here. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] Figure 1 This is a flowchart illustrating a method for enhancing kernel security in a power operating system according to an embodiment of the present invention. This embodiment is applicable to situations requiring enhanced kernel security in power operating systems, particularly those utilizing randomization techniques. The method can be executed by the kernel security enhancement device for a power operating system provided in this embodiment. This device can be implemented in software and / or hardware and can be integrated into an electronic device, which can be various user terminals or servers.

[0022] See Figure 1 The method of this invention specifically includes the following steps:

[0023] S110. During the kernel startup process of the power operating system, a random offset is generated using a random number generator, and the random offset is added to the kernel's preset kernel base address to obtain the random offset base address.

[0024] The power operating system can be understood as an operating system used in the power field. In combination with the application scenarios that may be involved in the embodiments of the present invention, the operating system may optionally be implemented based on the Euler operating system (openEuler); of course, it may also be implemented based on other operating systems, without specific limitations.

[0025] For the kernel of a power operating system, the preset kernel base address can be understood as a base address preset for that kernel. During the kernel boot process, a random offset is generated using a random number generator, and this random offset is added to the preset kernel base address to obtain a random offset base address. Compared to the preset kernel base address, this random offset base address has randomness, that is, the kernel security is enhanced by randomizing the kernel base address.

[0026] In this embodiment of the invention, the random number generator may optionally be a hardware random number generator and / or a pseudo-random number generator, which is related to the actual situation and is not specifically limited here.

[0027] S120. Modify the kernel's virtual address mapping table based on a random offset base address.

[0028] The virtual address mapping table can be understood as a table that represents the mapping relationship between the kernel's virtual addresses and real addresses (i.e., actual addresses). Modifying this virtual address mapping table based on a random offset base address, especially in real time, helps to quickly achieve kernel address randomization, thereby reducing the complexity and performance overhead of manual configuration.

[0029] S130. Based on the virtual address mapping table, random offset base addresses are applied to kernel modules and data structures in the kernel to enhance kernel security.

[0030] Here, a kernel module can be understood as a functional module within the kernel, and a data structure can be understood as the structure of data used within the kernel. Since the virtual address mapping table is obtained by modifying a random offset base address, random offset base addresses can be applied to kernel modules (i.e., randomizing kernel modules to enhance kernel security) and data structures (i.e., randomizing kernel modules to enhance kernel security).

[0031] The technical solution of this invention, during the kernel startup process of the power operating system, generates a random offset using a random number generator and adds the random offset to the kernel's preset kernel base address to obtain a random offset base address, thus achieving kernel base address randomization. Based on the random offset base address, the kernel's virtual address mapping table is modified, achieving kernel address randomization. Based on the virtual address mapping table, the random offset base address is applied to kernel modules and data structures within the kernel, achieving kernel module and data structure randomization. This technical solution enhances kernel security by generating a random offset during kernel startup and applying it to various kernel components (i.e., kernel base address, kernel modules, and data structures). Furthermore, this randomization process is automatically implemented using the virtual address mapping table, ensuring high efficiency and reducing the impact of randomization on system performance. In other words, it effectively balances the relationship between kernel security and system performance, meeting the power industry's requirements for high reliability and security.

[0032] An alternative technical solution, after generating a random offset using a random number generator, further includes the following kernel security enhancement method:

[0033] The maximum value within the preset randomization range is used to perform a modulo operation with the random offset, and the random offset is updated based on the obtained modulo operation result.

[0034] The preset randomization range can be understood as a pre-set range of randomization values. This range can be flexibly adjusted according to the system requirements of the power operating system, ensuring that the power operating system maintains good security under different scenarios. The maximum value can be understood as the maximum value within this range.

[0035] Using this maximum value, a modulo operation is performed with the random offset, and the random offset is updated based on the obtained modulo operation result, thereby ensuring that the random offset is within the preset randomization range. For example, R... final =R offset modR max , where R final R represents the updated random offset. offset R represents the random offset before the update. max This represents the maximum value, and mod represents the modulo operation.

[0036] The above technical solution ensures that the random offset of the final application is within the preset randomization range through modular arithmetic, which can prevent repeated or excessive random offsets and ensure the stability and security of system operation.

[0037] Another alternative technical solution, after generating a random offset using a random number generator, includes the following kernel security enhancement method:

[0038] If the random offset is not within the preset randomization range, repeat the step of generating a random offset using a random number generator.

[0039] In other words, if the generated random offset is within the preset randomization range, it is applied directly; otherwise, a new random offset is generated using a random number generator to obtain a random offset within the preset randomization range. This technical solution, by limiting the random offset, can prevent duplicate or excessively large random offsets, ensuring the stability and security of the system operation.

[0040] Figure 2This is a flowchart of another kernel security enhancement method for a power operating system provided in this embodiment of the invention. This embodiment is based on and optimized from the above-described technical solutions. In this embodiment, optionally, the random number generator includes a hardware random number generator and a pseudo-random number generator; generating a random offset using the random number generator may include: determining the total entropy of the power operating system; generating an initial random value based on the total entropy using the hardware random number generator; and generating a random offset based on the initial random value using the pseudo-random number generator. The explanations of terms that are the same as or corresponding to those in the above embodiments are not repeated here.

[0041] See Figure 2 The method in this embodiment may specifically include the following steps:

[0042] S210. During the kernel startup process of the power operating system, determine the total entropy of the power operating system.

[0043] Specifically, the total entropy of the power operating system can be determined based on the entropy collected from one, two, or more entropy sources. It should be noted that using two or more entropy sources to collect entropy, compared to using a single source, increases the complexity of random offset generation, reduces the likelihood of an attacker launching an attack using a single entropy source, and the different randomness characteristics exhibited by different entropy sources under different conditions make the generated random offsets more comprehensive and uniform, thus helping to resist various attack methods.

[0044] Based on this, and considering the application scenarios that may be involved in the embodiments of the present invention, the total entropy can be determined in the following way: Obtain the entropy collected from at least two entropy sources in the power operating system, and then obtain the total entropy of the power operating system based on the sum of all the obtained entropies. The at least two entropy sources may include at least two of the following: Central Processing Unit (CPU) performance, system clock, and input / output (I / O) events. For example, E... total =E cpu +E time +E io E total E represents the total entropy; cpu This represents the entropy collected from the CPU performance entropy source, or the entropy provided by the CPU performance counter; E time E represents the entropy collected from the system clock, a source of entropy, and characterizes the randomness of the system clock; io This represents the entropy collected from the entropy source of I / O events, characterizing the randomness of I / O events.

[0045] S220. Using a hardware random number generator, an initial random value is generated based on the total entropy.

[0046] Since the hardware random number generator generates random values ​​based on physical phenomena (i.e., the initial random value in this step), these values ​​are difficult to copy or predict, which helps improve the security of subsequently generated random offsets. This, in turn, helps to effectively resist external attacks and enhance the security of the power operating system. Therefore, this step utilizes a hardware random number generator to generate an initial random value based on total entropy. For example, R... initial =f(E total ), where R initial Let f represent the initial random value, and let f represent the function that generates the initial random value from the entropy source, which is the function represented by the hardware random number generator in this step.

[0047] Based on this, and considering the application scenarios that may be involved in the embodiments of the present invention, an initial random value can be generated in the following way: obtain the hash function of the total entropy, and obtain the preset first weighting coefficient and second weighting coefficient; using a hardware random number generator, generate an initial random value based on the first weighting coefficient, the total entropy to be mathematically operated with the first weighting coefficient, the second weighting coefficient, and the hash function to be mathematically operated with the second weighting coefficient. For example, R... initial =α·E total +β·H(E total ), where α represents the first weighting coefficient, used to adjust the influence of the total entropy on the initial random value, and can range from 0 to 1; β represents the second weighting coefficient, controlling the influence of the hash function, and can range from 0 to 1; H(E total ) represents a hash function based on total entropy, used to enhance randomness and output a random value of fixed length.

[0048] In the example above, by setting α and β, the influence of different entropy sources on the generated initial random value can be adjusted, thereby improving the quality of the initial random value and the flexibility of the system. Introducing a hash function based on total entropy increases the randomness of the generated initial random value, making the output results more unpredictable and reducing the risk of potential attacks.

[0049] S230. Using a pseudo-random number generator, a random offset is generated based on the initial random value.

[0050] Among them, the pseudo-random number generator can quickly generate a large number of random values, which is suitable for scenarios that require high-frequency calls. Moreover, it can be adaptively adjusted according to different inputs to meet specific security requirements. Therefore, based on the initial random value generated by the hardware random number generator, the pseudo-random number generator is used to generate random offsets.

[0051] S240. Add the random offset to the kernel's preset kernel base address to obtain the random offset base address.

[0052] S250: Modify the kernel's virtual address mapping table based on a random offset base address.

[0053] S260. Based on the virtual address mapping table, random offset base addresses are applied to kernel modules and data structures in the kernel to enhance kernel security.

[0054] The technical solution of this invention, by combining an entropy source, a hardware random number generator, and a pseudo-random number generator, achieves the effective generation of random offsets.

[0055] An optional technical solution utilizes a pseudo-random number generator to generate a random offset based on an initial random value, including:

[0056] Collect the hash values ​​corresponding to at least two entropy sources in the power operating system, wherein the at least two entropy sources include at least two of the central processing unit performance, system clock, and input / output events;

[0057] Using a pseudo-random number generator, a random offset is generated based on all collected hash values ​​and an initial random value.

[0058] For example, taking three entropy sources as an example, the above random offset generation process can be represented as R offset =PRNG(R initial T, H cpu H time H io ), where R offset R represents a random offset; PRNG represents a pseudo-random number generator; R initial Indicates the initial random value; T represents the current timestamp, used to provide an additional source of randomness; H cpu H represents the hash value of the CPU performance counter; time H represents the hash value of the system clock; io The hash value representing the I / O event.

[0059] The above technical solution, by combining initial random values ​​and hash values, can improve the mixing degree of random offsets, ensure the difference between random offsets, and thus enhance the security of the power operating system.

[0060] Optionally, based on all collected hash values ​​and the initial random value, a random offset is generated, including:

[0061] Based on all collected hash values ​​and initial random values, generate pseudo-random numbers;

[0062] Adjust the pseudo-random number to generate a random offset.

[0063] This process involves generating pseudo-random numbers based on all collected hash values ​​and initial random values. For example, an XOR operation can be used to generate pseudo-random numbers based on all hash values ​​and initial random values. The application of XOR operations ensures a mixture of randomness between different inputs. Optionally, the maximum value can be used in conjunction with modulo operations to process the pseudo-random numbers, ensuring that the processed pseudo-random numbers remain within a preset randomization range. For example, R′... offset =(R initial ⊕H cpu ⊕H time ⊕H io )mod R max , where R′ offset This represents the processed pseudo-random number, i.e., the pseudo-random number that has been adjusted to generate a random offset; R initial ⊕H cpu ⊕H time ⊕H io ⊕ represents a directly generated pseudo-random number, and ⊕ represents the XOR operation.

[0064] Furthermore, the pseudo-random numbers are adjusted to generate the final random offset for the application. For example, R... offset =(R′) offset +T+K)mod R max Where K represents a constant. In this example, R is strengthened by applying T. offset Randomness; by applying R max This limits R offset This can prevent duplicate or excessively large R values. offset This ensures the stability and security of the system operation.

[0065] Figure 3 This is a flowchart of another kernel security enhancement method for a power operating system provided in this embodiment of the invention. This embodiment is based on and optimized from the above-described technical solutions. In this embodiment, optionally, applying the random offset base address to the kernel module in the kernel may include: for the kernel module in the kernel, during the kernel module loading process, adding a weight to the random offset corresponding to the random offset base address to generate a weighted offset; adding the weighted offset to the original module base address of the kernel module to obtain the random module base address. The explanations of terms that are the same as or corresponding to those in the above embodiments are not repeated here.

[0066] See Figure 3 The method in this embodiment may specifically include the following steps:

[0067] S310. During the kernel startup process of the power operating system, a random offset is generated using a random number generator, and the random offset is added to the kernel's preset kernel base address to obtain the random offset base address.

[0068] S320: Modify the kernel's virtual address mapping table based on a random offset base address.

[0069] S330: For data structures in the kernel, based on the virtual address mapping table, a random offset base address is applied to the data structures to enhance kernel security.

[0070] S340. For kernel modules in the kernel, based on the virtual address mapping table, during the kernel module loading process, a weight is added to the random offset corresponding to the random offset base address to generate a weighted offset.

[0071] In the kernel module loading process, a random offset 2 for the kernel module application is generated by adding weights to the random offset 1 generated by S310. Compared with generating random offset 2 using a random number generator, the method of generating by adding weights has less computation and saves computing resources.

[0072] It should be noted that, in order to distinguish the two random offsets in terms of naming, random offset 1 will be called random offset, and random offset 2 will be called weight offset.

[0073] S350. Add the weight offset to the original module base address of the kernel module to obtain a random module base address, thereby enhancing kernel security.

[0074] Here, the original module base address can be understood as the original base address of the kernel module. Adding a weight offset to the original module base address yields a random module base address. In other words, by randomizing the kernel module, specifically the original module base address, kernel security is enhanced.

[0075] The technical solution of this invention generates a weighted offset by adding weights to a random offset, and then adds the weighted offset to the original module base address of the kernel module to obtain a random module base address, thereby realizing the randomization of the kernel module and enhancing kernel security.

[0076] An alternative technical solution, the above-mentioned kernel security enhancement method, further includes:

[0077] The kernel module's symbol table is updated based on a random module base address, so that during kernel operation, the address of functions and / or variables in the kernel module is resolved based on the symbol table, and the kernel module is called based on the resolution result.

[0078] After loading a kernel module, the kernel module's symbol table is updated based on a random module base address to reflect the address changes under the new base address (i.e., the random module base address). In this way, during kernel execution, the kernel can correctly resolve the addresses of functions and / or variables within the kernel module based on the symbol table, and then call the kernel module based on the resolved results, achieving correct kernel module invocation without introducing significant performance overhead.

[0079] Figure 4 This is a flowchart of another kernel security enhancement method for a power operating system provided in this embodiment of the invention. This embodiment is based on and optimized from the above-described technical solutions. In this embodiment, optionally, applying the random offset base address to a data structure in the kernel may include: for the data structure in the kernel, adding the random offset corresponding to the random offset base address to the original data base address of the data structure to obtain a random data base address; and allocating a random memory address for the data structure based on the random data base address, so that the random memory address of the data structure is different each time the kernel starts. The explanations of terms that are the same as or corresponding to those in the above embodiments are not repeated here.

[0080] See Figure 4 The method in this embodiment may specifically include the following steps:

[0081] S410. During the kernel startup process of the power operating system, a random offset is generated using a random number generator, and the random offset is added to the kernel's preset kernel base address to obtain the random offset base address.

[0082] S420: Modify the kernel's virtual address mapping table based on a random offset base address.

[0083] S430: For kernel modules within the kernel, a random offset base address is applied to the kernel module based on a virtual address mapping table to enhance kernel security.

[0084] S440. For data structures in the kernel, based on the virtual address mapping table, add the random offset corresponding to the random offset base address to the original data base address of the data structure to obtain the random data base address.

[0085] The original data base address can be understood as the original base address of the data structure. By adding a random offset to the original data base address of the data structure, a random data base address is obtained.

[0086] S450 allocates random memory addresses to data structures based on random data base addresses, so that the random memory addresses of data structures are different each time the kernel starts, thereby enhancing kernel security.

[0087] Specifically, random memory addresses are allocated to data structures based on random data base addresses. This ensures that the actual memory address of the data structure is different each time the kernel starts, thereby reducing the possibility of attackers using known memory addresses and enhancing kernel security. The aforementioned actual memory address is the allocated random memory address.

[0088] Optionally, during the operation of the power operating system, the memory layout can be audited periodically to ensure that the randomized state of data structures remains unchanged. In practical applications, this can be achieved through kernel scheduled tasks or hook mechanisms to monitor whether the actual memory addresses of data structures have been tampered with or restored to fixed values. If anomalies are detected, appropriate protective measures can be taken to ensure the safe operation of the system.

[0089] Alternatively, when certain data structures are no longer needed, an appropriate memory reclamation mechanism can be employed to ensure that allocated memory can be safely reallocated while maintaining randomization in the process.

[0090] The technical solution of this invention allocates random memory addresses to data structures by using random data base addresses. This ensures that the actual memory addresses of the data structures are different each time the kernel starts, thereby reducing the possibility of attackers launching attacks using known memory addresses and thus enhancing kernel security.

[0091] To better understand the various technical solutions mentioned above, an example of power operating system kernel security enhancement based on openEuler is provided here for illustrative purposes.

[0092] For example, see Figure 5 The specific implementation process is as follows:

[0093] 1. Randomized kernel base address:

[0094] During kernel startup, a random offset is generated using a random number generator, and this random offset is added to the preset kernel base address to obtain the random offset base address;

[0095] The virtual address mapping table is modified in real time to apply the random offset base address to all data structures and functional modules in the kernel, quickly realizing kernel address randomization and reducing the complexity and performance overhead of manual configuration.

[0096] 2. Randomized kernel module:

[0097] During each kernel module loading process, a weight offset is generated and applied to the original module base address of the kernel module to obtain a random module base address;

[0098] The symbol table is updated based on random module base addresses. After the kernel module is loaded, the symbol table is used to resolve the addresses of functions and variables, so that the kernel can call the kernel module at runtime using the resolved addresses. This ensures the security and functionality of the kernel module without introducing significant performance loss.

[0099] 3. Randomized data structures:

[0100] During the kernel initialization phase, random memory addresses are allocated to data structures using random offset base addresses;

[0101] During system operation, periodically audit the memory layout to ensure that the randomization state of data structures remains unchanged.

[0102] The above example, through a series of effective randomization steps, not only improves the kernel's resistance to attacks but also optimizes system performance, ensuring high efficiency while maintaining security. By comprehensively utilizing these techniques, this example effectively balances kernel security and system performance, meeting the power industry's requirements for high reliability and security.

[0103] Figure 6 This is a structural block diagram of a kernel security enhancement device for a power operating system provided in an embodiment of the present invention. This device is used to execute the kernel security enhancement method for a power operating system provided in any of the above embodiments. This device and the kernel security enhancement methods for a power operating system in the above embodiments belong to the same inventive concept. Details not described in detail in the embodiments of the kernel security enhancement device for a power operating system can be found in the embodiments of the kernel security enhancement methods for a power operating system described above. See also... Figure 6 The device may specifically include: a random offset base address acquisition module 510, a virtual address mapping table modification module 520, and a kernel security enhancement module 530.

[0104] Among them, the random offset base address acquisition module 510 is used to generate a random offset using a random number generator during the kernel startup process of the power operating system, and add the random offset to the kernel's preset kernel base address to obtain the random offset base address.

[0105] The virtual address mapping table modification module 520 is used to modify the kernel's virtual address mapping table based on a random offset base address;

[0106] The kernel security enhancement module 530 is used to apply random offset base addresses to kernel modules and data structures in the kernel based on a virtual address mapping table to enhance kernel security.

[0107] Optionally, the random number generator includes a hardware random number generator and a pseudo-random number generator;

[0108] The random offset base address acquisition module 510 may include:

[0109] Total entropy determination unit, used to determine the total entropy of the power operating system;

[0110] The initial random value generation unit is used to generate initial random values ​​based on the total entropy using a hardware random number generator.

[0111] The random offset generation unit is used to generate random offsets based on initial random values ​​using a pseudo-random number generator.

[0112] Based on this, an optional total entropy determination unit is specifically used for:

[0113] The entropy is obtained from at least two entropy sources in the power operating system, and the total entropy of the power operating system is obtained by summing the total entropy obtained. The at least two entropy sources include at least two of the following: CPU performance, system clock, and input / output events.

[0114] Another optional initial random value generation unit is specifically used for:

[0115] Obtain the hash function of the total entropy, and obtain the preset first weighting coefficient and second weighting coefficient;

[0116] Using a hardware random number generator, an initial random value is generated based on a first weighting coefficient, the total entropy to be mathematically operated on with the first weighting coefficient, a second weighting coefficient, and a hash function to be mathematically operated on with the second weighting coefficient.

[0117] Alternatively, the random offset generation unit may include:

[0118] The hash value collection subunit is used to collect the hash values ​​corresponding to at least two entropy sources in the power operating system. The at least two entropy sources may include at least two of the central processing unit performance, system clock, and input / output events.

[0119] The random offset generation subunit is used to generate random offsets using a pseudo-random number generator, based on all collected hash values ​​and an initial random value.

[0120] Based on this, optional random offset generation sub-cells are specifically used for:

[0121] Based on all collected hash values ​​and initial random values, generate pseudo-random numbers;

[0122] Adjust the pseudo-random number to generate a random offset.

[0123] Optionally, the aforementioned kernel security enhancement device also includes:

[0124] The random offset update module is used to generate a random offset using a random number generator, perform a modulo operation between the maximum value in the preset randomization range and the random offset, and update the random offset based on the obtained modulo operation result.

[0125] Alternatively, a repeat execution module can be used to repeatedly execute the step of generating a random offset using a random number generator if the random offset is not within a preset randomization range after generating a random offset using a random number generator.

[0126] Optionally, the kernel security enhancement module 530 may include:

[0127] The weighted offset generation unit is used to add weights to the random offsets corresponding to the random offset base addresses during the kernel module loading process, thereby generating weighted offsets.

[0128] The random module base address is obtained by adding the weight offset to the original module base address of the kernel module to obtain the random module base address.

[0129] In addition, optionally, the aforementioned kernel security enhancement device may further include:

[0130] The kernel module calling module is used to update the symbol table of the kernel module based on a random module base address, so that the kernel can resolve the addresses of functions and / or variables in the kernel module based on the symbol table during operation, and call the kernel module based on the obtained resolution results.

[0131] Optionally, the kernel security enhancement module 530 may include:

[0132] The random data base address acquisition unit is used to add the random offset corresponding to the random offset base address to the original data base address of the data structure in the kernel to obtain the random data base address;

[0133] The random memory address allocation unit is used to allocate random memory addresses to data structures based on random data base addresses, so that the random memory addresses of the data structures are different each time the kernel starts.

[0134] The kernel security enhancement device for a power operating system provided in this invention includes a random offset base address generation module. During the kernel startup process of the power operating system, a random number generator generates a random offset, which is then added to the kernel's preset kernel base address to obtain the random offset base address, thus achieving kernel base address randomization. A virtual address mapping table modification module modifies the kernel's virtual address mapping table based on the random offset base address, achieving kernel address randomization. Finally, a kernel security enhancement module applies the random offset base address to kernel modules and data structures within the kernel, based on the virtual address mapping table, achieving kernel module and data structure randomization. This device enhances kernel security by generating a random offset during kernel startup and applying it to various kernel components (i.e., kernel base address, kernel modules, and data structures). Furthermore, this randomization process is automatically implemented using the virtual address mapping table, ensuring high efficiency and reducing the impact of randomization on system performance. This effectively balances kernel security and system performance, meeting the power industry's requirements for high reliability and security.

[0135] The kernel security enhancement device for the power operating system provided in this embodiment of the invention can execute the kernel security enhancement method for the power operating system provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0136] It is worth noting that in the embodiments of the above-mentioned power operating system kernel security enhancement device, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0137] Figure 7 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0138] like Figure 7As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from storage unit 18. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0139] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0140] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the methods and processes described above, such as kernel security enhancement methods for a power operating system.

[0141] In some embodiments, the kernel security enhancement method for the power operating system may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the kernel security enhancement method for the power operating system described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the kernel security enhancement method for the power operating system by any other suitable means (e.g., by means of firmware).

[0142] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0143] Computer programs used to implement the methods of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0144] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0145] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0146] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0147] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0148] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0149] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for enhancing kernel security in a power operating system, characterized in that, include: During the kernel startup process of the power operating system, a random offset is generated using a random number generator, and the random offset is added to the preset kernel base address to obtain the random offset base address; Based on the random offset base address, modify the kernel's virtual address mapping table; Based on the virtual address mapping table, the random offset base address is applied to kernel modules and data structures in the kernel to enhance the security of the kernel; The step of applying the random offset base address to a kernel module in the kernel includes: For the kernel modules in the kernel, during the kernel module loading process, a weight is added to the random offset corresponding to the random offset base address to generate a weighted offset. The weight offset is added to the original module base address of the kernel module to obtain a random module base address; The step of applying the random offset base address to the data structure in the kernel includes: For the data structure in the kernel, the random offset corresponding to the random offset base address is added to the original data base address of the data structure to obtain the random data base address; Based on the random data base address, a random memory address is allocated to the data structure so that the random memory address of the data structure is different each time the kernel starts.

2. The method according to claim 1, characterized in that, The random number generator includes a hardware random number generator and a pseudo-random number generator; The method of generating a random offset using a random number generator includes: Determine the total entropy of the power operating system; Using the hardware random number generator, an initial random value is generated based on the total entropy; Using the pseudo-random number generator, a random offset is generated based on the initial random value.

3. The method according to claim 2, characterized in that, Determining the total entropy of the power operating system includes: The entropy collected from at least two entropy sources in the power operating system is obtained, and the total entropy of the power operating system is obtained based on the sum of all the obtained entropy, wherein the at least two entropy sources include at least two of the central processing unit performance, system clock, and input / output events.

4. The method according to claim 2, characterized in that, The step of generating an initial random value using the hardware random number generator based on the total entropy includes: Obtain the hash function of the total entropy, and obtain the preset first weighting coefficient and second weighting coefficient; Using the hardware random number generator, an initial random value is generated based on the first weighting coefficient, the total entropy to be mathematically operated with the first weighting coefficient, the second weighting coefficient, and the hash function to be mathematically operated with the second weighting coefficient.

5. The method according to claim 2, characterized in that, The step of generating a random offset based on the initial random value using the pseudo-random number generator includes: Collect the hash values ​​corresponding to at least two entropy sources in the power operating system, wherein the at least two entropy sources include at least two of the central processing unit performance, system clock, and input / output events; Using the pseudo-random number generator, a random offset is generated based on all the collected hash values ​​and the initial random value.

6. The method according to claim 5, characterized in that, The step of generating a random offset based on all the collected hash values ​​and the initial random value includes: Based on all the collected hash values ​​and the initial random value, generate pseudo-random numbers; The pseudo-random number is adjusted to generate a random offset.

7. The method according to claim 1, characterized in that, After generating the random offset using a random number generator, the method further includes: The maximum value within a preset randomization range is used to perform a modulo operation with the random offset, and the random offset is updated based on the obtained modulo operation result. Or, If the random offset is not within the preset randomization range, the step of generating a random offset using a random number generator is repeated.

8. The method according to claim 1, characterized in that, Also includes: The symbol table of the kernel module is updated based on the random module base address, so that during the kernel's operation, the addresses of functions and / or variables in the kernel module are resolved based on the symbol table, and the kernel module is called based on the obtained resolution results.

Images