Safety protection method, device and equipment of operation system and medium

Abstract

The invention discloses a safety protection method and device for an operation system, equipment and a medium, and relates to the field of function safety protection, and the method comprises the steps: carrying out the safety protection of different modes on the operation system according to the type of the processing data of the operation system; wherein the category of the data comprises key data and non-key data; if the data processed by the operation system is key data, performing safety protection on the operation system in a mode of backing up the operation system; and if the data processed by the operation system is non-critical data, performing security protection on the operation system according to the handshake information of the operation system. According to the method and the device, differentiated protection is carried out on the operation system by distinguishing the types of the processing data of the operation system, so that the safety and reliability of the operation system are improved while the safety protection cost is controlled.

Description

Technical Field

[0001] The present invention relates to the field of functional safety protection, and in particular to a safety protection method, device, equipment and medium for an operating system. Background Art

[0002] With the accelerated popularization and application of automobile electrification and intelligence, the electronic and electrical architecture of automobiles has become increasingly complex. At the same time, it also puts higher reliability and safety requirements on the safety protection of operating systems that adopt the automotive functional safety architecture to improve the safety of automobile driving.

[0003] In the security protection scheme of the running system, the E-GAS three-layer architecture (a three-layer electronic monitoring architecture for power domain system design) is usually used for layered design. The first layer is the business implementation layer, which is mainly used to obtain business data. The second layer is the functional monitoring layer, which is mainly used to process the business data obtained by the first layer to realize the monitoring and error detection of the first layer. The third layer is the controller monitoring layer, which usually uses additional reliable hardware, such as watchdog chips, CPU (Central Processing Unit) / RAM (Random Access Memory) / ROM (Read-Only Memory) fault detection modules, etc., to realize error detection and whole system recovery when errors occur in the second layer. Among them, the second layer (functional monitoring layer) in the running system is implemented as software, which is prone to reliability and security problems, thereby causing system-level failures in the running system; therefore, how to achieve security protection for the running system is currently a problem that needs to be optimized. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a security protection method, device, equipment and medium for a running system, which can differentiate the types of data processed by the running system to provide differentiated protection for the running system, thereby improving the security and reliability of the running system while controlling the security protection cost. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a method for protecting the security of an operating system, comprising:

[0006] Performing different security protections on the operating system according to the categories of data processed by the operating system; the categories of data include critical data and non-critical data;

[0007] If the data processed by the operating system is critical data, the operating system is protected by backing up the operating system;

[0008] If the data processed by the operating system is non-critical data, security protection is performed on the operating system according to the handshake information of the operating system.

[0009] Optionally, the performing security protection on the operating system by backing up the operating system includes:

[0010] The first monitoring process that processes key data in the running system backs up its own process state to a backup process in the running system, so as to perform security protection on the first monitoring process based on the backup process.

[0011] Optionally, the performing security protection on the first monitoring process based on the standby process includes:

[0012] When the first monitoring process fails, security protection is performed on the first monitoring process based on the target process state stored in the standby process;

[0013] The target process state is the process state of the first monitoring process backed up to the standby process before a failure occurs.

[0014] Optionally, the performing security protection on the first monitoring process based on the target process state stored in the standby process includes:

[0015] Killing the first monitoring process based on the standby process, configuring itself as a new first monitoring process using the target process state, and creating a corresponding new standby process;

[0016] Or, the first monitoring process is restored based on the target process state stored in the standby process.

[0017] Optionally, the performing security protection on the running system according to the handshake information of the running system includes:

[0018] According to the handshake information between the first monitoring process processing critical data and the second monitoring process processing non-critical data in the running system, security protection is performed on the second monitoring process.

[0019] Optionally, the performing security protection on the second monitoring process according to the handshake information between the first monitoring process processing critical data and the second monitoring process processing non-critical data in the running system includes:

[0020] When the first monitoring process does not receive the handshake information sent by the second monitoring process, determining that the second monitoring process fails, and restoring the second monitoring process based on the process state of the second monitoring process recorded in advance at the target checkpoint;

[0021] The target checkpoint is a checkpoint generated by the second monitoring process based on its own process state before the failure occurs.

[0022] Optionally, the security protection method for the operating system further includes:

[0023] The number of fault occurrences of the monitoring process is counted, and when the number of fault occurrences reaches a corresponding preset number, a reset operation for the running system is triggered.

[0024] In a second aspect, the present application provides a safety protection device for an operating system, comprising:

[0025] A security protection module, used for performing different security protections on the operating system according to the categories of data processed by the operating system; the categories of data include critical data and non-critical data;

[0026] A backup protection module, used for protecting the operating system by backing up the operating system if the data processed by the operating system is critical data;

[0027] The handshake protection module is used to perform security protection on the operating system according to the handshake information of the operating system if the data processed by the operating system is non-critical data.

[0028] In a third aspect, the present application provides an electronic device, including:

[0029] Memory, used to store computer programs;

[0030] A processor is used to execute the computer program to implement the aforementioned security protection method for the operating system.

[0031] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the aforementioned security protection method for the operating system.

[0032] In the present application, different methods of security protection are performed on the operating system according to the category of data processed by the operating system; the category of data includes critical data and non-critical data; if the data processed by the operating system is critical data, the operating system is securely protected by backing up the operating system; if the data processed by the operating system is non-critical data, the operating system is securely protected according to the handshake information of the operating system. It can be seen that the present application distinguishes the categories of data processed by the operating system, so that when the data processed by the operating system is critical data, the operating system is securely protected by backing up the operating system, wherein the backup method has high real-time performance and good security, and when the data processed by the operating system is non-critical data, the operating system is securely protected by the handshake information of the operating system without introducing other processes, thereby realizing differentiated protection of the operating system according to the category of data processed by the operating system, so as to improve the security and reliability of the operating system while controlling the security protection cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0034] Figure 1 A flow chart of a security protection method for an operating system disclosed in this application;

[0035] Figure 2 A security protection architecture diagram of an operating system disclosed in this application;

[0036] Figure 3 A schematic diagram of the structure of a safety protection device for an operating system disclosed in this application;

[0037] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] The second layer (functional monitoring layer) in the operating system is implemented as software, which is prone to reliability and security issues, thereby causing system-level failures in the operating system. To this end, the present application provides a security protection method for an operating system, which differentiates the categories of data processed by the operating system to provide differentiated protection for the operating system, thereby improving the security and reliability of the operating system while controlling the security protection cost.

[0040] See also Figure 1 As shown, an embodiment of the present invention discloses a security protection method for a running system, including:

[0041] Step S11, performing different security protections on the operating system according to the categories of data processed by the operating system; the categories of data include critical data and non-critical data.

[0042] In the embodiment of the present invention, during the operation of the operation system, the operation system will obtain the data to be processed and process the data to be processed. During the data processing process, the operation system needs to be protected in different ways according to the category of the data processed by the operation system; wherein the category of data includes critical data and non-critical data. Taking the operation system as an automobile operation system adopting the E-GAS three-layer architecture as an example, the operation system obtains the data to be processed through the business implementation layer, and sends the data to be processed to the function monitoring layer in the operation system, so that the data to be processed is processed through the function monitoring layer.

[0043] The data to be processed includes, but is not limited to, the business information and operation information of the operating system. The business information can be the driver information of each business driver or the peripheral information input by an external device; and the external device includes, but is not limited to, sensors, storage devices, codec chips, etc. The operation information can be the operation information of the electronic device connected to the operating system or the operation information of the electronic device inside the operating system.

[0044] Taking the automobile operating system that adopts the E-GAS three-layer architecture as an example, each business driver is located in the business implementation layer of the operating system, and the business information may include environmental information collected during the driving of the car, request information for planning the driving route of the car based on the environmental information, etc.; the operating information may include the operating information of the engine, electronic throttle, etc.

[0045] The classification of critical data and non-critical data can be based on the importance of the data and the impact of errors. If the importance of the data is high or the impact of errors is large, the data is classified as critical data; if the importance of the data is low and the impact of errors is small, the data is classified as non-critical data. The importance and the impact of errors can be determined based on the type of data.

[0046] Furthermore, the operating system needs to use different monitoring processes to process the data according to the type of data to be processed. If the type of data to be processed by the operating system is critical data, the first monitoring process needs to be used to process the critical data; if the type of data to be processed by the operating system is non-critical data, the second monitoring process needs to be used to process the non-critical data.

[0047] Correspondingly, different methods of security protection are performed on the running system according to the category of data processed by the running system. If the category of data processed by the running system is critical data, then the first monitoring process in the running system needs to be securely protected; if the category of data processed by the running system is non-critical data, then the second monitoring process in the running system needs to be securely protected; and different methods need to be adopted for the security protection of the first monitoring process and the security protection of the second monitoring process.

[0048] Furthermore, the processing of key data and non-key data depends on the processing function configured in the monitoring process. For example, when the processing function is used to monitor whether the data is legal, the corresponding processing results can be legal data and illegal data; when the processing function is used to monitor whether the data is available, the corresponding processing results can be available data and unavailable data. It should be noted that when processing key data and non-key data, if the processing function used is a Boolean function, the corresponding processing results can be true and false.

[0049] Taking the automobile operating system adopting the E-GAS three-layer architecture as an example, the operating system processes data through the functional monitoring layer; wherein, for critical data, the operating system processes it through the first monitoring process in the functional monitoring layer, and for non-critical data, the operating system processes it through the second monitoring process in the functional monitoring layer.

[0050] Step S12: If the data processed by the operating system is critical data, the operating system is protected by backing up the operating system.

[0051] In the embodiment of the present invention, if the data processed by the operating system is critical data, the operating system is protected by backing up the operating system, wherein the backup may include real-time backup, periodic backup, backup triggered when the critical data begins to be processed, and the like.

[0052] Furthermore, if the data processed by the operating system is critical data, the first monitoring process that processes the critical data in the operating system backs up its own process state to the backup process in the operating system, so as to perform security protection for the first monitoring process based on the backup process.

[0053] Specifically, for the security protection of the first monitoring process based on the standby process, the first monitoring process can be protected based on the target process state stored in the standby process when the first monitoring process fails; wherein the target process state is the process state of the first monitoring process backed up to the standby process before the failure occurs. That is, when the first monitoring process fails, the target process state of the first monitoring process backed up to the standby process before the failure occurs is determined from the standby process, and the target process state is used to protect the first monitoring process.

[0054] It should be noted that the target process state can be the process state of the first monitoring process that was most recently backed up to the standby process before the failure occurs, or it can be the process state of the first monitoring process that was backed up to the standby process at any time before the failure occurs. No specific limitation is made here.

[0055] Among them, for the security protection of the first monitoring process based on the target process state stored in the standby process, in one case, the first monitoring process that fails can be killed based on the standby process, and the target process state can be used to configure itself as a new first monitoring process, and a corresponding new standby process can be created, thereby forming a pair of new master-slave processes. In this way, the present invention kills the first monitoring process that fails by the standby process, thereby achieving zero tolerance for the first monitoring process that fails, and through the standby process that pre-stores the process state of the first monitoring process, it can quickly configure itself as a new first monitoring process to quickly take over the work of the killed first monitoring process, thereby performing security protection on the first monitoring process through the master-slave mechanism, thereby achieving security protection of the running system, and improving the security and reliability of the running system.

[0056] Among them, for the security protection of the first monitoring process based on the target process state stored in the standby process, in another case, the first monitoring process can be directly restored based on the target process state stored in the standby process. In this way, the present invention can improve the security protection speed of the first monitoring process by restoring the failed first monitoring process through the process state of the first monitoring process stored in the standby process. Since there is no need to recreate the process, the first monitoring process can be protected while reducing the security protection cost, thereby realizing the security protection of the running system.

[0057] In addition, the first monitoring process includes a status management module, a data backup module, and a verification module; wherein the data backup module in the first monitoring process is used to back up the process status of the first monitoring process to the data backup module in the standby process; the status management module in the first monitoring process is used to process key data according to business logic, such as whether the key data is legal or normal; the verification module in the first monitoring process is used to verify the key data to determine whether the first monitoring process has failed based on the verification results.

[0058] It should be noted that the verification algorithm adopted by the verification module to verify the key data includes but is not limited to CRC (Cyclic Redundancy Check), parity check, etc. The verification result at this time is a binary number. By judging whether the verification result is bit flipped relative to the verification code of the key data when the running system obtains the key data, it is possible to judge whether the key data is correct, thereby determining whether the first monitoring process has a fault.

[0059] If the check result is bit-flipped relative to the check code, it indicates that the key data is incorrect. At this time, the key data may be affected by the first monitoring process that has failed, resulting in errors. Therefore, in this case, it can be considered that the first monitoring process has failed. If the check result is not bit-flipped relative to the check code, it indicates that the key data is correct, and it can be considered that the first monitoring process has not failed.

[0060] Step S13: If the data processed by the operating system is non-critical data, security protection is performed on the operating system according to the handshake information of the operating system.

[0061] In an embodiment of the present invention, if the data processed by the operating system is non-critical data, the operating system can be protected according to the handshake information of the operating system. Specifically, if the data processed by the operating system is non-critical data, the second monitoring process is protected according to the handshake information between the first monitoring process that processes critical data in the operating system and the second monitoring process that processes non-critical data in the operating system.

[0062] Among them, for the security protection of the second monitoring process, the second monitoring process can be protected by using the checkpoint generated in advance by the second monitoring process based on its own process state. It should be noted that the generation of the checkpoint is actually recording the process state of the current second monitoring process under the current checkpoint; and the checkpoint can be generated regularly or triggered when non-critical data begins to be processed.

[0063] More specifically, the present application continuously exchanges handshake information between the first monitoring process and the second monitoring process, so as to determine that the second monitoring process has failed when the first monitoring process does not receive the handshake information sent by the second monitoring process, and restore the second monitoring process based on the process state of the second monitoring process recorded in advance at the target checkpoint. The target checkpoint is a checkpoint generated by the second monitoring process based on its own process state before the failure occurs.

[0064] It should be noted that the target checkpoint can be either the latest checkpoint generated by the second monitoring process before the failure occurs, or the checkpoint generated by the second monitoring process at any time before the failure occurs. Considering that the closer the generation time of the checkpoint is to the current time, the more perfect the process state of the second monitoring process recorded under the checkpoint is, therefore, the latest checkpoint generated by the second monitoring process before the failure occurs is generally selected as the target checkpoint to restore the second monitoring process. In this way, considering that the process state recorded under the checkpoint may not be completely normal, there may be certain problems, but it does not affect the normal operation of the second monitoring process. Therefore, the present invention uses a checkpoint that can tolerate certain errors to perform security protection on the second monitoring process that fails. It can improve the security and reliability of the second monitoring process while controlling the security protection cost, thereby achieving security protection for the running system.

[0065] Among them, the second monitoring process includes a state management module and a checkpoint module; the state management module in the second monitoring process is used to process non-critical data according to business logic, such as whether the non-critical data is legal or normal; the checkpoint module in the second monitoring process is used to generate and save checkpoints according to the process state of the second monitoring process.

[0066] Furthermore, the present application can also determine that the first monitoring process has failed when the second monitoring process has not received the handshake information sent by the first monitoring process by continuously exchanging handshake information between the first monitoring process and the second monitoring process. That is, if any one of the first monitoring process and the second monitoring process has not received the handshake information sent by the other monitoring process, it is determined that the other monitoring process has failed. In this way, through the back and forth handshake information between the first monitoring process and the second monitoring process, the first monitoring process and the second monitoring process can regularly obtain the status of each other, so that without adding additional processes, fault monitoring of the first monitoring process and the second monitoring process can be achieved, avoiding unnecessary cost overhead for the security protection of the running system.

[0067] Furthermore, in order to improve the accuracy of fault monitoring of the first monitoring process and the second monitoring process, when it is initially determined that any monitoring process has not received the handshake information sent by the other monitoring process, that is, when it is initially determined that the other monitoring process has failed, a handshake message can be sent again by any monitoring process to the other monitoring process to recheck whether the other monitoring process has failed; if any monitoring process still has not received the handshake information sent by the other monitoring process, it is determined that the other monitoring process has indeed failed; if any monitoring process receives the handshake information sent by the other monitoring process again, it is determined that the other monitoring process has not failed, and the handshake information exchange between the first monitoring process and the second monitoring process continues. In this way, when the present application first determines that a certain monitoring process has failed, a handshake message is sent to the monitoring process again to recheck whether the monitoring process has failed, thereby improving the accuracy of fault monitoring of the monitoring process.

[0068] It should be noted that the present application may also set a preset time period to determine that another monitoring process has failed when any monitoring process does not receive a handshake message sent by another monitoring process within the preset time period. The preset time period may be set according to actual fault monitoring requirements.

[0069] For example, the handshake information between the first monitoring process and the second monitoring process may be the heartbeat information between the first monitoring process and the second monitoring process, that is, if either of the first monitoring process and the second monitoring process does not receive the heartbeat information sent by the other monitoring process, it is determined that the other monitoring process has failed.

[0070] Furthermore, the operating system will count the number of faults that occur in the monitoring process, and trigger a reset operation for the operating system when the number of faults reaches a corresponding preset number. Taking the operating system as an automobile operating system that adopts the E-GAS three-layer architecture as an example, the operating system counts the number of faults that occur in the monitoring process through the controller monitoring layer, and triggers a reset operation for the operating system when the number of faults reaches a corresponding preset number.

[0071] Specifically, for counting the number of failures of the monitoring process, the number of failures of the first monitoring process and the second monitoring process can be counted separately to obtain the first number of failures and the second number of failures, or the number of failures of the first monitoring process and the second monitoring process can be cumulatively counted to obtain the third number of failures, that is, the third number of failures is equal to the sum of the first number of failures and the second number of failures.

[0072] Correspondingly, for determining whether the number of fault occurrences reaches the preset number, it may include determining whether the number of any of the first fault occurrences, the second fault occurrences, and the third fault occurrences reaches the preset number corresponding to any of the fault occurrences. The preset numbers corresponding to the first fault occurrences, the second fault occurrences, and the third fault occurrences may be the same number or different numbers. That is, the first fault number of the first monitoring process and the second fault number of the second monitoring process may be counted, and the cumulative number of faults (the third number of faults) may be determined based on the first fault number and the second fault number; and whether to trigger the system reset operation may be determined based on whether the current number of faults meets the preset conditions; the current number of faults includes any one or a combination of the first fault number, the second fault number, and the cumulative number of faults; wherein the preset conditions include the first fault number or the second fault number or the cumulative number of faults reaching the corresponding preset number.

[0073] It should be noted that when the number of failures does not reach the corresponding preset number, if the failure occurs in the first monitoring process, the operating system will send a process protection notification to the standby process so that the standby process can perform safety protection on the first monitoring process that has failed based on the process state of the first monitoring process stored in itself. If the failure occurs in the second monitoring process, the operating system will call the checkpoint pre-generated in the checkpoint module of the second monitoring process to perform safety protection on the second monitoring process that has failed. The checkpoint at this time is the checkpoint generated by the second monitoring process before the failure occurs.

[0074] Taking the running system as an example of a car running system using the E-GAS three-layer architecture, when a fault occurs in the first monitoring process and / or the second monitoring process, a fault notification message used to characterize the fault itself will be sent to the controller monitoring layer in the running system, so that the controller monitoring layer can count the number of faults of the monitoring process, and trigger a reset operation for the running system when the number of faults reaches a corresponding preset number. In this way, when the number of faults of the monitoring process reaches a preset number, the present invention can trigger a reset operation for the running system, considering that it may be caused by instability or abnormality of the running system, thereby achieving security protection for the running system without the need to add additional hardware such as a watchdog, thereby reducing the hardware cost required for security protection.

[0075] by Figure 2 Taking the operation system shown as an example, the operation system is a system built based on the business implementation layer, the function monitoring layer and the controller monitoring layer; wherein the function monitoring layer includes a first monitoring process for processing critical data, a second monitoring process for processing non-critical data, and a standby process. The specific implementation scheme is as follows:

[0076] The business implementation layer receives critical data input from external devices or critical data generated by business drivers, and transmits the critical data to the first monitoring process in the functional monitoring layer; and the business implementation layer can also receive non-critical data input from external devices or non-critical data generated by business drivers, and transmit the non-critical data to the second monitoring process in the functional monitoring layer.

[0077] The first monitoring process processes the key data according to the business logic through the local state management module, and calls the local data backup module to back up its own process state to the data backup module in the standby process. At the same time, the local verification module can also be called to verify the key data to determine whether the first monitoring process fails based on the verification result. If the first monitoring process determines that the first monitoring process fails based on the verification result, a fault notification message used to characterize the failure of the first monitoring process is sent to the fault management module in the controller monitoring layer, so that when the fault management module in the controller monitoring layer receives the fault notification message, it adds one to the current fault occurrence number to obtain a new current fault occurrence number, and determines whether the current fault occurrence number is greater than the preset number; if the current fault occurrence number is greater than the preset number, the system reset module in the controller monitoring layer is called to perform a reset operation; if the current fault occurrence number is not greater than the preset number, a process protection notification is sent to the standby process in the functional monitoring layer, so that the standby process performs security protection on the first monitoring process based on the target process state stored in the local data backup module, wherein the target process state is the process state of the first monitoring process synchronized to the data backup module of the standby process before the failure occurs.

[0078] The second monitoring process processes non-critical data through the local status management module, and calls the local checkpoint module to generate and store checkpoints based on the process status of the second monitoring process. Thereafter, when a fault occurs in the second monitoring process, a fault notification message characterizing the fault of the second monitoring process is sent to the fault management module in the controller monitoring layer, so that when the fault management module in the controller monitoring layer receives the fault notification message, it increments the current fault occurrence count by one to obtain a new current fault occurrence count, and determines whether the current fault occurrence count is greater than the preset count; if the current fault occurrence count is greater than the preset count, the system reset module in the controller monitoring layer is called to perform a reset operation; if the current fault occurrence count is not greater than the preset count, the process status recorded under the target checkpoint stored in the checkpoint module of the second monitoring process is called to perform security protection on the second monitoring process, wherein the target checkpoint is the checkpoint generated by the second monitoring process before the fault occurs.

[0079] Furthermore, the first monitoring process and the second monitoring process perform heartbeat detection between the two monitoring processes based on their respective heartbeat detection modules. If any of the first monitoring process and the second monitoring process does not receive the heartbeat signal of the other monitoring process within a preset time period, it is determined that the other monitoring process has failed, and a fault notification message used to characterize the failure of the other monitoring process is sent to the fault management module in the controller monitoring layer, so that when the fault management module in the controller monitoring layer receives the fault notification message, it increments the current fault occurrence count by one to obtain a new current fault occurrence count, and determines whether the current fault occurrence count is greater than the preset count; if the current fault occurrence count is greater than the preset count, the system reset module in the controller monitoring layer is called to perform a reset operation; if the current fault occurrence count is not greater than the preset count, the other monitoring process is protected based on the security protection method corresponding to the other monitoring process; wherein, when the other monitoring process is the first monitoring process, the security protection method is to protect the first monitoring process based on the standby process, and when the other monitoring process is the second monitoring process, the security protection method is to protect the second monitoring process based on the checkpoint.

[0080] In summary, the present application distinguishes between a first monitoring process that processes critical data and a second monitoring process that processes non-critical data at the functional monitoring layer, and adopts a standby process that backs up the process state of the first monitoring process for security protection of the first monitoring process. Since the real-time performance of the process state backup between the first monitoring process and the standby process is high, the security and reliability of the protection of the first monitoring process can be improved through the master-slave mechanism; further, the present application adopts a checkpoint that can tolerate certain errors for the second monitoring process, thereby achieving security protection of the second monitoring process through the checkpoint fault-tolerant mechanism without introducing other processes, that is, achieving security protection of the second monitoring process while controlling the security protection cost; in this way, the present application achieves differentiated protection of the first monitoring process and the second monitoring process through the master-slave mechanism and the fault-tolerant mechanism, which can not only control the security protection cost, but also improve the security and reliability of the monitoring process in the functional monitoring layer, thereby achieving security protection of the running system.

[0081] It can be seen that the present application distinguishes the categories of data processed by the running system, and when the data processed by the running system is critical data, the security protection of the running system is achieved by backing up the running system, wherein the backup method has high real-time performance and good security, and when the data processed by the running system is non-critical data, the handshake information of the running system is used to achieve security protection of the running system without introducing other processes, thereby achieving differentiated protection of the running system according to the category of data processed by the running system, so as to improve the security and reliability of the running system while controlling the security protection cost.

[0082] See also Figure 3 As shown, an embodiment of the present invention discloses a safety protection device for a running system, comprising:

[0083] A security protection module 11 is used to perform different security protections on the operating system according to the types of data processed by the operating system; the types of data include critical data and non-critical data;

[0084] A backup protection module 12, for protecting the operating system by backing up the operating system if the data processed by the operating system is critical data;

[0085] The handshake protection module 13 is used to perform security protection on the operating system according to the handshake information of the operating system if the data processed by the operating system is non-critical data.

[0086] It can be seen that the present application distinguishes the categories of data processed by the running system, and when the data processed by the running system is critical data, the security protection of the running system is achieved by backing up the running system, wherein the backup method has high real-time performance and good security, and when the data processed by the running system is non-critical data, the handshake information of the running system is used to achieve security protection of the running system without introducing other processes, thereby achieving differentiated protection of the running system according to the category of data processed by the running system, so as to improve the security and reliability of the running system while controlling the security protection cost.

[0087] In some specific embodiments, the backup protection module 12 includes:

[0088] The backup submodule is used to back up the process state of the first monitoring process that processes key data in the running system to the backup process in the running system, so as to perform security protection on the first monitoring process based on the backup process.

[0089] In some specific embodiments, the backup submodule includes:

[0090] A first process protection unit, configured to perform security protection on the first monitoring process based on the target process state stored in the standby process when the first monitoring process fails;

[0091] The target process state is the process state of the first monitoring process backed up to the standby process before a failure occurs.

[0092] In some specific embodiments, the first process protection unit includes:

[0093] A process configuration unit, configured to kill the first monitoring process based on the standby process, configure itself as a new first monitoring process using the target process state, and create a corresponding new standby process;

[0094] A process recovery unit is used to recover the first monitoring process based on the target process state stored in the standby process.

[0095] In some specific embodiments, the handshake protection module 13 includes:

[0096] The second process protection unit is used to perform security protection on the second monitoring process according to the handshake information between the first monitoring process that processes critical data and the second monitoring process that processes non-critical data in the running system.

[0097] In some specific embodiments, the second process protection unit includes:

[0098] a checkpoint recovery unit, configured to determine that a failure occurs in the second monitoring process when the first monitoring process does not receive the handshake information sent by the second monitoring process, and to recover the second monitoring process based on the process state of the second monitoring process recorded in advance at a target checkpoint;

[0099] The target checkpoint is a checkpoint generated by the second monitoring process based on its own process state before the failure occurs.

[0100] In some specific embodiments, the safety protection device of the operating system further includes:

[0101] The reset unit is used to count the number of faults that occur during the monitoring process, and trigger a reset operation on the running system when the number of faults that occur reaches a corresponding preset number.

[0102] Furthermore, the present application also discloses an electronic device. Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0103] Figure 4 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the security protection method for the operating system disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0104] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0105] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0106] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the security protection method of the operating system executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0107] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed operating system security protection method. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0108] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0109] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0110] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0111] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0112] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A security protection method for a running system, characterized in that: include: Providing different security protections to the operating system according to the types of data processed by the operating system; The categories of said data include critical data and non-critical data; If the data processed by the operating system is critical data, the operating system is protected by backing up the operating system; If the data processed by the operating system is non-critical data, security protection is performed on the operating system according to the handshake information of the operating system.

2. The security protection method for the operating system according to claim 1, characterized in that: The method of performing security protection on the operating system by backing up the operating system includes: The first monitoring process that processes key data in the running system backs up its own process state to a backup process in the running system, so as to perform security protection on the first monitoring process based on the backup process.

3. The security protection method for the operating system according to claim 2, characterized in that: The performing security protection on the first monitoring process based on the standby process includes: When the first monitoring process fails, security protection is performed on the first monitoring process based on the target process state stored in the standby process; The target process state is the process state of the first monitoring process backed up to the standby process before a failure occurs.

4. The security protection method for the operating system according to claim 3, characterized in that: The performing security protection on the first monitoring process based on the target process state stored in the standby process includes: Killing the first monitoring process based on the standby process, configuring itself as a new first monitoring process using the target process state, and creating a corresponding new standby process; Or, the first monitoring process is restored based on the target process state stored in the standby process.

5. The security protection method for the operating system according to claim 1, characterized in that: The performing security protection on the running system according to the handshake information of the running system includes: According to the handshake information between the first monitoring process processing critical data and the second monitoring process processing non-critical data in the running system, security protection is performed on the second monitoring process.

6. The security protection method for the operating system according to claim 5, characterized in that: The step of performing security protection on the second monitoring process according to the handshake information between the first monitoring process processing critical data and the second monitoring process processing non-critical data in the running system includes: When the first monitoring process does not receive the handshake information sent by the second monitoring process, determining that the second monitoring process fails, and restoring the second monitoring process based on the process state of the second monitoring process recorded in advance at the target checkpoint; The target checkpoint is a checkpoint generated by the second monitoring process based on its own process state before the failure occurs.

7. The safety protection method for the operating system according to claim 3 or 6, characterized in that: Also includes: The number of fault occurrences of the monitoring process is counted, and when the number of fault occurrences reaches a corresponding preset number, a reset operation for the running system is triggered.

8. A safety protection device for a running system, characterized in that: include: A security protection module, used to perform different security protections on the operating system according to the type of data processed by the operating system; The categories of said data include critical data and non-critical data; A backup protection module, used for protecting the operating system by backing up the operating system if the data processed by the operating system is critical data; The handshake protection module is used to perform security protection on the operating system according to the handshake information of the operating system if the data processed by the operating system is non-critical data.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the security protection method for the operating system as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the security protection method for an operating system as described in any one of claims 1 to 7.

Images