Safety protection method, device and equipment of operation system and medium

Abstract

The invention discloses a safety protection method and device for an operation system, equipment and a medium, and relates to the field of functional safety protection, and the method comprises the steps: obtaining target information of the operation system; inputting the target information to at least two monitoring processes, and obtaining corresponding monitoring results; if the monitoring result accords with a preset rule, it is represented that the operation system is normal; if the monitoring result does not accord with the preset rule, inputting the target information to a judgment process, and obtaining a corresponding judgment result; and determining whether the operation system is normal according to the monitoring result and the judgment result. According to the method and the device, a plurality of monitoring processes and judgment processes are introduced into the operation system to process the target information of the operation system, so that whether the operation system is normal or not is finally determined, and the safety protection of the operation system is better realized by improving the reliability and the safety of processing the target information.

Description

Technical Field

[0001] The present invention relates to the field of functional safety protection, and in particular to a safety protection method, device, equipment and medium for an operating system. Background Art

[0002] With the accelerated popularization and application of automobile electrification and intelligence, the electronic and electrical architecture of automobiles has become increasingly complex. At the same time, it also puts higher reliability and safety requirements on the safety protection of operating systems that adopt the automotive functional safety architecture to improve the safety of automobile driving.

[0003] In the security protection scheme of the running system, the E-GAS three-layer architecture (a three-layer electronic monitoring architecture for power domain system design) is usually used for layered design. The first layer is the business implementation layer, which is mainly used to obtain business information. The second layer is the functional monitoring layer, which is mainly used to process the business information of the first layer to realize the monitoring and error detection of the first layer. The third layer is the controller monitoring layer, which usually uses additional reliable hardware, such as watchdog chips, CPU (Central Processing Unit) / RAM (Random Access Memory) / ROM (Read-Only Memory) fault detection modules, etc., to realize error detection and whole system recovery when errors occur in the second layer. Among them, the second layer (functional monitoring layer) in the running system is implemented as software, and the processing of business information is prone to reliability and security problems. If errors occur in the processing of business information, it is very easy to cause system-level failures in the running system; therefore, how to achieve security protection for the running system is currently a problem that needs to be optimized. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for security protection of a running system, which can introduce multiple monitoring processes and referee processes in the running system to process the target information of the running system, so as to finally determine whether the running system is normal, and improve the reliability and security of processing the target information to better achieve security protection of the running system. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a security protection method for an operating system, comprising:

[0006] Get target information of running system;

[0007] Inputting the target information into at least two monitoring processes, and obtaining corresponding monitoring results;

[0008] If the monitoring result meets the preset rules, it indicates that the operating system is normal; if the monitoring result does not meet the preset rules, the target information is input into the referee process and the corresponding referee result is obtained;

[0009] Determine whether the operating system is normal according to the monitoring result and the judgment result.

[0010] Optionally, after obtaining the corresponding monitoring result, the step further includes:

[0011] A first voting operation is performed on each of the monitoring results through the at least two monitoring processes respectively, and it is determined whether the monitoring result complies with a preset rule based on a first voting result obtained after the first voting operation.

[0012] Optionally, the first voting operation is an operation of determining the first voting result based on the most identical monitoring results among the monitoring results when the voting has not timed out;

[0013] Accordingly, determining whether the monitoring result complies with a preset rule based on the first voting result obtained after the first voting operation includes:

[0014] Determine whether the monitoring result complies with a preset rule based on the most identical voting results in the first voting results.

[0015] Optionally, determining whether the operating system is normal according to the monitoring result and the referee result includes:

[0016] A second voting operation is performed on each of the monitoring results and the referee result through the at least two monitoring processes, and whether the operating system is normal is determined based on a second voting result obtained after the second voting operation.

[0017] Optionally, the second voting operation is an operation of determining the second voting result based on the most identical results among the monitoring results and the referee results;

[0018] Accordingly, determining whether the operating system is normal based on the second voting result obtained after the second voting operation includes:

[0019] Whether the operating system is normal is determined based on the most identical voting results among the second voting results.

[0020] Optionally, the security protection method for the operating system further includes:

[0021] After acquiring the target information of the operating system, calculating a first check code for the target information;

[0022] Inputting the first check code and the target information into a data daemon process, so as to calculate a second check code for the target information through the data daemon process, and inputting the target information into any process based on a check result between the first check code and the second check code;

[0023] Wherein, any of the processes includes the monitoring process and / or the refereeing process.

[0024] Optionally, the security protection method for the operating system further includes:

[0025] If it is determined that the operating system is abnormal according to the monitoring result and the referee result, a reset operation is performed on the operating system.

[0026] In a second aspect, the present application provides a safety protection device for an operating system, comprising:

[0027] A target information acquisition module is used to acquire target information of the running system;

[0028] A monitoring result acquisition module, used to input the target information into at least two monitoring processes and obtain corresponding monitoring results;

[0029] A referee result acquisition module, for indicating that the operating system is normal if the monitoring result meets the preset rules; if the monitoring result does not meet the preset rules, inputting the target information into the referee process and acquiring the corresponding referee result;

[0030] The system status determination module is used to determine whether the operating system is normal according to the monitoring result and the judgment result.

[0031] In a third aspect, the present application provides an electronic device, including:

[0032] Memory, used to store computer programs;

[0033] A processor is used to execute the computer program to implement the aforementioned security protection method for the operating system.

[0034] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the aforementioned security protection method for the operating system.

[0035] In the present application, the target information of the operating system is obtained; the target information is input into at least two monitoring processes, and the corresponding monitoring results are obtained; if the monitoring results meet the preset rules, it indicates that the operating system is normal; if the monitoring results do not meet the preset rules, the target information is input into the referee process, and the corresponding referee results are obtained; whether the operating system is normal is determined based on the monitoring results and the referee results. It can be seen that the present application introduces multiple monitoring processes and referee processes into the operating system, so that when the monitoring results of the target information of the operating system by multiple monitoring processes do not meet the preset rules, the referee process is added to referee the target information of the operating system, so as to finally determine whether the operating system is normal based on the referee results and the monitoring results; in this way, the present application introduces multiple monitoring processes and referee processes into the operating system to improve the reliability and security of processing the target information, so as to better realize the security protection of the operating system. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 A flow chart of a security protection method for an operating system disclosed in this application;

[0038] Figure 2 A security protection architecture diagram of an operating system disclosed in this application;

[0039] Figure 3 A schematic diagram of the structure of a safety protection device for an operating system disclosed in this application;

[0040] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] The second layer (functional monitoring layer) in the operating system is implemented as software, and the processing of business information is prone to reliability and security issues. If errors occur in the processing of business information, it is very easy to cause system-level failures in the operating system. To this end, the present application provides a security protection method for an operating system, which introduces multiple monitoring processes and referee processes in the operating system to process the target information of the operating system, thereby ultimately determining whether the operating system is normal, and improving the reliability and security of processing the target information to better achieve security protection of the operating system. .

[0043] See also Figure 1 As shown, an embodiment of the present invention discloses a security protection method for a running system, including:

[0044] Step S11, obtaining target information of the running system.

[0045] In the embodiment of the present invention, for the security protection of the operating system, it is first necessary to obtain the target information of the operating system during the operation of the operating system. Specifically, taking the operating system as an automobile operating system using the E-GAS three-layer architecture as an example, the operating system at this time can obtain the target information of the operating system through the business implementation layer.

[0046] The target information of the operating system includes, but is not limited to, the business information and operation information of the operating system. The business information may be the driving information of each business driver or the peripheral information input by an external device; and the external device includes, but is not limited to, sensors, storage devices, codec chips, etc. The operation information may be the operation information of the electronic device connected to the operating system or the operation information of the electronic device inside the operating system.

[0047] Taking the automobile operating system that adopts the E-GAS three-layer architecture as an example, each business driver is located in the business implementation layer of the operating system, and the business information may include environmental information collected during the driving of the car, request information for planning the driving route of the car based on the environmental information, etc.; the operating information may include the operating information of the engine, electronic throttle, etc.

[0048] Step S12: input the target information into at least two monitoring processes, and obtain corresponding monitoring results.

[0049] In an embodiment of the present invention, the operating system inputs the target information into at least two monitoring processes, so that the target information is processed by the at least two monitoring processes respectively, and corresponding monitoring results are obtained. Specifically, taking the operating system as an automobile operating system adopting the E-GAS three-layer architecture as an example, the operating system obtains the target information of the operating system through the business implementation layer, and inputs the target information into at least two monitoring processes in the functional monitoring layer to obtain corresponding monitoring results.

[0050] The processing of the target information by the monitoring process depends on the processing function configured in the functional monitoring layer. For example, when the processing function is used to monitor whether the target information is legal, the corresponding monitoring results can be the target information is legal and the target information is illegal; when the processing function is used to monitor whether the target information is available, the corresponding monitoring results can be the target information is available and the target information is unavailable. It should be noted that when processing the target information, if the processing function used is a Boolean function, the corresponding monitoring results can be true and false.

[0051] Moreover, the processing of target information by each monitoring process in the functional monitoring layer corresponds to the same processing function, such as monitoring whether the target information is legal, but each monitoring process can use the same processing flow or processing method to process the target information, or different processing flows or processing methods. For example, monitoring process 1 uses processing method 1 (such as CRC check) to monitor whether the target information is legal, and monitoring process 2 uses processing method 2 (such as ECC check or hash check) to monitor whether the target information is legal. Although monitoring process 1 and monitoring process 2 use different processing methods, they have the same processing function. Accordingly, the monitoring results of monitoring process 1 and monitoring process 2 are both that the target information is legal or that the target information is illegal.

[0052] Step S13: If the monitoring result meets the preset rules, it indicates that the operating system is normal; if the monitoring result does not meet the preset rules, the target information is input into the referee process and the corresponding referee result is obtained.

[0053] In an embodiment of the present invention, when the operating system obtains the monitoring results corresponding to at least two monitoring processes, it is necessary to further determine whether the monitoring results comply with the preset rules. If the monitoring results comply with the preset rules, it indicates that the operating system is normal; if the monitoring results do not comply with the preset rules, the target information is input into the referee process in the operating system so that the target information is processed by the referee process and the corresponding referee result is obtained.

[0054] Taking the automobile operating system with the E-GAS three-layer architecture as an example, when the operating system obtains the monitoring results corresponding to at least two monitoring processes in the functional monitoring layer, if the monitoring results do not meet the preset rules, the operating system inputs the target information into the judgment process in the functional monitoring layer and obtains the corresponding judgment results.

[0055] Among them, as to whether the monitoring results comply with the preset rules, at least two monitoring processes can perform a first voting operation on each monitoring result respectively, and determine whether the monitoring results comply with the preset rules based on the first voting results obtained after the first voting operation.

[0056] It should be noted that the first voting operation is an operation to determine the first voting result based on the most identical monitoring results among the monitoring results when the voting has not timed out, that is, the first voting operation may or may not obtain the first voting result. Therefore, for determining whether the monitoring result complies with the preset rules based on the first voting result obtained after the first voting operation, it specifically includes determining whether the monitoring result complies with the preset rules based on the most identical voting results among the first voting results, and it can also be determined whether the monitoring result complies with the preset rules based on whether the number of the most identical voting results among the first voting results obtained after the first voting operation is greater than the preset number. Among them, if the number of the most identical voting results among the first voting results is greater than the preset number, it is determined that the monitoring result complies with the preset rules; if the number of the most identical voting results among the first voting results is not greater than the preset number, it is determined that the monitoring result does not comply with the preset rules.

[0057] In addition, the first voting operation can also be used as an operation to determine the first voting result based on the maximum number of identical monitoring results among all monitoring results. Accordingly, whether the monitoring result complies with the preset rules is determined based on the first voting result obtained after the first voting operation, including: whether the number of the maximum number of identical voting results in the first voting result is greater than the preset number; wherein any monitoring process that has timed out does not generate a voting result; if the number of the maximum number of identical voting results in the first voting result is greater than the preset number, then it is determined that the monitoring result complies with the preset rules; if the number of the maximum number of identical voting results in the first voting result is not greater than the preset number, then it is determined that the monitoring result does not comply with the preset rules.

[0058] It should be noted that the preset number is a preset ratio of the total number of monitoring processes, and the maximum number of identical monitoring results mentioned in the first voting operation also needs to be greater than the preset number. The preset ratio can be set according to the actual demand for voting correctness. The demand for voting correctness is directly proportional to the size of the preset ratio, that is, the higher the demand for voting correctness, the larger the preset ratio; in general, the preset ratio can be set to one-half.

[0059] For example, when the total number of monitoring processes is four and the preset ratio is one-half, the preset number is two. If the four monitoring results obtained by processing the target information through the four monitoring processes are A, A, A, and B, since the number of the most identical monitoring results A among A, A, A, and B is greater than two, the first voting result can be determined to be A based on the most identical monitoring results A among the four monitoring results. If the four monitoring results obtained by processing the target information through the four monitoring processes are A, A, B, and B, since the number of the most identical monitoring results A among A, A, B, and B is equal to two, the first voting result cannot be determined based on the most identical monitoring results among the four monitoring results; wherein, if a monitoring process times out, it outputs flase or 0 or is not counted in the voting result.

[0060] Furthermore, for the voting not timed out mentioned in the first voting operation, in the process of processing the target information by each monitoring process respectively, if one monitoring process generates a monitoring result, the voting timer is started, and when the current timing of the voting timer reaches the preset duration, or when the current timing of the voting timer does not reach the preset duration but each monitoring process has determined the corresponding first voting result based on its own first voting operation, the voting timer is ended, and the first voting operation of each monitoring process is ended at the same time, and the voting timer is cleared, and then based on the first voting result obtained when the voting does not time out, it is determined whether the monitoring result meets the preset rules. Furthermore, the start of the voting timer can also be set when each monitoring process starts to process the target information respectively, and can also be set when each monitoring process starts to perform the first voting operation on multiple monitoring results respectively. Of course, other times can also be selected, and no more examples are given here.

[0061] For the first voting operation, more specifically, after each monitoring process receives the target information, each monitoring process processes the target information, stores the generated monitoring results in a local voting buffer, and outputs and stores the generated monitoring results in the voting buffers of other monitoring processes. After each monitoring process completes processing the target information, each monitoring process performs a first voting operation on the multiple monitoring results stored in its own voting buffer, and determines whether the monitoring results meet the preset rules based on whether the maximum number of identical voting results in the first voting results obtained after the first voting operation is greater than a preset number.

[0062] Since the first voting operation may or may not obtain the first voting result based on the condition that the maximum number of identical monitoring results in each monitoring result should be greater than a preset number, each monitoring process needs to output a voting failure notification message indicating that the first voting result has not been generated or a voting success notification message containing its own first voting result to other monitoring processes, so that any monitoring process can determine whether the monitoring result complies with the preset rules based on whether the maximum number of identical voting results in the first voting results of itself and / or other monitoring processes is greater than a preset number.

[0063] If the monitoring result meets the preset rules, it indicates that the operating system is normal, and the final voting result determined based on the maximum number of identical voting results greater than the preset number in the first voting result can be output to an external device. If the monitoring result does not meet the preset rules, it indicates that the operating system may be abnormal. At this time, it is necessary to further call the referee process to process the target information to obtain the corresponding referee result, so as to finally determine whether the operating system is normal based on the monitoring result and the referee result.

[0064] Before calling the referee process to process the target information, the referee process needs to be awakened first. The referee process can be awakened by any monitoring process, and after waking up the referee process, the referee process is called to process the target information.

[0065] Furthermore, in order to improve the reliability and security of the target information, the present invention can calculate a first verification code for the target information after acquiring the target information of the operating system, and input the first verification code and the target information into a data daemon process in the operating system, so as to calculate a second verification code for the target information through the data daemon process, and input the target information into a monitoring process or a referee process based on the verification result between the first verification code and the second verification code.

[0066] Among them, if the verification result indicates that the first verification code and the second verification code are consistent, the target information is directly transmitted to the monitoring process or the referee process; if the verification result indicates that the first verification code and the second verification code are inconsistent, the target information is corrected based on the inconsistent binary bits in the first verification code and the second verification code, and the corrected target information is transmitted to the monitoring process or the referee process. In this way, the present invention introduces a data daemon process to determine whether the target information is correct by means of a verification code, and can also correct the target information if it is incorrect, thereby ensuring the correctness of the target information, so as to improve the reliability and security of the subsequent monitoring process and the referee process in processing the target information.

[0067] Furthermore, before the target information is processed by the monitoring process to generate the monitoring result, the third check code of the target information can be calculated by the monitoring process, and the target information can be judged whether it is currently correct based on the check result between the first check code and the third check code. Correspondingly, after the target information is processed by the monitoring process to generate the monitoring result, the fourth check code of the target information can also be calculated by the monitoring process, and the target information can be judged whether it is currently correct based on the check result between the first check code and the fourth check code. In this way, the present invention calculates the check code for the target information before and after the target information is processed by the monitoring process, so as to use the check code to judge whether the target information is correct and has no errors, thereby improving the reliability and security of the voting operation by improving the reliability and security of the target information, and then more accurately determining whether the operating system is normal.

[0068] The calculation of the check code does not limit the specific check algorithm, for example, parity check, CRC (Cyclic Redundancy Check), ECC (Error Checking and Correcting), etc. may be used; and the check code obtained by calculating the target information using the check algorithm is a binary number.

[0069] Step S14: Determine whether the operating system is normal according to the monitoring result and the referee result.

[0070] In the embodiment of the present invention, after obtaining the referee result, at least two monitoring processes respectively perform a second voting operation on each monitoring result and the referee result, and determine whether the operating system is normal based on the second voting result obtained after the second voting operation. In this way, when the monitoring result is determined to be inconsistent with the preset rule based on the monitoring process, the present invention further calls the referee process to add the referee result on the basis of the monitoring result to finally determine whether the operating system is normal, thereby improving the accuracy of monitoring whether the operating system is normal.

[0071] Specifically, after obtaining the corresponding judgment results, the judgment process needs to first output and store the judgment results in the voting buffer of each monitoring process respectively, and then at least two monitoring processes perform a second voting operation on the monitoring results and judgment results stored in their respective voting buffers, and determine whether the operating system is normal based on the second voting result obtained after the second voting operation.

[0072] The second voting operation is an operation of determining the second voting result based on the most identical results in each monitoring result and the referee result, specifically including determining whether the operating system is normal based on the most identical voting results in the second voting result, and also determining whether the operating system is normal based on whether the number of the most identical voting results in the second voting result obtained after the second voting operation is greater than a preset number. If the number of the most identical voting results in the second voting result is greater than the preset number, it is determined that the operating system is normal; if the number of the most identical voting results in the second voting result is not greater than the preset number, it is determined that the operating system is abnormal. In addition, the number of the most identical results in each monitoring result and the referee result should be greater than the preset ratio of the total number of monitoring processes and referee processes.

[0073] Taking the example of one refereeing process, four monitoring processes and a preset ratio of one-half, if the refereeing result is A, and multiple monitoring results are A, A, B, B, since the number of the most identical results A among A, A, A, B, B is greater than the preset ratio of the total number of monitoring processes and refereeing processes, that is, the number of the most identical results A is greater than 2.5, it can be determined that the second voting result is also A based on the refereeing result and the most identical results A among multiple monitoring results.

[0074] Since the second voting operation may or may not obtain the second voting result under the condition that the maximum number of identical results in each monitoring result and the refereeing result should be greater than the preset ratio of the total number of monitoring processes and refereeing processes, each monitoring process needs to output a voting failure notification message indicating that the second voting result has not been generated or a voting success notification message containing its own second voting result to other monitoring processes, so that any monitoring process can determine whether the operating system is normal based on whether the maximum number of identical voting results in the second voting results of itself and / or other monitoring processes is greater than the preset number.

[0075] If the number of the most identical voting results in the second voting result is greater than a preset number, it is determined that the operating system is normal, and the final voting result determined based on the most identical voting results in the second voting result is output to an external device. If the number of the most identical voting results in the second voting result is not greater than a preset number, it is determined that the operating system is abnormal, and a reset operation for the operating system is performed.

[0076] Furthermore, when it is determined that the operating system is abnormal, the cause of the failure of the operating system can be determined by checking the monitoring process that failed to vote. In one case, if the monitoring process that failed to vote is checked and it is found that the voting failure is caused by abnormal target information, then the cause of the failure of the operating system at this time is abnormal data flow; in another case, if the monitoring process that failed to vote is checked and it is found that the voting failure is caused by voting timeout, and the voting timeout is caused by the abnormality of the monitoring process itself, then the cause of the failure of the operating system at this time is control flow abnormality. In this way, compared with the software watchdog that can only detect control flow abnormalities when determining whether the operating system is normal, the scheme of the present invention can simultaneously realize the abnormality detection of data flow and control flow.

[0077] Taking the operating system as an example of an automobile operating system using the E-GAS three-layer architecture, for the reset operation of the operating system, when it is determined that the operating system is abnormal, a fault notification message can be sent to the controller monitoring layer in the operating system so that the controller monitoring layer performs the reset operation. In this way, the present invention can determine whether the operating system is normal through the monitoring process and the referee process in the functional monitoring layer, and the controller monitoring layer only needs to perform the reset operation. Compared with the monitoring of whether the operating system is normal through the reliable hardware in the controller monitoring layer, the controller monitoring layer can reduce the demand and use of hardware, and the use of hardware generally requires greater power consumption. Therefore, the cost and power consumption required by the functional monitoring layer can be reduced through the present invention.

[0078] Take the functional monitoring layer of the running system as an example, which contains two monitoring processes and one referee process. Figure 2 As shown, the business implementation layer in the running system obtains the target information generated by the business driver or the target information input by the external device, calculates the first check code for the target information, and sends the target information and the first check code to the data daemon process in the functional monitoring layer. After receiving the target information and the first check code, the data daemon process calculates the second check code for the target information through its own check module, and transmits the target information to the first monitoring process and the second monitoring process in the functional monitoring layer based on the check result between the first check code and the second check code.

[0079] After receiving the target information, the first monitoring process and the second monitoring process process the target information respectively, and when one of the monitoring processes generates a corresponding monitoring result, stores the monitoring result in a local voting buffer, and outputs and stores the monitoring result in the voting buffer of the other monitoring process, the first monitoring process and the second monitoring process start the voting timer through their respective timing modules. Further, when two monitoring results are stored in the voting buffers of the first monitoring process and the second monitoring process, the first monitoring process and the second monitoring process respectively perform a first voting operation on the two monitoring results through their respective distributed voting modules, wherein the first voting operation is an operation of determining the first voting result based on the most identical monitoring results greater than 1 in the two monitoring results when the voting is not timed out. Then, when the current timing of the voting timer reaches the preset duration, or when the current timing of the voting timer does not reach the preset duration but the first monitoring process and the second monitoring process respectively determine the corresponding first voting result based on their respective first voting operations, the voting timer ends and the voting timer is cleared, and at the same time, it can also be determined whether the monitoring result meets the preset rules based on the first voting result obtained after the first voting operation.

[0080] The operating system also includes a synchronization module, and each monitoring process outputs its voting results to any other monitoring process through the synchronization module to improve the reliability of the voting results. Since the first monitoring process and the second monitoring process may not both be able to determine the corresponding first voting result based on the first voting operation without timing out, the first monitoring process and the second monitoring process can both output a voting failure notification message representing that the first voting result has not been generated or a voting success notification message containing their own first voting results to another monitoring process through the synchronization module, so that the first monitoring process and the second monitoring process can both determine whether the monitoring results comply with preset rules based on whether the maximum number of identical voting results in their own and / or another monitoring process's first voting results is greater than 1.

[0081] If the monitoring result meets the preset rules, the final voting result determined based on the most identical voting results in the first voting results is output to an external device through the first monitoring process or the second monitoring process. If the monitoring result does not meet the preset rules, the referee process in the functional monitoring layer is awakened through the first monitoring process or the second monitoring process, and the target information is obtained from the data daemon process through the referee process, and the target information is processed to obtain the referee result, and then the referee result is output and stored in the voting buffers of the first monitoring process and the second monitoring process respectively.

[0082] Afterwards, the first monitoring process and the second monitoring process each perform a second voting operation based on the judgment result and the two monitoring results stored in their respective voting buffers, wherein the second voting operation is an operation for determining the second voting result based on the judgment result and the most identical results greater than 1.5 of the two monitoring results, and then determining whether the operating system is normal based on the second voting result obtained after the second voting operation.

[0083] Similarly, since the first monitoring process and the second monitoring process may not both be able to determine the corresponding second voting result based on the second voting operation, the first monitoring process and the second monitoring process can both output a voting failure notification message indicating that the second voting result has not been generated or a voting success notification message containing their own second voting result to another monitoring process through a synchronization module, so that the first monitoring process and the second monitoring process can both determine whether the operating system is normal based on whether the maximum number of identical voting results in their own and / or another monitoring process's second voting results is greater than 1.

[0084] If the operating system is normal, the final voting result determined based on the most identical voting results in the second voting results is output to the external device through the first monitoring process or the second monitoring process. If the operating system is abnormal, a fault notification message is sent to the controller monitoring layer through the first monitoring process or the second monitoring process, so that the controller monitoring layer performs a reset operation through its own misalignment reset module.

[0085] In summary, since time redundancy processes the target information serially through multiple processes in the running system, and sends the processing results to the same process for centralized voting to determine whether the running system is normal, time redundancy will bring about the problem of longer time consumption and low reliability of centralized voting; since space redundancy processes the target information in parallel through more processes in the running system, and sends the processing results to the same process for centralized voting to determine whether the running system is normal, space redundancy will bring about the problem of large performance consumption and low reliability of centralized voting. The present invention processes the target information respectively through multiple monitoring processes, and performs voting operations on the multiple monitoring results obtained by processing through multiple monitoring processes, thereby determining whether the running system is normal through distributed voting. Compared with centralized voting of time redundancy and space redundancy, the reliability of voting can be greatly improved, and the serial processing of time redundancy can significantly reduce time consumption and improve the real-time performance of voting. Compared with the large number of processes required for space redundancy, the present invention only needs at least two monitoring processes and one referee process to achieve normal monitoring of the running system, reducing the performance consumption required for monitoring.

[0086] It can be seen that the present application introduces multiple monitoring processes and referee processes in the running system, so that when the monitoring results of the target information of the running system by multiple monitoring processes do not meet the preset rules, a referee process is added to judge the target information of the running system, so as to finally determine whether the running system is normal according to the judgment results and monitoring results; in this way, the present application introduces multiple monitoring processes and referee processes in the running system to improve the reliability and security of processing the target information, so as to better realize the security protection of the running system.

[0087] See also Figure 3 As shown, an embodiment of the present invention discloses a safety protection device for a running system, comprising:

[0088] The target information acquisition module 11 is used to acquire the target information of the running system;

[0089] A monitoring result acquisition module 12, used to input the target information into at least two monitoring processes and obtain corresponding monitoring results;

[0090] The referee result acquisition module 13 is used to indicate that the operating system is normal if the monitoring result meets the preset rules; if the monitoring result does not meet the preset rules, the target information is input into the referee process and the corresponding referee result is obtained;

[0091] The system status determination module 14 is used to determine whether the operating system is normal according to the monitoring result and the judgment result.

[0092] It can be seen that the present application introduces multiple monitoring processes and referee processes in the running system, so that when the monitoring results of the target information of the running system by multiple monitoring processes do not meet the preset rules, a referee process is added to judge the target information of the running system, so as to finally determine whether the running system is normal according to the judgment results and monitoring results; in this way, the present application introduces multiple monitoring processes and referee processes in the running system to improve the reliability and security of processing the target information, so as to better realize the security protection of the running system.

[0093] In some specific embodiments, the safety protection device of the operating system further includes:

[0094] The first voting module is used to perform a first voting operation on each of the monitoring results through the at least two monitoring processes, and determine whether the monitoring result complies with a preset rule based on a first voting result obtained after the first voting operation.

[0095] In some specific embodiments, the first voting operation is an operation of determining the first voting result based on the most identical monitoring results among the monitoring results when the voting has not timed out;

[0096] Accordingly, the first voting module includes:

[0097] A monitoring result determination unit is used to determine whether the monitoring result complies with a preset rule based on the most identical voting results in the first voting results.

[0098] In some specific embodiments, the system state determination module 14 includes:

[0099] The second voting module is used to perform a second voting operation on each of the monitoring results and the judgment results through the at least two monitoring processes, and determine whether the operating system is normal based on the second voting result obtained after the second voting operation.

[0100] In some specific embodiments, the second voting operation is an operation of determining the second voting result based on the most identical results among the monitoring results and the referee results;

[0101] Accordingly, the second voting module includes:

[0102] A system status determination unit is used to determine whether the operating system is normal based on the most identical voting results in the second voting results.

[0103] In some specific embodiments, the safety protection device of the operating system further includes:

[0104] A check code calculation unit, configured to calculate a first check code for the target information after acquiring the target information of the operating system;

[0105] An information input unit is used to input the first verification code and the target information into a data daemon process, so as to calculate a second verification code for the target information through the data daemon process, and input the target information into any process based on the verification result between the first verification code and the second verification code; wherein, any process includes the monitoring process and / or the referee process.

[0106] In some specific embodiments, the safety protection device of the operating system further includes:

[0107] A reset unit is used to perform a reset operation on the operating system if it is determined that the operating system is abnormal according to the monitoring result and the referee result.

[0108] Furthermore, the present application also discloses an electronic device. Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0109] Figure 4 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the security protection method for the operating system disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0110] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0111] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0112] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the security protection method of the operating system executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0113] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed operating system security protection method. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0114] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0115] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0116] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0117] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0118] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A security protection method for a running system, characterized in that: include: Get target information of running system; Inputting the target information into at least two monitoring processes, and obtaining corresponding monitoring results; If the monitoring result meets the preset rules, it indicates that the operating system is normal; If the monitoring result does not meet the preset rules, the target information is input into the referee process and the corresponding referee result is obtained; Determine whether the operating system is normal according to the monitoring result and the judgment result.

2. The security protection method for the operating system according to claim 1, characterized in that: After obtaining the corresponding monitoring result, the method further includes: A first voting operation is performed on each of the monitoring results through the at least two monitoring processes respectively, and it is determined whether the monitoring result complies with a preset rule based on a first voting result obtained after the first voting operation.

3. The security protection method for the operating system according to claim 2, characterized in that: The first voting operation is an operation of determining the first voting result based on the most identical monitoring results among the monitoring results when the voting is not timed out; Accordingly, determining whether the monitoring result complies with a preset rule based on the first voting result obtained after the first voting operation includes: Determine whether the monitoring result complies with a preset rule based on the most identical voting results in the first voting results.

4. The security protection method for the operating system according to claim 1, characterized in that: The determining whether the operating system is normal according to the monitoring result and the referee result includes: A second voting operation is performed on each of the monitoring results and the referee result through the at least two monitoring processes, and whether the operating system is normal is determined based on a second voting result obtained after the second voting operation.

5. The security protection method for the operating system according to claim 4, characterized in that: The second voting operation is an operation of determining the second voting result based on the most identical results among the monitoring results and the referee results; Accordingly, determining whether the operating system is normal based on the second voting result obtained after the second voting operation includes: Whether the operating system is normal is determined based on the most identical voting results among the second voting results.

6. The security protection method for the operating system according to claim 1, characterized in that: Also includes: After acquiring the target information of the operating system, calculating a first check code for the target information; Inputting the first check code and the target information into a data daemon process, so as to calculate a second check code for the target information through the data daemon process, and inputting the target information into any process based on a check result between the first check code and the second check code; Wherein, any of the processes includes the monitoring process and / or the refereeing process.

7. The method for protecting the operating system according to any one of claims 1 to 6, characterized in that: Also includes: If it is determined that the operating system is abnormal according to the monitoring result and the referee result, a reset operation is performed on the operating system.

8. A safety protection device for a running system, characterized in that: include: A target information acquisition module is used to acquire target information of the running system; A monitoring result acquisition module, used to input the target information into at least two monitoring processes and obtain corresponding monitoring results; A referee result acquisition module, used to indicate that the operating system is normal if the monitoring result meets the preset rules; If the monitoring result does not meet the preset rules, the target information is input into the referee process and the corresponding referee result is obtained; The system status determination module is used to determine whether the operating system is normal according to the monitoring result and the judgment result.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the security protection method for the operating system as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the security protection method for an operating system as described in any one of claims 1 to 7.

Images