Customized calling method and device for credential operation system

Abstract

The invention discloses a customized calling method and device for a credential operating system, and relates to the technical field of operating system management. Comprising the steps of 1, compiling a user mode hook function by utilizing a gcc compiling tool, and customizing user mode system calling by utilizing the user mode hook function; 2, customizing a kernel mode system call by using a debugging tool kprobe of a kernel of the creative operation system; according to the method, calling management of the operating system in the user mode and the kernel mode is achieved, calling logic customization of the creative operating system is achieved, the overall integrity of the creative operating system is maintained, the stability and compatibility of the creative operating system are guaranteed, and the service logic of the application is ensured.

Description

Technical Field

[0001] The present invention discloses a customized calling method and device for a trusted operating system, and relates to the technical field of operating system management. Background Art

[0002] The emergence of trusted operating systems is aimed at supporting and optimizing specific trusted applications. Trusted operating systems provide a series of call interfaces in kernel mode, which distinguish different functions by call numbers. The Glibc component encapsulates the call interface of the trusted operating system and provides an interface that complies with the POSIX standard, so that end-user programs can easily call these system functions.

[0003] However, the calling interface functions of the trusted operating system are clear and fixed. When the system call logic needs to be changed, the trusted operating system kernel and Glibc components usually have to be significantly modified. However, the interfaces of the trusted operating system kernel and Glibc components are public interfaces. Making significant modifications is not only difficult, but may also have a wide-ranging impact on all applications running on the trusted operating system, thereby affecting the business logic of these applications. Summary of the invention

[0004] In view of the problems of the prior art, the present invention provides a customized calling method and device for a trusted operating system. Without changing the trusted operating system kernel and Glibc components, the method and device implement user-state and kernel-state operating system call management through Hook technology expansion, implement the customization of the calling logic of the trusted operating system, maintain the overall integrity of the trusted operating system, ensure the stability and compatibility of the trusted operating system, and ensure the business logic of the application.

[0005] The specific scheme proposed by the present invention is: The present invention provides a customized calling method for a trusted operating system, comprising: Step 1: Use the gcc compiler tool to write a user-mode hook function, and use the user-mode hook function to customize the user-mode system call: In the Glibc component, the user-state system call of the system call interface is intercepted through the user-state hook function; the user-state function to be called is assigned as the system call function through the user-state hook function; the user-state function to be called is called when the user-state system call occurs subsequently; and the pre-processing logic is added before the system call interface for the pre-processing of the business logic, and the post-processing logic is added after the system call interface for the post-processing of the business logic; Step 2: Use the debugging tool kprobe of the Xinchuang operating system kernel to customize the kernel-mode system call: Create a new system call: Use kprobe to obtain the kernel system call table pointer. According to the kernel system call table pointer, specify the function with the reserved index in the system call table to create a new system call interface. Replace system call logic: Replace the system call logic by modifying the function of the reserved index in the specified system call table; Add system call pre-processing: specify the pre-processing function for pre-processing of kernel-mode system calls.

[0006] Furthermore, when creating a new system call in step 2 of the customized calling method of the trusted operating system, it specifically includes: using kprobe to obtain the kernel system call table pointer according to the function corresponding address returned by the kallsyms_lookup_name function, the kallsyms_lookup_name function is used to find the function symbol in the kernel symbol table and return the function corresponding address, according to the kernel system call table pointer, specify the function of the reserved index in the system call table for creating a new system call interface.

[0007] Further, when replacing the system call logic in step 2 of the customized calling method of the trust-created operating system, it specifically includes: obtaining a reserved index in the system call table, obtaining an index number according to the reserved index, each index number corresponds to a system call interface, Replace the system call logic corresponding to the system call interface by modifying the function of the reserved index in the specified system call table.

[0008] Furthermore, when adding system call pre-processing in step 2 of the customized calling method of the trusted operating system, it specifically includes: using kprobe to find the system call function name that needs to add pre-processing in the kernel symbol table, and designating the system call function corresponding to the system call function name as the pre-processing function.

[0009] The present invention provides a customized calling device for a trusted operating system, comprising a user state system call management module and a kernel state system call management module. The user-mode system call management module uses the gcc compiler tool to write user-mode hook functions and uses user-mode hook functions to customize user-mode system calls: In the Glibc component, the user-state system call of the system call interface is intercepted through the user-state hook function; the user-state function to be called is assigned as the system call function through the user-state hook function; the user-state function to be called is called when the user-state system call occurs subsequently; and the pre-processing logic is added before the system call interface for the pre-processing of the business logic, and the post-processing logic is added after the system call interface for the post-processing of the business logic; The kernel-mode system call management module uses the debugging tool kprobe of the Xinchuang operating system kernel to customize the kernel-mode system call: Create a new system call: Use kprobe to obtain the kernel system call table pointer. According to the kernel system call table pointer, specify the function with the reserved index in the system call table to create a new system call interface. Replace system call logic: Replace the system call logic by modifying the function of the reserved index in the specified system call table; Add system call pre-processing: specify the pre-processing function for pre-processing of kernel-mode system calls.

[0010] Furthermore, when a kernel-mode system call management module of a customized calling device of a trusted operating system creates a new system call, it specifically includes: using kprobe to obtain a kernel system call table pointer according to a function corresponding address returned by a kallsyms_lookup_name function, the kallsyms_lookup_name function is used to find a function symbol in the kernel symbol table and return the function corresponding address, and according to the kernel system call table pointer, specifying a function with a reserved index in the system call table for creating a new system call interface.

[0011] Further, when the kernel-mode system call management module of the customized calling device of the trust-created operating system replaces the system call logic, it specifically includes: obtaining a reserved index in the system call table, obtaining an index number according to the reserved index, each index number corresponds to a system call interface, Replace the system call logic corresponding to the system call interface by modifying the function of the reserved index in the specified system call table.

[0012] Furthermore, when the kernel-mode system call management module of the customized calling device of the trusted operating system adds system call pre-processing, it specifically includes: using kprobe to find the system call function name that needs to add pre-processing in the kernel symbol table, and designating the system call function corresponding to the system call function name as the pre-processing function.

[0013] The benefits of the present invention are: It implements user-mode and kernel-mode system call management, supports user-mode system call pre-processing, supports user-mode system call post-processing, supports new kernel-mode system call interfaces, supports replacement of kernel-mode system call logic, and supports kernel-mode system call pre-processing. Without changing the kernel of the trusted operating system, it implements the customization of the system call logic of the trusted operating system, maintains the overall integrity of the trusted operating system, ensures the stability and compatibility of the trusted operating system, and ensures the business logic of the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a schematic flow chart of the method of the present invention.

[0015] Figure 2 It is a schematic diagram of the application framework of the device of the present invention. DETAILED DESCRIPTION

[0016] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0017] Embodiment 1: The present invention provides a customized calling method of a trusted operating system, comprising: Step 1: Use the gcc compiler tool to write a user-mode hook function, and use the user-mode hook function to customize the user-mode system call: In the Glibc component, the user-state system call of the system call interface is intercepted through the user-state hook function; the user-state function to be called is assigned to the system call function through the user-state hook function; the user-state function to be called is called when the user-state system call occurs subsequently; and the pre-processing logic is added before the system call interface for the pre-processing of the business logic, and the post-processing logic is added after the system call interface for the post-processing of the business logic.

[0018] For example, write a user-mode hook function: TRY_LOAD_HOOK_FUNC, The input of TRY_LOAD_HOOK_FUNC function is name: system call interface name, The TRY_LOAD_HOOK_FUNC function assigns the function named g_sys_##name to the system call function. Subsequent calls to the g_sys_##name function are equivalent to calling the ##name system call.

[0019] Code sample: #define unlikely(x) __builtin_expect(!!(x), 0) / / User-mode hook function, supports interception of user-mode system calls #define TRY_LOAD_HOOK_FUNC(name) if (unlikely(!g_sys_##name)) {g_sys_##name = (sys_##name##_t)dlsym(RTLD_NEXT,#name);} / / User mode system call management void* system call interface name (size_t size) { TRY_LOAD_HOOK_FUNC(system call interface name); / / Add system call preprocessing void *p = g_sys_system call interface name (size); / / Add system call post-processing } Step 2: Use the debugging tool kprobe of the Xinchuang operating system kernel to customize the kernel-mode system call: Create a new system call: Use kprobe to obtain the kernel system call table pointer. According to the kernel system call table pointer, specify the function with the reserved index in the system call table to create a new system call interface.

[0020] When creating a new system call, it specifically includes: using kprobe to obtain the kernel system call table pointer according to the function corresponding address returned by the kallsyms_lookup_name function. The kallsyms_lookup_name function is used to find the function symbol in the kernel symbol table and return the function corresponding address. According to the kernel system call table pointer, specify the function of the reserved index in the system call table for creating a new system call interface. The reserved index of the system call table is some system call index numbers reserved by the Xinchuang operating system. It does not implement specific business logic and is used to implement new system call logic. For example, the reserved index numbers are: 441 to 456.

[0021] For example, the code sample can be found as follows: / / New system call function implementation asmlinkage long create new system call function (conststructpt_regs *regs) { / / Create a new system call business logic return 0; } / / kprobe preprocessing function Preprocessing function (structkprobe *p, structpt_regs *regs) { / / Get the address of the specified function kln_addr = (--regs->ip); return 0; } / / Kernel state system call management module initialization function static int new system call initialization function (void) { / / Get the address of the function "kallsyms_lookup_name" through the kprobe preprocessing function kp->symbol_name = "kallsyms_lookup_name"; kp->pre_handler = preprocessing function; / / Register kprobe ret = register_kprobe(kp); / / Get the system call table through the function "kallsyms_lookup_name" kln_pointer = (unsigned long (*)(const char *name)) kln_addr; __sys_call_table = kln_pointer("sys_call_table"); / / Specify the reserved index 450 as the new system call function __sys_call_table

[450] = (unsigned long) Create a new system call function; return 0; } / / User mode system call program int main() { syscall (new system call number, system call parameters); return 0; } Replace system call logic: Replace the system call logic by modifying the function with the reserved index in the specified system call table.

[0022] When replacing the system call logic, it specifically includes: obtaining a reserved index in the system call table, obtaining an index number according to the reserved index, each index number corresponds to a system call interface, Replace the system call logic corresponding to the system call interface by modifying the function of the reserved index in the specified system call table.

[0023] Add system call pre-processing: specify the pre-processing function for pre-processing of kernel-mode system calls.

[0024] When adding the system call pre-processing, the method specifically includes: using kprobe to find the system call function name to which the pre-processing needs to be added in the kernel symbol table, and specifying the system call function corresponding to the system call function name as the pre-processing function.

[0025] For example, the code sample can be found as follows: / / Specify the kprobe kernel symbol as the system call function name that needs to add preprocessing static structkprobekp = { .symbol_name = the system call function name that needs to add preprocessing, }; / / System call pre-processing function static int preprocessing function (structkprobe *p, structpt_regs *regs) { / / Pre-processing logic } / / System call pre-processing kernel module static int __init system call pre-processing function initialization (void) { / / Specify the pre-processing function kp.pre_handler = pre-processing function; ret = register_kprobe(&kp); return 0; } Example 2: Combination Figure 2 The present invention provides a customized calling device for a trusted operating system, including a user-mode system calling management module and a kernel-mode system calling management module. The user-mode system call management module uses the gcc compiler tool to write user-mode hook functions and uses user-mode hook functions to customize user-mode system calls: In the Glibc component, the user-state system call syscall of the system call interface posix is ​​intercepted through the user-state hook function; the user-state function to be called is assigned to the system call function through the user-state hook function; the user-state function to be called is called when the user-state system call occurs later; and the pre-processing logic is added before the system call interface for the pre-processing of the business logic, and the post-processing logic is added after the system call interface for the post-processing of the business logic; The kernel-mode system call management module uses the operating system kernel debugging tool kprobe to customize kernel-mode system calls: Create a new system call: Use kprobe to obtain the kernel system call table pointer. According to the kernel system call table pointer, specify the function of the reserved index in the system call table for creating a new system call interface. That is, specify the reserved index 64 as the new system call function, and create a new system call syscall_64.tbl; Replace system call logic: Replace the system call logic by modifying the function of the reserved index in the specified system call table; Add system call pre-processing: specify the pre-processing function for pre-processing of kernel-mode system calls.

[0026] After the kernel-mode system call management module is successfully built, it can be loaded into the kernel of the trusted operating system through the insmod command.

[0027] As the information interaction and execution process between the modules of the above-mentioned device are based on the same concept as the embodiment of the method of the present invention, the specific contents can be found in the description of the embodiment of the method of the present invention and will not be repeated here.

[0028] Similarly, the device of the present invention implements system call management in user mode and kernel mode, supports user mode system call pre-processing, supports user mode system call post-processing, supports new kernel mode system call interface, supports replacement of kernel mode system call logic, supports kernel mode system call pre-processing, and implements customization of system call logic by the trusted operating system without changing the kernel of the trusted operating system, thereby maintaining the overall integrity of the trusted operating system, ensuring the stability and compatibility of the trusted operating system, and ensuring the business logic of the application.

[0029] It should be noted that not all steps and modules in the above-mentioned processes and device structures are necessary, and some steps or modules can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or some components in multiple independent devices may be implemented together.

[0030] The above-described embodiments are only preferred embodiments for fully illustrating the present invention, and the protection scope of the present invention is not limited thereto. Equivalent substitutions or changes made by those skilled in the art based on the present invention are within the protection scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. A customized calling method for a trusted operating system, characterized by: include: Step 1: Use the gcc compiler tool to write a user-mode hook function, and use the user-mode hook function to customize the user-mode system call: In the Glibc component, the user-state system call of the system call interface is intercepted through the user-state hook function; the user-state function to be called is assigned as the system call function through the user-state hook function; the user-state function to be called is called when the user-state system call occurs subsequently; and the pre-processing logic is added before the system call interface for the pre-processing of the business logic, and the post-processing logic is added after the system call interface for the post-processing of the business logic; Step 2: Use the debugging tool kprobe of the Xinchuang operating system kernel to customize the kernel-mode system call: Create a new system call: Use kprobe to obtain the kernel system call table pointer. According to the kernel system call table pointer, specify the function with the reserved index in the system call table to create a new system call interface. Replace system call logic: Replace the system call logic by modifying the function of the reserved index in the specified system call table; Add system call pre-processing: specify the pre-processing function for pre-processing of kernel-mode system calls.

2. According to the customized calling method of the information creation operating system described in claim 1, it is characterized by When creating a new system call in step 2, it specifically includes: using kprobe to obtain the kernel system call table pointer according to the function corresponding address returned by the kallsyms_lookup_name function, the kallsyms_lookup_name function is used to find the function symbol in the kernel symbol table and return the function corresponding address, according to the kernel system call table pointer, specify the function of the reserved index in the system call table for creating a new system call interface.

3. According to the customized calling method of the information creation operating system described in claim 1, it is characterized by When replacing the system call logic in step 2, it specifically includes: obtaining a reserved index in the system call table, obtaining an index number according to the reserved index, each index number corresponds to a system call interface, Replace the system call logic corresponding to the system call interface by modifying the function of the reserved index in the specified system call table.

4. According to the customized calling method of the information creation operating system described in claim 1, it is characterized by When adding the system call pre-processing in step 2, specifically including: using kprobe to find the system call function name that needs to add the pre-processing in the kernel symbol table, and specifying the system call function corresponding to the system call function name as the pre-processing function.

5. A customized calling device for a trusted operating system, characterized in that Including user-mode system call management module and kernel-mode system call management module, The user-mode system call management module uses the gcc compiler tool to write user-mode hook functions and uses user-mode hook functions to customize user-mode system calls: In the Glibc component, the user-state system call of the system call interface is intercepted through the user-state hook function; the user-state function to be called is assigned as the system call function through the user-state hook function; the user-state function to be called is called when the user-state system call occurs subsequently; and the pre-processing logic is added before the system call interface for the pre-processing of the business logic, and the post-processing logic is added after the system call interface for the post-processing of the business logic; The kernel-mode system call management module uses the debugging tool kprobe of the Xinchuang operating system kernel to customize the kernel-mode system call: Create a new system call: Use kprobe to obtain the kernel system call table pointer. According to the kernel system call table pointer, specify the function with the reserved index in the system call table to create a new system call interface. Replace system call logic: Replace the system call logic by modifying the function of the reserved index in the specified system call table; Add system call pre-processing: specify the pre-processing function for pre-processing of kernel-mode system calls.

6. According to the customized calling device of the information creation operating system according to claim 5, it is characterized by When the kernel-mode system call management module creates a new system call, it specifically includes: using kprobe to obtain the kernel system call table pointer according to the function corresponding address returned by the kallsyms_lookup_name function, the kallsyms_lookup_name function is used to find the function symbol in the kernel symbol table and return the function corresponding address, according to the kernel system call table pointer, specify the function of the reserved index in the system call table for creating a new system call interface.

7. According to claim 5, a customized calling device for a trusted operating system is characterized by: When the kernel-mode system call management module replaces the system call logic, it specifically includes: obtaining a reserved index in the system call table, obtaining an index number according to the reserved index, each index number corresponds to a system call interface, Replace the system call logic corresponding to the system call interface by modifying the function of the reserved index in the specified system call table.

8. According to claim 5, a customized calling device for a trusted operating system is characterized by: When the kernel-mode system call management module adds a system call pre-processing, it specifically includes: using kprobe to find the system call function name that needs to add pre-processing in the kernel symbol table, and specifying the system call function corresponding to the system call function name as the pre-processing function.

Images