Safety protection method, device and system and intelligent driving equipment

Abstract

The invention discloses a safety protection method, device and system and intelligent driving equipment, and the method can comprise the steps that a safety monitoring device deployed in a first virtual machine obtains kernel data of a second virtual machine, and determines the safety state of the second virtual machine according to the kernel data of the second virtual machine; when the second virtual machine has the security problem, the security monitoring device sends a prompt message to a virtual machine manager (VMM), and the prompt message is used for indicating that the second virtual machine has the security problem; the VMM performs security management on the second virtual machine after receiving the prompt message; wherein the security of the first virtual machine is higher than that of the second virtual machine. According to the scheme, the security of the second virtual machine can be improved.

Description

Technical Field

[0001] The present application relates to the field of safety protection technology, and more specifically, to a safety protection method, device, system and intelligent driving equipment. Background Art

[0002] With the development of computer technology, virtual machine technology has been widely used in the fields of vehicles, robots, servers, etc. Taking vehicles as an example, the current mainstream vehicle-mounted systems can start multiple virtual machines through the virtual machine manager (VMM), and the multiple virtual machines can respectively run multiple identical or different operating systems, which can avoid interference between different applications and improve the reliability and flexibility of applications.

[0003] In current technology, the virtual machines started by the vehicle-mounted system mainly include high-security virtual machines and low-security virtual machines. Among them, the high-security virtual machine is the security foundation of the entire system. It has no direct network exposure and is relatively safe. However, the low-security virtual machine will face more network attack surfaces, with a higher risk of remote attacks and security risks.

[0004] Therefore, how to improve the security of low-security virtual machines is an urgent problem to be solved. Summary of the invention

[0005] The present application provides a security protection method, device, system and intelligent driving equipment, which can improve the security of low-security virtual machines.

[0006] In a first aspect, a security protection method is provided. The method is applied to a security monitoring device, which is deployed on a first virtual machine. The method includes: obtaining kernel data of a second virtual machine; determining the security status of the second virtual machine based on the kernel data of the second virtual machine; when there is a security problem with the second virtual machine, sending a prompt message to the VMM, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine, the VMM is used to perform security management on the second virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

[0007] Among them, kernel data is the data that the operating system relies on when running, and can reflect the security status of the kernel.

[0008] The present application monitors the security status of a second virtual machine with lower security by deploying a security monitoring device in a first virtual machine with higher security, and uses VMM to perform security management on the second virtual machine when security issues are detected in the second virtual machine, thereby improving the security of the second virtual machine.

[0009] In combination with the first aspect, in certain implementations of the first aspect, the working mode of the security monitoring device includes a security monitoring mode, in which the security monitoring device runs instructions through a first address space, wherein the first address space includes a user state address space and a kernel state address space, the user state address space in the first address space is used to map application data of the security monitoring device, and the kernel state address space in the first address space is used to map kernel data of the second virtual machine, and obtaining the kernel data of the second virtual machine includes: obtaining the kernel data of the second virtual machine from the kernel state address space in the first address space.

[0010] Among them, the application data of the security monitoring device refers to the collection of codes and data that realize its security monitoring function; the kernel data of the second virtual machine refers to the data on which the operation of the second virtual machine operating system depends, which can reflect the security status of its kernel.

[0011] The first address space may be constructed by a VMM.

[0012] It should be noted that based on traditional technology, the data of the security monitoring device and the second virtual machine are usually mapped to different address spaces (for example, the data of the security monitoring device can be mapped to the second address space associated with the security monitoring device, and the data of the second virtual machine can be mapped to the third address space associated with the security monitoring device). Therefore, the security monitoring device usually cannot directly access the kernel data of the second virtual machine.

[0013] Based on this, the present application proposes that a new address space (i.e., the first address space mentioned above) can be constructed, in which the user-mode address space is mainly used to map the application data of the security monitoring device, and the kernel-mode address space is mainly used to map the kernel data of the second virtual machine, so as to realize the fusion of the address space of the security monitoring device and the address space of the second virtual machine, and then realize the acquisition of the kernel data of the second virtual machine.

[0014] In combination with the first aspect, in certain implementations of the first aspect, the mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space is achieved by changing the page table pointing to the kernel of the first virtual machine on the extended page table to a page table pointing to the kernel of the second virtual machine.

[0015] It should be understood that based on traditional technology, the second address space associated with the security monitoring device generally includes a user state address space and a kernel state address space. The user state address space is generally used to map the application data of the security monitoring device, and the kernel state address space is generally used to map the kernel data of the first virtual machine.

[0016] In order to achieve the fusion of the address space of the security monitoring device and the address space of the second virtual machine, the present application proposes that the first address space can be constructed based on the second address space. Specifically, the page table in the second address space that originally points to the kernel of the first virtual machine can be changed to a page table that points to the kernel of the second virtual machine to construct a new first address space. Based on the new address space, the user state address space can still be used to map the application data of the security monitoring device, while the kernel state address space can be used to map the kernel data of the second virtual machine.

[0017] Optionally, in actual operation, the first address space may not be constructed based on the second address space, but the first address space may be constructed directly by the VMM. However, it should be understood that in this manner, the VMM needs to additionally maintain the consistency of the page table, and the processing work is relatively complicated.

[0018] In combination with the first aspect, in some implementations of the first aspect, the kernel data of the second virtual machine is mapped as read-only.

[0019] Based on the solution of the present application, the kernel data of the second virtual machine can be mapped as read-only, so that the kernel data of the second virtual machine is neither executable nor writable in the kernel state address space of the first address space, and therefore will not cause an attack on the first virtual machine and will not affect the second virtual machine.

[0020] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: obtaining the kernel data of the second virtual machine when a first condition is met, the first condition including: the second virtual machine creates a new process, or before the second virtual machine issues a vehicle control instruction; or, obtaining the kernel data of the second virtual machine according to a preset period.

[0021] The present application can perform monitoring operations when the second virtual machine creates a new process to ensure the security of the new process; it can also perform monitoring operations when the second virtual machine generates but does not issue a vehicle control instruction to ensure the security of the vehicle control instruction; it can also perform monitoring operations according to a preset period to ensure the security of the second virtual machine.

[0022] In combination with the first aspect, in some implementations of the first aspect, determining the security status of the second virtual machine according to the kernel data of the second virtual machine includes: determining whether the second virtual machine is invaded by an attacker according to the kernel data of the second virtual machine.

[0023] Specifically, when it is determined that the second virtual machine is invaded by an attacker, it can be considered that the second virtual machine has a security problem; when it is determined that the second virtual machine is not invaded by an attacker, it can be considered that the second virtual machine has no security problem.

[0024] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: determining whether the second virtual machine has been invaded by an attacker based on at least one of the following: determining based on the task list and scheduling queue on the second virtual machine; determining based on whether the process with high privileges on the second virtual machine is on the whitelist; determining based on whether the configuration file and implementation of the security access control policy of the second virtual machine comply with a known whitelist; determining based on whether the access rights to key partitions in the disk file system of the second virtual machine are read-only; determining based on whether the second virtual machine has an abnormal network connection.

[0025] In combination with the first aspect, in certain implementations of the first aspect, the working mode of the security monitoring device also includes a system call mode, and the system call mode and the security monitoring mode are executed alternately. In this system call mode, the security monitoring device runs instructions through a second address space, and the second address space includes a user state address space and a kernel state address space. The user state address space in the second address space is used to map application data of the security monitoring device, and the kernel state address space in the second address space is used to map kernel data of the first virtual machine.

[0026] It should be understood that when using a security monitoring device to monitor the kernel data of the second virtual machine, the system call mode and the security monitoring mode can be executed alternately, wherein the security monitoring mode is used to obtain the kernel data of the second virtual machine, and the system call mode is used to provide system call support for the monitoring function.

[0027] In combination with the first aspect, in some implementations of the first aspect, the security management includes: forcing a safe restart.

[0028] Based on the solution of the present application, if there is a security problem in the second virtual machine, the VMM can force a safe restart of the second virtual machine to ensure the security of the second virtual machine.

[0029] In a second aspect, a security protection method is provided, which is applied to VMM, and includes: receiving a prompt message sent by a security monitoring device, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine, and the security monitoring device is deployed on the first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine; and performing security management on the second virtual machine.

[0030] Based on the solution of the present application, when the VMM learns that the second virtual machine has a security problem, the VMM can perform security management on the second virtual machine, thereby improving the security of the second virtual machine.

[0031] In combination with the second aspect, in certain implementations of the second aspect, the method also includes: constructing a first address space, the first address space being used to run instructions of the security monitoring device, the first address space comprising a user state address space and a kernel state address space, the user state address space of the first address space being used to map application data of the security monitoring device, and the kernel state address space of the first address space being used to map kernel data of the second virtual machine.

[0032] It should be noted that based on traditional technology, the data of the security monitoring device and the second virtual machine are usually mapped to different address spaces (for example, the data of the security monitoring device can be mapped to the second address space associated with the security monitoring device, and the data of the second virtual machine can be mapped to the third address space associated with the security monitoring device). Therefore, the security monitoring device usually cannot directly access the kernel data of the second virtual machine.

[0033] Based on this, the present application proposes that VMM can be used to construct a new address space (i.e., the first address space mentioned above), in which the user-mode address space is mainly used to map the application data of the security monitoring device, and the kernel-mode address space is mainly used to map the kernel data of the second virtual machine, so as to realize the fusion of the address space of the security monitoring device and the address space of the second virtual machine.

[0034] In combination with the second aspect, in certain implementations of the second aspect, constructing the first address space includes: changing the page table on the extended page table pointing to the kernel of the first virtual machine to a page table pointing to the kernel of the second virtual machine, so as to realize the mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space.

[0035] It should be understood that based on traditional technology, the second address space associated with the security monitoring device generally includes a user state address space and a kernel state address space. The user state address space is generally used to map the application data of the security monitoring device, and the kernel state address space is generally used to map the kernel data of the first virtual machine.

[0036] In order to achieve the fusion of the address space of the security monitoring device and the address space of the second virtual machine, the present application proposes that the VMM can construct the first address space based on the second address space. Specifically, the VMM can change the page table in the second address space that originally points to the kernel of the first virtual machine to a page table that points to the kernel of the second virtual machine to construct a new first address space. Based on the new address space, the user state address space can still be used to map the application data of the security monitoring device, while the kernel state address space can be used to map the kernel data of the second virtual machine.

[0037] In combination with the second aspect, in some implementations of the second aspect, the secure management of the second virtual machine includes: forcibly restarting the second virtual machine securely.

[0038] Based on the solution of the present application, if there is a security problem in the second virtual machine, the VMM can force a safe restart of the second virtual machine to ensure the security of the second virtual machine.

[0039] In a third aspect, a security protection device is provided, which is applied to a security monitoring device, which is deployed on a first virtual machine, and the device includes: an acquisition unit, which is used to acquire kernel data of a second virtual machine; a processing unit, which is used to determine the security status of the second virtual machine based on the kernel data of the second virtual machine; and a transceiver unit, which is used to send a prompt message to the VMM when there is a security problem with the second virtual machine, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine, and the VMM is used to perform security management on the second virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

[0040] In combination with the third aspect, in certain implementations of the third aspect, the working mode of the security monitoring device includes a security monitoring mode, in which the security monitoring device runs instructions through a first address space, wherein the first address space includes a user state address space and a kernel state address space, the user state address space in the first address space is used to map application data of the security monitoring device, and the kernel state address space in the first address space is used to map kernel data of the second virtual machine, and the acquisition unit is used to: obtain the kernel data of the second virtual machine from the kernel state address space in the first address space.

[0041] In combination with the third aspect, in certain implementations of the third aspect, the mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space is achieved by changing the page table pointing to the kernel of the first virtual machine on the extended page table to a page table pointing to the kernel of the second virtual machine.

[0042] In combination with the third aspect, in certain implementations of the third aspect, the kernel data of the second virtual machine is mapped as read-only.

[0043] In combination with the third aspect, in certain implementations of the third aspect, the acquisition unit is also used to: obtain the kernel data of the second virtual machine when the first condition is met, and the first condition includes: the second virtual machine creates a new process, or before the second virtual machine issues a vehicle control instruction; or, the acquisition unit is also used to: obtain the kernel data of the second virtual machine according to a preset period.

[0044] In combination with the third aspect, in certain implementations of the third aspect, the processing unit is used to: determine whether the second virtual machine is invaded by an attacker based on kernel data of the second virtual machine.

[0045] In combination with the third aspect, in certain implementations of the third aspect, the processing unit is further used to: determine whether the second virtual machine has been invaded by an attacker based on at least one of the following: determine based on the task list and scheduling queue on the second virtual machine; determine based on whether the process with high privileges on the second virtual machine is on the whitelist; determine based on whether the configuration file and implementation of the security access control policy of the second virtual machine comply with a known whitelist; determine based on whether the access rights to key partitions in the disk file system of the second virtual machine are read-only; determine based on whether the second virtual machine has an abnormal network connection.

[0046] In combination with the third aspect, in certain implementations of the third aspect, the working mode of the security monitoring device also includes a system call mode, and the system call mode and the security monitoring mode are executed alternately. In this system call mode, the security monitoring device runs instructions through a second address space, and the second address space includes a user state address space and a kernel state address space. The user state address space in the second address space is used to map application data of the security monitoring device, and the kernel state address space in the second address space is used to map kernel data of the first virtual machine.

[0047] In combination with the third aspect, in certain implementations of the third aspect, the security management includes: forcing a safe restart.

[0048] In a fourth aspect, a security protection device is provided, which is applied to a VMM. The device includes: a transceiver unit, which is used to receive a prompt message sent by a security monitoring device, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine. The security monitoring device is deployed on a first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine; and a processing unit, which is used to perform security management on the second virtual machine.

[0049] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is also used to: construct a first address space, the first address space is used to run the instructions of the security monitoring device, the first address space includes a user state address space and a kernel state address space, the user state address space of the first address space is used to map the application data of the security monitoring device, and the kernel state address space of the first address space is used to map the kernel data of the second virtual machine.

[0050] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is also used to: change the page table on the extended page table pointing to the kernel of the first virtual machine to a page table pointing to the kernel of the second virtual machine, so as to realize the mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space.

[0051] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is used to: forcibly restart the second virtual machine safely.

[0052] In a fifth aspect, a security protection device is provided, comprising an input / output interface, a processor and a memory, wherein the processor is used to control the input / output interface to send and receive signals or information, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the security protection device executes a security protection method as in the first aspect or any possible implementation method of the first aspect.

[0053] In the sixth aspect, a security protection device is provided, comprising an input / output interface, a processor and a memory, wherein the processor is used to control the input / output interface to send and receive signals or information, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the security protection device executes the security protection method in the second aspect or any possible implementation method of the second aspect.

[0054] In the seventh aspect, a safety protection system is provided, comprising a safety protection device as in the third aspect or any possible implementation of the third aspect; or comprising a safety protection device as in the fourth aspect or any possible implementation of the fourth aspect; or comprising a safety protection device as in the fifth aspect; or comprising a safety protection device as in the sixth aspect.

[0055] In an eighth aspect, a security protection system is provided, comprising: a VMM, a first virtual machine and a second virtual machine, the security of the first virtual machine being higher than that of the second virtual machine, the first virtual machine comprising a security monitoring device, wherein the security monitoring device comprises a security protection device as in the third aspect or any possible implementation of the third aspect; the VMM comprises a security protection device as in the fourth aspect or any possible implementation of the fourth aspect.

[0056] In the ninth aspect, a computer-readable medium is provided, which stores a program code. When the program code runs on a computer, the computer executes a security protection method as in the first aspect or any possible implementation of the first aspect; or, executes a security protection method as in the second aspect or any possible implementation of the second aspect.

[0057] In the tenth aspect, a computer program product is provided, comprising instructions. When the instructions are run on a computer, the security protection method in the first aspect or any possible implementation of the first aspect is executed, or the security protection method in the second aspect or any possible implementation of the second aspect is executed.

[0058] In the eleventh aspect, a computing device is provided, comprising: at least one processor and a memory, wherein the at least one processor is coupled to the memory, and is used to read and execute instructions in the memory to execute a security protection method as in the first aspect or any possible implementation of the first aspect; or, to execute a security protection method as in the second aspect or any possible implementation of the second aspect.

[0059] In a twelfth aspect, a chip is provided, the chip comprising a circuit for executing the security protection method in the first aspect or any possible implementation of the first aspect; or comprising a circuit for executing the security protection method in the second aspect or any possible implementation of the second aspect. .

[0060] In the thirteenth aspect, an intelligent driving device is provided, comprising a protection device as in the third aspect or any possible implementation of the third aspect; or, comprising a protection device as in the fourth aspect or any possible implementation of the fourth aspect; or, comprising a safety protection device as in the fifth aspect; or, comprising a safety protection device as in the sixth aspect; or, comprising a safety protection system as in the seventh aspect; or, comprising a safety protection system as in the eighth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 is a functional schematic diagram of the intelligent driving device 100 provided in an embodiment of the present application;

[0062] Figure 2 is a schematic diagram of a safety protection system provided in an embodiment of the present application;

[0063] Figure 3 is a schematic diagram of a security protection method provided in an embodiment of the present application;

[0064] Figure 4 is a schematic diagram of the structure of the first address space provided in an embodiment of the present application;

[0065] Figure 5 It is a schematic diagram of the conversion principle of an address space and a physical address provided in an embodiment of the present application;

[0066] Figure 6 It is a schematic diagram of a page table modification provided by an embodiment of the present application;

[0067] Figure 7 This is a schematic diagram of the life cycle of a security monitoring device provided in an embodiment of the present application;

[0068] Figure 8 is a schematic diagram of the structure of a safety protection device 800 provided in an embodiment of the present application;

[0069] Fig. 9 is a schematic diagram of the structure of a safety protection device 900 provided in an embodiment of the present application;

[0070] Fig.10 It is a schematic block diagram of the hardware structure of the security monitoring device 1000 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0071] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or. For example, A / B can mean A or B. The “and / or” in this article is a description of the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0072] In this application, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0073] The prefixes such as "first" and "second" used in the embodiments of the present application are only used to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. The use of prefixes such as ordinal numbers used to distinguish description objects in the embodiments of the present application does not constitute a limitation on the described objects. For the statement of the described objects, please refer to the description in the context of the claims or embodiments, and the use of such prefixes should not constitute an unnecessary limitation.

[0074] The following first introduces the professional terms involved in this application.

[0075] VMM: Also known as hypervisor, it is a small software layer used to create and manage multiple independently running virtual machines. It can logically separate multiple virtual machines from each other and allocate its own underlying computing power, memory, network and disk to each virtual machine.

[0076] root: Also known as the root user, it has the highest permissions in the system, such as starting or stopping a process, deleting or adding users, adding or disabling hardware, creating new files, modifying files, or deleting all files, etc.

[0077] Process whitelist: refers to a list of processes approved by the user or administrator. It should be understood that only processes listed in the whitelist are allowed, and processes not listed will be prohibited. The whitelist can prevent users or attackers from implanting unauthorized processes or viruses.

[0078] Address space: A set of addresses that a process can use to address memory. The operating system has an address space for each process, and this address space is independent of the address space of other processes. And each process cannot access the physical address. The operating system will provide a mechanism to map the virtual addresses of different processes to the physical addresses of different memories.

[0079] Page table: is a data structure used to convert virtual addresses into physical addresses.

[0080] Extended page table: A data structure managed by the VMM when hardware virtualization is enabled. When hardware virtualization is enabled, the page table managed by the virtual machine kernel converts virtual addresses into intermediate addresses, and the extended page table further converts intermediate addresses into physical addresses. This translation process is completed by the hardware memory management unit (MMU).

[0081] Translation table base register (TTBR): used to store the base address of the first-level page table, including TTBR0 and TTBR1. TTBR0 is used to store the base address of the first-level page table of the user process, and TTBR1 is used to store the base address of the first-level page table of the kernel space. When hardware virtualization is enabled, the TTBR stores the intermediate address of the base page table managed by the virtual machine kernel.

[0082] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0083] The solution of the present application can be applied to intelligent driving devices, for example, to vehicle-mounted computing platforms such as the central computing platform, intelligent driving domain controller, cockpit domain controller, microcontroller unit (MCU), and electronic control unit (ECU) in intelligent driving devices.

[0084] Among them, the intelligent driving equipment may include road vehicles, water vehicles, air vehicles, industrial equipment, agricultural equipment, or entertainment equipment, etc. For example, the intelligent driving equipment may be a vehicle, which is a vehicle in a broad sense, and may be a vehicle (such as a commercial vehicle, a passenger car, a motorcycle, a flying car, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), agricultural equipment (such as a mower, a harvester, etc.), amusement equipment, a toy vehicle, etc. This application does not specifically limit the type of vehicle. For another example, the intelligent driving equipment may be a vehicle such as an airplane or a ship.

[0085] The present application scheme can also be applied to servers, smart terminals, smart homes, vehicle-mounted embedded devices, etc. For example, it can be applied to smart phones, desktop computers, laptops, tablet computers, wearable devices, robots, etc.

[0086] Combine the following Figure 1 , taking intelligent driving equipment as an example, the application scenarios of this application are exemplarily introduced.

[0087] Figure 1 It is a functional schematic diagram of the intelligent driving device 100 provided in an embodiment of the present application. The intelligent driving device 100 may include a perception system 110 and a computing platform 120, wherein the perception system 110 may include one or more sensors for sensing information about the environment around the intelligent driving device 100. For example, the perception system 110 may include a positioning system, and the positioning system may be a global positioning system (GPS), or a Beidou system or other positioning systems. The perception system 110 may also include one or more of an inertial measurement unit (IMU), a laser radar, a millimeter wave radar, an ultrasonic radar, and a camera device.

[0088] The computing platform 120 is used to analyze and process the data sensed by the perception system 110, and to control some or all functions of the intelligent driving device 100. Based on virtualization technology, the computing platform 120 may include a hardware layer 121, a VMM 122 running on the hardware layer 121, and one or more virtual machines 123 running on the VMM 122 (or understood as one or more virtual machine isolation domains started by the VMM). The hardware layer 121 may include a processor 1211, a physical memory 1212, a hard disk 1213, and a network interface device 1214, wherein the processor 1211 may be one or more; the network interface device 1214 may be a network adapter or a network card, which is used to connect to any connectable network, such as the Internet, an enterprise network, etc. Each virtual machine 123 may include one or more application programs 1231 and an operating system 1232, and the operating system includes a kernel. Among them, the kernel is the core of the operating system, which is mainly responsible for core tasks such as process management, disk management, task scheduling, and memory management.

[0089] The processor 1211 is a circuit with signal processing capability. In one implementation, the processor 1211 may be a circuit with instruction reading and execution capability, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which may be understood as a microprocessor), or a digital signal processor (DSP); in another implementation, the processor 1211 may implement certain functions through the logical relationship of a hardware circuit, and the logical relationship of the hardware circuit may be fixed or reconfigurable, such as the processor 1211 being a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as a field programmable gate array (FPGA). In a reconfigurable hardware circuit, the processor 1211 loads a configuration document to implement the hardware circuit configuration process, which may be understood as the process of the processor 1211 loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0090] The virtual machines on the computing platform 120 usually include high-security virtual machines and low-security virtual machines. Among them, the high-security virtual machine is the security foundation of the entire system. It has no direct network exposure and is relatively safe. Low-security virtual machines face more network attack surfaces and are at a higher risk of remote attacks. For example, the entertainment domain virtual machine in the smart driving device deploys a large number of network applications and third-party entertainment applications. These processes have a high risk of vulnerabilities and often become a point of entry for remote attackers to attack the vehicle system.

[0091] Based on this, the present application proposes a security protection method, which mainly uses a security monitoring device deployed in a high-security virtual machine to monitor the security status of a low-security virtual machine, and when a security problem is detected, uses the VMM to perform security management on the low-security virtual machine to improve the security performance of the low-security virtual machine.

[0092] Figure 2Schematic diagram of a safety protection system provided by an embodiment of the present application. Figure 2 As shown, the security protection system 200 includes a first virtual machine 210, a second virtual machine 220, a VMM 230, and a security monitoring device 211 deployed in the first virtual machine 210. Among them, the first virtual machine 210 has no direct network exposure port, is relatively safe, and can be understood as a high-security virtual machine; the second virtual machine 220 faces more network attack surfaces and has security risks, and can be understood as a low-security virtual machine.

[0093] The security monitoring device 211 can be understood as a chip, module or processor in the first virtual machine 210. In this application, it is mainly used to monitor the kernel data of the second virtual machine 220. For specific monitoring methods, please refer to steps S310 to S330 in method 300 below.

[0094] The security monitoring device 211 may include two working modes: security monitoring mode and system service call mode, and these two modes may be executed alternately. In the security monitoring mode, the security monitoring device 211 may access the kernel data of the second virtual machine 220 and determine the security status of the second virtual machine 220; in the system service call mode, the security monitoring device 211 may complete the service call task involved in itself.

[0095] The VMM 230 is used to perform security management on the second virtual machine. For specific management methods, see steps S330 and S340 in the method 300 below.

[0096] The security protection system 200 may include one low-security virtual machine or multiple low-security virtual machines. The first virtual machine 210 may monitor one low-security virtual machine or multiple low-security virtual machines, without limitation.

[0097] based on Figure 2 The architecture shown below is combined with Figure 3 Provide a detailed introduction to safety protection methods.

[0098] Figure 3 3 is a schematic diagram of a security protection method provided by an embodiment of the present application. The method 300 can be applied to the computing platform 120 or the security protection system 200, and specifically, can be applied to the security monitoring device 211 and the VMM 230 in the security protection system 200. Figure 3 As shown, the method 300 includes steps S310 to S340, which are described in detail below.

[0099] S310, the security monitoring device obtains kernel data of the second virtual machine. The security monitoring device is deployed on the first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

[0100] Among them, kernel data is the data that the operating system relies on when running, and can reflect the security status of the kernel.

[0101] The security monitoring device can specifically obtain the kernel data of the second virtual machine from the kernel address space in the first address space. Figure 4 As shown, the first address space includes a user state address space and a kernel state address space, wherein the user state address space of the first address space is used to map application data of the security monitoring device, and the kernel state address space of the first address space is used to map kernel data of the second virtual machine.

[0102] Among them, the application data of the security monitoring device refers to the collection of codes and data that realize its security monitoring function; the kernel data of the second virtual machine refers to the data on which the operation of the second virtual machine operating system depends, which can reflect the security status of its kernel.

[0103] It should be understood that the first address space is an address space newly constructed by the VMM and is specifically used to monitor the second virtual machine. The construction of the first address space is described in detail below with reference to the accompanying drawings.

[0104] It should be noted that, in conventional technologies, the data of the first virtual machine and the second virtual machine are usually mapped to different address spaces. For example, the data of the security monitoring device deployed in the first virtual machine is usually mapped to the second address space associated with the security monitoring device, and the data of the second virtual machine is mapped to the third address space associated with the second virtual machine.

[0105] Figure 5 FIG. 1 is a schematic diagram of the conversion principle of an address space and a physical address provided in an embodiment of the present application. Figure 5 As shown, the address space includes a user state address space and a kernel state address space. Based on the conventional technology, taking a security monitoring device as an example, the user state address space in the second address space associated with the security monitoring device is mainly used to map the application data of the security monitoring device, and the kernel state address space is mainly used to map the kernel data of the first virtual machine; taking the second virtual machine as an example, the user state address space in the third address space associated with the second virtual machine is mainly used to map the application data of the second virtual machine, and the kernel state address space is mainly used to map the kernel data of the second virtual machine.

[0106] It should be understood that the physical address (PA) corresponding to the user-mode address space is usually pointed to by TTBR0, and the PA corresponding to the kernel-mode address space is pointed to by TTBR1. A virtual address is represented by TTBR and multi-level page tables (e.g. Figure 5The three-level page table (PGD, PMD, PTE) or (PGD', PMD', PTE') shown is translated and finally converted into PA. It should also be understood that when hardware virtualization is turned on, the TTBR and all page table entries are translated into intermediate physical addresses (IPA), and IPA needs to be translated through the stage 2 page table to become PA, where the stage 2 page table is maintained by the VMM.

[0107] Because based on traditional technology, the data of the security monitoring device and the second virtual machine are usually mapped to different address spaces (ie, the second address space and the third address space mentioned above), the security monitoring device cannot directly access the kernel data of the second virtual machine.

[0108] Based on this, the present application proposes that VMM can be used to construct a new address space (i.e., the first address space mentioned above), in which the user-mode address space is mainly used to map the application data of the security monitoring device, and the kernel-mode address space is mainly used to map the kernel data of the second virtual machine, so as to realize the fusion of the address space of the security monitoring device and the address space of the second virtual machine, and then realize the acquisition of the kernel data of the second virtual machine.

[0109] Optionally, the VMM can construct the first address space based on the second address space. Specifically, the VMM can change the page table in the second address space that originally points to the kernel of the first virtual machine to a page table that points to the kernel of the second virtual machine to construct a new first address space. Based on the new address space, the user state address space can still be used to map the application data of the security monitoring device, while the kernel state address space can be used to map the kernel data of the second virtual machine.

[0110] Optionally, the VMM may not construct the first address space based on the second address space, but directly construct the first address space. However, it should be understood that in this manner, the VMM needs to additionally maintain the consistency of the page table, and the processing work is relatively complicated.

[0111] Figure 6 Schematic diagram of a page table modification provided by an embodiment of the present application. Figure 6 As shown, the page table entry on stage 2 corresponding to the kernel mode address space of the second address space can be rewritten (i.e., stage2 is changed to stage2'), and the stage 1 page table (wherein, the stage 1 page table refers to the PGD, PMD, and PTE page tables) is redirected, so that the TTBR1 originally pointing to the kernel of the first virtual machine points to the kernel of the second virtual machine, and the fused address space (i.e., the first address space) is constructed.

[0112] The kernel data of the second virtual machine can be mapped as read-only, so that the kernel data of the second virtual machine is neither executable nor writable in the kernel state address space of the first address space, thus causing no attack on the first virtual machine and no impact on the second virtual machine.

[0113] S320: The security monitoring device determines the security status of the second virtual machine according to the kernel data of the second virtual machine.

[0114] Optionally, the security monitoring device can determine whether the second virtual machine is invaded by an attacker based on the kernel data of the second virtual machine, and when the second virtual machine is invaded by an attacker, it is considered that there is a security problem with the second virtual machine; when the second virtual machine is not invaded by an attacker, it is considered that there is no security problem with the second virtual machine.

[0115] The security monitoring device may determine whether the second virtual machine is hacked by an attacker according to at least one of the following:

[0116] In example 1, the security monitoring device may determine whether the second virtual machine is invaded by an attacker based on a task list and a scheduling queue on the second virtual machine.

[0117] It should be understood that the kernel of the second virtual machine will maintain a task list for the running processes in the second virtual machine system. In order to erase their own intrusion traces, the root attacker will remove their own nodes on the task list; but the attacker usually cannot remove himself from the kernel's scheduling queue, because the system will not schedule this process after the removal. Therefore, by comparing the task list and the scheduling queue, it is possible to determine whether there are hidden processes, that is, whether there are traces of root attacks.

[0118] Example 2: The security monitoring device can determine whether the second virtual machine is invaded by an attacker based on whether the processes with high permissions on the second virtual machine are in the white list. For example, when all the processes with high permissions are in the white list, it can be determined that the second virtual machine is not invaded by the attacker; when some of the processes with high permissions are not in the white list, it can be determined that the second virtual machine is invaded by the attacker.

[0119] Example 3: The security monitoring device can determine whether the second virtual machine is invaded by an attacker based on whether the configuration file and implementation of the security access control policy of the second virtual machine conform to a known whitelist. For example, when the configuration file and implementation of the security access control policy conform to a known whitelist, it can be determined that the second virtual machine has not been invaded by an attacker; when the configuration file and implementation of the security access control policy do not conform to a known whitelist, it can be determined that the second virtual machine has been invaded by an attacker.

[0120] Example 4: The security monitoring device can determine whether the second virtual machine is hacked by an attacker based on whether the access permission of the key partition in the disk file system of the second virtual machine is read-only. For example, when the access permission of the key partition in the disk file system of the second virtual machine is read-only, it can be considered that the second virtual machine has not been hacked by an attacker; when the access permission of the key partition in the disk file system of the second virtual machine is not read-only, it can be considered that the second virtual machine has been hacked by an attacker.

[0121] Example 5: The security monitoring device may determine whether the second virtual machine is invaded by an attacker based on whether the second virtual machine has an abnormal network connection. For example, when the second virtual machine does not have an abnormal network connection, it can be considered that the second virtual machine has not been invaded by an attacker; when the second virtual machine has an abnormal network connection, it can be considered that the second virtual machine has been invaded by an attacker.

[0122] It should be understood that the above determination method is only an example, and in actual operation, the security monitoring device may also determine whether the second virtual machine is invaded by an attacker in other ways without limitation.

[0123] Optionally, the security monitoring device can also determine whether the second virtual machine has problems such as module execution function failure based on the kernel data of the second virtual machine, and when the second virtual machine has these problems, it is considered that the second virtual machine has security problems; when the second virtual machine does not have these problems, it is considered that the second virtual machine does not have security problems.

[0124] Optionally, the security monitoring device may also determine whether the second virtual machine has other problems according to the kernel data of the second virtual machine, and determine the security status of the second virtual machine based on these problems, without limitation.

[0125] S330, when the second virtual machine has a security problem, the security monitoring device sends a prompt message to the VMM; correspondingly, the VMM receives the prompt message sent by the security monitoring device, wherein the prompt message is used to indicate that the second virtual machine has a security problem.

[0126] S340: The VMM performs security management on the second virtual machine.

[0127] Optionally, the VMM may forcefully restart the second virtual machine safely to implement safety management to ensure the safety of the second virtual machine; or may modify kernel data in the second virtual machine to implement safety management to ensure the safety of the second virtual machine.

[0128] Based on the solution of the present application, a security monitoring device deployed in a high-security virtual machine (for example, the first virtual machine) can monitor the security status of a low-security virtual machine (for example, the second virtual machine), and when a security problem is detected in the low-security virtual machine, a prompt message can be sent to the VMM to use the VMM to perform security management on the low-security virtual machine, thereby improving the security performance of the low-security virtual machine.

[0129] Optionally, when the security monitoring device determines that the second virtual machine has a security problem, the virtual machine administrator may be notified so that the virtual machine administrator can perform security management on the second virtual machine.

[0130] In one implementation, the monitoring operation (ie, method 300 ) may be performed according to a preset period, that is, the security monitoring device may obtain the kernel data of the second virtual machine according to the preset period and monitor the security status of the second virtual machine.

[0131] In another implementation, the monitoring operation may be performed when the first condition is met. The first condition may include when the second virtual machine creates a new process or before the second virtual machine issues a vehicle control instruction. For example, the monitoring operation may be triggered when the second virtual machine creates a new process to ensure the security of the new process; or the monitoring operation may be triggered when the second virtual machine generates but does not issue a vehicle control instruction to ensure the security of the vehicle control instruction.

[0132] The working mode of the security monitoring device may include a security monitoring mode and a system call mode, and the security monitoring mode and the system call mode may be executed alternately to ensure the normal operation of the monitoring function of the security monitoring device. In the security monitoring mode, the security monitoring device runs instructions through the first address space to obtain the kernel data of the second virtual machine; in the system call mode, the security monitoring device runs instructions through the second address space to provide system call support for the monitoring function. For the introduction of the first address space and the second address space, please refer to the above and will not be repeated.

[0133] Figure 7 Schematic diagram of the life cycle of a security monitoring device provided in an embodiment of the present application. Figure 7 As shown, when the security monitoring device is started, when a request is received to check the second virtual machine, the VMM helps it to build and switch to the first address space to enter the security monitoring mode. In the security monitoring mode, the kernel data of the second virtual machine can be checked; in this process, if the security monitoring device needs the support of the system call, it can switch to the system call mode, that is, switch to the second address space originally corresponding to the first virtual machine to implement the system call; after the system call is completed, it can switch to the security monitoring mode again. This cycle is executed until the inspection task is completed and the inspection result is output.

[0134] The above-mentioned security monitoring device can be used to monitor one low-security virtual machine, and can also be used to monitor multiple low-security virtual machines.

[0135] For example, when the security monitoring device receives a request to check multiple low-security virtual machines at the same time, the VMM can help the multiple low-security virtual machines to respectively construct address spaces that merge with the security monitoring device, and then Figure 7 The method shown traverses each low-security virtual machine in turn to complete the inspection.

[0136] In the various embodiments of the present application, unless otherwise specified or logically conflicting, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0137] The above describes in detail the method provided by the embodiment of the present application. Figures 8 to 10 The device provided in the embodiment of the present application is described in detail. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment, so the contents not described in detail can be referred to the method embodiment above, and for the sake of brevity, they will not be repeated here.

[0138] Figure 8 800 is a schematic diagram of the structure of the security protection device 800 provided in the embodiment of the present application. Optionally, the device 800 may be a security monitoring device, or a chip, processor or module in the security monitoring device, etc., without limitation. The security monitoring device is deployed in the first virtual machine. Figure 8 As shown, the device 800 includes an acquisition unit 810, a processing unit 820 and a transceiver unit 830. It should be understood that the transceiver unit 830 has the ability to send and / or receive data, and the transceiver unit 830 can be an interface circuit in a specific implementation.

[0139] Among them, the acquisition unit 810 is used to: obtain the kernel data of the second virtual machine; the processing unit 820 is used to: determine the security status of the second virtual machine according to the kernel data of the second virtual machine; the transceiver unit 830 is used to: when there is a security problem in the second virtual machine, send a prompt message to the VMM, wherein the prompt message is used to indicate that there is a security problem in the second virtual machine, the VMM is used to perform security management on the second virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

[0140] Optionally, the working mode of the security monitoring device may include a security monitoring mode, in which the security monitoring device runs instructions through a first address space. The first address space includes a user state address space and a kernel state address space, the user state address space in the first address space is used to map application data of the security monitoring device, and the kernel state address space in the first address space is used to map kernel data of the second virtual machine, and the acquisition unit 810 may be used to: acquire the kernel data of the second virtual machine from the kernel state address space in the first address space.

[0141] Optionally, mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space may be achieved by changing a page table pointing to the kernel of the first virtual machine on the extended page table to a page table pointing to the kernel of the second virtual machine.

[0142] Optionally, the kernel data of the second virtual machine may be mapped as read-only.

[0143] Optionally, the acquisition unit 810 can also be used to: obtain the kernel data of the second virtual machine when a first condition is met, the first condition including: the second virtual machine creates a new process, or before the second virtual machine issues a vehicle control instruction; or, the acquisition unit 810 can also be used to: obtain the kernel data of the second virtual machine according to a preset period.

[0144] Optionally, the processing unit 820 may be configured to determine whether the second virtual machine is invaded by an attacker according to kernel data of the second virtual machine.

[0145] Optionally, the processing unit 820 can also be used to determine whether the second virtual machine has been invaded by an attacker based on at least one of the following: determining based on the task list and scheduling queue on the second virtual machine; determining based on whether the process with high privileges on the second virtual machine is on the whitelist; determining based on whether the configuration file and implementation of the security access control policy of the second virtual machine comply with a known whitelist; determining based on whether the access rights to key partitions in the disk file system of the second virtual machine are read-only; determining based on whether the second virtual machine has an abnormal network connection.

[0146] Optionally, the working mode of the security monitoring device may also include a system call mode, and the system call mode and the security monitoring mode may be executed alternately. In the system call mode, the security monitoring device runs instructions through the second address space, and the second address space includes a user state address space and a kernel state address space, the user state address space in the first address space is used to map the application data of the security monitoring device, and the kernel state address space in the second address space is used to map the kernel data of the first virtual machine.

[0147] Optionally, the above safety management may include: forcing a safe restart.

[0148] Fig. 9 900 is a schematic diagram of the structure of the security protection device 900 provided in the embodiment of the present application. Optionally, the device 900 may be a VMM, or a chip, processor or module in the VMM, etc., without limitation. Fig. 9 As shown, the device 900 includes a transceiver unit 910 and a processing unit 920. It should be understood that the transceiver unit 910 has the ability to send and / or receive data, and the transceiver unit 910 can be an interface circuit in a specific implementation.

[0149] Among them, the transceiver unit 910 is used to: receive a prompt message sent by a security monitoring device, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine, the security monitoring device is deployed on the first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine; the processing unit 920 is used to: perform security management on the second virtual machine.

[0150] Optionally, the processing unit 920 can also be used to: construct a first address space, which is used to run instructions of the security monitoring device, and the first address space includes a user state address space and a kernel state address space, the user state address space of the first address space is used to map application data of the security monitoring device, and the kernel state address space of the first address space is used to map kernel data of the second virtual machine.

[0151] Optionally, the processing unit 920 can also be used to: change the page table pointing to the first virtual machine kernel on the extended page table to a page table pointing to the second virtual machine kernel, so as to implement mapping of the kernel data of the second virtual machine to the kernel state address space in the first address space.

[0152] Optionally, the processing unit 920 may be configured to: forcibly restart the second virtual machine safely.

[0153] Fig.10 1 is a schematic block diagram of the hardware structure of a security monitoring device 1000 provided in an embodiment of the present application. Optionally, the device 1000 may be a computer device. The device 1000 includes a memory 1010, a processor 1020, and a communication interface 1030. The memory 1010, the processor 1020, and the communication interface 1030 may be connected to each other through a bus.

[0154] The memory 1010 may be a read-only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM). The memory 1010 may store a program. When the program stored in the memory 1010 is executed by the processor 1020, the processor 1020 is used to execute each step in the method 300 of the embodiment of the present application.

[0155] The processor 1020 may be a CPU, a microprocessor, an ASIC, a GPU, or one or more integrated circuits, for executing relevant programs to implement the various steps in the method 300 of the method embodiment of the present application.

[0156] The processor 1020 may also be an integrated circuit chip with signal processing capability. In the implementation process, each step in the method 300 of the present application may be completed by an integrated logic circuit of hardware in the processor 1020 or by instructions in the form of software.

[0157] The communication interface 1030 uses a transceiver device such as, but not limited to, a transceiver to implement communication between the apparatus 1000 and other devices or a communication network.

[0158] The embodiment of the present application also provides a computer-readable storage medium, including instructions, which, when executed on a computer, enable the computer to execute each step in the above method 300.

[0159] The embodiment of the present application also provides a computer program product, which includes instructions. When the instructions are run on a computer, each step in the above method 300 is executed.

[0160] An embodiment of the present application also provides a computing device, including: at least one processor and a memory, wherein the at least one processor is coupled to the memory and is used to read and execute instructions in the memory to perform each step in the above method 300.

[0161] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute each step in the above method 300, or the chip executes each step in the above method 300 through a hardware circuit.

[0162] An embodiment of the present application also provides an intelligent driving device, including the above-mentioned device 800 and / or device 900 and / or system 200.

[0163] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0164] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0165] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0166] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0167] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0168] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0169] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A safety protection method, characterized in that: The method is applied to a security monitoring device, the security monitoring device is deployed on a first virtual machine, and the method includes: Obtaining kernel data of the second virtual machine; determining a security state of the second virtual machine according to the kernel data of the second virtual machine; When the second virtual machine has a security problem, a prompt message is sent to the virtual machine manager VMM, wherein the prompt message is used to indicate that the second virtual machine has a security problem, and the VMM is used to perform security management on the second virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

2. The method according to claim 1, characterized in that The working mode of the security monitoring device includes a security monitoring mode. In the security monitoring mode, the security monitoring device runs instructions through a first address space, wherein the first address space includes a user state address space and a kernel state address space, the user state address space in the first address space is used to map application data of the security monitoring device, and the kernel state address space in the first address space is used to map kernel data of the second virtual machine, and obtaining the kernel data of the second virtual machine includes: The kernel data of the second virtual machine is obtained from the kernel state address space in the first address space.

3. The method according to claim 2, characterized in that The mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space is achieved by changing the page table pointing to the kernel of the first virtual machine on the extended page table to a page table pointing to the kernel of the second virtual machine.

4. The method according to claim 3, characterized in that The kernel data of the second virtual machine is mapped as read-only.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: When a first condition is met, the kernel data of the second virtual machine is obtained, the first condition including: the second virtual machine creates a new process, or before the second virtual machine issues a vehicle control instruction; or, The kernel data of the second virtual machine is obtained according to a preset period.

6. The method according to any one of claims 1 to 5, characterized in that Determining the security status of the second virtual machine according to the kernel data of the second virtual machine includes: Determine whether the second virtual machine is invaded by an attacker according to the kernel data of the second virtual machine.

7. The method according to claim 6, characterized in that The method further includes: determining whether the second virtual machine is hacked by an attacker according to at least one of the following: Determining according to the task list and the scheduling queue on the second virtual machine; Determining based on whether the process with high privileges on the second virtual machine is in the whitelist; Determining based on whether the configuration file and implementation of the security access control policy of the second virtual machine conform to a known whitelist; Determining according to whether the access permission of the key partition in the disk file system of the second virtual machine is read-only; The determination is made based on whether the second virtual machine has an abnormal network connection.

8. The method according to claim 2, characterized in that: The working mode of the security monitoring device also includes a system call mode, and the system call mode and the security monitoring mode are executed alternately. In the system call mode, the security monitoring device runs instructions through a second address space, and the second address space includes a user state address space and a kernel state address space. The user state address space in the second address space is used to map application data of the security monitoring device, and the kernel state address space in the second address space is used to map kernel data of the first virtual machine.

9. The method according to any one of claims 1 to 8, characterized in that The safety management includes: forcing a safe restart.

10. A safety protection method, characterized in that: The method is applied to a virtual machine manager VMM, and the method comprises: receiving a prompt message sent by a security monitoring device, wherein the prompt message is used to indicate that a security problem exists in the second virtual machine, the security monitoring device is deployed on the first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine; Perform security management on the second virtual machine.

11. The method according to claim 10, characterized in that The method further comprises: Construct a first address space, the first address space is used to run the instructions of the security monitoring device, the first address space includes a user state address space and a kernel state address space, the user state address space of the first address space is used to map the application data of the security monitoring device, and the kernel state address space of the first address space is used to map the kernel data of the second virtual machine.

12. The method according to claim 11, characterized in that The constructing the first address space comprises: The page table pointing to the first virtual machine kernel on the extended page table is changed to a page table pointing to the second virtual machine kernel, so as to implement mapping of the kernel data of the second virtual machine to the kernel state address space in the first address space.

13. The method according to any one of claims 10 to 12, characterized in that The performing security management on the second virtual machine includes: The second virtual machine is restarted safely.

14. A safety protection device, characterized in that: The device is applied to a security monitoring device, the security monitoring device is deployed in a first virtual machine, and the device includes: An acquisition unit, used for acquiring kernel data of the second virtual machine; a processing unit, configured to determine a security state of the second virtual machine according to the kernel data of the second virtual machine; The transceiver unit is used to send a prompt message to the virtual machine manager VMM when there is a security problem with the second virtual machine, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine, the VMM is used to perform security management on the second virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

15. The device according to claim 14, characterized in that The working mode of the security monitoring device includes a security monitoring mode. In the security monitoring mode, the security monitoring device runs instructions through a first address space, wherein the first address space includes a user state address space and a kernel state address space, the user state address space in the first address space is used to map application data of the security monitoring device, and the kernel state address space in the first address space is used to map kernel data of the second virtual machine, and the acquisition unit is used to: The kernel data of the second virtual machine is obtained from the kernel state address space in the first address space.

16. The device according to claim 15, characterized in that The mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space is achieved by changing the page table pointing to the kernel of the first virtual machine on the extended page table to a page table pointing to the kernel of the second virtual machine.

17. The device according to claim 16, characterized in that The kernel data of the second virtual machine is mapped as read-only.

18. The device according to any one of claims 14 to 17, characterized in that The acquisition unit is further used to: acquire kernel data of the second virtual machine when a first condition is met, wherein the first condition includes: the second virtual machine creates a new process, or before the second virtual machine issues a vehicle control instruction; or, the acquisition unit is further used to: The kernel data of the second virtual machine is obtained according to a preset period.

19. The device according to any one of claims 14 to 18, characterized in that The processing unit is used for: Determine whether the second virtual machine is invaded by an attacker according to the kernel data of the second virtual machine.

20. The device according to claim 19, characterized in that The processing unit is further configured to determine whether the second virtual machine is invaded by an attacker according to at least one of the following: Determining according to the task list and the scheduling queue on the second virtual machine; Determining based on whether the process with high privileges on the second virtual machine is in the whitelist; Determining based on whether the configuration file and implementation of the security access control policy of the second virtual machine conform to a known whitelist; Determining according to whether the access permission of the key partition in the disk file system of the second virtual machine is read-only; The determination is made based on whether the second virtual machine has an abnormal network connection.

21. The device according to claim 15, characterized in that The working mode of the security monitoring device also includes a system call mode, and the system call mode and the security monitoring mode are executed alternately. In the system call mode, the security monitoring device runs instructions through a second address space, and the second address space includes a user state address space and a kernel state address space. The user state address space in the second address space is used to map application data of the security monitoring device, and the kernel state address space in the second address space is used to map kernel data of the first virtual machine.

22. The device according to any one of claims 14 to 21, characterized in that The safety management includes: forcing a safe restart.

23. A safety protection device, characterized in that: The device is applied to a virtual machine manager VMM, and the device comprises: a transceiver unit, configured to receive a prompt message sent by a security monitoring device, wherein the prompt message is used to indicate that a security problem exists in the second virtual machine, the security monitoring device is deployed on the first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine; A processing unit is used to perform security management on the second virtual machine.

24. The device according to claim 23, characterized in that The processing unit is also used for: Construct a first address space, the first address space is used to run the instructions of the security monitoring device, the first address space includes a user state address space and a kernel state address space, the user state address space of the first address space is used to map the application data of the security monitoring device, and the kernel state address space of the first address space is used to map the kernel data of the second virtual machine.

25. The device according to claim 24, characterized in that The processing unit is also used for: The page table pointing to the first virtual machine kernel on the extended page table is changed to a page table pointing to the second virtual machine kernel, so as to implement mapping of the kernel data of the second virtual machine to the kernel state address space in the first address space.

26. The device according to any one of claims 23 to 25, characterized in that The processing unit is used for: The second virtual machine is restarted safely.

27. A safety protection device, characterized in that: It includes an input / output interface, a processor and a memory, the processor is used to control the input / output interface to send and receive signals or information, the memory is used to store computer programs, and the processor is used to call and run the computer program from the memory, so that the safety protection device runs the safety protection method as described in any one of claims 1 to 9.

28. A safety protection device, characterized in that: It includes an input-output interface, a processor and a memory, the processor is used to control the input-output interface to send and receive signals or information, the memory is used to store computer programs, and the processor is used to call and run the computer program from the memory, so that the safety protection device runs the safety protection method as described in any one of claims 10 to 13.

29. A safety protection system, characterized in that: include: A virtual machine manager VMM, a first virtual machine and a second virtual machine, wherein the first virtual machine has a higher security than the second virtual machine, and the first virtual machine includes a security monitoring device, wherein: The security monitoring device comprises a device as claimed in any one of claims 14 to 22 and 27; The VMM comprises the apparatus as claimed in any one of claims 23 to 26 and 28.

30. An intelligent driving device, characterized in that: Includes the safety protection device as described in any one of claims 14 to 28; or includes the safety protection system as described in claim 29.

Images