Cross-privilege-level communication method and device and storage medium
By introducing super user programs and multi-layer security checks in the RISC-V architecture, the problem of communication security risks between user programs and kernel programs is solved, and higher communication security and data integrity are achieved.
Patent Information
- Application Number
- CN202411789081.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-06
- Publication Date
- 2025-03-28
AI Technical Summary
In the RISC-V architecture, communication between user programs and kernel programs poses a greater security risk, and data may be tampered with during the delivery process, resulting in system crash or data loss.
In the communication process between the user program and the kernel program, the super user program is introduced as an intermediary and security checks are performed on multiple nodes, including command legality checks, address legality checks when data copying and withdrawing, security authentication of response data and security verification of user programs.
It effectively improves the communication security between user programs and kernel programs, prevents data tampering and unauthorized operations, and ensures system stability and data integrity.
Smart Images
Figure CN119720147A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of secure communication technology, and in particular to a cross-privilege level communication method, device and storage medium. Background Art
[0002] In RISC-V, the architecture design supports three main privilege levels: User mode (Umode), Supervisor mode (S mode) and Machine mode (M mode). Machine mode is the highest privilege mode, directly controlling hardware and managing system resources; Supervisor mode is used for operating system operation, providing process management and system services; User mode is the lowest privilege mode, mainly used for the execution of user-level applications.
[0003] In many cases, the user program in user mode needs to communicate with the kernel program in machine mode, that is, the user program needs to send the kernel command requested to be executed as user data to the kernel program. In the prior art, the communication between the user program and the kernel program is implemented through system calls, that is, the user program calls the API provided by the kernel program, transfers the user data through the super user program in the super user mode, and finally passes it to the kernel program. After the kernel program completes the execution of the above kernel command, it uses the buffer mechanism to pass the response data obtained by completing the kernel command to the user program. This cross-privilege level communication method has a large security risk, as follows:
[0004] In the prior art, the kernel program usually has an unconditional trust attitude towards the data transferred through the superuser program. This trust is based on an assumption that the superuser program is safe and reliable as an intermediary, and can ensure that all the transmitted data is not tampered with and the source is credible. However, in practical applications, this assumption is not always true. Data may face a variety of potential security threats during the transmission process. For example, attackers may exploit system vulnerabilities or unprotected communication channels to intercept and tamper with data during the process of transmitting data from the user program to the superuser program and finally reaching the kernel program. If these data contain key commands or requests to be executed in the kernel program, any minor changes may lead to serious consequences. Tampered kernel commands may trigger unauthorized operations, access sensitive resources, or even destroy system integrity, causing system crashes or data loss. At the same time, when the kernel program transmits response data back to the user program, the response data may also be tampered with. If the user program receives the above response data without identification, it may also cause damage to itself. Summary of the invention
[0005] The present invention provides a cross-privilege level communication method, device and storage medium, which are used to solve the problem of high communication security risk between user programs and kernel programs in a RISC-V architecture.
[0006] The present invention adopts the following technical solutions:
[0007] In a first aspect, the present invention provides a cross-privilege-level communication method, the method comprising: a user program sends user data to a super-user program; the super-user program performs a command validity check on the user data according to a kernel command; the super-user program copies the user data to a command parameter buffer after the user data passes the command validity check; the kernel program retrieves the user data from the command parameter buffer multiple times; after the kernel program completes the kernel command and obtains the response data, the kernel program performs security authentication on the response data to obtain authenticated data; the kernel program copies the authenticated data to the response buffer; in the process of retrieving and copying data, the kernel program performs an address validity check on the user data and the authenticated data, and handles data access instruction exceptions that occur according to a preset exception handling mechanism; the user program performs security verification on the authenticated data, and after the security verification passes, receives the authenticated data.
[0008] In a feasible implementation, the kernel program retrieves user data from the command parameter buffer in multiple times, including: executing multiple data fetch instructions on the user data in units of a preset data block size; before each execution of the data fetch instruction, turning on the virtual address translation function, and turning off the virtual address translation function after the specified data fetch execution is completed; when the remaining data in the user data is less than the preset data block size, executing the data fetch instruction on the remaining data in units of bytes.
[0009] In a feasible implementation, the kernel program handles the data access instruction exception according to a preset exception handling mechanism, including: before executing the data access instruction, saving the value of the processing register, the processing register including the machine trap vector base address register, the machine exception program counter, the machine cause register and the machine status register; setting the value of the machine trap vector base address register to the address of the processing function corresponding to the data access instruction exception; after the data access instruction exception occurs, executing the processing function to restore the context environment according to the value of the processing register.
[0010] In a feasible implementation, the kernel program performs an address validity check on the user data and the authenticated data, including: obtaining the virtual addresses corresponding to the user data and the authenticated data, respectively, and determining the physical addresses corresponding to the user data and the authenticated data, respectively; determining whether the physical address is an illegal address, and the illegal address includes the address of the kernel program; if so, triggering a data access instruction exception, otherwise, passing the address validity check.
[0011] In a feasible implementation, the super user program performs a command validity check on the user data, including: building a legal command set based on preset authorized command types; extracting the command type corresponding to the kernel command from the user data; detecting whether the command type is in the legal command set; if so, passing the command validity check, otherwise, discarding the user data.
[0012] In a feasible implementation, the kernel program performs security authentication on the response data, including: using a preset security authentication key and a preset encryption algorithm to calculate a hash value of the response data to obtain security authentication data; inserting the security authentication data into the response data to obtain authenticated data.
[0013] In a feasible implementation, the user program performs security verification on the post-authentication data, including: extracting security authentication data and response data to be verified from the post-authentication data; using a preset security authentication key and a preset encryption algorithm to calculate a hash value of the response data to be verified to obtain security verification data; if the security authentication data is the same as the security verification data, the security verification passes, otherwise the security verification fails.
[0014] In a feasible implementation, the user program sends user data to the super user program, including: the user program saves the user data into a data file and sends the address of the data file to the super user program through a system call; the super user program retrieves the user data according to the address of the data file.
[0015] In a second aspect, the present invention also provides a cross-privilege level communication device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor so that the at least one processor can execute a cross-privilege level communication method as described in any of the above embodiments.
[0016] In a third aspect, the present invention further provides a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured to be able to execute a cross-privilege level communication method as described in any of the above embodiments.
[0017] The present invention provides a cross-privilege level communication method, device and storage medium, which have the following beneficial effects:
[0018] 1. In the present invention, when user data is transmitted to the super user program, the super user program performs a command legitimacy check, which can filter illegal commands before the user data is sent to the kernel program, and avoid the kernel program from executing erroneous commands, thereby ensuring the security of the system. The kernel program takes out user data from the command parameter buffer multiple times, which can reduce the time used for each user data extraction, increase the attack difficulty of hackers in the data extraction process, and thus increase the security of the data extraction process. Performing security authentication and security verification operations on the response data can allow the user program to have a means of verifying the correctness of the data after obtaining the response data, and ensure that the user program obtains the response data without tampering. In the process of processing memory data, the address legitimacy check is performed on the memory data, which can ensure the security of the memory address in the memory data processing process. The present invention greatly improves the security of the communication between the user program and the kernel program under the RISC-V architecture by setting a variety of security measures in multiple links in the communication process between the user program and the kernel program.
[0019] 2. The present invention calculates the hash value of the response data as the security authentication data. The hash function has a high degree of sensitivity and unidirectionality, that is, a small change in the data will also cause a significant change in the hash value. This feature makes it impossible for the security verification data calculated based on the modified response data to match the security authentication data even if only a small part of the content is tampered with. This mechanism effectively provides a means of verifying data integrity, allowing the user program to quickly identify whether the data has been illegally modified during transmission.
[0020] 3. The present invention enables the virtual address translation function before executing the data fetch instruction, so that the kernel program can use the virtual address translation function to determine the physical address corresponding to the data fetch instruction. After executing the data fetch instruction, the virtual address translation function is turned off, so that after the data fetch instruction is executed, it can avoid being attacked by hackers based on the page table, thereby improving the security of the data fetch process. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:
[0022] Figure 1 A method flow chart of a cross-privilege level communication method provided by the present invention;
[0023] Figure 2 A schematic diagram of the structure of a cross-privilege level communication device provided by the present invention. DETAILED DESCRIPTION
[0024] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0025] The invention provides a cross-privilege level communication method, which improves the security of communication between the user program and the kernel program by using a super user program as an intermediary for communication between the user program and the kernel program and performing security checks at multiple nodes of communication.
[0026] The method of the present invention is described in detail below with reference to the accompanying drawings.
[0027] Figure 1 A method flow chart of a cross-privilege level communication method provided by the present invention, such as Figure 1 As shown, the method in the present invention at least includes the following execution steps:
[0028] Step 101: The user program sends user data to the super user program.
[0029] Here, the user program refers to the program running in the user mode, the super user program refers to the program running in the super user mode, and the kernel program refers to the program running in the machine mode. In the present invention, for the kernel program, the user program and the super user program are both untrusted, so the data transfer between the user program and the super user program does not need to be checked for safety, and can be realized in a variety of ways. For example, the user program saves the user data in a specified file, and the file address is transferred to the super user program through a system call, and the super user program takes out the user data from the file according to the file address, thus completing the transfer of the user data. Alternatively, the user program stores the message in the data buffer of the internal memory, and the buffer address and size are transferred to the super user program through a system call, thus also completing the message transfer. After executing the system call, the processor enters the super user mode, and the super user program starts to run in the processor.
[0030] In one example, the user program is TSS, the supervisor program is a firmware driver, and the kernel program is a firmware TPM. TSS organizes the user data requested to be executed by the firmware TPM into a byte stream data packet in a specified format, and uses the write() system call to write the above group of throttled data packets to a specified file. After completing the data writing, TSS calls syscall and passes the file address to the firmware driver through syscall. The processor enters supervisor mode, and the firmware driver retrieves the user data in the file according to the parameters passed by syscall.
[0031] The above-mentioned TPM refers to Trusted Platform Module, which can generate and store encryption keys, support device authentication, prevent unauthorized access and malware attacks, thereby greatly enhancing the security of computer systems.
[0032] Firmware TPM is a TPM function implemented at the software level. It does not rely on an independent hardware chip, but the CPU executes the TPM software code.
[0033] TSS refers to TCG Software Stack, which is a trusted computing software stack. It is used to provide an interface for application software to access the firmware TPM, that is, to receive the content of the application software request, convert the request content of the above application software into the kernel command and command parameters that the firmware TPM needs to execute, and pass them to the firmware TPM.
[0034] The firmware driver is used to provide an interface for TSS to access TPM, that is, to pass TSS messages to the firmware TPM.
[0035] Step 102: The superuser program performs a command validity check on the user data according to the kernel command.
[0036] Specifically, first, a legal command set is constructed based on the preset authorized command types. The kernel program can directly control the hardware and manage system resources. Once the wrong command is executed, it will cause serious negative effects. Therefore, the super user program needs to determine which kernel commands can be called by the user program and construct the command types of these kernel commands into a legal command set.
[0037] Then, the command type of the kernel command requested to be executed by the user program is extracted from the user data. The user data may be a byte stream data packet or data in other formats, so the command type of the kernel command needs to be extracted according to the data type of the user data.
[0038] Next, it checks whether the command type of the kernel command is in the legal command set. If so, it passes the command legitimacy check, otherwise the user data is discarded. The legitimacy check of the command type of the user data is performed through the super user program, so that the user data is filtered before entering the security area, which can prevent unauthorized malicious commands from invading the kernel program and protect the security of the system.
[0039] Step 103: After the user data passes the command validity check, the super user program copies the user data to a preset command parameter buffer.
[0040] The command parameter buffer here is part of the data buffer, which is selected by the superuser program from the free area in the data buffer, and the same is true for the subsequent response buffer. The data buffer is a storage space allocated in the memory when the operating system starts, which is used for data exchange between different programs.
[0041] Specifically, after passing the command validity check, the superuser program copies the user data to the command parameter buffer. After the copy is completed, the superuser program needs to pass the first address of the command parameter buffer and the size of the command parameter buffer to the kernel program, and also needs to pass the address of the response buffer and the size of the response buffer to the kernel program to indicate the storage location of the response data to the kernel program. The superuser program passes the above buffer address and buffer size information through the sbi_ecall function. After calling the sbi_ecall function, the processor enters the machine mode and the kernel program starts running in the processor.
[0042] In one example, after receiving the user data transmitted by the TSS, the firmware driver copies the user data to the command parameter buffer, determines the command type and command position according to the content in the byte stream data packet, and encapsulates the above content according to the following structure format, specifically, encapsulates the command type, command position, command parameter buffer address and command parameter buffer size of the kernel command requested to be executed by the TSS according to the commandType format to obtain rtpm_sbi_command_t command; encapsulates the response buffer address and response buffer size according to the sbi_response_t format to obtain rtpm_sbi_response_t response; and encapsulates rtpm_sbi_command_t command and rtpm_sbi_response_t response according to the struct sbi_communication_t format to generate sbi_ecall parameters. The command position is used to mark the source of the command, such as a process or a hardware level.
[0043] struct sbi_command_t{
[0044] uint_32_t commandType; / / command type
[0045] uint_8_t locality; / / command location
[0046] const unint8_t* commandBuffer; / / command parameter buffer address
[0047] uint32_t written; / / command parameter buffer size
[0048] };
[0049] struct sbi_response_t{
[0050] uint8_t* responseBuffer; / / response buffer address
[0051] uint32_t* read; / / response buffer size
[0052] };
[0053] struct sbi_communication_t{
[0054] struct rtpm_sbi_command_t command;
[0055] struct rtpm_sbi_response_t response;
[0056] };
[0057] After the encapsulation is completed, sbi_ecall is called using the above sbi_ecall parameters, the sbi_ecall parameters are passed to the machine mode, and the machine mode is entered at the same time.
[0058] Step 104: The kernel program retrieves user data from the command parameter buffer multiple times.
[0059] Specifically, in the process of fetching user data, a data fetch instruction is executed on the user data in units of a preset data block size, where the data fetch instruction may also be referred to as a LOAD instruction. Before executing the data fetch instruction, the virtual address conversion function is turned on, and after executing the data fetch instruction, the virtual address conversion function is immediately turned off. When the remaining data in the user data is smaller than the data block, the data fetch instruction is executed on the remaining data in units of bytes. Because the kernel program can only access physical addresses, and the command parameter buffer address and the response buffer address passed by the super user program are virtual addresses, the kernel program needs to turn on the virtual address conversion function to obtain relevant data. The virtual address conversion depends on the page table in the memory. Once the virtual address conversion function is turned on, it faces hacker attacks based on the page table. Therefore, when the kernel program copies data according to the virtual address, it is necessary to minimize the data risk window as much as possible, that is, the data block size corresponding to the execution of the data fetch instruction should be as small as possible, so that the time interval between turning on the virtual address conversion and turning off the virtual address conversion will be shorter, and the time window for being attacked will be smaller. By reducing the data risk window, the difficulty of hacker attacks based on the page table can be increased, thereby improving the security of data copying.
[0060] In one example, the firmware TPM copies the data passed by the firmware driver in double words. When the remaining data is less than a double word, it is copied in bytes. During the copying process, before executing each LOAD instruction, mstatus.MPRV is set to 1, and after executing a LOAD instruction, mstatus.MPRV is immediately cleared.
[0061] Step 105: After completing the kernel command and obtaining the response data, the kernel program performs security authentication on the response data to obtain authenticated data.
[0062] Specifically, first, a preset security authentication key and a preset encryption algorithm are used to calculate the hash value of the response data to obtain the security authentication data. Then, the security authentication data is inserted into the response data. By calculating the hash value of the response data, it can be ensured that even if only a very small part of the response data is tampered with, the security verification data calculated based on the modified response data cannot match the security authentication data. This mechanism effectively provides a means of verifying data integrity, allowing the user program to quickly identify whether the data has been illegally modified during transmission.
[0063] In one example, the firmware TPM calculates an HMAC signature for each response data and inserts the signature into the byte stream of the response data. The key used to calculate the HMAC signature for the response data is the same as the key used to verify the response data later, and the keys of both parties are shared through a secure channel or negotiated during system initialization to ensure the uniqueness and confidentiality of the key between user mode and machine mode, preventing attackers from guessing the key or forging the signature.
[0064] Step 106: The kernel program copies the authenticated data to the response buffer.
[0065] Specifically, the kernel program copies the authenticated data to the response buffer according to the response buffer address and the response buffer size transmitted by the superuser program.
[0066] Step 107: During the process of retrieving and copying data, the kernel program performs an address validity check on the user data and the authenticated data, and handles the data access instruction exceptions according to the preset exception handling mechanism.
[0067] The data access instructions here can also be called LOAD / STORE instructions.
[0068] In the process of processing memory data, it is necessary to determine the physical address corresponding to the virtual address of the memory data according to the page table. At this time, hackers may tamper with the value of the page table and change the correct physical address of the memory data to the address of the kernel program or other illegal addresses. If user data is written into the address of the kernel program, it will hinder the correct operation of the kernel command and even cause the kernel program to crash, thereby causing serious damage to the entire system. Therefore, in the process of processing memory data, it is necessary to check the legitimacy of the physical address to ensure that the physical address is not in an illegal area such as the address space corresponding to the kernel command or the address space corresponding to other processes.
[0069] The specific steps of the address legitimacy check are as follows: first, obtain the virtual addresses corresponding to the user data and the authenticated data, and then enable the virtual address conversion function to determine the physical addresses corresponding to the user data and the authenticated data. Then, determine whether the physical addresses corresponding to the user data and the authenticated data are illegal addresses, such as the addresses of the kernel program or other user programs. If so, the data access instruction exception is triggered, otherwise, the address legitimacy check passes.
[0070] The preset exception handling mechanism is: before executing the data access instruction, save the value of the processing register, which includes the machine trap vector base address register (mtvec), the machine exception program counter (mepc), the machine cause register (mcause) and the machine status register (mstatus). By saving the values of the above registers, the instruction can be re-executed after the exception occurs, and the exception can also be eliminated according to the values of the above registers.
[0071] After the value of the processing register is saved, the value of the machine trap vector base address register is set to the address of the processing function corresponding to the data access instruction exception. After the data access instruction exception occurs, the processing function is executed to restore the context environment according to the value of the exception processing register. By setting the value of mtvec to the address of the processing function corresponding to the data access instruction exception, the execution flow of the program can be jumped to the above processing function after the data access instruction exception occurs, and the context environment can be restored through the processing function.
[0072] In one example, during the process of writing back the response data, the firmware TPM checks whether the physical address of the response buffer is in the address space of the firmware TPM. If so, an abnormal termination of the copy is triggered; if not, the copy is continued.
[0073] Step 108: The user program performs security verification on the authenticated data, and receives the authenticated data after the security verification passes.
[0074] During the process of the kernel program copying the authenticated data to the response buffer, and during the process of storing the authenticated data in the response buffer, the authenticated data may be illegally tampered with, that is, the authenticated data obtained by the user program from the response buffer is not the correct authenticated data, so the authenticated data needs to be securely verified.
[0075] Specifically, first, after completing the corresponding kernel command, the kernel program notifies the superuser program through the return value of sbi_ecall, and the processor enters the superuser mode. Then, after receiving the return value of the kernel program, the superuser program passes the address of the response buffer and other information as the return value of the system call to the user program, and the processor enters the user mode. Next, the user mode takes out the authenticated data from the response buffer according to the return value of the system call, and extracts the security authentication data and the response data to be verified from the authenticated data. Next, the user program uses the same security authentication key and encryption algorithm as the data authentication to calculate the hash value of the response data to be verified to obtain the security verification data. If the security authentication data is the same as the security verification data, the security verification is passed, otherwise the security verification is not passed. After passing the security verification, the response data to be verified is received to complete the communication between the user mode and the machine mode. By calculating the hash value of the response data to be verified and comparing the above hash value with the security authentication data, it can be quickly and accurately determined whether the authenticated data has been tampered with.
[0076] In one example, after receiving the response data from the firmware TPM, the TSS will independently calculate the HMAC of the response data based on the same HMAC key and compare the calculation result with the HMAC field in the response byte stream. If the two match, it indicates that the response data has not been tampered with during transmission.
[0077] Based on the same inventive concept, the present invention also provides a cross-privilege level communication device, whose structure is as follows: Figure 2 shown.
[0078] Figure 2 The present invention provides a schematic diagram of the structure of a cross-privilege level communication device. Figure 2 As shown, the cross-privilege level communication device 200 in the present invention specifically includes: at least one processor 201; and a memory 203 that is communicatively connected to the at least one processor (connected via a bus 202); wherein the memory 203 stores instructions that can be executed by the at least one processor 201, so that the at least one processor 201 can execute a cross-privilege level communication method as described in the above embodiment.
[0079] In one or more possible implementations of the present invention, the aforementioned processor is used to execute, the user program sends user data to the super user program; the super user program performs a command legitimacy check on the user data according to the kernel command; the super user program copies the user data to the command parameter buffer after the user data passes the command legitimacy check; the kernel program retrieves the user data from the command parameter buffer multiple times; after the kernel program completes the kernel command and obtains the response data, the kernel program performs security authentication on the response data to obtain the authenticated data; the kernel program copies the authenticated data to the response buffer; in the process of data retrieval and data copying, the kernel program performs an address legitimacy check on the user data and the authenticated data, and handles the data access instruction exceptions that occur according to the preset exception handling mechanism; the user program performs security verification on the authenticated data, and after the security verification passes, receives the authenticated data.
[0080] In addition, the present invention also provides a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured to be able to execute a cross-privilege level communication method as described in any one of the above embodiments.
[0081] In one or more possible implementations of the present invention, the aforementioned computer executable instructions are set to be executed, and the user program sends user data to the super user program; the super user program performs a command legitimacy check on the user data according to the kernel command; the super user program copies the user data to the command parameter buffer after the user data passes the command legitimacy check; the kernel program retrieves the user data from the command parameter buffer multiple times; after completing the kernel command and obtaining the response data, the kernel program performs security authentication on the response data to obtain authenticated data; the kernel program copies the authenticated data to the response buffer; in the process of data retrieval and data copying, the kernel program performs an address legitimacy check on the user data and the authenticated data, and handles the data access instruction exceptions that occur according to a preset exception handling mechanism; the user program performs security verification on the authenticated data, and after the security verification passes, receives the authenticated data.
[0082] Each embodiment of the present invention is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the IoT device and medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.
[0083] The system and medium provided by the present invention correspond one-to-one to the method, and therefore, the system and medium also have similar beneficial technical effects to the corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the system and medium will not be repeated here.
[0084] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0085] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0086] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0087] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.
[0088] The above are only embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims
1. A cross-privilege level communication method, characterized in that: The method comprises: The user program sends user data to the super user program, wherein the user data includes a kernel command that the user program requests the kernel program to execute; The super user program performs a command validity check on the user data according to the kernel command; The super user program copies the user data to a command parameter buffer after the user data passes the command validity check; The kernel program fetches the user data from the command parameter buffer multiple times; After completing the kernel command and obtaining the response data, the kernel program performs security authentication on the response data to obtain authenticated data; The kernel program copies the authenticated data to a response buffer; The kernel program performs address legitimacy check on the user data and the authenticated data during data retrieval and data copying, and handles data access instruction exceptions according to a preset exception handling mechanism; The user program performs security verification on the authenticated data, and receives the authenticated data after the security verification passes.
2. A cross-privilege level communication method according to claim 1, characterized in that: The kernel program fetches the user data from the command parameter buffer in multiple times, including: Execute multiple data fetch instructions on the user data in units of a preset data block size; Before executing each data fetch instruction, a virtual address translation function is enabled, and after the data fetch instruction is executed, the virtual address translation function is disabled; When the remaining data in the user data is smaller than the preset data block size, the data fetch instruction is executed on the remaining data in bytes.
3. A cross-privilege level communication method according to claim 1, characterized in that: The kernel program processes the data access instruction exception according to the preset exception handling mechanism, including: Before executing the data access instruction, saving the values of processing registers, the processing registers including a machine trap vector base address register, a machine exception program counter, a machine cause register, and a machine status register; Setting the value of the machine trap vector base address register to the address of the processing function corresponding to the data access instruction exception; After the data access instruction exception occurs, the processing function is executed to restore the context environment according to the value of the processing register.
4. A cross-privilege level communication method according to claim 1, characterized in that: The kernel program performs an address validity check on the user data and the authenticated data, including: Acquire virtual addresses corresponding to the user data and the authenticated data, respectively, and determine physical addresses corresponding to the user data and the authenticated data, respectively; Determine whether the physical address is an illegal address, wherein the illegal address includes the address of the kernel program; If so, a data access instruction exception is triggered; otherwise, the address validity check passes.
5. A cross-privilege level communication method according to claim 1, characterized in that: The super user program performs a command validity check on the user data, including: Construct a legal command set based on the preset authorized command types; Extracting a command type corresponding to the kernel command from the user data; Detecting whether the command type is in the legal command set; If so, the command validity check passes; otherwise, the user data is discarded.
6. A cross-privilege level communication method according to claim 1, characterized in that: The kernel program performs security authentication on the response data, including: Using a preset security authentication key and a preset encryption algorithm, a hash value of the response data is calculated to obtain security authentication data; The security authentication data is inserted into the response data to obtain the authenticated data.
7. A cross-privilege level communication method according to claim 6, characterized in that: The user program performs security verification on the authenticated data, including: Extracting the security authentication data and the response data to be verified from the authenticated data; Using the preset security authentication key and the preset encryption algorithm, a hash value of the response data to be verified is calculated to obtain security verification data; If the security authentication data is the same as the security verification data, the security verification passes; otherwise, the security verification fails.
8. A cross-privilege level communication method according to claim 1, characterized in that: The user program sends the user data to the super user program, including: The user program saves the user data into a data file, and sends the address of the data file to the super user program through a system call; The super user program retrieves the user data according to the address of the data file.
9. A cross-privilege level communication device, characterized in that: The device specifically includes: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, so that the at least one processor can execute the cross-privilege level communication method according to any one of claims 1-8.
10. A non-volatile computer storage medium having computer executable instructions stored thereon, characterized in that: The computer executable instructions are configured to execute a cross-privilege level communication method according to any one of claims 1-8.